On-shore VASP in Australia

Virtual asset service providers register with AUSTRAC from 31 March 2026 (AML/CTF Amendment Act 2024, No. 110) and need an AFS licence for financial products; the crypto reform is enacted as the Digital Assets Framework Act 2026 (No. 38), commencing in April 2027.

AUSTRAC is the AML/CTF regulator; since 31 March 2026 it registers virtual asset service providers, replacing digital currency exchange registration (AML/CTF Amendment Act 2024, No. 110, Schedule 6).

ASIC regulates digital assets that are financial products under the Corporations Act and ASIC Act, including licensing, disclosure and design and distribution obligations; its guidance is INFO 225 (updated October 2025).

The Anti-Money Laundering and Counter-Terrorism Financing Act 2006 governs crypto AML/CTF; from 31 March 2026 its digital currency exchange registration was replaced by virtual asset service provider registration (AML/CTF Amendment Act 2024, No. 110, Schedule 6).

The Corporations Act 2001 governs digital assets that are financial products, requiring AFS licensing, product disclosure and design and distribution obligations (ASIC INFO 225); the Digital Assets Framework Act 2026 (No. 38) amends it to add digital asset platforms and tokenised custody platforms from April 2027.

Exchanges register with AUSTRAC for AML/CTF (virtual asset service provider registration from 31 March 2026) and need an AFS licence for financial products; ASIC enforces design and distribution obligations, with Bit Trade (Kraken) ordered to pay $8 million in December 2024 for issuing a margin product without a target market determination.

Providing custody of digital assets that are financial products currently requires an AFS licence covering custodial or depository services (RG 133, RG 166); the Digital Assets Framework Act 2026 (No. 38) adds tokenised custody platforms as a new financial product (s 761GD) from April 2027.

Holding digital assets that are financial products for clients is a custodial or depository service requiring an AFS licence, while a self-custody or self-hosted wallet product is unlikely to be one (ASIC INFO 225); ASIC extended omnibus-account relief to such digital assets in December 2025.

Since 31 March 2026 exchanges must register with AUSTRAC as virtual asset service providers (AML/CTF Act s 76B, as amended by Act No. 110, 2024), replacing digital currency exchange registration; exchanges dealing in financial products also need an AFS licence, and the Digital Assets Framework Act 2026 (No. 38) adds digital asset platforms from April 2027.

AFS licensees in the digital asset sector must meet ASIC's base-level financial requirements in Regulatory Guide 166, with tailored requirements by authorisation; custodial providers must also meet a net tangible assets requirement, at least 50% of it held in cash or cash equivalents (INFO 225).

From 31 March 2026 the AML/CTF Amendment Act 2024 (No. 110, 2024) replaced AML/CTF programs with 'AML/CTF policies' (s 26F) and requires every reporting entity, including virtual asset service providers, to designate an AML/CTF compliance officer (s 26J).

Local Presence: Must be a registered Australian company with an ABN; fit-and-proper directors/owners with clean backgrounds; robust governance, IT security, and risk controls.

AFS licensees offering digital asset products must also meet disclosure (PDS and FSG), design and distribution, internal and external dispute resolution and compensation requirements, and custodians must keep client assets separate from their own (ASIC INFO 225, RG 133).

AUSTRAC Registration: Submit online via AUSTRAC portal with business details, AML/CTF program, ownership structure, and compliance evidence. Approval typically 4-6 weeks if complete.

AFS licence applications, including for digital asset businesses, are lodged through ASIC's Regulatory Portal, where an application can be saved as a draft and resumed before lodgement.

Virtual asset service providers, which replaced digital currency exchange providers on 31 March 2026, must enrol with AUSTRAC as reporting entities (AML/CTF Act 2006 s 51B); registrable virtual asset services are virtual asset safekeeping, exchange, transfer, and services connected with the offer or sale of a virtual asset (s 5; s 6 table 1 items 29, 30, 46A, 50A-50C).

DCEs registered as reporting entities must transition to VASP registration by updating enrolment details between 31 March 2026 and 29 July 2026 to continue providing services. AUSTRAC QRG: Transitioning from DCE to VASP

VASPs must both enrol and register with AUSTRAC before providing virtual asset services; registration approval is required except under transitional rules for applications before 29 July 2026. AUSTRAC: Register as remittance or VASP

Businesses must enrol with AUSTRAC before providing designated services; daily penalties may accrue after 28 days of operating without enrolment.

Under the AML/CTF Act 2006 as amended by Act No. 110 of 2024, reporting entities must undertake an ML/TF risk assessment and maintain AML/CTF policies (ss 26C, 26F), conduct initial, ongoing and enhanced customer due diligence (ss 28, 30, 32), report suspicious matters to AUSTRAC (s 41) and keep records (Part 10).

Australia's travel rule is AML/CTF Act 2006 s 64 (ordering institutions) and s 65 (beneficiary institutions), as replaced by Act No. 110 of 2024 Sch 8 from 31 March 2026 to cover transfers of virtual assets; the AUD 10,000 figure belongs to the physical-currency threshold transaction report, not the travel rule.

Evidence fact au.tax not found (may have been renamed).

Providing a registrable virtual asset service without AUSTRAC registration is a strict-liability offence punishable by 2 years imprisonment or 500 penalty units, rising to 7 years or 2,000 penalty units for repeat conduct (AML/CTF Act 2006 s 76A); failing to enrol is a civil penalty contravention for each day (s 51B).

ASIC-obtained court penalties against crypto firms include $14 million against BPS Financial over its Qoin Wallet (Federal Court, ASIC 26-008MR, 27 January 2026) and $8 million against Kraken operator Bit Trade for design-and-distribution breaches (ASIC 24-274MR, 12 December 2024).

AUSTRAC's actions affected the most entities, signaling broad sector crackdown.