AUSTRAC Registration for Crypto Businesses: The 2026 Rules, Explained

AUSTRAC registration for a crypto business is an anti-money-laundering obligation, not a financial-services licence, and it is mandatory before providing virtual asset services in Australia.

The virtual asset service provider register replaced the digital currency exchange register on 31 March 2026, and ASIC's separate licensing regime for digital asset platforms does not commence until 9 April 2027.

I am Claude Igrow, a payments specialist at Boldrails, which provides payment, settlement and payout services for businesses in emerging and high-risk markets. What follows is AUSTRAC registration for a crypto business as the regime stands on 21 August 2026, sourced to the statute, to Parliament and to the regulators. This is not financial or legal advice.

What is AUSTRAC registration for a crypto business?

That definition is doing more work than it looks. Three things in it matter.

Registration is an anti-money-laundering measure. It is not a quality mark, not a consumer-protection licence, and it says nothing about whether a business is solvent or well run. It says the business has told AUSTRAC what it does and accepted the reporting obligations that follow. AUSTRAC's own overview for virtual asset service providers puts it plainly: you must be registered before you can provide virtual asset services in Australia.

Then there is the phrase designated virtual asset service. The obligation attaches to conduct, not to a label a business picks for itself. Calling yourself a technology provider does not remove you from the regime if what you actually do is exchange or hold virtual assets for other people.

And there is geographical link to Australia. That test catches offshore operators. I will come back to it, because it is the one businesses most often get wrong.

Before going further, a disambiguation, because the search results for this topic are thick with it: none of this concerns your personal crypto tax position. Capital gains, disposals and reporting on your own holdings are the Australian Taxation Office's area, not AUSTRAC's. This article is about businesses providing services to other people.

Nothing above describes Boldrails' own regulatory position; it is how the Australian regime works.

Does your crypto business need to register with AUSTRAC?

I would take them in order.

Test one: do you provide a designated virtual asset service? AUSTRAC sets out the virtual asset designated services in its guidance. They include exchanging fiat currency for virtual assets, exchanging one virtual asset for another, transferring virtual assets on behalf of another person, safekeeping or administering virtual assets or the means of access to them, and operating a crypto ATM. Custody is captured in its own right. It does not need to be paired with an exchange service to count.

Test two: is there a geographical link to Australia? This is the test that surprises people. It is not only about where a company is incorporated. A business incorporated offshore that provides designated services to Australian customers can be captured. The Department of Home Affairs has been explicit that the reforms are meant to bring the sector into the regime rather than let corporate structure decide the outcome. If you serve Australian users from Singapore or Dubai and have assumed the regime does not reach you, that is the assumption worth paying a lawyer to test.

Test three: are you providing it as a business? Providing a service in the course of carrying on a business is different from a one-off personal transaction. Trading your own holdings on your own account is not providing a service to another person.

Test four: does an exemption apply? Exemptions exist and they are narrow. AUSTRAC publishes a checker to help you see whether you are regulated, and it also documents who does not need to register. An exemption is not a planning tool, and I would not build a structure around one without advice.

These four tests interact in a way that catches people out. A business can fail test one on its main product and still be captured by a secondary feature nobody thought about, because the limbs of the designated service list are independent of each other. I would run the tests against every distinct thing the business does for a customer, not against the business as a whole.

The guides on this topic tend to skip a case that deserves stating plainly: some businesses genuinely do not need to register. If you build software that never touches customer assets, never holds keys and never exchanges anything, you may sit outside the virtual asset provisions entirely. That is a real answer, and a business that reaches it correctly has saved itself a great deal of work.

Nothing above describes Boldrails' own regulatory position; it is how the Australian regime works.

Enrolment and registration are two different steps

This is the mechanic readers most often get wrong, and it is not a novel observation: most of the better guides cover it. Where they stop short is that they describe two actions without naming the two destinations. And the destinations are what a counterparty actually looks at.

Both lists are named in primary law. The Reporting Entities Roll appears in the AML/CTF Rules, which set out the information required to request removal of an entry from it. The Virtual Asset Service Provider Register sits in the AML/CTF Act 2006 itself, at sections 76J to 76P, dealing with cancellation, suspension, renewal and removal. AUSTRAC's register with us page states the two-step requirement directly.

The practical consequence: a business that has enrolled and believes it has therefore “registered with AUSTRAC” has done half the job. And the half it skipped is the one that appears on a public register a bank will read.

Nothing above describes Boldrails' own regulatory position; it is how the Australian regime works.

What changed on 31 March 2026, when the DCE register became the VASP register?

The commencement date is stated in terms by the Department of Home Affairs. The amending statute is the Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024, Act No. 110 of 2024, made on 10 December 2024 and registered on 13 December 2024. A compilation was registered on 30 March 2026, the day before commencement. That is ordinary practice, not a second commencement date.

The transition detail matters and it is the part most commentary gets loose about. AUSTRAC's own quick reference guide on transitioning from a DCE to a VASP states that a reporting entity registered as a DCE had to transition to VASP and update its enrolment details between 31 March and 29 July 2026. So the reassuring half of the story is true: you did not have to start again. But there was an action to take, and its deadline has passed. If you hold a legacy registration and never touched your enrolment details, that is worth checking in AUSTRAC Online today rather than assuming.

What also changed for existing registrants is scope. The captured service list is wider than the old fiat-to-crypto exchange definition, so a business registered for exchange in 2024 may now be providing captured services it has never reported on.

Nothing above describes Boldrails' own regulatory position; it is how the Australian regime works.

What counts as a designated virtual asset service?

AUSTRAC enumerates them in its virtual asset designated services guidance. Reading them by item number rather than as a general category is the practical way to do it, because a business can be captured by exactly one item.

Two notes on how that list works in practice, because the item numbers are where the precision lives.

Crypto ATM operators are captured, but not by an item of their own. An ATM that exchanges cash for virtual assets is doing item 50A, and AUSTRAC's enforcement against ATM operators runs through the exchange limb rather than a separate machine-operator category. So the question for an ATM business is not “is there an ATM item” but “am I exchanging money for virtual assets”, and the answer is yes.

Beyond that, the list behaves in two ways that matter.

The means of accesslanguage in the safekeeping limb is deliberately broad. Holding keys on a customer's behalf is capture even where the business never holds an asset in its own name. This is the limb that catches wallet providers who think of themselves as software companies.

And the limbs are independent. A custodian that never exchanges anything is a VASP. A transfer service that never holds anything is a VASP. The common error in how businesses read this list is to treat the exchange limb as the real one and the rest as edge cases. They are not, and AUSTRAC publishes registration questions specific to virtual asset service providers that will make you declare which limbs apply.

Nothing above describes Boldrails' own regulatory position; it is how the Australian regime works.

How do you register with AUSTRAC as a VASP?

1. 1
   Determine which of the five designated services you provide. Get this wrong and everything downstream is wrong. Write it down with the reasoning.
2. 2
   Confirm the geographical link. Document why the regime applies to your structure, or why you concluded it does not.
3. 3
   Build the AML/CTF program before you apply, not after. The program is a document and a set of operating practices: risk assessment, customer due diligence procedures, transaction monitoring, reporting, record-keeping, staff training and independent review. AUSTRAC publishes a risk assessment quick guide for VASPs.
4. 4
   Appoint an AML/CTF compliance officer. A named person with authority to act.
5. 5
   Create an AUSTRAC Online account and complete the business profile.
6. 6
   Enrol as a reporting entity. This is the Reporting Entities Roll step, covered in AUSTRAC's enrolment overview.
7. 7
   Apply for registration on the Virtual Asset Service Provider Register, giving details of the business, its services, its key personnel and its beneficial owners. AUSTRAC publishes a guide on preparing the registration forms so you can gather the material first.
8. 8
   Answer AUSTRAC's questions. Expect follow-up on ownership, on source of funds, and on how the monitoring you described actually works.
9. 9
   Maintain and renew. Registration is not a one-time event. Details must be kept current, and providers must apply to renew every 3 years.

On timing and cost, I am giving you a non-answer on purpose. The figures circulating for both trace back to a source that sells ready-made AUSTRAC-registered companies, which is not a neutral party on how long registration takes or what it costs. I could find no government source stating either figure. A vendor's number has no place on a page about legal obligations. Timing comes from AUSTRAC and from your own advisers, and the length of step 3 is what actually determines it.

Nothing above describes Boldrails' own regulatory position; it is how the Australian regime works.

What does the AUSTRAC VASP register show, and who reads it?

The register became public relatively recently. AUSTRAC announced on 30 June 2026 that the virtual asset service provider register goes public, specifically so that anyone can verify whether a provider is registered. Before that, verification was harder and less public, which is worth knowing if you are reading older guidance.

Look at what an entry actually exposes before you treat the register as a formality:

• The registered entity's legal name and identifiers
• Which designated services it is registered to provide
• The status of the registration, and therefore whether it is current
• Separately, on AUSTRAC's virtual asset registration actions page, whether the registration has been refused, suspended or cancelled

Your own entry is also where your registration number lives. It sits in your AUSTRAC Online account under your registrations, and it appears on the public register once registration is granted, which is why counterparties ask for it during onboarding.

The second list is the one that matters commercially. A clean current entry tells a bank very little. A published action tells it a great deal. Because both are matters of public record, a business planning banking or payment relationships in Australia should expect its register history to be read before its pitch is.

Plan around the asymmetry in that. Registration is something you do once and renew. Being read off the register happens to you continuously, by parties you never meet. Every bank onboarding team, every payment provider's risk function and every institutional counterparty can check your status in the time it takes to type a company name. That changes what the register is for. It stopped being a filing obligation on 30 June 2026 and became a live commercial credential.

Two consequences follow. Your registered service list should match what you actually sell. If your entry says exchange and your website sells custody, a diligence team will notice, and the mismatch reads worse than a gap. And AUSTRAC's requirement to keep your details current is not administrative housekeeping. It is the mechanism by which the public record stays accurate, and an out-of-date entry is a self-inflicted diligence problem.

This is also why the register is the correct answer to “which exchanges are registered”. Any list published in an article is a snapshot that starts decaying the day it is written. AUSTRAC's register is the authoritative version, and I would not trust a copy of it, including one I wrote.

Nothing above describes Boldrails' own regulatory position; it is how the Australian regime works.

Your obligations after registration

The AML/CTF program. Not a document you file and forget. It must reflect what the business actually does, be independently reviewed, and be updated when the business changes.

Customer due diligence. Identifying and verifying customers, understanding beneficial ownership for entity customers, and applying enhanced measures where risk is higher.

Transaction monitoring and reporting. Ongoing monitoring, suspicious matter reporting and threshold transaction reporting. AUSTRAC publishes indicators of suspicious activity for virtual asset service providers to calibrate against. Late reporting is itself an enforcement trigger, not a technicality.

Record-keeping. Retention of the records evidencing all of the above.

Travel Rule obligations. From 1 July 2026, transfers of virtual assets carry requirements about the originator and beneficiary information that must travel with them, set out in AUSTRAC's travel rule guidance. This is a substantial topic of its own and it works differently across jurisdictions. If you operate across borders, our guide to the Travel Rule for crypto businesses carries the jurisdiction-by-jurisdiction detail, including how thresholds and the treatment of self-hosted wallets differ between regimes.

Reporting on unverified self-hosted wallet transfers.Australian legal commentary published at commencement puts the start of this obligation at 31 March 2029. I mark that as secondary sourcing, and I would not plan around it on this page's authority alone. It is stated consistently across Australian legal commentary, but I could not retrieve it from a government source, and AUSTRAC's own transitional guidance is the only place it should be confirmed. Treat the date as indicative until you have checked it there.

Nothing above describes Boldrails' own regulatory position; it is how the Australian regime works.

The compliance timeline for Australian crypto businesses, 2024 to 2029

I went looking for this arrangement before building it. Across the ten highest-ranking Australian pages on this topic, six dates govern the subject, and the best-covered page carries four of the six. Three of the ten carry none of them. The Digital Assets Framework commencement date of 9 April 2027 appears on none of the ten. That is why this table exists in the shape it does. Nine of the eleven rows are sourced to a government or parliamentary page. The two that are not are marked as secondary in the table itself.

Read down the Regime column and the shape of the problem appears. Two regimes, two regulators, two clocks, and the second clock has barely started. Every AML/CTF row above is in force today. On the Corporations side the statute exists and has assent, but the operative date is 9 April 2027, still ahead of us. A business that completed AUSTRAC registration this morning has satisfied one regime and has not begun the other.

Nothing above describes Boldrails' own regulatory position; it is how the Australian regime works.

AUSTRAC registration is not an AFS licence

ASIC's position sits in its information sheet on digital assets as financial products and services, which sets out when a digital asset arrangement is a financial product under existing Corporations law. Where it is, the ordinary licensing consequences follow, and they follow now, not in 2027.

What changes in 2027 is that the Corporations Amendment (Digital Assets Framework) Act 2026 creates a licensing perimeter aimed specifically at digital asset platforms. ASIC has published that it passed Parliament on 1 April 2026, received Royal Assent on 8 April 2026 and commences on 9 April 2027.

The current framework also carries relief you should know about. ASIC Corporations (Stablecoin and Wrapped Token Relief) Instrument 2025/867 provides relief from AFS licence, market licence and clearing and settlement facility licence requirements for distributors of eligible stablecoins and eligible wrapped tokens. I give the instrument its full name because the identifier matters and a half-remembered one points somewhere else entirely.

On secondary sourcing in this area: Australian legal commentary describes an 18-month window from assent to lodge an AFS licence application, and a subsequent transition period for ASIC to assess applications. That is arithmetically consistent with the commencement date, but I have not seen a government page state a closing date. So the approximate October 2027 in the timeline above is an inference, and it is labelled as one. Do not diary it as a deadline.

Nothing above describes Boldrails' own regulatory position; it is how the Australian regime works.

Buying a registered VASP entity: what the shelf-company market does not tell you

Registration is a status, not a capability. The obligations attach to the conduct, not to the shell. A purchased entity needs its own AML/CTF program, customer due diligence, monitoring and reporting from the day it starts trading. Buying the registration buys the entry on the register and none of the machinery the entry is supposed to represent. The work in step 3 above does not transfer with a share certificate.

AUSTRAC has said in terms that it is watching for exactly this. In an April 2026 statement, two months before the register was made public, AUSTRAC said it had run the “use it or lose it” blitz to make sure the crypto register was not being exploited by inactive or dormant entities. The blitz itself, announced on 29 April 2025, encouraged inactive DCE businesses to deregister voluntarily. It also signalled that AUSTRAC would cancel registrations where a business was no longer providing the service. A dormant registration is precisely the profile such a review is designed to find. The regulator has already named the pattern, so buying into it is not a clever position.

You inherit the entity's history. Beneficial ownership changes, prior conduct and prior reporting gaps do not settle at completion. A counterparty bank reading the public register can see how long the entity has been registered and can ask what it did in that time. An entity with three dormant years is a harder conversation than a fresh registration with a clean explanation. Remember too that registration now expires every 3 years, so an acquired shell arrives with a renewal clock already running.

That is why this gets a section rather than a footnote. A registration you cannot operate behind is not a shortcut, and the organisations that scrutinise it hardest are the banks and payment providers you need in order to move money at all.

Nothing above describes Boldrails' own regulatory position; it is how the Australian regime works.

What does AUSTRAC enforcement look like for crypto businesses?

The clearest recent example is dated and specific. On 10 August 2026 AUSTRAC announced that it had ordered Cryptolink's crypto ATMs offline. AUSTRAC chief executive Brendan Thomas said the company's “VASP registration was suspended for three months from Sunday 9 August and it is no longer allowed to operate”. That is the mechanism working end to end: a suspension of registration, a hard stop on the business activity, and a public announcement naming the entity.

AUSTRAC has also stepped up supervision of the virtual assets sector as the reforms took effect, and it maintains the virtual asset registration actions page as a standing record of refusals, suspensions and cancellations. Alongside those, the “use it or lose it” review described above shows AUSTRAC treating the register as something to keep accurate rather than merely maintain.

Those three together say something more useful than any penalty table. AUSTRAC's preferred lever in this sector is the registration itself. It suspends, it cancels, it refuses, and it publishes. For a business whose entire ability to bank and to acquire depends on being a registered provider in good standing, losing the registration for three months is not a fine to be absorbed. It is a stop on trading.

I am not going to quote a penalty figure. Penalty amounts for AML/CTF contraventions are set by statute and vary by provision, and I could not retrieve a government source stating a crypto-specific quantum. A number lifted from commentary and attached to the wrong provision would be worse than no number. The mechanics above are what you can actually plan around.

Nothing above describes Boldrails' own regulatory position; it is how the Australian regime works.

How Boldrails works with registered Australian crypto businesses

That part is ours. We provide AUD collection and payouts for businesses operating in Australia, and we settle in AUD, USD or crypto on one contract. On collections we support cards, including Visa, Mastercard and Amex, plus Apple Pay, Google Pay, PayID, PayTo, Osko, BECS Direct Debit, bank transfer and crypto. Payouts run to bank accounts and over NPP and Osko. EFTPOS and BPAY are Australian market infrastructure that we do not carry.

We underwrite digital-asset businesses case by case rather than screening the category out. For an exchange or OTC desk that has been declined elsewhere, that is the practical difference. Your own registration position forms part of the review, as does any AUSTRAC obligation attaching to your model. We hold the necessary licences required in the markets we serve.

Onboarding takes 3 to 14 days, depending on your case. We do not publish rate cards. Pricing is set per case after the review, and the way to get it is to start the onboarding conversation and share your volumes and rails.

For Australian payment methods and settlement detail, see accepting and paying out AUD. For AUD and stablecoin conversion, see our Australian crypto desk. For which markets and rails we carry, the acceptance index is the current record.

This is not financial or legal advice. Australian AML/CTF and financial-services obligations depend on the specific services a business provides and on its structure, and this article is general information current at 21 August 2026. Confirm your own position with AUSTRAC, with ASIC and with your professional advisers.

On corrections: every date and statutory reference here was checked against a government source on 21 August 2026, and the two claims for which no government source could be retrieved are labelled as secondary in the text and in the timeline. Australian crypto regulation is moving, so this page is reviewed when a governing date passes or a regime changes. If you find something that has gone stale, tell us and we will correct it and re-date the page.

Frequently asked questions

These answers cover the questions asked most often about AUSTRAC registration for a crypto business. Where a question turns on your own facts, AUSTRAC's checker for whether you may be regulated is the right starting point rather than any article.