Crypto-Asset Transaction Reporting under Section 509 of the Income Tax Act 2025: Form 167, Due Date and Penalty
Section 509 of the Income-tax Act, 2025 makes a reporting crypto-asset service provider (an exchange, broker, dealer or crypto ATM operator) file a statement on its customers' crypto-asset transactions. The statement is Form No. 167, due by 31 May of the calendar year after the year it covers, and the first calendar year in scope is 2026. Late filing attracts a penalty of Rs 200 a day under section 446.
This is a duty on the platform, not on the person who trades. The rules ask the provider to report customers who are tax residents of countries outside India, so a platform with foreign-resident customers has to collect residence declarations and file even if it has nothing to report. This guide explains who is covered, what Form 167 contains, how the due diligence works and what the penalties are. All figures come from section 509, section 446 and rules 241 to 244 of the Income-tax Rules, 2026, as amended by the Finance Act, 2026. Last reviewed on 10 November 2026.
I trade crypto myself: what do I owe under the Income Tax Act 2025?
Section 509 is the platform's duty, but a trader has separate obligations in the same Act. Both use the term "virtual digital asset" from section 2(111), which covers crypto-assets under clause (d).
- Tax on income: section 194(1) (Table Sl. No. 4) taxes income from transfer of a virtual digital asset at 30%. Only the cost of acquisition, if any, is deductible, and no other expense or allowance is allowed.
- No loss set-off: a loss on transferring a virtual digital asset cannot be set off against any other income or carried forward to later tax years.
- TDS: section 393(1) (Table Sl. No. 8(vi)) requires any person paying consideration for the transfer to deduct 1%, with no threshold in the main entry. Table Sl. No. 12 of section 393(4) sets a no-deduction limit: Rs 50,000 in a tax year for an eligible individual or HUF, and Rs 10,000 for any other payer. The tax is deposited under rule 218(3)(d) within 30 days from the end of the month of deduction, with a challan-cum-statement in Form No. 141.
- Crypto swapped for crypto: where there is no cash part, or the cash part is too small, the person paying must make sure the tax has been paid before releasing the consideration (Note 6 to section 393(1)).
Illustration (tax year 2026-27, assumed figures): Ravi buys a token for Rs 1,00,000 and sells it for Rs 1,40,000. Income = 1,40,000 - 1,00,000 = Rs 40,000; tax at 30% = Rs 12,000 (before any surcharge or cess). If he instead sold at Rs 80,000, the Rs 20,000 loss could not be set off against his salary or carried forward. On the Rs 1,40,000 sale, 1% TDS is Rs 1,400.
What does section 509 of the Income Tax Act 2025 require?
Section 509(1) says a person who is a "reporting entity" in respect of a crypto-asset must furnish information on transactions of that asset in a statement. The period, time, form, manner and the income-tax authority receiving it are prescribed by the Rules. "Crypto-asset" has the meaning given in section 2(111)(d): a digital representation of value that relies on a cryptographically secured distributed ledger or similar technology to validate and secure transactions.
Section 509 has six sub-sections. The table below lists what each one does.
| Provision | What it does |
|---|---|
| Section 509(1) | Reporting entity furnishes a statement of crypto-asset transactions |
| Section 509(2) | If the authority finds the statement defective, it intimates the defect; the provider has 30 days to rectify (or a longer period if allowed); if not rectified, it is treated as having furnished inaccurate information |
| Section 509(3) | If no statement is filed in time, the authority can serve a notice requiring it within 30 days at most |
| Section 509(4) | A provider that discovers an inaccuracy in a filed statement must inform the authority and give correct information within 10 days |
| Section 509(5) | Rules may require registration, record-keeping and due diligence to identify crypto-asset users or owners |
| Section 509(6) | "Crypto-asset" means as in section 2(111)(d) |
Who is a reporting crypto-asset service provider?
Rule 241(13) defines it as any individual or entity that, as a business, provides a service for effecting exchange transactions for or on behalf of customers. That includes acting as a counterparty or intermediary, or making a trading platform available. Rule 241(14) names these examples:
- dealers who buy and sell relevant crypto-assets to customers for their own account;
- operators of crypto-asset ATMs;
- exchanges that act as market makers and earn a bid-ask spread;
- brokers who complete buy or sell orders for clients;
- individuals or entities subscribing one or more relevant crypto-assets; and
- trading platforms, meaning software or an application that lets users carry out exchange transactions in whole or in part.
Someone who provides such a service only occasionally and for non-commercial reasons is outside "as a business".
When does an Indian filing obligation apply?
Under rule 242(1) the provider must report and do due diligence in India if it is any one of the following:
- an entity or individual resident for tax purposes in India;
- an entity incorporated or organised under Indian law;
- an entity with legal personality in India, or one with an obligation to file a return of income under section 263;
- an entity managed from India; or
- an entity or individual with a regular place of business in India.
Transactions effected through an Indian branch are covered as well (rule 242(2)). Rule 242(3) lifts the Indian obligation where the same requirements are completed in a "partner jurisdiction", a country the Central Government has specified by notification (rule 241(7)), or where the provider has lodged the required notification with India.
What is a "relevant crypto-asset" and a "relevant transaction"?
Only relevant crypto-assets and relevant transactions are reported. Under rule 241(9) and (11), a relevant crypto-asset is one that is not a Central Bank Digital Currency, not a specified electronic money product, and not an asset the provider has adequately determined cannot be used for payment or investment. A relevant transaction is an exchange transaction or a transfer of relevant crypto-assets.
| Term | Meaning (rule 241) |
|---|---|
| Exchange transaction | Exchange between relevant crypto-assets and fiat currency, or between different relevant crypto-assets (241(12)(a)) |
| Transfer | Moving a relevant crypto-asset to or from a user's address or account where the provider cannot tell it is an exchange transaction (241(12)(c)) |
| Reportable retail payment transaction | Transfer of relevant crypto-assets for goods or services worth more than USD 50,000 (241(12)(b)) |
| Reportable user | A crypto-asset user who is a reportable person: a person resident in a country or territory outside India for tax purposes, other than an excluded person (241(15), (16)(g)) |
| Excluded person | For example a listed entity or its related entity, a government entity, an international organisation, a central bank, or a financial institution (241(5)) |
How does the reporting process work from start to filing?
What is the due diligence a provider must do?
Rule 244 sets out the checks. The core of it is a self-certification from each user, which the provider tests for reasonableness against its Anti Money Laundering or Know Your Customer records.
- New users: obtain the self-certification when the relationship is established (rule 244(2)(a)).
- Existing individual users: obtain it within twelve months on and from 1 January 2026 (rule 244(2)(a)).
- Entity users: obtain a self-certification of residence; if the entity has no tax residence, use its place of effective management or principal office address (rule 244(3)). Unless the entity is an excluded person or an active entity, identify controlling persons who are reportable persons (rule 244(4)).
- Change of circumstances: if the provider knows or has reason to know a self-certification is wrong, it must stop relying on it and obtain a valid one or a reasonable explanation (rule 244(2)(b), (7)).
- Valid individual self-certification: signed or positively affirmed, dated no later than receipt, and carrying name, residence address, country of tax residence, foreign TIN where one exists, and date of birth (rule 244(8)).
- Records: keep documents and data for at least seven tax years after the end of the period within which the statement must be reported (rule 244(12)). A provider may use a third party, but stays responsible (rule 244(11)).
What goes into Form 167 and when is it due?
Rule 243(7) requires the statement in Form No. 167 by 31 May of the calendar year following the year to which the information relates. Rule 243(1) applies to each calendar year starting on or after 1 January 2026, so the first statement, for calendar 2026, falls due on 31 May 2027.
For each reportable user the provider reports identity details (name, address, country or countries of residence, TIN, and date and place of birth for an individual), the provider's own name, address and PAN, and, for each type of relevant crypto-asset, the aggregate amounts, units and number of transactions in these categories (rule 243(1)(e)):
| Category | Reported as |
|---|---|
| Acquisitions against fiat currency | Gross amount paid, units, number of transactions |
| Disposals against fiat currency | Gross amount received, units, number of transactions |
| Acquisitions and disposals against other crypto-assets | Aggregate fair market value, units, number of transactions |
| Reportable retail payment transactions | Fair market value, units, number of transactions |
| Other transfers to and by the user | Fair market value, units, number of transactions, split by transfer type |
| Transfers to wallet addresses not known to belong to a virtual asset service provider or financial institution | Aggregate fair market value and units |
Where no user or controlling person turns out to be reportable, a nil statement must still be filed (rule 243(6)). The statement goes to the Director or Joint Director of Income-tax (Intelligence and Criminal Investigation) by electronic transmission under a digital signature (rule 243(9)), signed and verified by the provider's designated director (rule 243(11)(b)).
How are values converted and netted?
- Amounts paid or received for fiat acquisitions and disposals are reported net of transaction fees, in Indian rupees (rule 243(8)(a)).
- A payment in another fiat currency is converted at the telegraphic transfer buying rate on the date of each transaction (rule 243(8)(a)(iii)).
- Fair market value for crypto-to-crypto transactions is worked out in rupees at the time of each transaction, using the provider's own crypto-asset to rupee trading pairs where it has them (rule 243(8)(b)).
- External wallet addresses linked to transfers must be kept for at least seven years, but need not be reported (rule 243(8)(d)).
Worked example 1: aggregating fiat purchases and sales for one user
Assumptions: calendar year 2026; one reportable user holds an account with an Indian exchange; all trades are in one crypto-asset against rupees; fees are shown to illustrate the netting rule in rule 243(8)(a)(i). The figures are illustrative.
| Trade | Paid or received before fee (Rs) | Fee (Rs) | Reported net of fee (Rs) |
|---|---|---|---|
| Buy 1 | 2,01,000 | 1,000 | 2,00,000 |
| Buy 2 | 1,51,500 | 1,500 | 1,50,000 |
| Buy 3 | 50,500 | 500 | 50,000 |
| Acquisitions total | 4,03,000 | 3,000 | 4,00,000 |
| Sale 1 | 2,53,000 | 3,000 | 2,50,000 |
| Sale 2 | 1,02,000 | 2,000 | 1,00,000 |
| Disposals total | 3,55,000 | 5,000 | 3,50,000 |
Form 167 shows, for that asset, acquisitions of Rs 4,00,000 across 3 transactions and disposals of Rs 3,50,000 across 2 transactions, with the unit totals alongside. Check: 2,00,000 + 1,50,000 + 50,000 = 4,00,000 and 2,50,000 + 1,00,000 = 3,50,000.
Worked example 2: converting a foreign-currency purchase
Assumptions: a reportable user pays in US dollars; the telegraphic transfer buying rates below are made up for the illustration. Each transaction is converted at the rate of its own date (rule 243(8)(a)(iii)).
| Transaction | USD paid (net of fee) | Assumed TT buying rate (Rs per USD) | Reported (Rs) |
|---|---|---|---|
| Purchase on day 1 | 1,000 | 84 | 1,000 x 84 = 84,000 |
| Purchase on day 2 | 500 | 86 | 500 x 86 = 43,000 |
| Total | 1,500 | 1,27,000 |
Using one average rate for both days would give a different total. The rule asks for conversion transaction by transaction, and the form also has to identify the fiat currency in which each amount is reported (rule 243(4)).
What are the deadlines for defects, notices and corrections?
What is the penalty for not filing or for filing wrong information?
Section 446, as substituted by Act No. 4 of 2026 with effect from 1 April 2026, sets two penalties. Both are imposed by the prescribed income-tax authority under section 509.
| Default | Penalty |
|---|---|
| Statement not furnished within the prescribed time (446(1)) | Rs 200 for every day the failure continues |
| Inaccurate information not corrected as required by section 509(4) (446(2)(a)) | Rs 50,000 |
| Failure to comply with the due diligence requirement of section 509(5) (446(2)(b)) | Rs 50,000 |
Example: a provider's statement for calendar 2026 is due on 31 May 2027. It files on 20 June 2027. Taking the failure as continuing for 20 days, the penalty is 20 x Rs 200 = Rs 4,000. If a statement is also found to carry an inaccuracy the provider did not correct within 10 days of discovering it, the Rs 50,000 penalty applies as well. Whether the day count starts on 1 June is for the authority to apply, so treat the figure as an estimate.
Real-life example 1: an Indian exchange with a Dubai-resident customer
Ravi lives in Dubai and has traded for years on an Indian exchange. In 2026 the exchange asks him for a self-certification of his tax residence. He declares the UAE and gives his name, address and date of birth. The exchange confirms this against his KYC file and, if the UAE is a country with a TIN, collects it. If no TIN is issued there, rule 243(2) and rule 244(10) allow it to be left out. Ravi is a reportable user, so his 2026 trades appear in Form 167 filed by 31 May 2027.
Real-life example 2: a platform with no reportable users
Meena runs a small crypto brokerage in Pune. Every customer she onboarded certifies Indian tax residence, and none is an entity with a foreign-resident controlling person. Her due diligence under rule 244 finds nobody reportable. She still files a nil statement in Form 167 by 31 May of the next year (rule 243(6)), because the obligation attaches to her as a provider and not to what she found. Her designated director signs it.
Common mistakes
- Assuming the duty falls on the trader. Section 509 and rules 242 to 244 bind the service provider.
- Skipping the nil statement. Rule 243(6) requires a statement even when nobody is reportable.
- Reporting gross figures. Fiat amounts and fair market values are reported net of transaction fees.
- Using one exchange rate for a whole year. Conversion is at the telegraphic transfer buying rate on each transaction date.
- Relying on an old self-certification. If the provider has reason to know it is wrong, it must get a fresh one (rules 244(2)(b) and 244(7)).
- Sitting on a discovered error. The 10-day window in section 509(4) starts when the provider comes to know of the inaccuracy.
Quick reference
| Item | Rule |
|---|---|
| Form | Form No. 167 (rule 243(7)) |
| First reporting year | Calendar year 2026 (rule 243(1)) |
| Due date | 31 May of the following calendar year (rule 243(7)) |
| Rectify a defect | 30 days from intimation (section 509(2)) |
| Respond to a notice | Up to 30 days from service (section 509(3)) |
| Report an inaccuracy | 10 days from discovery (section 509(4)) |
| Late-filing penalty | Rs 200 a day (section 446(1)) |
| Penalty for uncorrected inaccuracy or due diligence default | Rs 50,000 (section 446(2)) |
| Record retention | Wallet addresses: at least seven years (rule 243(8)(d)(ii)); other documents and data: at least seven tax years after the reporting deadline (rule 244(12)) |
Where this is in the Act
- Section 509: obligation to furnish information on transactions of crypto-assets
- Section 446: penalty for failure to furnish, or inaccurate information
- Section 2(111)(d): meaning of crypto-asset
- Rule 241: definitions for rules 242 to 244
- Rule 242: who must report and where it can be skipped
- Rule 243: contents, valuation, Form No. 167 and due date
- Rule 244: due diligence and self-certification
For the wider picture of how deductors and others report to the department, see our guide to TDS deposit and statement compliance under the Income Tax Act 2025. If you advise a crypto platform or a client with foreign-resident users, Finexo's practice management software can track the self-certification follow-ups and the 31 May filing alongside your other client deadlines.
This article is general information on the statute and rules and is not tax or legal advice. Confirm the position against the current text before acting on it.
Frequently Asked Questions
Who has to file the crypto-asset statement under section 509?
A reporting crypto-asset service provider with an Indian nexus under rule 242(1), such as an exchange, broker, dealer or crypto ATM operator. Individual traders are not the filers.
What is Form 167 and when is it due?
Form No. 167 is the statement of crypto-asset transactions under rule 243(7). It is due by 31 May of the calendar year following the year to which the information relates, starting with calendar year 2026.
Whose transactions are reported?
Transactions of reportable users, meaning customers (or controlling persons of entity customers) who are tax residents of a country or territory outside India, other than excluded persons (rule 241(16)(g)).
Is a nil statement required if there are no reportable users?
Yes. Rule 243(6) requires a nil statement where the due diligence under rule 244 identifies no reportable user or reportable person.
What is the penalty for not filing the statement?
Section 446(1) allows a penalty of Rs 200 for every day the failure continues. Section 446(2) allows Rs 50,000 for uncorrected inaccurate information or failing the due diligence requirement.
How long does a provider have to correct an error?
Within 10 days of discovering an inaccuracy (section 509(4)), and within 30 days of an intimation of a defect from the authority (section 509(2)).
Do individual crypto traders have to report under section 509?
No. Section 509 binds the service provider. A trader's own obligations are the 30% tax under section 194(1) (Sl. No. 4), with no loss set-off, and the 1% TDS under section 393(1) (Sl. No. 8(vi)) on the transfer consideration.