AML/CTF Compliance for Digital Currency Exchanges and Virtual Asset Providers

Since 31 March 2026 the AML/CTF Act covers anyone who, as a business, exchanges virtual assets for money or for other virtual assets, transfers virtual assets on behalf of customers, provides custody or safekeeping of virtual assets or private keys, or participates in financial services relating to an issuer's offer or sale of a virtual asset. This is wider than the old "digital currency exchange" definition and captures many custodial wallet providers and brokers.

Yes. Providing a virtual asset exchange or related designated service without AUSTRAC registration is a criminal offence. Digital currency exchanges registered before 31 March 2026 were rolled over, but had to complete the virtual asset service provider transition in AUSTRAC Online and update their enrolment by 29 July 2026; if that was missed, contact AUSTRAC now. New entrants must register before trading, nominate a compliance officer and pass fit-and-proper checks on key personnel.

From 1 July 2026, when you send a virtual asset on a customer's behalf you must collect and pass on payer and payee information (name, account or wallet identifier and, for the payer, an address or other identifier) to the receiving provider, and screen incoming transfers for missing information. Transfers to unhosted wallets require risk-based controls. The rule mirrors the long-standing requirements for international funds transfer instructions.

Suspicious matter reports within three business days (24 hours for terrorism financing); threshold transaction reports for physical cash of $10,000 or more within 10 business days; international value transfer reports for cross-border virtual asset transfers once the transitional deferral ends (31 March 2029 for virtual-asset-only providers); and the annual compliance report. Blockchain analytics alerts, such as exposure to mixers, sanctioned addresses or darknet markets, commonly create the suspicion that requires a report.

Customers who split deposits to stay under thresholds, use multiple accounts or VPNs, convert large amounts quickly into privacy coins, send funds to or receive funds from mixers, gambling sites or sanctioned addresses, show trading patterns inconsistent with their stated income, provide forged or mismatched identity documents, or appear to be victims of investment or romance scams. Each should prompt enhanced due diligence and possibly a suspicious matter report.

Operating unregistered carries criminal penalties including imprisonment. Civil penalties for contravening the Act can reach 100,000 penalty units per breach for a body corporate, tens of millions of dollars at the current rate, and AUSTRAC has already taken enforcement action against Australian exchanges for inadequate programs and monitoring. Banks also de-risk exchanges that cannot evidence a compliant program, so compliance is a commercial issue as much as a legal one.

We prepare and lodge your AUSTRAC registration, write the risk assessment and AML/CTF policies, design customer onboarding and transaction monitoring rules that integrate with blockchain analytics tools, set up travel rule procedures, train staff, and arrange the independent evaluation (we evaluate only programs we did not write, as AUSTRAC requires). We also handle the tax, BAS and bookkeeping that crypto businesses find hard. Fees are fixed and quoted in advance. This page is general information, not legal advice.