Crypto & Virtual Assets Compliance in Australia

Australia is open to crypto businesses, including fully online exchanges and custodians, but it regulates them twice: once for financial crime and once as financial services. AUSTRAC registers virtual asset service providers and enforces customer due diligence, reporting and the travel rule under the reformed anti-money laundering law that took effect on 31 March 2026. ASIC licenses the many crypto products that are financial products; in June 2026 the High Court confirmed that a crypto yield product was one.

The biggest obstacle for a new entrant is timing. AUSTRAC registration can take up to 90 days and must be in place before trading, an ASIC licence is likely to be needed as well, and the new platform licence regime is close behind.

1. Who regulates this sector

The Australian Taxation Office (ATO) administers crypto tax; draft legislation would require registered VASPs to report Australian users' transactions from 1 July 2027 to it.

2. Licensing and authorisation

AUSTRAC registration (mandatory for every provider)

Under section 76A of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act, Compilation No. 63, 1 October 2026), a person must not provide a "registrable virtual asset service" unless registered as a virtual asset service provider (VASP). These are crypto-to-fiat exchange (item 50A in table 1 of section 6), crypto-to-crypto exchange (50B), custody (46A), services connected with a token offer the business participates in (50C), and sending or receiving virtual asset transfers for customers. Financial institutions and casinos are excluded. Operating unregistered is a strict-liability offence of up to 2 years' imprisonment or 500 penalty units, rising to 7 years or 2,000 penalty units for repeat breaches, and a civil penalty provision. Applicants enrol and apply through AUSTRAC Online; AUSTRAC may take up to 90 days, can approve with conditions or refuse, and registration lasts three years. Changes must be notified within 14 days. The application must describe the assets, delivery channels, transaction limits, expected volumes and every wallet the applicant controls (AML/CTF Rules 2025, rule 4-14).

ASIC financial services licensing

Classification turns on each token's rights. ASIC's Information Sheet 225 (INFO 225) says bitcoin is unlikely to be a financial product, but certain stablecoins are likely non-cash payment facilities, many wrapped tokens are likely derivatives, yield-bearing products may be managed investment schemes, and controlling clients' private keys is likely a custodial service. These generally need an Australian financial services (AFS) licence. ASIC's class relief exempts intermediaries distributing eligible stablecoins and wrapped tokens until 1 January 2029 (ASIC Corporations (Stablecoin and Wrapped Token Relief) Instrument 2025/867).

ASIC's no-action position required firms to lodge an AFS licence application or variation by 30 September 2026. Under the June 2026 class no-action letter, a firm that met the conditions, including having provided the service by 31 December 2025, stays covered until ASIC grants, refuses or declines to receive its application, or it is withdrawn. Crypto lending and earn products, and derivatives other than wrapped tokens, are excluded. Firms that did not apply risk civil and criminal penalties from 1 October 2026.

Digital asset platforms [Adopted, effective 8 Apr 2027]

The Corporations Amendment (Digital Assets Framework) Act 2026 creates two new financial products, the "digital asset platform" (an operator holding digital tokens for clients) and the "tokenised custody platform". Operators will need an AFS licence authorising the service. In a six-month transition from 8 April 2027, operators need not hold the new authorisation; those applying in that window continue until ASIC decides. A low-value exemption applies only where no financial products are held, platform transactions are $10 million or less over 12 months, each client's holdings are $5,000 or less on entry, and ASIC has been notified.

3. AML, KYC and customer due diligence

Registered VASPs are reporting entities under the AML/CTF Act. The reformed framework applied to item 50A exchange providers from 31 March 2026 and to newly regulated services from 1 July 2026 (Transitional Rules 2026, s 12). Existing digital currency exchanges became VASPs automatically.

Risk assessment and programme

No service may be provided without an up-to-date ML/TF risk assessment (s 26E) and AML/CTF policies (s 26F), including policies on wallet due diligence for virtual asset transfers (Rules 5-17 and 5-18).

Initial CDD (s 28)

Before the first service, establish on reasonable grounds the customer's identity, agents and their authority, beneficial owners (25% or more, or control), PEP and targeted financial sanctions status, and the purpose of the relationship.

Enhanced CDD (s 32)

Mandatory for high-risk customers, foreign PEPs, customers in FATF call-for-action jurisdictions, nested services, and where a suspicious matter report has arisen. Rule 6-22 adds customers who deposit or receive cash when exchanging crypto, with source of funds and source of wealth.

Ongoing CDD (s 30)

Monitor all customers for unusual activity and re-verify KYC information when in doubt (all customers since 31 March 2026).

Reporting and records

• Suspicious matter reports (s 41): within 3 business days of forming the suspicion, 24 hours for terrorism financing, and 5 where legal professional privilege may apply. Identity doubts are a trigger; tipping off is an offence (s 123).
• Threshold transaction reports (s 43): physical currency transfers of $10,000 or more. The Act allows regulations to set a virtual asset threshold; none has been made.
• Unverified self-hosted wallet reports (s 46A) [Adopted, applies from 31 Mar 2029]: within 10 business days of a transfer to or from a self-hosted wallet whose controller the VASP has not verified.
• Records: transaction records for 7 years (s 107) and CDD records for 7 years after the relationship ends (s 111). ID document copies need not be kept.

4. Identity verification and onboarding

Section 28(3) is outcomes-based. For an individual, the provider must take reasonable steps to establish that the customer is the person they claim to be, collect KYC information appropriate to the customer's risk, and verify it "using reliable and independent data". The delivery channel is a mandatory risk factor (s 28(4)(d)).

AUSTRAC's guidance on initial CDD for individuals (31 March 2026) gives examples: collect full name, other names, date of birth, residential address and any unique identifier; verify name and date of birth with a government-issued photo ID, or a non-photo document such as a birth or citizenship certificate plus a secondary document showing name and address; and confirm the person by comparing them to their photo in person, by a video call, or by "biometric technology" that compares the ID with the customer's appearance. Customers who cannot produce standard ID may be verified under alternative procedures (Rule 6-10).

Electronic verification and reliance

AUSTRAC accepts third-party digital identity services where their data is reliable and independent, considering who maintains it (for example a government body) and whether the system is secure and current. A provider may match name, address and date of birth against a credit reporting body only if the customer is told how the check works, expressly agrees, and is offered an alternative method (s 35A). Third parties may collect and verify KYC information as agents, but the provider remains liable (s 37); reliance on another entity's CDD needs a written arrangement meeting the Rules (ss 37A and 38).

Delayed verification is narrow

Section 29 and Rule 6-12 allow some CDD after service starts only if essential to avoid interrupting business and the extra risk is low. Even then, identity must already be established and the provider must not transfer or release money or virtual assets for the customer until CDD is complete.

5. Digital channels: what's different

Bottom line: the CDD and travel rule duties are channel-neutral, but cash is not: crypto ATMs and cash exchange desks face enhanced due diligence, threshold reporting and AUSTRAC registration conditions that a bank-funded online exchange does not.

Cash-facing channels

Rule 6-22 makes enhanced due diligence, with verified source of funds, mandatory for any customer who deposits or receives cash when exchanging crypto. On 17 July 2025 AUSTRAC also announced registration conditions for crypto ATM operators: a $5,000 cap on cash deposits and withdrawals, stronger due diligence and mandatory scam warnings. Online providers have no fixed cap but must disclose any limits when registering.

Remote confirmation of identity

AUSTRAC accepts a video call or biometric comparison in place of a face-to-face check. Neither the Act nor the Rules prescribe a liveness standard; the method must be reasonable for the customer's risk.

6. Data protection and biometrics

Every reporting entity is covered by the Privacy Act 1988 for its AML/CTF activities, including small businesses under the $3 million turnover threshold. The OAIC's privacy guidance for AML/CTF reporting entities (updated 28 August 2026) treats biometric information used for verification as sensitive information and says consent should generally be sought before biometric identification or verification. Collection must still be reasonably necessary.

Under Australian Privacy Principle 11.2, information must be destroyed or de-identified once no longer needed, unless a law requires it to be kept. Since 31 March 2026 the AML/CTF Act no longer requires copies of identity documents, so the OAIC expects full ID copies to be destroyed or de-identified once no longer needed, while the CDD records in section 111 are kept for 7 years. Disclosures to credit reporting bodies are authorised only under the section 35A conditions.

7. Sector-specific obligations

Travel rule

Part 5 of the AML/CTF Act and Part 8 of the Rules apply to all non-incidental virtual asset transfers by VASPs, domestic and international, with no minimum amount. Before passing on a transfer, the ordering VASP collects payer information (full name plus a customer identification number or other unique identifier, date and place of birth, or address) and the payee's full name, verifies the payer information, and passes these on with tracing information such as wallet addresses (Rule 8-3). Rule 8-6 allows the revised FATF Recommendation 16 data set instead, used as a whole. The beneficiary VASP must not make assets available until it has the required information (s 66A(6)).

Counterparty and self-hosted wallets

Before each transfer, both the sending and receiving VASP must determine whether the other wallet is held by a licensed or registered provider, by a provider not required to be registered, by an unregistered provider that should be registered, or is a self-hosted wallet (s 66A). Transfers involving an unregistered provider that is required to be registered are prohibited. Data may be withheld only if the counterparty cannot receive or protect it securely, with the reason recorded. For self-hosted wallets the provider's policies must say how it identifies the payee and whether it verifies who controls the wallet. An exemption removes initial CDD on the receiving person for occasional withdrawals of under $1,000 to their self-hosted wallet (Class Exemptions and Other Matters Rules 2007, Chapter 4). Until 1 July 2030, an ordering VASP need not re-verify payer information for customers who have already completed CDD, unless it has doubts (Rule 8-8(7)).

Sanctions

Screening against the DFAT Consolidated List is part of initial CDD (s 28(2)(e)). Assets of a listed person must be frozen and reported to the Australian Sanctions Office and the Australian Federal Police; dealing with a listed person is a serious criminal offence carrying up to 10 years' imprisonment for individuals.

8. Risk indicators and red flags

AUSTRAC indicators for virtual asset service providers (updated 25 March 2026)

• Unverifiable identity: false or vague ID, details shared with other customers, or a mismatch with the ID photo.
• Rapid conversion: crypto to crypto or fiat to stablecoin hops without economic purpose.
• Structuring: deposits split into smaller amounts, including repeated crypto ATM payments under $500.
• High-risk exposure: transactions linked to ransomware addresses, darknet clusters, mixers or unregistered providers.
• Pass-through: a new customer makes a large purchase and immediately withdraws to an external address.
• Scam victim signs: coached answers, mentions of an "adviser", or customers over 50 buying crypto for an "investment".
• Privacy tools: VPN use, privacy coins or high-privacy email providers that do not fit the profile.

9. Enforcement and penalties

AML/CTF civil penalties are set per contravention, up to 100,000 penalty units for a body corporate and 20,000 for others (s 175). With the Commonwealth penalty unit at $364 for contraventions from 1 July 2026 (Crimes (Amount of a Penalty Unit) Instrument 2026), the corporate maximum is about $36.4 million for each contravention. AUSTRAC can also suspend, cancel or condition registrations, accept enforceable undertakings and issue infringement notices. ASIC warns unlicensed firms of fines of up to 10% of annual turnover.

• Cryptolink (10 August 2026): AUSTRAC suspended the crypto ATM operator's VASP registration for three months, taking 96 machines offline, after it failed to lodge threshold transaction reports despite an October 2025 enforceable undertaking and a $56,340 infringement notice.
• Registration removals (7 September 2026): AUSTRAC cancelled, suspended or refused to renew 45 remittance and VASP registrations in the preceding year, including BA Digital Ventures (trading as GetCoins), cancelled on 4 June 2026.
• ASIC v Web3 Ventures (Block Earner): on 17 June 2026 the High Court unanimously held that a fixed-yield crypto product was a financial product, both a facility for making a financial investment and a derivative, so an AFS licence was needed ([2026] HCA 21). The penalty appeal returns to the Full Federal Court.

10. Recent changes and what to watch

• 28 October 2026: Treasury consultation on crypto asset tax transparency draft legislation closed [Draft legislation, not yet law]. Registered VASPs would report Australian users' transactions from 1 July 2027 to the ATO, and the OECD Crypto-Asset Reporting Framework would apply from the 2027 calendar year.
• 15 October 2026: ASIC Consultation Paper 392 on standards and guidance for digital asset platforms [Proposed, comments close 27 Nov 2026].
• 12 October 2026: AML/CTF Amendment Bill 2026 introduced in the Senate after passing the House on 16 September [Bill, not enacted]. It would let the AUSTRAC CEO restrict or prohibit high-risk products, services or delivery channels, a power AUSTRAC has linked to crypto ATM risks.
• 30 September 2026: ASIC's no-action deadline passed [In force]. Firms that applied in time remain covered while ASIC decides.
• 10 August 2026: AUSTRAC suspended a crypto ATM operator's registration [In force].
• 8 April 2027: Digital Assets Framework commences [Adopted, effective 8 Apr 2027]. Platform and tokenised custody operators must hold an authorised AFS licence or apply within six months.
• 31 March 2029: reports on transfers involving unverified self-hosted wallets begin [Adopted, effective 31 Mar 2029].

11. What this means for identity verification

• Verify before value moves. Identity must be established before onboarding, and Rule 6-12 bars releasing crypto or money until CDD is complete, so verification sits in the signup flow, not after first deposit.
• Pair documents with a face match. Remote providers confirm the person through video or biometric comparison against a government photo ID; record the method and result as evidence of "reasonable steps".
• Collect travel rule data at onboarding. Date of birth and address from CDD later serve as payer information.
• Treat self-hosted wallets as an identity problem. Ownership proof for withdrawal addresses will determine whether a transfer becomes reportable from 31 March 2029.
• Handle biometrics as sensitive information. Seek consent before biometric checks and delete full ID images once no longer needed, keeping the CDD record.