Resources Categories
INDUSTRY FACT FILE · BLOCKCHAIN, WEB3 & VIRTUAL DIGITAL ASSETS
Market Landscape and the Drivers of Cybersecurity Demand in Web3
The business, technology, regulatory, legal and statutory forces that create audit, testing, monitoring and investigation work for VDA exchanges, custodians, Web3 and DeFi projects and enterprise blockchain platforms.
|
In this document 1. Market landscape 2. Business drivers 3. Technology drivers 4. Regulatory drivers: FIU-IND, CERT-In, tax and DPDP 5. Legal and statutory drivers 6. How the drivers differ by organisation type 7. What this means for buyers and for Codec Networks |
1. Market landscape
India's digital asset market is regulated mainly through tax and anti-money laundering law rather than a dedicated licensing statute. The 30% tax and 1% TDS introduced in 2022 shaped trading behaviour, the March 2023 PMLA notification turned exchanges, brokers and custodians into reporting entities, and FIU-IND has used registration, penalties and website blocking to bring offshore platforms into the framework: by October 2025 the government reported 50 registered VDA service providers and notices to 25 offshore providers. In March 2020 the Supreme Court set aside RBI's 2018 circular restricting banking services to VDA businesses, but access to banking and payment partners remains a practical dependency, and partners run their own due diligence. Alongside the trading market, Indian developers build Web3, DeFi and gaming products for global users, enterprises and government run permissioned ledgers, and India's 2023 G20 presidency secured endorsement of the FSB's crypto-asset recommendations and the IMF-FSB synthesis paper.
Cybersecurity demand follows five pressures. Registration: FIU-IND's September 2025 circular, as reported, made a cyber security audit by a CERT-In empanelled auditor part of initial and continued registration, creating a recurring audit cycle. AML technology: the January 2026 Guidelines expect liveness checks, geo-tagging, real-time travel rule messaging, unhosted wallet monitoring and tamper-proof audit trails, all of which are systems that must be secured and tested. Theft: the WazirX and CoinDCX losses, and global thefts estimated by Chainalysis at more than US$3.4 billion in 2025, put custody, signing and hot wallet security on every Board agenda. Partners: banks, payment providers, liquidity venues and institutional clients ask for security evidence such as ISO 27001, SOC 2 and recent audit reports. Data: KYC and transaction records must be kept for five years under CERT-In's Directions while the DPDP Rules bring safeguards and breach intimation from May 2027. Most platforms and Web3 teams are lean and rely on external auditors, testers, SOC providers and forensic investigators for depth.
|
50 VDA SPs registered with FIU-IND (Oct 2025) |
25 Offshore VDA SPs sent FIU-IND notices (Oct 2025) |
₹1,016 crore e-rupee in circulation, March 2025 (RBI) |
Jan 2026 FIU-IND AML/CFT Guidelines for VDA SPs updated |
|
Market segment |
Landscape and buying behaviour |
Cybersecurity opportunity |
|
VDA exchanges |
A few large Indian platforms and offshore entrants registering with FIU-IND |
CERT-In empanelled audits, VAPT, wallet reviews, SOC, forensics |
|
Brokers and OTC desks |
Smaller firms with partner-venue accounts and operational wallets |
Wallet and secrets reviews, API testing, monitoring |
|
Custodians and wallet providers |
Specialist firms and in-house custody teams using MPC, multisig and HSMs |
Custody architecture, key ceremony and signing policy reviews |
|
Web3 and DeFi projects |
Venture-funded teams shipping contracts to global users |
Smart contract audits, fuzzing, upgrade and admin-key reviews |
|
NFT and gaming platforms |
Studios and marketplaces with large online communities |
Contract audits, app testing, community account and brand security |
|
Enterprise blockchain and tokenisation |
Enterprises, consortia and government platforms on permissioned ledgers |
Chaincode, node and certificate reviews, DPDP design reviews |
2. Business drivers
|
Business driver |
Buying trigger |
Relevant services |
|
Obtaining and keeping FIU-IND registration |
Registration and renewal require evidence, including a cyber security audit |
CERT-In empanelled audits, gap reviews, evidence packs |
|
Keeping banking and payment partners |
Partners run due diligence and ask for security and AML evidence |
ISO 27001, SOC 2 readiness, audit reports |
|
Winning institutional and enterprise clients |
Custody and tokenisation clients demand assurance |
SOC 2, custody reviews, penetration test reports |
|
Preventing and surviving thefts |
Large exchange hacks threaten solvency and trust |
Wallet reviews, red teaming, SOC, IR retainers |
|
Launching contracts and products safely |
Every deployment and upgrade can be exploited |
Smart contract audits, fuzzing, launch monitoring |
|
Protecting reputation and users |
Phishing, fake apps and impersonation target users |
Brand monitoring, takedown support, awareness |
|
Answering regulators and law enforcement |
FIU-IND, CERT-In and police requests need reliable records |
Log and record reviews, forensic readiness |
3. Technology drivers
|
Technology driver |
Exposure created |
Codec Networks opportunity |
|
Hot, warm and cold wallets |
Key theft, unmonitored operational wallets |
Custody architecture and wallet inventory reviews |
|
Multisig and MPC signing |
Tampered interfaces, blind signing, share compromise |
Signing policy, decoding and tooling assurance |
|
Smart contracts and upgrades |
Logic flaws, oracle manipulation, unsafe upgrades |
Smart contract audits, fuzzing, timelock reviews |
|
Bridges, nodes and RPCs |
Validator key compromise, node takeover, spoofed data |
Infrastructure VAPT, bridge and node reviews |
|
Exchange apps and APIs |
Account takeover, API key theft, broken authorisation |
Web, mobile and API testing, secure SDLC |
|
KYC, travel rule and analytics systems |
Data exposure, bypass of checks, vendor compromise |
Application testing, vendor assessments, DPDP reviews |
Figure 3: The four groups of drivers behind cybersecurity spending in blockchain, Web3 and digital assets.
4. Regulatory drivers: FIU-IND, CERT-In, tax and DPDP
|
Instrument |
Key requirements |
|
PMLA notification (7 March 2023) |
Exchange, transfer, safekeeping and issuer-related financial services for VDAs make providers reporting entities; client verification, records and suspicious transaction reports |
|
FIU-IND AML & CFT Guidelines (8 January 2026) |
Registration with FIU-IND; Principal Officer based in India; enhanced CDD with liveness and geo-tagging; real-time travel rule; unhosted wallet and mixer controls; tamper-proof audit trails; annual independent audit; monthly reporting |
|
FIU-IND registration circular (15 September 2025) |
As reported, a cyber security audit certificate from a CERT-In empanelled auditor for registration and continued registration |
|
CERT-In Directions (2022) and audit guidelines (2025) |
Six-hour incident reporting; 180-day ICT logs in India; five-year KYC and transaction records for VASPs, exchanges and custodian wallet providers; risk-based independent audits |
|
Income-tax Act VDA provisions |
30% tax on transfer income; 1% TDS on transfers; continued under the Income-tax Act 2025 from 1 April 2026 |
|
DPDP Act 2023 and Rules 2025 |
Safeguards, retention limits and breach intimation for user personal data; most obligations from May 2027 |
|
Confirm applicability Obligations depend on the VDA activities you perform for others, your FIU-IND registration, your role in tax deduction, the users and countries you serve, listing status and contracts. Confirm against the official instruments and your agreements. |
Figure 4: Legal and regulatory timeline shaping VDA and Web3 security, as of October 2026.
5. Legal and statutory drivers
|
Law or obligation |
Relevance |
Demand created |
|
PMLA, 2002 and PML Rules, 2005 |
Reporting entity duties for VDA service providers; penalties for non-compliance |
AML control reviews, record and log reviews |
|
Income-tax Act (1961 and 2025) |
VDA definition, 30% tax and 1% TDS |
Integrity of transaction and TDS records |
|
IT Act, 2000 |
Computer offences, website blocking and intermediary duties |
VAPT, incident response, takedown support |
|
IAMAI v RBI, Supreme Court (March 2020) |
Set aside RBI's 2018 banking restriction as disproportionate |
Banking partner due diligence remains a driver |
|
DPDP Act, 2023 and Rules, 2025 |
KYC and personal data of users |
Privacy programmes, data maps, safeguards |
|
Companies Act, 2013 and SEBI LODR (listed groups) |
Board risk responsibility; quarterly cyber incident disclosure |
Board reporting, incident records |
|
Contracts with banks, partners and custodians |
Security, audit and notification clauses |
Assurance reports, third-party reviews |
6. How the drivers differ by organisation type
|
Organisation type |
Dominant business drivers |
Dominant technology drivers |
Principal regulatory drivers |
|
VDA exchanges |
Registration, banking partners, trust after hacks |
Wallets, apps, APIs, cloud |
PMLA and FIU-IND, CERT-In, tax, DPDP |
|
Brokers and OTC desks |
Partner venues, institutional clients |
Operational wallets, API keys |
PMLA and FIU-IND, CERT-In |
|
Custodians and wallet providers |
Client assurance, insurance |
MPC, multisig, HSMs, apps |
PMLA safekeeping, CERT-In, contracts |
|
Web3 and DeFi projects |
Launch safety, investor diligence |
Smart contracts, oracles, bridges |
Activity-based PMLA, IT Act, overseas rules |
|
NFT and gaming platforms |
Community trust, brand |
Token contracts, game wallets |
Tax, IT Act, DPDP, gaming laws |
|
Enterprise blockchain and tokenisation |
Client and regulator acceptance |
Nodes, chaincode, certificates |
Sector rules, CERT-In, DPDP, contracts |
7. What this means for buyers and for Codec Networks
|
Customer buying need |
Recommended offering |
Natural recurring engagement |
|
“We need a CERT-In empanelled audit for FIU-IND registration.” |
CERT-In empanelled cyber security audit with gap closure |
Annual audit cycle with quarterly checks |
|
“Our bank partner wants evidence of our security.” |
ISO 27001 readiness, VAPT and SOC 2 readiness |
Annual assurance programme |
|
“We are about to deploy or upgrade a smart contract.” |
Smart contract audit with fuzzing and upgrade review |
Audit of every release |
|
“We are not sure every wallet we control is monitored.” |
Wallet inventory, custody and signing policy review |
Continuous on-chain monitoring |
|
“Our multisig signers rely on a third-party interface.” |
Signing tooling assurance and decoding controls |
Periodic custody red team |
|
“The 2026 FIU-IND Guidelines changed our KYC and travel rule systems.” |
Application and control testing of KYC and travel rule flows |
Release-by-release testing |
|
“Funds have left a wallet and we do not know how.” |
Hack response, blockchain forensics and fund tracing |
IR retainer and SOC |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. It is not legal, tax, regulatory or investment advice, and nothing in it recommends or endorses any virtual digital asset, token, exchange or platform. Obligations differ by activity (exchange, transfer, safekeeping or issuer-related services), FIU-IND registration status, the users and countries served, listing status, contracts and the data each organisation handles; confirm them against the official Ministry of Finance, FIU-IND, CBDT, CERT-In, RBI, MeitY and Data Protection Board instruments and your agreements. Incident references are summarised from official statements and widely reported events; attributions are those made by the authorities or researchers named.