Blockchain & Web3 Development Company in Mumbai

On-ramp and reporting obligations dominate a Mumbai Web3 budget: a scoped smart-contract MVP at Mumbai BFSI rates (single-chain ERC-20, ERC-721, or ERC-3643 security token plus a minimal staking, vesting, or transfer-restricted contract, with one external audit and a testnet deployment), a production exchange or custody build in the CoinDCX or WazirX pattern, with INR on-ramp under PA-PG, full KYC and AML, FIU-IND STR and CTR wiring, Section 194S 1 percent TDS automation, Fireblocks or AWS Nitro Enclave custody, or a BFSI CBDC e-Rupee participating-bank wallet integration, with merchant acceptance, Hyperledger Besu or Quorum permissioned-ledger integration, RBI inspection documentation, and end-to-end SOC integration. RWA tokenisation programmes pre-positioned for IFSCA GIFT City or SEBI security-token listing depend on the issuance volume and on-chain identity scope. Mumbai BFSI rates sit at a small premium to Bangalore because of the regulator-proximate compliance work. Fixed-fee proposals only.

The WazirX July 2024 hot-wallet exploit, which drained approximately USD 235M and triggered moratoriums, customer disputes, and the ongoing Binance-WazirX ownership case, reset operational expectations across the Indian VDA industry. Codazz exchange and custody builds since the incident default to Fireblocks or equivalent multi-party computation (MPC) custody, hardware-wallet-only signing (Ledger Enterprise or YubiHSM 2), explicit withdrawal-address allowlists with cooling-off periods on new additions, transaction simulation against a forked mainnet before broadcast, real-time anomaly detection on signer behaviour (off-hours signing, unusual destination, unusual amount, unusual chain), operational separation between cold custody and hot operations including separate teams and separate access paths, mandatory four-eyes (and on critical amounts six-eyes) signing, and a documented dry-run incident-response exercise on a 90-day cadence. Every Mumbai exchange or custody engagement now ships with the post-WazirX hardening checklist baked into the architecture and explicitly referenced in the documentation.

Yes. HDFC Bank, ICICI Bank, SBI, Axis Bank, Yes Bank, IDFC First, Kotak Mahindra, Union Bank, and other participants are active in the RBI Digital Rupee (e-Rupee) Wholesale pilot (launched November 2022) and Retail pilot (launched December 2022). We have shipped CBDC wallet integrations and merchant-acceptance flows under the participating-bank programmes, with explicit alignment to the RBI's programmable-money constructs: purpose-bound payments (the use case can be encoded into the token itself, for example a subsidy that can only be spent on fertiliser), expiry-bound payments (the token self-extinguishes after a set window), and multi-tier issuance (the token is issued by RBI, distributed by participating banks, used by retail). Non-participating-bank clients can either join the pilot through a participating-bank partnership or pre-position infrastructure to onboard once the pilot expands. We do not white-label or simulate CBDC functionality outside the official pilot scope.

SEBI has issued draft frameworks on tokenised securities (including the 2024 consultation paper on tokenisation of securities), and the IFSCA in GIFT City has issued the framework for issuance and listing of security tokens in 2024. For Mumbai issuers, the practical path is either a domestic listing under the eventual SEBI framework or an IFSCA GIFT City listing under the existing IFSCA Security Token rules. We build the on-chain issuance layer using ERC-3643 (T-REX) for compliant transferable tokens, with on-chain identity verification under ONCHAINID (or an equivalent KYC-gated allowlist), operator-controlled transfer restrictions that enforce eligible-investor rules and lock-up periods, dividend and corporate-action distribution mechanics in the ERC-4626 vault or a custom security-token registrar pattern, and a registrar-and-transfer-agent integration where CDSL or NSDL is involved. The legal wrapper goes through SEBI or IFSCA counsel, the technology and operational controls go through us, and the resulting filing pack is one your regulator can route without three rewrites.

Operating a VDA exchange in Mumbai is legal but heavily regulated. The Supreme Court's March 2020 ruling in Internet and Mobile Association of India v. RBI struck down the 2018 RBI banking ban, so VDA service providers can operate, but the RBI still strongly discourages direct INR-crypto bank rails, and most exchanges run INR on-ramps through Payment Aggregator partners under RBI PA-PG scope. VDA income is taxed at a flat 30 percent under the Finance Act 2022, no loss set-off is permitted, and a 1 percent TDS under Section 194S applies. The PMLA amendments of March 2023 brought VDA service providers under FIU-IND reporting, requiring STR and CTR filings and a designated Principal Officer. CERT-In 2022 directions impose five-year log retention and a six-hour incident-reporting clock. The Mumbai zonal teams of FIU-IND and the income-tax department scrutinise VDA operators with particular granularity. We scope your engagement against that real regime.

Yes. Mumbai-headquartered conglomerates (Reliance, Tata Group, Mahindra Group, Adani Group, Larsen and Toubro) and their banking partners (HDFC, ICICI, SBI, Yes Bank) run trade-finance, supply-chain, and procurement programmes at volumes where tokenisation produces measurable working-capital savings. We build in the (now-shuttered) TradeLens and Marco Polo Network reference pattern: permissioned Hyperledger Besu or R3 Corda networks for the document-and-state layer, ERC-1155 or custom registrar tokens for the invoice or warehouse-receipt instrument, integration with the partner bank's core banking system for the disbursement and settlement legs, and operator-allowlist logic that enforces eligible-counterparty rules under RBI Master Direction on KYC and FEMA cross-border rules where the trade crosses borders. The result is a working-capital programme that survives an RBI inspection, a CAG audit if the conglomerate is government-adjacent, and the conglomerate's own internal-audit team.

Section 194S of the Income Tax Act 1961, introduced in Finance Act 2022 and effective from 1 July 2022, requires a 1 percent TDS deduction at source on transfer of any Virtual Digital Asset where the consideration exceeds INR 10,000 (specified persons) or INR 50,000 (other categories) in a financial year. For a Mumbai exchange or broker, the obligation to deduct, deposit, and report falls on the platform, and the Mumbai investigation circles of the income-tax department scrutinise this with high granularity. We build that into the matching engine and withdrawal pipeline directly: every transfer above the threshold automatically deducts 1 percent against the user's PAN, deposits TDS with the government within the statutory window, generates Form 16A certificates, feeds quarterly Form 26Q filings, and reconciles against the 26AS register. We also build an unmatched-PAN exception queue, an Aadhaar-PAN-mismatch flagging path, and a high-volume-trader Section 194S compounded-threshold tracker so the finance team can clear edge cases before quarter-close rather than during inspection.

Bridge and oracle attacks are the largest single category of value lost in Web3, and Mumbai BFSI participants cannot absorb that risk profile. Our design defaults: avoid bridges where the protocol can be designed as native multi-chain (LayerZero OFT, Wormhole NTT, Chainlink CCIP for verified-call patterns), require multi-oracle aggregation with explicit outlier-rejection logic (Chainlink primary with Pyth or RedStone secondary, with a circuit-breaker that pauses critical functions if oracle deviation exceeds a configured threshold), use price-time-weighted oracle feeds rather than spot reads where the protocol can tolerate a small finality delay, scope formal verification (Certora or Halmos) for any contract that depends on oracle input for a state transition, and explicitly model the cross-chain message security profile in the protocol's threat model rather than treating bridges as opaque dependencies. For BFSI permissioned-ledger deployments, the bridge problem mostly does not arise, but the oracle problem does, and we treat it with equivalent rigour.