Australian Crypto Regulations and Licensing by AUSTRAC: What Businesses Must Do by March 2026

By March 31, 2026, every crypto business operating in Australia must be registered with AUSTRAC-or it will be shut down. This isn’t a warning. It’s the law. And it’s already changing how exchanges, wallet providers, and even peer-to-peer platforms operate. If you’re running a crypto service in Australia, you need to know exactly what’s required, how much it costs, and what happens if you miss the deadline.

What AUSTRAC Actually Regulates Now

AUSTRAC doesn’t regulate Bitcoin or Ethereum themselves. It regulates the services that touch them. Since 2018, only crypto-to-fiat exchanges had to register. But the 2024 amendments changed everything. Now, five types of services fall under the law:

• Exchanging virtual assets for fiat currency (like AUD)
• Exchanging one crypto for another (BTC for ETH, for example)
• Transferring virtual assets between users
• Safekeeping or administering crypto assets (custody wallets)
• Participating in financial services tied to token issuance (like ICOs or STOs)

That means even if you’re not dealing with Australian dollars, you still need to register. A platform that lets users swap Solana for Polygon? That’s covered. A wallet that holds crypto for customers? Covered. A P2P app that connects buyers and sellers? Covered. The definition of a virtual asset is clear: it’s any digital value that can be transferred, stored, or traded electronically. Game tokens? Loyalty points? Excluded. Real crypto? Always in.

The March 2026 Deadline Is Non-Negotiable

The clock is ticking. All businesses must be registered and fully compliant by March 31, 2026. There are no extensions. No grace periods. And AUSTRAC isn’t asking politely-it’s enforcing. In July 2025, the regulator refused to renew one crypto ATM provider’s registration. Another voluntarily pulled out. A third paused operations. This isn’t about fines anymore. It’s about being locked out of the market.

Businesses have been scrambling. Independent Reserve got compliant in Q1 2025 and saw a 22% jump in institutional clients. CoinSpot, on the other hand, had to suspend its P2P service in August 2025 because it couldn’t meet the new transaction monitoring rules. The difference? Preparation. Those who started in 2024 had time. Those who waited are now behind.

What You Have to Do: The 4-Step Process

Getting compliant isn’t optional. It’s a process. Here’s what you need to do:

1. Register online through AUSTRAC’s portal. You’ll need your ABN, business structure, and details of all owners and directors. No exceptions.
2. Build an AML/CTF program. This isn’t a document you download. It’s a living system. You need customer identification, ongoing transaction monitoring, and a way to report suspicious activity. You can’t just use a template. AUSTRAC expects you to understand how your business is used for money laundering.
3. Implement the Travel Rule. Any transfer over AUD 1,000-whether it’s on-chain, via a bank, or through a wallet-must include full originator and beneficiary details. That means name, address, account number. No anonymous swaps. No privacy coins bypassing this. The rule applies equally to blockchain and traditional payments.
4. Train your team. Your staff need to know how to spot red flags. A customer who deposits $50,000 in Bitcoin and withdraws it as Monero? That’s a red flag. A user who sends crypto to 15 different wallets in one hour? That’s a red flag. You need people who understand these patterns.

The average time to get compliant? Six to nine months. The cost? Between AUD 120,000 and AUD 350,000, depending on your size. Small exchanges are feeling the pinch. One user on Reddit reported spending AUD 185,000 on compliance software alone. For a startup with 5 employees, that’s more than half its annual budget.

Technology-Neutral, But Not Risk-Neutral

Australia’s approach is unique. It doesn’t care if you use Bitcoin, Ethereum, or a private blockchain. The rules apply the same way to all of them. That’s smart. It means the law won’t become outdated when a new tech emerges.

But here’s the catch: the law doesn’t care about decentralization. DeFi protocols-like Uniswap or Aave-are not mentioned anywhere in the rules. If you’re running a smart contract that lets users lend and borrow without a company behind it, you’re in a legal gray zone. The regulator says it’s focusing on service providers, not the tech. But if there’s no company to hold accountable, who gets fined? No one has an answer yet. A September 2025 survey found 68% of Australian crypto businesses are worried about this gap.

What’s Missing: DeFi, Stablecoins, and Crypto ATMs

While the framework is broad, it’s incomplete. DeFi is ignored. Stablecoins aren’t regulated under a dedicated system-yet. The March 2025 Digital Asset Statement promised a Stored Value Facility (SVF) regime for stablecoins, but details aren’t out. That leaves businesses guessing. Should you treat USDT like a bank account? Like a security? Like cash? No one knows.

Crypto ATMs are another story. Australia has 1,800 of them-the most in Asia-Pacific. After a July 2025 crackdown that identified 90 scam victims, AUSTRAC set minimum standards: identity checks, location tracking, and a AUD 50,000 bonding requirement. Operators say it’s too high. In Texas, the bond is USD 25,000. But the regulator says it’s necessary. The Trustpilot rating for compliant ATMs is 3.2/5-mixed reviews, but clear enforcement.

Who’s Getting It Right-and Who’s Not

Independent Reserve, CoinSpot, and Swyftx control 68% of the Australian crypto market. Only 47% of domestic exchanges were fully compliant as of August 2025. That means more than half were still operating illegally.

Successful businesses share three traits:

• They started early-before 2024.
• They hired AML specialists with crypto experience, not just general compliance officers.
• They invested in blockchain analytics tools that can trace transactions across chains.

Failures? They assumed they could wait. They thought they were too small to matter. They used off-the-shelf software that didn’t handle crypto-specific risks. Now they’re either suspended, under investigation, or paying lawyers.

The Bigger Picture: Australia’s Place in the World

Compared to the U.S. and UAE, Australia is behind. The U.S. implemented the Travel Rule in 2021. The UAE has a clear licensing system for crypto firms. Singapore has a sandbox for testing new models. Australia has none of that.

Professor Ross Buckley from UNSW Law says Australia’s regulatory timeline is “lagging behind by 18-24 months.” That’s dangerous. If you’re a startup choosing where to launch, you’ll pick Singapore or Dubai-not Australia-unless you’re targeting Australian users.

But Australia has one advantage: it’s consistent. The rules apply to everyone the same way. No loopholes. No exceptions. If you’re serious about building a long-term crypto business in Australia, you have to play by these rules. There’s no shortcut.

What Comes Next

By December 2025, AUSTRAC, Treasury, ASIC, and the ACCC will finalize their joint framework. That’s when we’ll see:

• Formal licensing for Digital Asset Platforms (DAPs)
• Clear rules for stablecoins under the SVF regime
• Review of the regulatory sandbox
• Guidance on blockchain’s economic impact

Market size is growing fast. In 2025, Australia’s crypto services market hit AUD 4.7 billion. By 2027, KPMG projects it will hit AUD 7.3 billion-if regulation is clear. If it’s not? Growth stalls. Investors pull out. Startups leave.

The message is simple: if you’re in this space, compliance isn’t a cost. It’s the price of staying in business. The deadline is here. The rules are clear. The choice is yours.