Virtual Asset Service Providers, Virtual Asset Exchange Providers, and Custodian Wallet Providers (as defined by the Ministry of Finance from time to time) are required to mandatorily maintain all information obtained through Know Your Customer (KYC) processes, as well as comprehensive records of all financial transactions, for a minimum period of five (5) years.

This obligation aims to enhance cybersecurity in payments and financial markets, while simultaneously protecting citizens’ data privacy, fundamental rights, and economic freedom amid the growth of virtual assets.

For KYC compliance, the directions and procedures prescribed by the Reserve Bank of India (RBI) in 2016, the Securities and Exchange Board of India (SEBI) circular dated April 24, 2020, and the Department of Telecom (DoT) notice dated September 21, 2021, as amended from time to time, shall be adhered to. (Refer to Annexure III for detailed procedures.)

Regarding transaction records, accurate and detailed information must be maintained to enable the reconstruction of individual transactions. The maintained data shall include, but not be limited to:

• Identification details of the relevant parties involved, including IP addresses, timestamps, and time zones
• Transaction ID
• Public keys (or equivalent identifiers)
• Addresses or accounts involved (or equivalent identifiers)
• Nature and date of the transaction
• Amount transferred

These measures are essential for ensuring transparency, security, and accountability within the virtual asset ecosystem.