Use Case: FIU-IND Registration Readiness
Independent pre-registration AML review and remediation for a VDA service provider
An India-based virtual digital asset service provider (VDA SP) wanted to test its FIU-IND registration readiness. Internationally, such firms are known as VASPs. The firm already had AML/CFT policies, procedures, a risk assessment, controls and tools. Before its FIU-IND in-person meeting, management wanted an independent view of that framework.
First, Compliance7 conducted an independent pre-registration AML/CFT gap assessment and control review. It gave prioritised recommendations. Later, under a separate engagement, we supported remediation. Because we did both, the remediated framework has not been independently assured by us.
Engagement at a Glance
- Client: India-based VDA SP
- Trigger: Preparing for the FIU-IND in-person meeting
- Scope: Governance, policies, risk assessment and key AML/CFT controls
- Review time: 2-3 weeks
- Deliverable: Internal assessment report
- Follow-on: Separate remediation project
- Outcome: Proceeded to the in-person meeting
The Problem
A complete framework on paper, not yet tested independently
Many VDA SPs develop their AML/CFT frameworks before applying for FIU-IND registration. However, documented policies and procedures alone do not demonstrate that controls operate effectively in practice. FIU-IND’s registration process includes a live demonstration of relevant AML/CFT systems and tools to assess the applicant’s readiness.
FIU-IND’s registration circular of 15 September 2025 and its updated AML/CFT/CPF guidelines set out an in-person meeting. The Designated Director and Principal Officer must attend. The applicant must also demonstrate relevant systems and tools. These include KYC, transaction monitoring, blockchain analytics, the Travel Rule and sanctions screening, as applicable.
So management wanted answers to two questions. Do our controls work as our policies describe? And where should we fix gaps before we demonstrate them?
A complete policy set is a starting point. FIU-IND registration readiness also depends on showing that the controls behind those policies operate as described.
The Solution
An FIU-IND registration readiness review in four stages
Compliance7 structured the first engagement as an independent gap assessment and control review. We completed it before any remediation work began. This separated the assessment from the later remediation. However, it does not amount to independent assurance over the remediated framework.
Stage 1: Governance and policy review
First, we reviewed governance arrangements, including senior management oversight and the responsibilities of the Designated Director and Principal Officer. Then we reviewed the policies and procedures against the PMLA framework. We also used FIU-IND’s AML/CFT/CPF guidelines for VDA SPs, updated in January 2026.
Stage 2: Risk assessment and gap assessment
Next, we assessed whether the risk assessment reflected the firm’s products, customers, channels and geographies. We also mapped each identified risk to the controls meant to address it. This gap assessment showed where controls were missing or weak.
Stage 3: Control testing
We then used walkthroughs and risk-based sample testing on selected key controls. These covered identity verification, sanctions screening, transaction monitoring, blockchain analytics, the Travel Rule and STR escalation workflows. In each area, we compared practice with policy.
Stage 4: Reporting and recommendations
Finally, we delivered an internal assessment report. It described each gap and set out practical recommendations in priority order. As a result, management could plan remediation before the in-person meeting.
Key AML/CFT gaps identified during the FIU-IND registration readiness review
The main gaps were in identity verification, sanctions screening and transaction monitoring tuning. The table below summarises each area and the focus of our recommendations.
| Area | What the review examined | Recommendation focus |
|---|---|---|
| Identity verification | Whether onboarding checks applied the verification standards set out in the firm’s KYC policy | Align verification steps, evidence and records with the documented policy |
| Sanctions screening | How sanctions screening was configured and how potential matches were handled | Strengthen screening coverage, match review and documentation |
| Transaction monitoring tuning | Whether monitoring rules and thresholds matched the firm’s risk assessment | Tune rules to the firm’s risks and document the rationale for thresholds |
Client details and specific findings are confidential. The table summarises the main review areas. Appropriate controls depend on each firm’s risk profile, business model and applicable requirements.
Remediation to strengthen FIU-IND registration readiness
After the review, the firm engaged Compliance7 for a separate remediation project. This work covered four areas:
- Revised AML/CFT policies and procedures.
- Rework of the risk assessment.
- Support with system configuration, including screening and monitoring settings.
- Demonstration readiness for the FIU-IND in-person meeting.
Compliance7 supported the remediation. So for later independent audits, the firm should assess whether it needs a different, suitably independent reviewer. That depends on the applicable regulatory and independence requirements.
The Result
Stronger FIU-IND registration readiness before the meeting
After the review and the separate remediation project, the VDA SP proceeded to its FIU-IND in-person meeting. Management had a clearer view of its control gaps and remediation priorities. Our work supported FIU-IND registration readiness. However, it does not represent FIU-IND approval, endorsement or a guarantee of registration.
- An independent assessment of gaps before the registration meeting.
- Recommendations on identity verification, sanctions screening and transaction monitoring.
- Revised policies and a reworked risk assessment.
- Support with system configuration and demonstration readiness.
Frequently Asked Questions (FAQ)
What is an FIU-IND registration readiness review?
It is an independent review of a VDA SP’s AML/CFT framework before FIU-IND registration. It usually combines policy review, gap assessment and control testing. As a result, the firm can fix weaknesses early.
Is an independent AML audit mandatory before FIU-IND registration?
A pre-registration review is a voluntary, preparatory step. It is distinct from the independent audit requirement for reporting entities in FIU-IND’s updated guidelines of 8 January 2026. So a pre-registration review does not, by itself, meet that ongoing audit obligation.
What happens at the FIU-IND in-person meeting?
After the applicant submits the required documents, FIU-IND holds an in-person meeting. The Designated Director and Principal Officer attend. The applicant then demonstrates relevant AML/CFT processes and systems live. Requirements can change, so firms should check the current FIU-IND process first.
Is a pre-registration review the same as a VASP independent audit?
No. A pre-registration review is a preparatory assessment. It identifies gaps and evaluates selected controls before registration. However, it does not automatically qualify as the independent audit required under applicable AML/CFT/CPF requirements. The applicable law and FIU-IND guidelines set the scope, auditor eligibility and independence rules for that audit.
How long does an FIU-IND registration readiness review take?
It depends on the firm’s size, products and readiness. In this engagement, the review took two to three weeks.
Can the same firm review and remediate our controls?
Yes, under separate engagements, subject to conflict-of-interest checks. However, where a firm has helped design or implement controls, a different independent reviewer should generally carry out later audits. This depends on the applicable requirements and a conflict assessment.
Preparing for FIU-IND registration?
Compliance7 provides independent pre-registration AML reviews, gap assessments and control testing for VDA SPs in India. Talk to us before your FIU-IND in-person meeting.
