India Mandates Biometric Liveness Detection and Geo-Tracking for Cryptocurrency KYC

India has mandated biometric liveness detection for cryptocurrency know-your-customer checks, requiring users to submit a live selfie that passes anti-spoofing tests. The new rules also require crypto platforms to log latitude and longitude coordinates, IP address, date, and timestamp for account creation, tightening verification requirements for exchanges and virtual asset service providers operating in the country.

The requirements specify that a live selfie must demonstrate the user is physically present, not a static photograph, video replay, mask, or deepfake. Liveness detection must confirm the biometric sample comes from a living person at the time of capture. Platforms must collect and retain geo-location data alongside other account creation metadata. Geo-location must be captured at the time of registration.

The mandate applies across crypto exchanges and VASPs and is positioned as a replacement for earlier restrictions on the sector. India’s market context is significant: the country ranks second globally in overall digital asset adoption and leads in stablecoin usage, with an estimated 25.9 million crypto users. The new rules reflect growing regulatory focus on identity verification rather than outright prohibition.

India’s broader digital payments infrastructure provides additional context. The Unified Payments Interface supports about 500 million users and 65 million merchants and continues to expand internationally. Regulators appear to be aligning crypto onboarding with the stronger KYC expectations already applied to high-volume digital financial services.

The new rules create substantial technology requirements for liveness and anti-spoofing systems, including defenses against photo attacks, video replay, 3D masks, and synthetic media. The report highlights both active liveness (user actions like blinking or head turns) and passive liveness (analyzing inherent traits) as options for meeting the mandate. Vendors may need to support challenge-response flows or passive checks and integrate them into existing KYC workflows.

The policy also raises data protection questions because it requires the collection of biometric face data alongside precise location and network identifiers. The report notes concerns around data retention periods, cross-border transfers, user consent, and compliance with India’s Digital Personal Data Protection Act, all of which will shape how exchanges implement the mandate.

Sources: The Hindu, Mint

—

By the ID Tech Editorial Team