Module B — India's Actual Perimeter

The 30-second answer

India has no crypto ban, but it has no crypto law either, and for the institutional case those are very different things. The binding constraint on tokenised securities and deposits is almost never a prohibition; it is unaddressed legal ground (on-chain settlement finality and ledger-as-legal-register are simply not contemplated by Indian statute) plus supervisory caution. Only the private-crypto-asset route is genuinely restrictive, via a punitive tax, and that route is not the institutional case. India already runs one DLT system in mandatory production (SEBI's covenant-monitoring platform); everything else is pilot or sandbox. The widest permitted perimeter is GIFT City rather than the domestic market, and there the technology layer is already licensed.

The 5-minute summary

The distinction that matters: barred versus unaddressed. Most Indian commentary treats "no rule permits it" as equivalent to "a rule prohibits it." Separating those is the main analytical contribution here. Almost nothing in the institutional tokenisation case is barred. What blocks it is that Indian law does not yet contemplate it: the Payment and Settlement Systems Act 2007 confers settlement finality only on RBI-designated systems, so on-chain finality has no statutory basis; and the Depositories Act 1996 contemplates a depository, not a distributed ledger, so a DLT record is not recognised as the legal register of a security. These are gaps, not walls. The distinction matters, because a gap is closed administratively or by a narrow amendment, while a wall needs the ban repealed.

One system is genuinely in production, and the regulator built it. SEBI's Security and Covenant Monitoring System, mandated in 2022 and operated by the depositories NSDL and CDSL, records charges and covenants for corporate bonds on a permissioned DLT and gates ISIN activation on it. Near-complete adoption of the secured-debt universe. It is a registry inside the existing depository perimeter, rather than a settlement rail or a public chain, and it demonstrates the one thing that is uncontested in India: regulators will mandate DLT where it sits inside the perimeter and touches no finality or property-transfer question.

The RBI is piloting, cautiously, and on sovereign rails. The tokenised certificate-of-deposit pilot on the Unified Markets Interface, settled in wholesale CBDC, launched in October 2025 with "a few banks" the RBI declined to name. The RBI's own fintech officials have said plainly that "integrity and enforceability have to be established" and that "legal changes" are needed before scaling, which is disconfirming evidence against any claim that India is ready to scale tokenised instruments. SEBI's corporate-bond tokenisation pilot has since shipped, and on the same sovereign design: Demat 2.0, launched 10 September 2026, issues bonds as native tokens on a permissioned ledger owned by NSDL and CDSL and settles the cash leg in wholesale CBDC through UMI. ₹1,025 crore from three issuers, primary issuance only, inside SEBI's regulatory sandbox.

GIFT City is the operational core, and it is offshore. The IFSCA's TechFin and Ancillary Services Regulations (2025) already license the technology and tooling layer, so a registered entity can build the rails today. Actual token issuance and platform operation remain sandbox-only, with live entrants. GIFT operates in foreign currency with non-resident participants, which is what the domestic regime cannot replicate under FEMA. The reconciled reading: the widest permitted perimeter in India is offshore, and the domestic prizes sit behind legal gaps that GIFT does not reach.

On tax, separate the instrument from the asset. The 30% flat VDA tax with no loss set-off makes a private-crypto trading book unviable and is effectively prohibitive for that route. But a tokenised CD or corporate bond is the same security or deposit as its conventional twin, taxed as such rather than as a crypto-asset. The CBDT has not confirmed this, so the classificatory risk is live and unquantified. This single unresolved clarification is the largest tax variable for the institutional case.

The full report

This is the module as originally researched. The summary tiers above reflect the reconciliation pass, chiefly the barred-versus-unaddressed framing and the offshore-perimeter point. See the Reconciliation tab and the Figure Ledger for specifics, including the note that this module's classification of every activity is a legal reading, not settled law where flagged.

Overview

India already runs one blockchain/DLT system in genuine production in regulated finance: SEBI's mandatory Security and Covenant Monitoring System for corporate bonds, operated by NSDL and CDSL and gating ISIN activation since April 2022. Every other tokenisation initiative (RBI's tokenised CD pilot on UMI, SEBI's corporate-bond tokenisation pilot, IFSCA's RWA framework) is at pilot or announced-only stage. SEBI's bond pilot moved from announced to live sandbox issuance on 10 September 2026; it is a pilot, not production.

The most important analytical point: for tokenised securities and tokenised deposits, the binding constraint is almost never a prohibition. It is UNADDRESSED legal ground (settlement finality, ledger-as-register recognition, smart-contract enforceability) plus supervisory caution. Only private crypto-asset banking friction and the punitive VDA tax regime are genuinely restrictive, and those largely do not touch the institutional tokenisation case, which sources repeatedly conflate.

The widest permitted perimeter sits offshore in GIFT City/IFSC, where the IFSCA (TechFin and Ancillary Services) Regulations, 2025 already license the technology layer and a sandbox carries live tokenisation platforms. The gap between India and the global precedents is therefore mostly a gap of enabling legal instruments (an EU DLT-Pilot / UK DSS-style disapplication power) that no Indian body currently holds outside IFSC.

Reserve Bank of India

CBDC (wholesale and retail). The wholesale pilot began November 2022 and retail (e₹-R) on 1 December 2022. Retail users reached ~6 million and 17 banks by March 2025 (RBI Annual Report 2024-25, T1). By December 2025, Deputy Governor T. Rabi Sankar reported ~120 million retail transactions and value crossing ₹28,000 crore; by July 2026, Governor Sanjay Malhotra cited ~12 million users and >175 million transactions worth close to ₹400 billion (~$4.5bn). Note the gap between cumulative transaction flow and stock in circulation: e-Rupee in circulation was only ₹1,016 crore (~$115m) as of March 2025 and fell to ₹771.7 crore (~$88m) by March 2026, down ~24% despite pilot expansion, a candid signal that regulator-built rails do not create usage. Programmable CBDC was used in FY26 for direct-benefit-transfer food subsidies in Gujarat, Puducherry and Chandigarh, redeemable only for eligible goods, a live programmable-payments example. STATUS: LIMITED PILOT (retail and wholesale). Deputy Governor Sankar has said CBDC requires "consequential amendments in the Coinage Act, FEMA and the Information Technology Act," so the central bank's own token needs statutory work.

Tokenised deposit-instrument pilot. The RBI's FY26 Annual Report (29 May 2026) states it developed the Unified Markets Interface (UMI), "a multi-layer platform to facilitate tokenisation of financial assets while leveraging wholesale CBDC to enhance settlement efficiencies," and that a pilot for issuance and trading of certificates of deposit in tokenised form has begun, settled through wholesale CBDC. Launched 8 October 2025 with tokens "backed one-to-one by actual deposits," involving "a few banks," per RBI CGM (Fintech) Suvendu Pati. STATUS: LIMITED PILOT. Pati hedged the legal foundation explicitly: "integrity and enforceability have to be established... there needs to be legal changes put in place... clarity on ownership rights." Volumes were partly disclosed in September 2026: roughly 248 tokenised-CD transactions worth about ₹17,000 crore had settled on UMI. RBI Executive Director P. Vasudevan said on 9 September 2026 that UMI "has been a good launch pad" and that the RBI intends to add asset classes to it, with gold and bank deposits under examination, while naming legal certainty, data privacy, data movement, consent management, liquidity, interoperability and platform concentration as the unresolved risks (T3).

Banking access for digital-asset businesses. The RBI's 6 April 2018 circular barring banks from serving crypto businesses was struck down by the Supreme Court on 4 March 2020 in Internet and Mobile Association of India v. RBI on proportionality grounds; it has not been reinstated. Post-2020, banks cannot cite the set-aside circular to refuse service, though informal supervisory discouragement persists, which is a commercial obstacle rather than a legal one. STATUS: PERMITTED (ban set aside).

SEBI

DLT covenant monitoring: IN PRODUCTION. Framework circular of 13 August 2021; operational guidelines SEBI/HO/MIRSD/CRADT/CIR/P/2022/38 of 29 March 2022, effective 1 April 2022, for all non-convertible securities. NSDL's platform was unveiled 7 May 2022. Each pledged asset gets a unique asset ID with duplicate checks to prevent double-charging; issuers upload the Debenture Trust Deed and covenants; debenture trustees verify against Sub-Registrar/ROC/CERSAI/IBBI-IU sources; ISINs are gated on the recording. Adoption per vendor Cognizant: 4,291 issuers onboarded, 6,368 secured ISINs mapped (~90% of outstanding secured ISINs), 6,366 approved by trustees (>95%). Note: the mandate is T1 (the circular); the adoption scale is T4 (Cognizant) plus NSDL IPO documents; cite the circular for the mandate, label the scale figures.

Demat 2.0 tokenisation pilot: LIMITED PILOT (primary issuance). Announced by SEBI Chairman Tuhin Kanta Pandey on 26 May 2026 with implementation expected in "six to nine months," it shipped in three and a half. SEBI launched it as "Demat 2.0" on 10 September 2026 (PR No. 56/2026), jointly with RBI Governor Sanjay Malhotra. Three issuances preceded the launch: REC raised ₹500 crore on 7 September, at a 7.30% coupon over one year nine months against a bid book of about ₹796 crore, with bidding, pay-in, allotment and exchange listing completed the same day; L&T raised ₹500 crore and IIFL Finance ₹25 crore on 9 September. Total ₹1,025 crore (~$107m).

The architecture is the whole point, and it is the one this evidence base predicted. Bonds are issued as native digital tokens on a private permissioned DLT owned by the depositories, NSDL and CDSL; the depositories hold the private keys on investors' behalf and the depository record remains the authoritative register of beneficial ownership. Coupon, payment dates, day-count convention and redemption terms are encoded into the token through a smart contract. The cash leg connects to the RBI's wholesale CBDC through the Unified Markets Interface, giving atomic DvP. A Demat 2.0 account is an extension of the investor's existing demat account on existing KYC. The instrument keeps its ISIN, coupon, maturity, rating, covenants and investor rights; SEBI's own framing is that tokenisation changes the recording technology and creates no new asset class (FAQs, T1).

It runs under SEBI's Regulatory Sandbox, with any regulatory relaxation bounded to the pilot's scope and period, in three stages: institutional issuance first, then secondary-market trading, then retail access. Only the first has happened. There is no secondary market for these bonds yet (T5; the phasing itself is T1). SEBI has said the framework could later extend to equities, mutual fund units and electronic gold receipts. Do not read this as production: it is a sandbox pilot with no mandate, no statute and no traded secondary leg.

Depository framework. SEBI continues incremental demat reform but has no proposal to replace the book-entry model with a DLT register; a DLT register is not currently recognised as the legal register (the Depositories Act 1996 contemplates a depository). SEBI is a member of IOSCO's Tokenisation Working Group; no tokenisation SRO exists.

IFSCA and GIFT City (the operational core)

The IFSCA (TechFin and Ancillary Services) Regulations, 2025, notified 8 July 2025, superseded the 2022 FinTech Entity Framework; the Second Schedule lists 24 permitted TechFin services expressly including "Blockchain, DLT, Web 3.0 and Tokenisation." A technology provider can obtain a Certificate of Registration today: PERMITTED. Actual issuance or management of tokenised assets has no completed licence category (IFSCA's 26 February 2025 consultation paper posed questions rather than rules), so live token-platform operators run under the sandbox: SANDBOX ONLY. IFSCA has given conditional sandbox approval to Realdom India (Pinvest Exchange, fractional real-estate) and Terazo. Enumerated perimeter: technology/tooling permitted via CoR; token issuance/platform operation sandbox-only; FME regime available for fund structures; foreign-currency settlement and non-resident participation available, which is what the domestic regime cannot replicate under FEMA. IFSCA's powers derive from the IFSCA Act 2019, which applies only inside the IFSC; nothing equivalent lets the RBI or SEBI disapply domestic law for a pilot.

MeitY, DEA, Ministry of Finance

The inter-ministerial crypto discussion paper has been delayed repeatedly since 2024 and was reported shelved as of April 2026, with RBI opposition cited as the main factor (T5-adjacent sourcing; present as "reported"). The file is live again: a Department of Economic Affairs appearance before the Parliamentary Standing Committee on Finance on the VDA framework, cancelled in August 2026, was reported rescheduled to 16 September 2026 (T5 — lead only, re-check against the Committee's own record before use). DEA Secretary Ajay Seth said in February 2025 the paper was being "recalibrated" because "several countries changed their position." The Parliamentary Standing Committee on Finance noted the draft Securities Markets Code 2025 is "technology-neutral," allowing "tokenised versions of existing securities... to remain within the ambit of securities regulation," a signal that tokenised securities are treated as securities rather than crypto. STATUS: comprehensive policy UNADDRESSED.

FIU-IND and PMLA/VASP

VDA service providers became "reporting entities" under PMLA via the 7 March 2023 MoF notification; FIU-IND registration is mandatory, extending to offshore exchanges serving Indian users. FIU-IND imposed an ₹18.82 crore penalty (~$2.25m) on Binance in June 2024. The FATF-style "control or influence" test is embedded in the notification's activity list; non-custodial software providers that never take control of assets are, on the face of it, outside it, but this is untested and supervisory risk is high.

Tax

Under Section 115BBH, income from transfer of a VDA is taxed at a flat 30% plus 4% cess, with no deduction except cost of acquisition, no loss set-off, and no carry-forward; Section 194S imposes 1% TDS on transfers above ₹10,000 (₹50,000 for specified persons). For anything that is a VDA, this is effectively prohibitive for an institutional book. The VDA definition (s.2(47A)) was written for crypto-assets; a tokenised CD or corporate bond, being the same legal security or deposit as its conventional twin, should be taxed as that instrument, but the CBDT has issued no express clarification, so the classificatory risk is live. On GST, 18% applies in practice to platform services while the underlying asset transfer sits outside GST; a 28% rate was deliberated in 2022 but never enacted (the 18%-on-services point rests on advisory sources rather than a primary CBIC notification; treat as UNVERIFIED).

Legal foundations

Property. The Madras High Court held on 25 October 2025 in Rhutikumari v. Zanmai Labs that cryptocurrency "is a property, which is capable of being enjoyed and possessed... and capable of being held in trust," the first Indian judgment to expressly grant crypto property status. Persuasive, not binding nationally; a single-judge decision. Evidence. Under the Bharatiya Sakshya Adhiniyam 2023 (ss.61-63), electronic and digital records are admissible with the s.63(4) certificate. Smart contracts. Enforceable in principle, since the Indian Contract Act 1872 is medium-neutral and the IT Act 2000 recognises electronic records; automatic/self-executing enforcement where code and natural-language terms diverge is unaddressed. Settlement finality. UNADDRESSED: the PSS Act 2007 confers finality on RBI-designated systems only. Ledger-as-register. UNADDRESSED: the Depositories Act 1996 contemplates a depository. DPDP interaction. The right to erasure (s.12) and consent-withdrawal (s.6(4)) sit in tension with immutable ledgers (penalties up to ₹250 crore per contravention); the standard workaround is off-chain personal data with on-chain hashes, though the transaction graph itself may be personal data on a public chain, which pushes back toward permissioned infrastructure for identifiable Indian data.

Comparative jurisdictions and the transplantable mechanism

• Singapore (MAS, Project Guardian): no new carve-out; tokenised instruments issue under existing securities law with settlement finality from the Payment and Settlement Systems (Finality and Netting) Act 2002. Most transplantable: extending a settlement-finality statute to a designated DLT system, which for India means amending the PSS Act 2007.
• EU (DLT Pilot Regime; MiCA): a time-limited exemption regime, under which DLT market infrastructures apply for targeted derogations from named CSDR/MiFID provisions for up to 6 years. Most transplantable: a statutory power to grant named exemptions from settlement/depository law, which for India means a SEBI-administered exemption power under the Depositories Act / SCRA that SEBI does not hold.
• UK (Digital Securities Sandbox): under FSMA 2023, HM Treasury can temporarily disapply or modify named legislation to let FMIs test DLT. Most transplantable, and the cleanest fit: a primary-law power to create financial-market sandboxes that can disapply statute, delivered through an amendment to the RBI Act / SEBI Act or a dedicated FMI-sandbox Act. This is the key gap: no Indian regulator holds this power outside IFSC.
• UAE (ADGM): the DLT Foundations Regulations 2023 create a new legal entity type for token issuance. Lower priority for India's instrument-tokenisation case.
• US (GENIUS Act, Jul 2025): a federal licensing regime for fully-reserved payment stablecoins issued by banks or OCC-approved nonbanks. Maps onto the RBI's wholesale-CBDC-settled tokenised-deposit model; India is pursuing the CBDC route rather than a private-stablecoin licence, a deliberate divergence.
• Switzerland (DLT Act, 2021): created "ledger-based securities," a statutory security type whose legal register is the ledger. Most transplantable for curing India's ledger-as-register gap, through an amendment to the SCRA/Depositories Act.

Perimeter table

Gap analysis against each Module A "IN PRODUCTION" initiative

• BUIDL / BENJI (tokenised MMF on public chain): No domestically, given VDA tax/classification risk plus no recognition of a public-chain token as an MF unit. In IFSC: possible under the FME regime plus sandbox.
• JPMorgan Kinexys / deposit tokens: Partially, since the UMI tokenised-CD pilot is the analogue. Blocker: no settlement-finality statute for on-chain DvP, which Demat 2.0 works around by settling in wholesale CBDC inside RBI-designated infrastructure rather than by curing the gap.
• Citi Token Services / cross-border deposit tokens: No domestically (FEMA). In IFSC: the intended perimeter.
• HSBC Orion / sovereign digital bonds: No, since there is no ledger-as-register recognition and the G-Sec register is RBI's e-Kuber rather than a DLT.
• Broadridge DLR / Canton repo: Now partially permitted for the issuance leg, under Demat 2.0's sandbox; secondary trading and repo are not. The closest live analogues are SEBI's DLT covenant system and Demat 2.0. Blocker: still the absence of an EU-DLT-Pilot/UK-DSS-style exemption power, since a sandbox relaxation bounded to one pilot is not a statutory disapplication.
• Regulated payment stablecoins: No, given RBI policy preference for CBDC, no licensing framework, and active RBI opposition.

Disconfirming evidence

The five-times-delayed discussion paper is an explicit failure of inter-ministerial coordination, the clearest signal that cross-cutting tokenisation policy has no owner in India. RBI's own tokenisation officials disclaim legal readiness. The gulf between e-Rupee flow and stock (₹771 crore in circulation against hundreds of millions of transactions) signals limited standing usage after four years. The 2018 banking ban is a documented case where executive prohibition without proportionality failed in court. IFSC platforms still publish no volumes, and absence of usage figures is itself disconfirming of "adoption." Two of these weakened in September 2026: the CD pilot disclosed volumes, and the SEBI bond pilot shipped ahead of its own timeline. The legal gaps did not move.

Module close

1. Findings hardest to dismiss. SEBI's DLT covenant system is in production, mandatory, and gates ISIN activation (a circular plus vendor/NSDL adoption data); no crypto ban exists (Supreme Court, 4 Mar 2020); tokenised securities are treated as securities not crypto (Parliamentary Standing Committee on the technology-neutral Securities Markets Code); the binding constraints are unaddressed gaps not prohibitions (RBI's own fintech CGM); and IFSC already permits the technology layer under a notified 2025 regulation.
2. Strongest chart. Adoption of the SEBI DLT Security & Covenant Monitoring System, plotting issuers onboarded and secured ISINs as a share of the outstanding universe, from the Cognizant case study cross-referenced to NSDL's IPO disclosures. The only Indian dataset showing a DLT system in real production use.
3. Claims most likely to be challenged. "India has a blockchain system live in regulated finance" (SEBI circular + adoption figures); "SEBI and the RBI jointly put a permissioned, depository-owned tokenised-bond rail into live sandbox issuance settled in wholesale CBDC" (SEBI PR 56/2026, 10 Sep 2026; the challenge to expect is that a sandbox pilot is not production, which is correct); "tokenised securities are not taxed as crypto" (Standing Committee note; the gap is the absence of a CBDT carve-out, so flag as classificatory risk).
4. One-sentence summary. India has put one blockchain registry into mandatory production for corporate bonds and is piloting central-bank-settled tokenised deposits, but the legal plumbing that made tokenisation real elsewhere (settlement-finality recognition and a sandbox power to disapply old law) exists in India only inside GIFT City, not the domestic market.
5. What this module could not establish. The ₹-value on the DLT covenant platform (only issuer/ISIN counts exist); the RBI CD pilot's named participant banks, which remain undisclosed even though volumes are now partly public; whether the CBDT will treat tokenised securities as non-VDA, which Demat 2.0's structuring implies but does not settle; when Demat 2.0's secondary-trading and retail phases open, and on what terms; whether IFSCA's RWA framework will convert sandbox platforms to full licences; and whether the reported 18% GST-on-services is a formal CBIC instrument.