ED’s 5000 Crore Cryptocurrency Investigation: Mudrex, Saber.Money, Instadapp And Fluid Under Scrutiny Over Alleged FEMA Violations
The Enforcement Directorate conducted searches on 27 October 2026 at four premises linked to cryptocurrency platforms as part of a major investigation into alleged violations of the Foreign Exchange Management Act, 1999 (FEMA). Three of the locations were in Bengaluru and one in Madhya Pradesh. The searches were carried out under Section 37 of FEMA by the Bengaluru Zonal Office of the agency. A detailed press release issued by the Enforcement Directorate on 29 October 2026 outlined the findings of the probe, which centres on two distinct but related sets of alleged financial irregularities involving virtual digital assets.
The first strand of the investigation concerns Mudrex and Saber.money, platforms operated by Bengaluru-based RPFAS Technologies Private Limited. The Enforcement Directorate has alleged that these platforms were used to facilitate unauthorised cross-border transfers of money through cryptocurrency, particularly stablecoins such as USDT and USDC, thereby bypassing channels authorised by the Reserve Bank of India. According to the agency, the investigation has identified unauthorised cryptocurrency balances on foreign platforms exceeding ₹4,600 crore.
The second strand involves Instadapp and Fluid, a decentralised finance protocol associated with a group of overseas companies that the Enforcement Directorate alleges were controlled and operated from India. In this case, the agency has claimed that revenue and investor funds were received in stablecoins, converted through Singapore-based cryptocurrency trading platforms, routed through overseas corporate entities and subsequently brought into India under the description of software development and consultancy fees. The preliminary alleged FEMA contravention in this matter stands at approximately US$40 million.
The Enforcement Directorate’s press release described a wider pattern involving foreign corporate entities, large over-the-counter cryptocurrency transactions, foreign crypto exchanges, overseas bank accounts, stablecoin wallets and expenditure incurred outside India using cryptocurrency. The two investigations are separate. The first focuses on the alleged use of crypto infrastructure to facilitate cross-border money transfers. The second concerns the alleged international corporate and financial structure through which a DeFi business’s revenues and investor funds were received, converted and distributed. The combined financial exposure is approximately ₹4,940–5,000 crore, depending on the exchange rate applied to the US$40 million component.
These are preliminary findings and allegations made by the Enforcement Directorate. The press release does not establish that the entire amount represents proceeds of crime, customer losses, money laundering or a finally adjudicated FEMA liability. It also does not announce arrests, a final adjudication order or a conviction.
RPFAS Technologies Private Limited stands at the centre of the first investigation. Corporate records identify the company as having been incorporated on 10 January 2018 with the Registrar of Companies, Bengaluru. Its Corporate Identification Number is U74999KA2018PTC109384. The registered address listed in available records is 257, 16th Cross, 5th Main Road, Sector 6, HSR Layout, Bengaluru 560102. Authorised capital is shown as ₹5 lakh and paid-up capital as ₹1 lakh. Directors identified in corporate databases include Edul Mehernosh Patel and Alankar Saxena. The company’s Legal Entity Identifier is recorded as 648800GQ8KMSOD10XE25.
Mudrex is described by the Enforcement Directorate as a cryptocurrency investment and trading platform operated by RPFAS Technologies. The platform’s own public materials present it as a US-headquartered and Bengaluru-based fintech startup launched in early 2018. It claims more than three million users and identifies Edul Patel as its chief executive officer. The same materials list Saber as a business for which Patel also serves as chief executive. Mudrex’s website refers to an Indian FIU registration and certain overseas registrations. An FIU registration, however, is not equivalent to RBI authorisation to operate a cross-border remittance or payment system. This distinction forms one of the central regulatory questions raised in the investigation.
Saber.money is identified by the Enforcement Directorate alongside Mudrex as a platform operated by the same company. The agency’s concern is not limited to the facilitation of cryptocurrency trading. The core allegation is that the infrastructure of these platforms was being used to facilitate cross-border transfers of money through virtual digital assets without compliance with the applicable foreign exchange and remittance framework. A cryptocurrency trading platform, an authorised payment system operator, an RBI-authorised foreign exchange dealer and a cross-border remittance intermediary are not automatically the same category of regulated entity. Permission or registration for one activity does not automatically confer permission for the others.
According to the Enforcement Directorate, the investigation into RPFAS Technologies was initiated following complaints alleging large-scale FEMA violations. Discreet enquiries and intelligence gathering followed. The agency reported identifying a system through which stablecoins, particularly USDT and USDC, were being used for international transfers of money. The arrangement, as described by the Enforcement Directorate, enabled funds to move across borders without passing through the authorised banking and remittance channels required under the regulatory framework.
Three aspects of the allegation are highlighted. First, the company was openly advertising instant cross-border money transfers using cryptocurrency despite not being authorised by the RBI for the relevant payment activity. Second, the platforms allegedly enabled users to convert conventional currencies into cryptocurrency and subsequently convert cryptocurrency back into conventional currency. Third, overseas entities and cryptocurrency exchanges were used to facilitate these transfers. USDT and USDC are specifically named as the stablecoins employed in the alleged arrangement.
The Enforcement Directorate described a four-stage process in relation to the Mudrex and Saber.money operations. A person wishing to transfer money registers on the platform. The sender deposits the money into the company’s bank account. The company uses the deposited money to purchase virtual digital assets, particularly stablecoins such as USDT. The virtual digital asset is then sold in India on Indian cryptocurrency exchanges, and the sale consideration is remitted to the intended receiver. This is the sequence set out by the agency. The actual flow of funds, counterparties, wallet addresses and settlement records would need to be established through transaction-level evidence.
Traditionally, an international remittance involves regulated financial intermediaries, banking channels, documentation, transaction purposes and applicable reporting requirements. A person in India sending money abroad through an authorised dealer is required to comply with foreign exchange rules and provide the necessary information. The Enforcement Directorate’s allegation is that cryptocurrency was used as an alternative settlement mechanism. In such a structure, economic value can move across borders even if a conventional banking remittance does not take place in the ordinary way.
The critical legal question is whether the underlying foreign exchange transaction, payment activity and settlement were undertaken in compliance with FEMA and the RBI’s applicable authorisation and reporting requirements. A stablecoin transaction does not automatically become illegal simply because it crosses a national border. The relevant analysis depends on the nature of the transaction, the persons involved, their residency, the underlying purpose and the applicable permissions. The Enforcement Directorate’s case is that the arrangements under investigation crossed those regulatory boundaries.
USDT, or Tether, is a stablecoin designed to maintain a value close to one US dollar. USDC is a US dollar-linked stablecoin issued by Circle. Unlike Bitcoin, which can experience substantial price fluctuations, stablecoins are designed to maintain a relatively stable value, commonly by maintaining a one-to-one relationship with a fiat currency such as the US dollar. This characteristic makes them useful for transferring value. A user can purchase USDT in one country, transfer the tokens to a wallet in another country, and the receiver can sell those tokens for local currency with the proceeds credited to a bank account.
The transfer of the digital asset can take place through blockchain infrastructure without the same conventional bank-to-bank transfer mechanism used in traditional remittances. This is why stablecoins have become significant in international financial investigations. They can offer speed and convenience but can also create regulatory and monitoring challenges when the identity of the sender, recipient, underlying transaction purpose, source of funds or final beneficiary is not adequately established. In the present case, the Enforcement Directorate specifically alleges that stablecoins were used to bypass authorised channels for cross-border money transfer.
One of the more serious aspects of the first investigation, according to the Enforcement Directorate, is the alleged use of foreign corporate entities. Searches revealed the use of shell entities, particularly companies incorporated in Canada, Lithuania and the United States. The agency also identified the use of foreign cryptocurrency trading platforms, including Binance and Bybit. These entities and platforms were involved, according to the Enforcement Directorate, in the alleged unauthorised movement of funds across borders. Large-volume over-the-counter deals were undertaken and foreign cryptocurrency balances were maintained by the entity.
There can be legitimate reasons for an Indian technology or cryptocurrency business to establish overseas subsidiaries, including international expansion, foreign investment, overseas licensing, banking arrangements and commercial operations. The legal position changes when an overseas entity is allegedly used as a conduit for financial transactions that are controlled and operated from India but structured to avoid Indian foreign exchange requirements.
Questions that arise include who incorporated the overseas companies, who their shareholders and beneficial owners are, who controls their bank accounts, who has custody of the cryptocurrency wallets, where the actual decision-makers are located, where the employees and operational teams are located, what the commercial justification for each overseas entity is, whether the transactions were reported under applicable FEMA requirements, whether the entities were acting as independent counterparties or merely as intermediaries, and whether the transactions were supported by genuine underlying commercial activity.
The Enforcement Directorate’s press release does not provide the names of the Canadian, Lithuanian or US entities associated with RPFAS Technologies, nor does it provide their corporate registration numbers, addresses or directors.
Binance and Bybit are specifically named as foreign-based cryptocurrency trading platforms on which the entity allegedly undertook cryptocurrency purchase and sale transactions. Substantial cryptocurrency assets were held on foreign platforms in alleged violation of FEMA provisions, according to the agency.
Questions that arise include whose accounts were used, whether the exchange accounts were held in the name of RPFAS Technologies, its overseas subsidiaries, associated companies or individuals, who controlled the wallets, whether the wallets were operated directly by Indian-based personnel, foreign subsidiaries or independent third parties, what the source of the funds was, whether the cryptocurrency balances were acquired using Indian bank deposits, foreign receipts, customer funds or corporate funds, and what happened to the proceeds.
The Enforcement Directorate’s release does not answer these questions in transaction-level detail. The mere mention of Binance and Bybit does not establish that either exchange has been accused of participating in the alleged FEMA violations. The press release does not announce enforcement action against either exchange.
The figure of more than ₹4,600 crore is described by the Enforcement Directorate as a preliminary finding concerning contravention of FEMA through unauthorised cross-border money transfer and unauthorised crypto balances in foreign platforms. The agency identifies the amount in connection with these alleged activities. It does not publish a transaction-wise ledger, the total number of transactions, the period over which the transactions occurred, the number of customers involved, the number of overseas recipients, the number of foreign bank accounts, the wallet addresses, the total cryptocurrency holdings by token, the division between customer funds and company funds, the total value of cryptocurrency bought and sold, the value of transactions that were reversed or cancelled, or the final amount adjudicated as a FEMA contravention.
There is an important accounting distinction between a transaction volume, an outstanding crypto balance, the gross value of transfers and the value of a finally established contravention. These are not necessarily the same thing. If money moves through a system multiple times, the aggregate transaction volume may exceed the original underlying funds. An exchange balance is not automatically equivalent to an equal amount of unlawful remittances. Consequently, the ₹4,600-crore figure is reported as the Enforcement Directorate’s preliminary estimate of the alleged FEMA-related exposure, not as an established loss or a confirmed amount of illicit money.
The second part of the investigation concerns Instadapp and Fluid. Instadapp is described as a decentralised finance protocol built on the Ethereum blockchain, designed to allow users to interact with crypto lending, borrowing and token-swapping services. Unlike the Mudrex investigation, which primarily concerns the alleged facilitation of cross-border money transfers, the Instadapp investigation concerns how the income and investor funding of a decentralised finance business were received, held, converted and routed through several overseas companies.
The Enforcement Directorate describes Instadapp as a DeFi smart protocol deployed on the Ethereum blockchain. The protocol provides smart contracts through which users can undertake lending of cryptocurrency, borrowing of cryptocurrency, swapping of one cryptocurrency for another, managing digital asset positions and interacting with decentralised financial applications. The platform was started in 2018 and now operates largely under the name Fluid.
It generates revenue through fees associated with lending, borrowing and token-swapping activities. Open-source information cited by the Enforcement Directorate indicates that the platform has more than US 1billion in crypto assets and approximately US 149 million in cumulative fees. Crypto assets held or managed through a protocol should not automatically be treated as assets owned by its founders or operating company.
Fluid is identified as the name under which the Instadapp business now largely operates. The investigation is not merely about an Indian cryptocurrency exchange or a platform providing an ordinary remittance facility. It concerns a business that presents itself as a decentralised, blockchain-based financial protocol while the Enforcement Directorate alleges that the actual management and development activities are conducted from India.
This creates a jurisdictional question. If a business is incorporated abroad, receives international investment, earns revenue in cryptocurrency and maintains wallets and overseas bank accounts, but its founders, developers and operational management are located in India, the applicable Indian foreign exchange obligations come into focus. The Enforcement Directorate’s investigation is examining this issue. The agency alleges that the foreign corporate structure did not reflect the actual location of the business’s operations and management.
The Enforcement Directorate’s press release specifically identifies Sowmay Jain as one of the founders. Other reporting identifies the founders as two brothers, Sowmay Jain and Samyak Jain. The most significant statement in the press release is that Instadapp and Fluid were projected by their founders as a foreign, US-based, decentralised business, but the evidence gathered during searches allegedly indicated that the business was managed from India by Sowmay Jain. The agency further alleges that the founders operated a number of overseas corporate entities which did not have physical offices or employees at their places of registration.
A company can legitimately be incorporated in Delaware, Singapore, Dubai or the British Virgin Islands while its founders and software developers work from another country. That fact, by itself, does not make the corporate arrangement unlawful. The relevant questions are whether the structure was genuine, where the effective management and control were exercised, how the foreign income was earned, how the funds were received, what services were actually provided and whether the transactions complied with Indian foreign exchange requirements. The Enforcement Directorate’s allegation is that the overseas companies were essentially paper entities used to route income earned through a business managed from India.
The agency identifies five foreign entities allegedly associated with the Instadapp founders. These are Instadapp Labs Inc in Delaware, United States; Interop Labs Ltd and Summerspeak Ltd in the British Virgin Islands; Upsurge Labs Pte Ltd and Bhindi Labs Pte Ltd in Singapore; and Pebble Labs Technology Ltd in Dubai, United Arab Emirates. There is a naming discrepancy in the press release.
In one section the US-registered company is described as Instadapp Labs LLC, Delaware. In the subsequent list of associated entities it is called Instadapp Labs Inc. The legal identity and exact registration form would need verification against the Delaware corporate registry. The press release does not provide the company registration numbers, incorporation dates, directors, shareholders or ultimate beneficial ownership particulars of these five companies.
Delaware is a major US corporate incorporation jurisdiction. Companies often register there because of its established corporate law framework. The question in this investigation is whether the Delaware entity had actual commercial and operational substance. The British Virgin Islands is a major international offshore corporate jurisdiction, frequently used for international holding companies, investment structures and special-purpose vehicles.
Singapore is a major international financial centre with an established banking and digital asset ecosystem. Dubai is another important international financial and business centre. The presence of companies in these jurisdictions does not independently establish wrongdoing. What matters is the actual role of each entity in the financial transactions under investigation.
The Enforcement Directorate states that the searches revealed that the overseas companies did not have physical offices or employees at their respective places of registration. It further alleges that these companies were acting as fronts for routing foreign-currency income to India. This raises the possibility that the overseas corporate structure was being used to create a distinction between the apparent location of the business and its actual place of operation. The agency’s position is that the entire DeFi protocol and associated activities were managed from India.
Questions that arise include where the software developers were located, where the management decisions were taken, whether the overseas entities were actually providing services, who controlled the overseas companies, and whether the overseas companies were merely holding entities or operational businesses. The Enforcement Directorate’s allegation is that the entities had no meaningful physical or employee presence and were being used to route income. This would need to be tested against actual corporate and financial documentation.
The alleged financial routing mechanism involving approximately US$40 million is described in detail by the Enforcement Directorate. Revenue and investor funding generated through the Instadapp DeFi protocol and funds raised from investors were received in stablecoins. The stablecoins were deposited into multi-signature wallets associated with Interop Labs Ltd of the British Virgin Islands. According to the Enforcement Directorate, the wallets were controlled by persons based in India.
The stablecoins were sold through Independent Reserve Singapore and QCP Capital, Singapore. The fiat proceeds were credited to accounts held by Upsurge Labs Pte Ltd and Bhindi Labs Pte Ltd. Money was then remitted to India as payments for software development and consultancy fees that the agency alleges were bogus. Prepaid cards issued by Singapore-based banks were allegedly used to pay expenses of Indian-based entities. Funds from Singapore bank accounts were also routed to bank accounts of the founders in Dubai.
The sequence is based on the Enforcement Directorate’s description. The release does not disclose individual wallet addresses, bank account numbers, transaction dates or beneficiary-wise amounts. Revenue generated from platform activities and capital received from investors have different accounting and legal characteristics.
Investigators would need to establish the identity of each investor, the amount invested, the date of each investment, whether the investment was made in stablecoins, the valuation applied to the tokens, the legal entity that received the investment, whether the investor received equity, tokens or another contractual entitlement, and how the investment proceeds were subsequently used. The press release does not disclose these particulars.
A multi-signature wallet is a cryptocurrency wallet that requires multiple authorised signatures or approvals before a transaction can be executed. This arrangement can be used to improve security and prevent unilateral access to funds. It also creates an investigative opportunity.
The Enforcement Directorate can potentially establish who the authorised wallet signatories were, which individuals possessed the private keys, from which countries they operated, which devices were used to access the wallets, who approved individual transfers, which wallets received the tokens, and whether the wallet controllers were employees, founders or third-party service providers. The agency specifically states that the wallets were controlled by persons based in India. That assertion is central to its allegation that the overseas corporate structure was being managed from India.
The Enforcement Directorate alleges that stablecoins were sold through Independent Reserve Singapore and QCP Capital. The proceeds were subsequently credited to bank accounts belonging to the two Singapore companies. This is an important conversion point in the alleged transaction chain. The original revenue and investment funding were received in cryptocurrency.
The Singapore trading platforms were allegedly used to convert those digital assets into fiat currency. Questions that arise include whether the accounts were held in the names of the two Singapore companies, who the authorised users of those accounts were, what the total value of stablecoins sold through each platform was, what the actual fiat currency received was, whether the transactions were conducted through ordinary exchange trading or over-the-counter arrangements, whether the exchanges were provided with complete information about the beneficial owners and underlying transactions, and whether the transactions were supported by appropriate corporate documentation.
The mention of these platforms does not, by itself, establish that either platform committed an offence or knowingly participated in the alleged routing arrangement. The investigation concerns the entities and individuals allegedly using this financial structure.
The allegation concerning software development and consultancy payments is one of the more consequential elements of the press release. The Enforcement Directorate alleges that money held in the Singapore bank accounts was routed to India as remittances for software development and consultancy fees that were bogus. Software development and consultancy are legitimate commercial services. An Indian technology company can lawfully receive payments from a foreign client for genuine services. However, if money is transferred under the description of a service payment without the underlying service actually being provided, the transaction could potentially be used to disguise the actual purpose of the remittance.
The evidence required to establish such an allegation would include software development contracts, consultancy agreements, invoices and payment instructions, actual software deliverables, source-code repositories and development records, employee and contractor records, timesheets and project documentation, GST and income-tax records, bank statements and foreign remittance certificates, and correspondence between the Indian and Singapore companies. The Enforcement Directorate has not publicly identified the Indian recipient companies or quantified the amount paid to each of them.
The agency also alleges that prepaid cards issued by Singapore-based banks were used in India to meet expenses of Indian-based entities. This introduces another method of moving and using money across jurisdictions. A prepaid card can be funded through a bank or financial institution and then used to make payments to merchants. The allegation raises questions about whether expenses incurred in India were being paid directly using funds maintained outside India.
The agency would need to establish which banks issued the cards, who the cardholders were, who funded the cards, what the total amount spent was, which merchants received payments, whether the payments were made for corporate or personal expenses, whether the expenses were properly recorded in Indian company accounts, and whether applicable foreign exchange and tax requirements were complied with. The press release does not identify the Singapore banks or provide a transaction-wise list of card expenditures.
The final component of the Enforcement Directorate’s account concerns transfers from Singapore bank accounts to Dubai bank accounts belonging to the founders. This potentially connects the overseas corporate structure with the personal financial interests of the founders.
Questions that arise include how much money was transferred, which founder received the money, whether the transfers were made as dividends, salaries, consultancy payments, loans or some other category, whether the payments were made by a company or another intermediary, whether the recipients were the beneficial owners of the Singapore entities, whether the transactions were properly declared, and whether Indian foreign exchange and tax obligations were complied with.
The Enforcement Directorate has not published the individual beneficiary names, account numbers or amount-wise details. It would be incorrect to assume that the entire US$40 million was transferred to the founders personally. The release describes a broader set of alleged FEMA contraventions and multiple financial flows.
The preliminary FEMA contraventions identified in relation to Instadapp stand at approximately US40million.Thisisseparatefromthe₹4,600-crore Mudrex and Saber.money figure. Using illustrative exchange rates, US40 million is equivalent to roughly ₹340 crore at ₹85 per US dollar, ₹360 crore at ₹90 per US dollar, and ₹380 crore at ₹95 per US dollar. Some reporting has described the amount as approximately ₹380 crore. The Enforcement Directorate has not published the underlying calculation.
A meaningful financial breakdown would require details of DeFi protocol revenue received in stablecoins, total capital raised from investors, wallet holdings, value of cryptocurrency sold through Singapore platforms, amounts credited to each Singapore bank account, payments made to each Indian entity, total prepaid card expenditure in India, amounts credited to each founder in Dubai, and a transaction-wise quantified contravention. Without this breakdown, the US$40-million figure cannot be independently reconstructed.
The searches were conducted under Section 37 of the Foreign Exchange Management Act, 1999. This is significant because the present proceedings are not described as an ordinary criminal investigation under the Prevention of Money Laundering Act, 2002. They are FEMA investigations. Section 37 deals with the investigative powers of the Enforcement Directorate. It provides that the Director of Enforcement and other officers not below the rank of Assistant Director can investigate contraventions referred to in Section 13.
It also provides for the exercise of powers comparable to those conferred on income-tax authorities, subject to the applicable statutory limitations. In practical terms, it enables the Enforcement Directorate to investigate suspected contraventions of FEMA and exercise the relevant investigative powers. In this case, the agency conducted searches at four premises to obtain evidence concerning the alleged financial arrangements.
The searches can potentially yield corporate records, bank statements, accounting books, contracts, invoices, cryptocurrency exchange records, wallet access information, transaction histories, computer systems, email communications, internal communications, documents relating to foreign subsidiaries, and details of the beneficial ownership of overseas companies. The press release does not specify exactly what devices, records or assets were seized. Nor does it disclose whether any bank accounts or cryptocurrency wallets were frozen or restrained during the October searches. A search under Section 37 of FEMA is an investigative action and should not be described as an arrest, attachment or conviction.
The press release refers to Section 37 but does not provide a complete list of substantive provisions allegedly violated. Based on the nature of the transactions described, several provisions of FEMA are relevant to examine. Section 2(c) defines an authorised person. Section 3 places restrictions on dealings in foreign exchange and payments. Section 5 concerns current account transactions. Section 6 concerns capital account transactions.
Section 7 deals with the export of goods and services. Section 8 requires realisation and repatriation of foreign exchange. Section 10 concerns the duties and liabilities of authorised persons. Section 13 provides for penalties for contraventions. Section 15 provides for compounding of contraventions. These provisions would need to be examined against the individual transactions rather than treating every provision as an established charge.
Section 13(1) of FEMA provides for a penalty of up to three times the sum involved in the contravention where the amount is quantifiable. Where the amount is not quantifiable, the provision provides for a penalty up to ₹2 lakh. For continuing contraventions, a further penalty of up to ₹5,000 for every day after the first day may be imposed. Applying the statutory maximum of three times to the preliminary figures produces theoretical amounts of ₹13,800 crore for the Mudrex and Saber.money matter and ₹1,140 crore for an illustrative ₹380-crore Instadapp figure, for a combined illustrative amount of ₹14,940 crore.
These calculations must not be presented as the actual penalty facing the companies. Section 13 provides for a penalty of up to three times the sum involved in a contravention. The amount that is legally established, the persons responsible, the relevant transactions and any overlapping amounts would have to be determined through the statutory process.
The ₹4,600-crore figure may include cryptocurrency balances and transaction values. It is not yet a final adjudicated figure. Similarly, the US$40-million figure must be examined to determine which transactions actually constitute FEMA contraventions. There is no basis at this stage to claim that the Enforcement Directorate has imposed a ₹14,940-crore penalty.
FEMA contraventions are generally dealt with through civil adjudication and monetary penalties. The statutory framework provides for adjudication and, subject to the applicable conditions, compounding of certain contraventions. Under Section 15, a person who has committed a contravention may apply for compounding. The RBI’s compounding directions explain the process. This does not mean that a FEMA investigation can never be connected to criminal proceedings.
If investigators identify facts suggesting an independent offence under another statute, separate proceedings may arise, subject to that statute’s requirements. The Prevention of Money Laundering Act, 2002, has its own requirements, including the existence of proceeds of crime derived or obtained from criminal activity relating to a scheduled offence. A FEMA contravention does not automatically constitute money laundering under the Prevention of Money Laundering Act.
The Enforcement Directorate press release does not announce a Prevention of Money Laundering Act case, a scheduled offence, an attachment under that Act or an allegation that the entire ₹5,000 crore represents proceeds of crime. Therefore, the appropriate description of the present matter is an Enforcement Directorate investigation into alleged FEMA violations involving cryptocurrency-based cross-border financial transactions.
This is not the first time the Enforcement Directorate has investigated cryptocurrency-based cross-border transfers. The October 2026 investigation follows an earlier action in June 2026 involving five Bengaluru-based entities. On 17 June 2026 the Bengaluru Zonal Office conducted searches at six premises in Bengaluru under Section 37 of FEMA. The investigation covered Transak Technology India Private Limited operating Transak, Carretx Technologies Private Limited operating Carret, Mokshagna Technologies Private Limited operating Xpat formerly known as Remit2any, Buyhatke Internet Private Limited operating Onramp.money, and Abhibha Technologies Private Limited operating Onmeta.
The Enforcement Directorate alleged that these entities were facilitating cross-border transfers through cryptocurrency without the necessary RBI authorisation. The agency identified a modus operandi involving the collection of money, conversion into cryptocurrency, transfer through digital asset infrastructure and subsequent settlement.
In the case of Mokshagna Technologies, money was allegedly collected from customers in the United States, converted into virtual digital assets, transferred to Indian cryptocurrency platforms and subsequently sold through large-volume over-the-counter deals, with the proceeds credited to the company’s bank accounts and distributed to customers in India.
In the Transak Technology India case, money deposited into Indian company accounts was allegedly converted into cryptocurrency and subsequently sold, with the proceeds withdrawn outside India, and a related US entity was allegedly used to transfer operational profits. In the Carretx Technologies case, an arrangement involving customer deposits in Indian rupees, corresponding crypto credits and over-the-counter deals with foreign-based remittance applications was described.
The agency’s preliminary finding was that the alleged FEMA contraventions exceeded ₹2,500 crore. It also placed restraint orders on certain bank accounts used by some of the entities, with balances of approximately ₹6 crore. These findings are recorded in the Enforcement Directorate’s official June press release.
A comparison of the two investigations shows that the June searches took place on 17 June 2026 with a press release on 19 June 2026, covering six premises in Bengaluru and five companies with platforms including Transak, Carret, Xpat, Onramp.money and Onmeta. The main allegation concerned unauthorised crypto-based cross-border transfers, with a preliminary amount exceeding ₹2,500 crore and account restraints of approximately ₹6 crore disclosed.
The October searches took place on 27 October 2026 with a press release on 29 October 2026, covering three premises in Bengaluru and one in Madhya Pradesh, involving RPFAS Technologies and Instadapp-associated entities with platforms including Mudrex, Saber.money, Instadapp and Fluid. The main allegations concerned unauthorised transfers and alleged offshore income-routing structures, with a preliminary amount exceeding ₹4,600 crore plus US$40 million and no specific restraint amount disclosed in the press release.
The two investigations suggest that the Enforcement Directorate is examining whether cryptocurrency on-ramp and off-ramp providers are functioning as unregulated cross-border payment intermediaries. The issue is not limited to one cryptocurrency, one platform or one corporate structure. The agency’s attention is directed towards the larger financial infrastructure: who collects the money, who purchases the digital assets, where the assets are transferred, who converts them into conventional currency and who ultimately receives the proceeds.
The October investigation goes further by examining alleged offshore corporate arrangements, foreign bank accounts and the management of a decentralised finance business from India.
The Reserve Bank of India is relevant because the allegations concern cross-border foreign exchange transactions and the alleged operation of payment or remittance services without the required authorisation. Three separate regulatory questions arise. First, whether the entity is registered with FIU-IND. Virtual digital asset service providers operating within India’s anti-money-laundering framework have reporting and registration obligations under the Prevention of Money Laundering Act framework. Mudrex publicly identifies RPFAS Technologies as an FIU-registered entity.
Second, whether the entity is authorised to undertake the relevant payment or foreign exchange activity. An FIU registration does not automatically authorise a business to conduct all forms of international remittance or foreign exchange transactions. Third, whether the individual transactions are compliant with FEMA. Even a properly registered business must comply with the applicable foreign exchange laws and regulations when undertaking transactions falling within their scope.
This distinction is crucial to understanding the Enforcement Directorate’s allegation against RPFAS Technologies. The company may point to its regulatory registrations, but the question under investigation is whether the specific cross-border transactions complied with the applicable legal requirements. The same principle applies to the foreign corporate structures associated with Instadapp.
The Enforcement Directorate repeatedly highlights large-volume over-the-counter deals. In cryptocurrency markets, over-the-counter transactions are trades arranged directly between counterparties or through an intermediary rather than executed through the ordinary public order book of an exchange. These transactions are often used for large amounts because they can provide negotiated pricing, liquidity and settlement arrangements. However, they can also complicate financial tracing.
An investigator may need to identify the original buyer, the original seller, the beneficial owner of the digital assets, the intermediary, the wallet from which the assets originated, the receiving wallet, the fiat settlement account and the final beneficiary. An over-the-counter transaction does not inherently indicate illegality. The issue arises when the underlying transaction is allegedly being used to facilitate prohibited or unauthorised foreign exchange activity.
In the present case, the Enforcement Directorate says that the use of large-volume over-the-counter deals formed part of the alleged transaction structure. The agency’s June investigation also described over-the-counter transactions in the cases of Mokshagna Technologies and Carretx Technologies.
The Instadapp investigation raises a question that goes beyond cryptocurrency. It concerns the distinction between a company’s place of incorporation and the place from which its business is actually managed. Modern technology businesses frequently operate internationally. A company may be incorporated in the United States, raise funds from overseas investors, hold cryptocurrency in wallets controlled by individuals in India, maintain bank accounts in Singapore, have founders in India, employ developers in India, have associated companies in the British Virgin Islands, make payments through foreign financial institutions and hold assets in Dubai.
Such a structure is not automatically unlawful. However, the structure must comply with the relevant foreign exchange, tax, corporate, investment and reporting requirements. The Enforcement Directorate’s allegation is that the Instadapp corporate network used overseas entities without genuine physical or employee presence to route income generated through a business actually managed from India. This raises questions about the economic substance of the overseas companies and the actual purpose of the inter-company transactions. Suppose an Indian-based team develops and operates a software protocol. The business earns foreign revenue.
The revenue is received in cryptocurrency by a foreign company. The tokens are sold in Singapore. The proceeds are credited to a Singapore bank account. The money is then transferred to India as consultancy payments. The critical question becomes whether these are genuine payments for independently supplied services or merely a mechanism for routing the business’s own income. That is why the Enforcement Directorate’s allegation concerning software development and consultancy fees is significant.
It is not simply a question of where a company is incorporated. It is a question of what the company actually does, who controls it, who earns the income and how the income is ultimately distributed.
Although the five-page press release contains substantial information, it does not provide enough financial and corporate detail to reconstruct the entire investigation. Information still required includes the complete shareholding and beneficial ownership of RPFAS Technologies, current and former directors and key managerial personnel, complete transaction-wise details of the ₹4,600 crore, the precise operational and legal relationship of Saber.money with Mudrex, the names and registration numbers of the Canadian, Lithuanian and US entities, the account holders and beneficial owners of Binance and Bybit accounts, wallet addresses, token balances and transaction histories, counterparties and transaction-wise values of over-the-counter transactions, complete ownership and control of the overseas companies by the Instadapp founders, wallet addresses, signatories and beneficial ownership of Interop Labs, bank accounts, directors, shareholders and financial statements of the Singapore entities, names of Indian companies receiving consultancy and software payments, beneficiaries and transaction-wise amounts of Dubai transfers, identity and value of investor contributions, exact FEMA provisions allegedly contravened in each transaction, detailed seizure inventory and any restraint or freezing orders, and adjudication notices, orders and subsequent developments.
The absence of these details does not invalidate the Enforcement Directorate’s investigation. It does, however, limit what can presently be independently verified.
The October 29 press release does not announce any arrest, any prosecution complaint, any Prevention of Money Laundering Act attachment, any confiscation, any final FEMA penalty, any adjudication order, any seizure valuation or any freezing or restraint amount. This distinction is particularly important when reporting the investigation. A search under Section 37 of FEMA is an investigative action. The June 2026 investigation did disclose restraint orders on certain bank accounts containing approximately ₹6 crore. That earlier action should not be attributed to the October investigation.
There are several reasons why this investigation is significant. The scale of the alleged financial activity is substantial. The Enforcement Directorate’s preliminary figures exceed ₹4,600 crore in the Mudrex and Saber.money investigation and approximately US$40 million in the Instadapp investigation. This makes the case one of the significant publicly disclosed cryptocurrency-related FEMA investigations in India. The alleged use of cryptocurrency as a substitute for conventional international remittance infrastructure is another factor.
The Mudrex investigation highlights how stablecoins and on-ramp and off-ramp services can potentially be used to transfer value across borders outside the conventional authorised remittance channels. The alleged use of overseas shell companies is a further element. The Enforcement Directorate’s identification of companies in Delaware, the British Virgin Islands, Singapore and Dubai raises questions about beneficial ownership, corporate substance and the actual location of business management.
The alleged routing of money under the description of software and consultancy payments is particularly important because it concerns whether the overseas corporate structure was used to disguise the nature of the underlying transactions. Finally, the regulatory challenge presented by decentralised finance is relevant. The Instadapp investigation raises the question of how Indian authorities can establish jurisdiction and enforce foreign exchange regulations when the business operates through smart contracts, blockchain wallets and multiple overseas corporate entities.
The strongest investigative angle is not simply that the Enforcement Directorate conducted searches at cryptocurrency companies over alleged ₹5,000-crore violations. The larger question is whether Indian-based technology businesses were using international corporate structures, stablecoins and overseas financial accounts to move business income and customer money across borders without complying with the applicable Indian foreign exchange framework. The Mudrex and Saber.money allegations concern the alleged operation of a cross-border payment mechanism using stablecoins, overseas crypto platforms and over-the-counter transactions.
The Instadapp and Fluid allegations concern the alleged movement of revenue and investor funds through a network of overseas companies, Singapore bank accounts, Indian entities and founders’ Dubai accounts. These are two distinct financial arrangements, but they point towards a common regulatory challenge: the increasing ability of digital asset businesses to move economic value internationally without necessarily following conventional banking routes. There is also a substantial difference between the two cases in terms of the evidence disclosed. In the Mudrex case, the Enforcement Directorate has described a relatively straightforward transaction sequence involving deposits, crypto purchases, sales and settlement.
In the Instadapp case, the Enforcement Directorate has described a much more complicated corporate and financial arrangement involving multiple jurisdictions and allegations of commercial payments that were not genuine. The latter could potentially become a particularly important case concerning the treatment of overseas technology companies whose founders and operational teams are based in India.
Ultimately, the most important evidence will be the wallet transaction histories, foreign bank statements, corporate ownership records, contracts, invoices and the identity of the persons who actually controlled the overseas entities. Until these records are disclosed and the investigation reaches adjudication, the Enforcement Directorate’s findings must be treated as preliminary allegations rather than established violations.
Primary sources for further research include the Enforcement Directorate press release dated 29 October 2026, the Enforcement Directorate press release dated 19 June 2026 on the previous cryptocurrency investigation, the Reserve Bank of India’s FEMA compounding directions, and the Department of Revenue’s explanation of the broad scheme of FEMA.
Company and platform sources include Mudrex’s official company profile and regulatory disclosures, RPFAS Technologies company records, the Instadapp official website, the Fluid protocol website, the Delaware corporate registry, the Singapore corporate registry maintained by ACRA, and the British Virgin Islands Financial Services Commission. Independent reporting has appeared in The Indian Express, ThePrint, Moneycontrol, Inc42, PTI, and The New Indian Express.
The investigation remains at the stage of searches and preliminary findings. No arrests have been announced, no assets have been formally attached under the Prevention of Money Laundering Act in connection with this specific press release, and no final adjudication of the alleged FEMA contraventions has been reported. The two strands of the probe—one focused on alleged unauthorised cross-border transfers through Mudrex and Saber.money, and the other on the alleged offshore routing of revenues and investor funds through the Instadapp and Fluid corporate network—continue as separate but thematically linked inquiries into the intersection of cryptocurrency infrastructure and India’s foreign exchange regulatory framework.
