Financial Cyber Crime in the Emerging Web3 Ecosystem: Evaluating the Adequacy of India's Cyber Law Framework

Web3 technologies have evolved the structure of financial crimes. Financial cybercrime is now taking the shape of a category of crimes based on disintermediation, pseudonymity and cross-border movement with the support of cryptocurrencies, non-custodial wallets, decentralised exchanges, smart contracts, non-fungible tokens, and decentralised autonomous organisations. “This paper seeks to answer this question in respect of the Indian Cyber law. It looks at the Information Technology Act 2000, Bharatiya Nyaya Sanhita 2023, Prevention of Money Laundering Act 2002, Bharatiya Sakshya Adhiniyam 2023 and Bharatiya Nagarik Suraksha Sanhita 2023 and questions if they are sufficient to prevent, investigate, prosecute and remedy financial crime committed using Web3. It has taken a doctrinal approach, with comparisons drawn to the Markets in Crypto-Assets Regulation of the European Union and Payment Services Act of Singapore, and drawn on the guidelines of the Financial Action Task Force. The relevant Web3 crimes are aligned to the existing legislation to see the extent of existing law's reach, such as wallet compromising, phishing, rug pulls, smart contract exploits, ransomware, and layered money laundering. A combination of technology agnostic offences and a perimeter not yet defined for AML make India's framework workable with several legal gaps yet to be addressed. No legislation exists today explicitly related to virtual assets, and the jurisdiction and legal responsibility are not well defined. Laws are also not explicit about the existence of decentralised and autonomous code-based actors. Further, international cooperation and legal frameworks for the tracing and recovery of digital assets are still underdeveloped, which makes it difficult to do. These gaps have a real-time sense of urgency because the National Cyber Crime Reporting Portal data indicate that the financial fraud losses reported have increased significantly in 2022–2024. The paper conclude that India’s current legal framework can respond to harm after it occurs, but it does not yet fully regulate the virtual asset ecosystem that can create such risks. This paper therefore suggests introducing a dedicated law for virtual digital assets, strengthening specialised agencies to investigate cyber-financial crimes, improving international cooperation in line with FATF Recommendation 15, and learning from the regulatory approaches followed by the European Union and Singapore.