Australian Crypto Regulations and Licensing by AUSTRAC: What Businesses Must Do by 2026

By March 31, 2026, every crypto business operating in Australia must be registered with AUSTRAC-or shut down. There’s no extension. No grace period. This isn’t a suggestion. It’s the law, and it’s changing everything about how digital assets work in this country.

What AUSTRAC Actually Controls Now

AUSTRAC isn’t just watching crypto. It’s now in charge of five specific services involving virtual assets. These aren’t vague ideas-they’re concrete activities with clear rules:

• Exchanging crypto for Australian dollars (or any fiat currency)
• Exchanging one cryptocurrency for another (like BTC for ETH)
• Transferring crypto from one person to another
• Storing or managing crypto for others (custody wallets)
• Helping launch or sell new crypto tokens

That means even if you run a simple peer-to-peer app that lets users send Bitcoin to each other, you’re now regulated. Same if you offer a wallet that holds users’ keys. Even token issuers-people launching new coins or NFTs-are in scope. The law defines virtual assets as digital representations of value that can be transferred, stored, or traded electronically. Game tokens? Loyalty points? Those are out. Everything else? Covered.

The Travel Rule: No More Anonymous Transfers

If you send more than AUD 1,000 in crypto, you can’t hide who sent it or who got it. This is the Travel Rule, and Australia is finally enforcing it-same as the U.S. and EU-but with a twist: it applies to every payment rail, whether it’s blockchain, bank transfer, or a custom app. The sender’s name, address, and account number must travel with the transaction. The receiver’s too.

That’s a big deal for wallets and exchanges. Many platforms used to treat crypto like cash-anonymous, untraceable. Not anymore. Systems now need to capture and store that data for at least seven years. Non-compliant platforms face fines up to AUD 21 million. Independent Reserve, one of Australia’s largest exchanges, spent over a year building a system to meet this. CoinSpot paused its P2P service in August 2025 because their old system couldn’t track sender-receiver pairs properly.

Customer Checks: It’s Not Just One-Time

You can’t just ask for ID once and call it done. AUSTRAC now requires ongoing monitoring of every customer. If someone suddenly starts sending AUD 50,000 in crypto every week, you have to flag it. If they’re from a country on FATF’s blacklist-like North Korea or Iran-you need extra checks. Politically exposed persons? More scrutiny. Even if they’ve been a customer for three years, you still need to re-verify them if their behavior changes.

Small exchanges are struggling. One operator on Reddit said they spent AUD 185,000 on compliance software just to track customer activity. That’s not a typo. For a startup with 12 employees, that’s more than half their annual budget. The average cost to get compliant? Between AUD 120,000 and AUD 350,000. Most of that goes to tech-integrating blockchain analytics tools with old accounting systems. Sixty-three percent of businesses surveyed said that integration was their biggest headache.

Crypto ATMs: Now Heavily Regulated

Australia has over 1,800 crypto ATMs-the most in Asia-Pacific. But that number is dropping. In July 2025, AUSTRAC set new rules after a joint operation found 90 victims of scams targeting older Australians. Now, every ATM operator must:

• Hold a AUD 50,000 bond
• Verify ID for every transaction over AUD 1,000
• Limit daily withdrawals to AUD 10,000
• Report suspicious activity within 24 hours

Some operators called the AUD 50,000 bond excessive. In Texas, the requirement is USD 25,000. One operator voluntarily shut down after failing to meet the bond requirement. Another paused operations. Only those with real financial backing are surviving.

What’s Still Missing: DeFi and Stablecoins

Here’s the gap: DeFi. Decentralized finance platforms-like Uniswap or Aave-don’t have a central company. No CEO. No registered office. No compliance team. AUSTRAC’s rules assume you’re dealing with a business. That’s why DeFi is still a gray zone. No one knows how to regulate it yet. Eighty-two percent of Australian crypto businesses surveyed said they need clarity on this.

Stablecoins are another blind spot. The government announced in March 2025 that it’s working on a new framework for payment stablecoins under a “Stored Value Facility” regime. But as of November 2025, no draft rules have been published. That’s a problem. If you’re launching a coin pegged to the Australian dollar, you’re operating in legal limbo. Some companies are holding off on product launches until they know where the rules land.

How to Get Licensed (Step by Step)

If you run a crypto service in Australia, here’s what you need to do:

1. Register online via AUSTRAC’s portal. You’ll need your ABN, business structure details, and a description of your services.
2. Build an AML/CTF program. This isn’t a document you print and file. It’s a living system: customer identification, transaction monitoring, staff training, suspicious report procedures.
3. Buy or build compliance tech. You need software that can track wallet addresses, flag unusual patterns, and store data for seven years. Tools like Chainalysis or Elliptic are common.
4. Train your team. Staff must know how to spot red flags-like rapid deposits and withdrawals, or transactions from high-risk jurisdictions.
5. Submit your program to AUSTRAC for approval. They’ll review it. You might get asked to revise it.
6. Keep monitoring. Compliance isn’t a one-time task. You’ll need to update your system every time you add a new service or customer type.

The average time to get approved? Six to nine months. That’s why businesses that started in early 2024 are just finishing now. Those waiting until late 2025 are already behind.

Who’s Already Compliant? Who Got Hit?

Independent Reserve got certified in Q1 2025. Their institutional client base grew 22% after they went fully compliant. They say transparency built trust. Big banks now refer clients to them.

Not everyone was so lucky. CoinSpot had to suspend its peer-to-peer trading feature in August 2025 because they couldn’t meet the new transaction monitoring rules. Another exchange, CryptoVault, had its registration revoked after failing to report 14 suspicious transactions over six months. They’re now barred from operating in Australia.

Why This Matters for You

Australia’s crypto market hit AUD 4.7 billion in 2025. Over 3.2 million Australians use crypto-12.7% of the population. But only 47% of exchanges are fully compliant. That means half are operating illegally. If you’re a user, you’re taking a risk using an unlicensed platform. Your funds aren’t protected. If the platform gets shut down, you lose everything.

If you’re a business, the clock is ticking. The March 2026 deadline is real. AUSTRAC’s helpdesk is getting 1,200 questions a month. They’re not here to help you avoid the rules-they’re here to make sure you follow them. And they’re watching.

What’s Next? The Big Changes Coming

By December 2025, the government will finalize its new digital asset framework. That includes:

• A formal licensing system for Digital Asset Platforms (DAPs)
• Clear rules for stablecoins
• A review of the regulatory sandbox (to help startups test new ideas)
• More enforcement against crypto ATMs and scam operators

Experts warn: if Australia doesn’t meet these deadlines, it’ll fall behind Singapore and Hong Kong. Right now, Singapore has clear rules for DeFi. Hong Kong licenses crypto exchanges. Australia is still playing catch-up.

But there’s a silver lining. Australia’s rules are technology-neutral. That means if a new way to transfer value emerges-say, using AI-powered wallets-the same rules apply. That’s flexible. It’s future-proof. It just needs to be implemented.