M&A IN THE CRYPTO SPACE: LEGAL DUE DILIGENCE AND COMPLIANCE IN INDIA

This post is authored by Zuber Syed, Managing Partner at Zuber & Partners (Hyderabad), with expertise in M&A, corporate law, fintech, cryptocurrency regulation, and cyber law.

INTRODUCTION

The global rise of cryptocurrencies has redefined financial markets, bringing with it new forms of capital, innovative fundraising methods, and decentralized business models. In India, this trend coincided with the rapid growth of fintech and digital commerce. Start-ups offering blockchain-based products, digital asset exchanges, and payment solutions have attracted significant investor interest. As a result, Mergers and Acquisitions (“M&A”) in the crypto space are emerging as a natural next step, with established financial players, venture capitalists, and multinational corporations looking to consolidate, diversify, and hedge their positions in an evolving market.

Despite all this momentum, the Indian regulatory framework on cryptocurrencies remains fragmented. The Reserve Bank of India (“RBI”) has voiced concerns about financial stability. Separately, the Securities and Exchange Board of India (“SEBI”) has highlighted the potential securities dimension of crypto assets, and the Ministry of Finance calls for global cooperation. Yet, there is no unified law specifically addressing crypto transactions. This has created significant challenges for M&A transactions involving crypto entities, where due diligence, compliance, and contractual structuring become critical to managing risk.

The absence of clear regulation certainly doesn't deter activity, but it does heighten the need for meticulous legal oversight. Buyers must assess tokenomics, licensing risks, and compliance with Anti-Money Laundering (“AML”) and Know-Your-Customer (“KYC”) norms. Sellers need to ensure data protection and cyber security compliance to avoid liability. Given this situation, an analytical exploration of due diligence and compliance in crypto M&A is both timely and essential for India’s legal and commercial ecosystem. This article unfolds in seven parts, it begins with an overview of India’s evolving regulatory framework for crypto assets and M&A. The following sections discuss key due diligence challenges and outline contractual safeguards that help acquirers manage legal and compliance risks. It also draws lessons from Singapore, Dubai, the United States, and the European Union, linking each to India’s practical realities. The paper then offers policy recommendations with notes on possible trade-offs, sets out a concise checklist for practitioners handling crypto transactions, and closes with key insights for investors, regulators, and policymakers in India’s legal market.

REGULATORY LANDSCAPE IN INDIA FOR CRYPTO ASSETS

The legal treatment of cryptocurrencies in India still isn't settled, even though incremental regulatory markers do exist. The RBI has consistently cautioned against the risks posed by virtual currencies. In 2018, it issued a circular on 6 April 2018, under the heading “Prohibition on dealing in Virtual Currencies (VCs)” prohibiting banks from dealing in virtual currencies, a measure later struck down by the Supreme Court in Internet and Mobile Association of India v Reserve Bank of India (2020) for being disproportionate to its stated objectives. While this judgment revived the functioning of exchanges, it didn't confer legitimacy upon cryptocurrencies, leaving the market in a grey zone.

SEBI has expressed concern that certain crypto tokens may fall within the definition of securities. If classified as such, issuances and transfers could attract obligations under the Securities Contracts (Regulation) Act, 1956 and related regulations. However, no formal classification mechanism has been adopted, which produces uncertainty in M&A transactions that involve token-issuing entities.

From a compliance standpoint, crypto M&A transactions overlap with India’s foreign exchange and anti-money laundering regimes. Transactions involving foreign investors trigger the Foreign Exchange Management Act, 1999 (“FEMA”), particularly where consideration is paid through tokens or stablecoins. The Prevention of Money Laundering Act, 2002 (“PMLA”) and rules framed thereunder also apply, especially after the Finance Ministry notified virtual digital asset service providers as “reporting entities” in 2023. This brings exchanges and custodial wallet providers within the fold of mandatory KYC and suspicious transaction reporting requirements.

Finally, the Information Technology Act, 2000 (“IT Act”) governs cybersecurity, data retention, and digital evidence. Since crypto businesses often rely on user data and smart contracts, compliance with IT rules on sensitive personal data becomes essential during due diligence. The biggest issue is the absence of a dedicated cryptocurrency statute, resulting in fragmented regulation and forcing acquirers to piece together multiple legal frameworks during M&A deals. India’s crypto regulation still operates under a patchwork of laws, RBI, SEBI, FEMA, PMLA, and the IT Act, making compliance mapping a priority in any deal. The biggest legal exposure for crypto-rich targets is uncertainty in classification and overlapping regulatory reach. Hence, it is essential to verify the target’s reporting-entity status and its regulatory interaction at the early stage, ideally before signing a term sheet.

Having outlined the regulatory backdrop, the next step is to examine the practical challenges that counsel face when conducting due diligence in crypto-related M&A.

DUE DILIGENCE CHALLENGES IN CRYPTO M&A

M&A in the crypto sector poses unique due diligence challenges that set them apart from traditional transactions. These complexities come from the technological features of blockchain-based businesses, the uncertain legal classification of tokens, and the fragmented nature of regulatory oversight.

1. Tokenomics and Financial Risk

Tokenomics, broadly defined, refers to the economic structure and incentive model of a crypto-asset ecosystem, how tokens are created, distributed, and used to sustain the project’s value and governance. The first and most critical element of crypto due diligence is evaluating tokenomics. Acquirers must assess the total supply of tokens, vesting schedules, pre-mined allocations, and liquidity management. Poorly structured tokenomics might conceal risks of inflation or market manipulation, undermining long-term valuation. For example, projects with large founder holdings or limited public float certainly raise red flags concerning governance and investor protection.

2. Jurisdictional and Cross-Border Risks

Crypto businesses frequently operate across borders, often incorporating in offshore hubs such as Singapore or Dubai while servicing Indian users. This introduces uncertainty regarding applicable law, enforceability of contracts, and recognition of dispute resolution clauses. In M&A deals, parties must carefully analyze governing law provisions, compliance with foreign exchange norms under FEMA, and the possibility of parallel enforcement actions.

3. AML/KYC and FATF Standards

The Financial Action Task Force (“FATF”) has issued global guidelines on virtual assets, calling for effective implementation of “travel rule” requirements. FATF Updated Guidance (2021). Indian acquirers must ensure that target companies follow robust AML and KYC protocols, particularly in light of the Finance Ministry’s 2023 notification bringing virtual asset service providers under the PMLA framework. Failure to comply can expose acquirers to severe regulatory penalties and reputational risks.

4. Data Protection and Cybersecurity

Crypto businesses are highly data-intensive, storing personal details of users, wallet information, and transaction histories. Digital Personal Data Protection Act, 2023 (“DPDP”) mandates stringent consent and processing obligations. During due diligence, acquirers must verify whether the target has implemented adequate data security practices and can produce admissible electronic records under the IT Act, 2000. Weaknesses in cybersecurity can easily lead to breaches, regulatory liabilities, and litigation exposure.

These challenges underline that crypto M&A requires interdisciplinary scrutiny, combining financial valuation, regulatory compliance, and crucial technical audits. A target’s tokenomics, ownership structure, and AML/KYC systems directly influence both valuation and regulatory comfort, while cross-border or multi-jurisdiction operations often complicate FEMA compliance and dispute enforcement. To avoid costly surprises later, it is essential to commission independent legal and technical audits at the initial due diligence stage to avoid costly surprises later.

CONTRACTUAL AND STRUCTURAL SAFEGUARDS

Even when due diligence identifies risks, parties to a crypto M&A deal can mitigate exposure through well-drafted contractual and structural safeguards. The distinctive features of crypto businesses, volatile valuations, code-dependent operations, and cross-border elements, necessitate a much more rigorous approach to drafting acquisition agreements.

1. Escrow and Holdback Mechanisms

Given regulatory uncertainty, it’s common for a portion of the purchase price to be placed in escrow until specified conditions are satisfied. Holdback provisions allow acquirers to retain part of the consideration to offset potential liabilities, such as penalties under the PMLA or disputes regarding token issuance.

2. Clawback Provisions

Clawback clauses enable the recovery of consideration where post-closing investigations reveal fraud, misrepresentation, or undisclosed regulatory violations. In crypto transactions, where information asymmetry is often the norm, these provisions are crucial to protect acquirers from unforeseen risks.

3. Representations and Warranties

Acquirers should require detailed warranties covering: compliance with AML/KYC obligations, validity of token issuance and absence of unlawful securities offerings, robustness of cybersecurity infrastructure, and ownership and licensing of intellectual property such as smart contracts. Breach of these warranties should trigger indemnification rights.

4. Code Audits and Technical Reviews

Unlike traditional acquisitions, crypto deals necessitate independent audits of smart contracts, blockchain protocols, and custodial infrastructure. Technical vulnerabilities like exploitable code or poor private key management can expose acquirers to significant liabilities. Requiring audited reports as a condition precedent reduces post-closing risk considerably.

5. Governance and Post-Acquisition Integration

To address valuation volatility, agreements might include earn-outs linked to compliance milestones, such as successful regulatory registration or achievement of cybersecurity certifications. Board seats, veto rights, or enhanced oversight mechanisms may also be negotiated to ensure alignment between acquirers and founders in the transitional period.

Together, these contractual protections transform crypto M&A transactions into legally manageable structures, balancing innovation with accountability. Linking 20–30% of the purchase price to compliance and technical audit milestones further strengthens accountability. Escrow and holdback provisions mitigate regulatory uncertainty by ensuring that compliance lapses or delayed approvals do not jeopardize the entire acquisition. Claw back clauses and representations directly address information asymmetry, giving acquirers recourse if hidden liabilities or misstatements emerge post-closing. Code audits and technical reviews manage technological risks, ensuring that vulnerabilities in smart contracts or custody frameworks are detected before integration. Finally, post-acquisition governance rights and performance-linked earn-outs help stabilize operational volatility, aligning incentives between founders and investors. Taken together, these safeguards transform high-risk, innovation-driven transactions into legally manageable structures.

COMPARATIVE INSIGHTS FROM OTHER JURISDICTIONS

The Indian legal landscape for crypto M&A can greatly benefit from examining comparative experiences in other jurisdictions. Countries with more mature regulatory regimes provide useful guidance on investor protection, compliance standards, and market oversight.

1. Singapore

Singapore has positioned itself as a global fintech hub through the Payment Services Act, 2019, which requires licensing of digital payment token services. Crypto exchanges and custodians must comply with AML and counter-terrorism financing norms. In M&A transactions, buyers can verify licensing status through the Monetary Authority of Singapore, which significantly reduces regulatory uncertainty.

2. Dubai International Financial Centre (DIFC)

Dubai has developed a comprehensive framework through the Dubai Virtual Assets Regulatory Authority (“VARA”), offering clarity on token issuance, custody, and exchange operations. The availability of a specialized regulator within the DIFC provides predictability for cross-border acquirers, encouraging more structured deal-making.

3. United States

In the United States, regulation is fragmented between agencies like the Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (“CFTC”). While this leads to jurisdictional overlaps, extensive enforcement actions have created judicial precedents that guide investors. Acquirers typically conduct in-depth reviews of whether tokens qualify as securities under the Howey Test, which greatly influences transaction structuring.

4. European Union

The European Union’s Markets in Crypto-Assets Regulation (“MiCA”), adopted in 2023, establishes uniform licensing and disclosure requirements. MiCA Regulation (EU 2023/1114) across EU member states. For M&A deals, MiCA ensures that acquirers can rely on standardized compliance norms, including whitepaper disclosures, consumer protections, and capital requirements.

Experience from Singapore, Dubai, the U.S., and the E.U. shows that licensing clarity and disclosure discipline consistently lower transactional risk. India should borrow workable components, clear disclosure rules, centralised licensing, grievance mechanisms, rather than transplanting entire foreign regimes. India should also prioritise uniform disclosure templates and consumer-complaint processes before moving toward a phased licensing framework.

POLICY RECOMMENDATIONS FOR INDIA

The fragmented regulatory framework in India requires targeted reforms to facilitate secure and sustainable M&A activity in the crypto sector. Comparative insights demonstrate that clarity of law, institutional oversight, and investor safeguards are central to building market confidence. Several key measures can be considered for India.

1. Classification and Oversight by SEBI

India really needs a clear mechanism to classify whether crypto tokens fall within the definition of securities. SEBI could issue guidelines similar to the Howey Test used in The United States applies the Howey Test to determine whether a token qualifies as a security. SEC v W.J. Howey Co. (1946). This would assist acquirers in determining compliance requirements right at the stage of due diligence.

While clearer classification would greatly reduce uncertainty, it could also raise compliance costs for small or emerging token issuers. A phased or threshold-based approach can keep regulation proportional and innovation alive.

2. Licensing of Exchanges and Wallets by RBI

The RBI could introduce a licensing regime under the Payment and Settlement Systems Act, 2007 for crypto exchanges and custodial wallets. Licensed entities would be subject to prudential regulations, consumer protection norms, and reporting obligations, which would reduce systemic risks. Licensing strengthens oversight but, if too rigid, may push domestic innovators overseas. A tiered model and a sandbox framework would balance supervision with flexibility.

3. Mandatory Grievance Redressal Mechanisms

Drawing from the EU’s Markets in Crypto-Assets Regulation (“MiCA”), India could require platforms to establish accessible grievance redressal processes, with time-bound responses to user complaints. Such a measure would significantly enhance consumer trust and accountability. Strong consumer-protection mandates improve trust but can strain smaller platforms. Scaling the response timelines and reporting duties by transaction size can keep compliance realistic.

4. Fast-Track Tribunal for Digital Asset Disputes

Given the speed of transactions in crypto markets, India could establish a specialized fast-track tribunal or designate benches under the National Company Law Tribunal (“NCLT”) to adjudicate disputes concerning digital assets. Expedited procedures would greatly improve enforcement of rights and contractual claims.Fast-track benches will speed up enforcement, yet they demand trained judicial and technical capacity. Using selected NCLT panels with expert assessors could achieve the same result more efficiently.

5. Encouraging Self-Regulation and Industry Standards

India may promote industry associations to formulate codes of conduct, disclosure standards, and cybersecurity protocols. This hybrid approach, combining regulation with industry self-governance, should reduce regulatory burdens while still encouraging compliance.

Taken together, these steps would bring predictability, align India with global best practices, and encourage investment in the crypto sector. More importantly, they would provide a structured framework for M&A activity, balancing innovation with investor protection.Industry-led codes promote agility, though uneven enforcement remains a risk. Pairing self-regulation with minimum statutory safeguards and independent audits would maintain accountability.

Implementing these policy measures would represent a decisive step toward a coherent digital-asset regulatory framework in India. Each reform, whether in licensing, disclosure, or dispute resolution, would significantly improve legal predictability and investor confidence. However, these benefits will come with practical implications. Stricter licensing norms may initially increase compliance costs, while new oversight mechanisms could require capacity building within regulatory bodies and the judiciary. Smaller start-ups may also face transitional burdens in aligning with enhanced KYC and disclosure standards. Yet, these short-term challenges are outweighed by the long-term gains of market credibility, consumer protection, and stable capital inflow. In essence, these recommendations aim to strike a balance between innovation and accountability, ensuring that India’s crypto ecosystem matures within a structured, rule-based environment.

CONCLUSION

M&A in the crypto sector represents an inevitable phase of India’s digital economy. Startups and exchanges that once operated on uncertain foundations are now becoming acquisition targets for established financial institutions, global investors, and technology companies. This transition underscores both the opportunities of innovation and the vulnerabilities that come with inadequate regulation.India stands at a critical juncture where thoughtful regulation could transform crypto M&A from a speculative exercise into a structured and trustworthy avenue of investment. For policymakers and practitioners seeking to align innovation with regulatory prudence, reference may be made to the NITI Aayog’s Blockchain: The India Strategy (Discussion Paper, 2020) which outlines India’s vision for responsible blockchain adoption across financial and governance ecosystems.

The path ahead lies in harmonizing innovation with accountability, ensuring that India’s digital-asset market evolves within a framework that promotes both technological freedom and legal certainty. In the immediate term, India’s foremost priority should be to establish a clear classification and licensing regime, the foundation upon which effective supervision, enforcement, and investor confidence will rest.