Rule 244 — Due diligence procedures under section 509. Made under s.509 of the Income-tax Act, 2025.
Rule 244 gives effect to Section 509 of the Income-tax Act, 2025. A rule cannot go beyond the section it serves: where the two seem to differ, the section governs.
The rule sets the due diligence a reporting crypto-asset service provider must carry out to identify reportable users and reportable persons for the purposes of section 509.
Sub-rule (1) fixes the moment: a crypto-asset user is treated as a reportable user beginning as of the date it is identified as such pursuant to these procedures.
Sub-rule (2) governs individual users. When establishing the relationship, or for pre-existing individual users within twelve months on and from the 1st January, 2026, the provider must obtain a self-certification allowing it to determine the residence or residences of the user for tax purposes, and confirm the reasonableness of that self-certification on the information it holds, including documentation collected under Anti Money Laundering or Know Your Customer Procedures. On a change of circumstances that causes the provider to know or have reason to know that the original self-certification is incorrect or unreliable, it shall not rely on that self-certification, shall obtain a valid self-certification or a reasonable explanation, and the documentation supporting the validity of the original self-certification as may be appropriate.
Sub-rule (3) governs entity users, and applies both to determining whether the entity is a reportable user and whether an entity, other than an excluded person or an active entity, has controlling persons who are reportable persons. The same self-certification and reasonableness steps apply, for pre-existing entity users within twelve months on and from the 1st January, 2025. If the entity certifies that it has no residence for tax purposes, the provider relies on the place of effective management or the address of the principal office. If the self-certification indicates residence outside India, the provider treats the entity as a reportable user unless it reasonably determines, on the self-certification or on information in its possession or publicly available, that the entity is an excluded person.
Sub-rules (4) to (7) deal with controlling persons. For an entity user other than an excluded person, the provider must determine whether it has one or more controlling persons who are reportable persons, unless it determines on a self-certification that the entity is an active entity. In identifying controlling persons it may rely on information collected under Anti Money Laundering or Know Your Customer Procedures consistent with the 2012 Financial Action Task Force Recommendations as updated in June, 2019 pertaining to virtual asset service providers and as further updated from time to time, and where it is not legally required to apply such procedures it must apply substantially similar ones. To decide whether a controlling person is a reportable person it relies on a self-certification from the entity or the controlling person and confirms its reasonableness. The change of circumstances rule in sub-rule (2)(b) is repeated for entity users and their controlling persons.
Sub-rules (8) and (9) fix what makes a self-certification valid. For an individual user or controlling person it must be signed or otherwise positively affirmed, dated at the latest at the date of receipt, and contain first and last name, residence address, country or territory of residence for tax purposes, the tin for each country or territory outside India in which a reportable person is resident, and date of birth. For an entity user it must likewise be signed or positively affirmed and dated, and contain legal name, address, countries or territories of residence, the tin for each such country, the sub-rule (8) information for each controlling person of an entity that is neither an active entity nor an excluded person together with the role by virtue of which each is a controlling person, and if applicable the criteria it meets to be treated as an active entity or excluded person. Sub-rule (10) excuses the tin where the country or territory of residence does not issue one to the reportable person, or where the domestic law of that country does not require its collection.
Sub-rule (11) permits reliance on a third party to fulfil these obligations while leaving the obligations with the provider. Sub-rule (12) requires all documentation and data to be maintained for not less than seven tax years after the end of the period within which the information required under rule 243 is to be reported.
Sub-rule (13) is the interpretive apparatus. Clause (a) elaborates sub-rule (2) in eighteen sub-clauses: dual residence means the user is a reportable user in respect of each country or territory; "reasonableness" is confirmed where, on review of the information obtained, the provider does not know or have reason to know that the self-certification is incorrect or unreliable; where the test fails, a valid self-certification or a reasonable explanation and documentation must be obtained and a copy or notation retained before providing services effectuating relevant transactions; "reason to know" is defined by the reasonably prudent person standard and by conflicting or incomplete information, including facts within the knowledge of a service provider relied on; documentation may not be relied on where it does not reasonably establish identity or is inconsistent with the claimed status; "change of circumstances" is defined and terminates the validity of the self-certification as to the information no longer reliable; a provider may treat a person as having its former status until the earlier of ninety calendar days from invalidity, confirmation of validity, or a new self-certification, and where nothing is obtained in that ninety-day period it must treat the individual as resident of both the originally claimed country or territory and the one indicated by the change; a provider may rely on a self-certification without inquiring into possible changes unless it knows or has reason to know of them; copies in various media may be retained; and an inconsequential error does not invalidate a self-certification where the provider has sufficient documentation on file to supplement the missing information, that documentation being conclusive. Clause (b) elaborates sub-rule (3), including what counts as "publicly available" information — a list published by a tax administration, a publicly accessible register maintained or authorised by an authorised government body, or information disclosed on an established securities market. Clause (c) allows a self-certification to be signed or positively affirmed by any person authorised to sign under domestic law. Clause (d) identifies the third-party situations covered by sub-rule (11), being documentation collected by third party service providers or agents or of an acquired business, and reliance on other reporting crypto-asset service providers handling the same relevant transaction.
Sub-rule (14) limits use: for the purposes of rules 241, 242, 243 and this rule, exchange of any information in respect of any transaction in relevant crypto-asset shall be only for the limited purposes of administration of taxes by the relevant jurisdiction.
Section 509 requires reporting on crypto-asset users who are reportable, but reportability turns on tax residence, which a service provider cannot observe. The rule builds the only workable substitute — a self-certification from the user, tested for reasonableness against what the provider already holds under its Anti Money Laundering and Know Your Customer files — and then closes the gaps that a self-certification alone would leave: what makes one valid, when the provider is fixed with knowledge that it is not, what happens when circumstances change, and how long the evidence must be kept. Sub-rule (14) confines the resulting information to tax administration.
| What | Figure | The condition on it | Where |
|---|---|---|---|
| Period to complete due diligence on pre-existing individual crypto-asset users | Within twelve months on and from the 1st January, 2026 | For users other than those onboarded when establishing the relationship | Sub-rule (2)(a) |
| Period to complete due diligence on pre-existing entity crypto-asset users | Within twelve months on and from the 1st January, 2025 | For entity users other than those onboarded when establishing the relationship | Sub-rule (3)(i) |
| Period for which a person may be treated as having its pre-change status | Ninety calendar days from the date the self-certification became invalid | Or until validity is confirmed or a new self-certification is obtained, whichever is earlier | Sub-rule (13)(a)(xiv) |
| Retention period for documentation and data | Not less than seven tax years | After the end of the period within which the information required to be reported under rule 243 is to be reported | Sub-rule (12) |
| Standard for Anti Money Laundering or Know Your Customer Procedures relied on for controlling persons | The 2012 Financial Action Task Force Recommendations, as updated in June, 2019 | Pertaining to virtual asset service providers and as further updated from time to time; substantially similar procedures where the provider is not legally required to apply them | Sub-rule (5) |
The self-certification is the spine of the rule, but the provider is never entitled simply to file it: sub-rule (2)(a)(ii) requires the reasonableness check against what it already knows, and sub-rule (13)(a) fixes it with reason to know wherever the certification is incomplete, internally inconsistent, or conflicts with anything in its files — including facts known to a service provider it relies on. Dual residence produces reporting to each country or territory, not a choice between them. The ninety-day rule is a grace period with a sting: if nothing valid is obtained within it, the individual is treated as resident of both the country originally claimed and the one the change points to, which widens rather than narrows the reporting. Reliance on a third party under sub-rule (11) shifts the work and not the responsibility. Two dates in the text differ — twelve months on and from the 1st January, 2026 for pre-existing individual users in sub-rule (2)(a), and twelve months on and from the 1st January, 2025 for pre-existing entity users in sub-rule (3)(i) — and each should be applied as it reads. The retention period is not the ordinary records period: sub-rule (12) runs seven tax years from the end of the rule 243 reporting period, not from the transaction.
A provider onboards an individual who self-certifies residence in one country outside India, which sits comfortably with the address and documents in its Know Your Customer file, so the user is treated as a reportable user in respect of that country from the date of identification. Two years later the user updates his profile with an address in a second country, which is a change of circumstances: the provider may treat him as before for up to ninety calendar days, but if no valid self-certification or reasonable explanation is obtained in that time it must treat him as resident of both countries and report accordingly. Its file on him — the certifications, the notations and the supporting documents — must be kept for not less than seven tax years after the end of the period within which the rule 243 information is to be reported.
A crypto-asset user meets it at onboarding, in the self-certification of tax residence and tin, and again whenever a change of address or profile prompts the provider to ask for a fresh one. The provider meets it continuously, and in the statement it later files under rule 243.
A crypto-asset user is treated as a reportable user beginning as of the date it is identified as such, pursuant to the due diligence procedures specified in this rule.
A reporting crypto-asset service provider may rely on a third party to fulfil the due diligence obligations set out in this rule, but such obligations remain the responsibility of the reporting crypto-asset service provider.
A reporting crypto-asset service provider shall maintain all documentation and data for a period of not less than seven tax years after the end of the period within which the reporting crypto-asset service provider shall report the information required to be reported pursuant to rule 243.
