By March 31, 2026, every crypto business operating in Australia must be registered with AUSTRAC-or it will be shut down. This isn’t a warning. It’s the law. And it’s already changing how exchanges, wallet providers, and even peer-to-peer platforms operate. If you’re running a crypto service in Australia, you need to know exactly what’s required, how much it costs, and what happens if you miss the deadline.
What AUSTRAC Actually Regulates Now
AUSTRAC doesn’t regulate Bitcoin or Ethereum themselves. It regulates the services that touch them. Since 2018, only crypto-to-fiat exchanges had to register. But the 2024 amendments changed everything. Now, five types of services fall under the law:
- Exchanging virtual assets for fiat currency (like AUD)
- Exchanging one crypto for another (BTC for ETH, for example)
- Transferring virtual assets between users
- Safekeeping or administering crypto assets (custody wallets)
- Participating in financial services tied to token issuance (like ICOs or STOs)
That means even if you’re not dealing with Australian dollars, you still need to register. A platform that lets users swap Solana for Polygon? That’s covered. A wallet that holds crypto for customers? Covered. A P2P app that connects buyers and sellers? Covered. The definition of a virtual asset is clear: it’s any digital value that can be transferred, stored, or traded electronically. Game tokens? Loyalty points? Excluded. Real crypto? Always in.
The March 2026 Deadline Is Non-Negotiable
The clock is ticking. All businesses must be registered and fully compliant by March 31, 2026. There are no extensions. No grace periods. And AUSTRAC isn’t asking politely-it’s enforcing. In July 2025, the regulator refused to renew one crypto ATM provider’s registration. Another voluntarily pulled out. A third paused operations. This isn’t about fines anymore. It’s about being locked out of the market.
Businesses have been scrambling. Independent Reserve got compliant in Q1 2025 and saw a 22% jump in institutional clients. CoinSpot, on the other hand, had to suspend its P2P service in August 2025 because it couldn’t meet the new transaction monitoring rules. The difference? Preparation. Those who started in 2024 had time. Those who waited are now behind.
What You Have to Do: The 4-Step Process
Getting compliant isn’t optional. It’s a process. Here’s what you need to do:
- Register online through AUSTRAC’s portal. You’ll need your ABN, business structure, and details of all owners and directors. No exceptions.
- Build an AML/CTF program. This isn’t a document you download. It’s a living system. You need customer identification, ongoing transaction monitoring, and a way to report suspicious activity. You can’t just use a template. AUSTRAC expects you to understand how your business is used for money laundering.
- Implement the Travel Rule. Any transfer over AUD 1,000-whether it’s on-chain, via a bank, or through a wallet-must include full originator and beneficiary details. That means name, address, account number. No anonymous swaps. No privacy coins bypassing this. The rule applies equally to blockchain and traditional payments.
- Train your team. Your staff need to know how to spot red flags. A customer who deposits $50,000 in Bitcoin and withdraws it as Monero? That’s a red flag. A user who sends crypto to 15 different wallets in one hour? That’s a red flag. You need people who understand these patterns.
The average time to get compliant? Six to nine months. The cost? Between AUD 120,000 and AUD 350,000, depending on your size. Small exchanges are feeling the pinch. One user on Reddit reported spending AUD 185,000 on compliance software alone. For a startup with 5 employees, that’s more than half its annual budget.
Technology-Neutral, But Not Risk-Neutral
Australia’s approach is unique. It doesn’t care if you use Bitcoin, Ethereum, or a private blockchain. The rules apply the same way to all of them. That’s smart. It means the law won’t become outdated when a new tech emerges.
But here’s the catch: the law doesn’t care about decentralization. DeFi protocols-like Uniswap or Aave-are not mentioned anywhere in the rules. If you’re running a smart contract that lets users lend and borrow without a company behind it, you’re in a legal gray zone. The regulator says it’s focusing on service providers, not the tech. But if there’s no company to hold accountable, who gets fined? No one has an answer yet. A September 2025 survey found 68% of Australian crypto businesses are worried about this gap.
What’s Missing: DeFi, Stablecoins, and Crypto ATMs
While the framework is broad, it’s incomplete. DeFi is ignored. Stablecoins aren’t regulated under a dedicated system-yet. The March 2025 Digital Asset Statement promised a Stored Value Facility (SVF) regime for stablecoins, but details aren’t out. That leaves businesses guessing. Should you treat USDT like a bank account? Like a security? Like cash? No one knows.
Crypto ATMs are another story. Australia has 1,800 of them-the most in Asia-Pacific. After a July 2025 crackdown that identified 90 scam victims, AUSTRAC set minimum standards: identity checks, location tracking, and a AUD 50,000 bonding requirement. Operators say it’s too high. In Texas, the bond is USD 25,000. But the regulator says it’s necessary. The Trustpilot rating for compliant ATMs is 3.2/5-mixed reviews, but clear enforcement.
Who’s Getting It Right-and Who’s Not
Independent Reserve, CoinSpot, and Swyftx control 68% of the Australian crypto market. Only 47% of domestic exchanges were fully compliant as of August 2025. That means more than half were still operating illegally.
Successful businesses share three traits:
- They started early-before 2024.
- They hired AML specialists with crypto experience, not just general compliance officers.
- They invested in blockchain analytics tools that can trace transactions across chains.
Failures? They assumed they could wait. They thought they were too small to matter. They used off-the-shelf software that didn’t handle crypto-specific risks. Now they’re either suspended, under investigation, or paying lawyers.
The Bigger Picture: Australia’s Place in the World
Compared to the U.S. and UAE, Australia is behind. The U.S. implemented the Travel Rule in 2021. The UAE has a clear licensing system for crypto firms. Singapore has a sandbox for testing new models. Australia has none of that.
Professor Ross Buckley from UNSW Law says Australia’s regulatory timeline is “lagging behind by 18-24 months.” That’s dangerous. If you’re a startup choosing where to launch, you’ll pick Singapore or Dubai-not Australia-unless you’re targeting Australian users.
But Australia has one advantage: it’s consistent. The rules apply to everyone the same way. No loopholes. No exceptions. If you’re serious about building a long-term crypto business in Australia, you have to play by these rules. There’s no shortcut.
What Comes Next
By December 2025, AUSTRAC, Treasury, ASIC, and the ACCC will finalize their joint framework. That’s when we’ll see:
- Formal licensing for Digital Asset Platforms (DAPs)
- Clear rules for stablecoins under the SVF regime
- Review of the regulatory sandbox
- Guidance on blockchain’s economic impact
Market size is growing fast. In 2025, Australia’s crypto services market hit AUD 4.7 billion. By 2027, KPMG projects it will hit AUD 7.3 billion-if regulation is clear. If it’s not? Growth stalls. Investors pull out. Startups leave.
The message is simple: if you’re in this space, compliance isn’t a cost. It’s the price of staying in business. The deadline is here. The rules are clear. The choice is yours.
Do I need to register with AUSTRAC if I only trade crypto-to-crypto?
Yes. Exchanging one virtual asset for another is one of the five regulated services under the AML/CTF Act. Even if you don’t handle Australian dollars, you must register with AUSTRAC and comply with all requirements, including the Travel Rule for transfers over AUD 1,000.
What happens if I don’t register by March 31, 2026?
Your business will be blocked from operating in Australia. AUSTRAC can shut down your website, freeze your bank accounts, and refer you to law enforcement. There are no warnings. No fines first. Just immediate shutdown. Any customers who try to use your service after that date will be at risk of dealing with an illegal entity.
Is DeFi regulated in Australia?
No, not yet. DeFi protocols-like decentralized exchanges or lending platforms without a legal entity-are not covered by current regulations. AUSTRAC says it regulates service providers, not technology. But if a DeFi project has a company behind it, that company must register. If it doesn’t, it operates in a legal gray zone with no protection or oversight.
How much does it cost to get AUSTRAC-compliant?
Costs vary by size. Small exchanges typically spend AUD 120,000-200,000 on software, legal help, and staff training. Larger platforms spend up to AUD 350,000. This includes blockchain analytics tools, customer due diligence systems, and compliance personnel. The registration fee itself is minimal, but the real cost is building a working AML/CTF program that meets AUSTRAC’s standards.
Can I use a foreign AML system to comply with AUSTRAC?
No. AUSTRAC requires a locally tailored AML/CTF program. Even if you’re compliant in the U.S., EU, or Singapore, you still need to meet Australia’s specific rules. This includes the Travel Rule, customer verification standards, and reporting thresholds. Foreign systems may help as a starting point, but they won’t be accepted as full compliance.
Do I need to report every transaction over AUD 1,000?
No. You don’t report every transaction-you must collect and verify the originator and beneficiary details for every transaction over AUD 1,000. Then, you monitor for suspicious patterns. If you see something unusual, you file a Suspicious Matter Report (SMR) with AUSTRAC. The Travel Rule is about data collection, not reporting every single transfer.
Are crypto ATMs regulated differently?
Yes. Crypto ATMs have specific rules under AUSTRAC’s July 2025 minimum standards. Operators must conduct identity checks, record transaction locations, and maintain a AUD 50,000 financial bond. These rules were introduced after a joint operation found 90 scam victims using ATMs to launder funds. Non-compliant ATMs have been shut down.
Can I operate as an individual without a company?
No. AUSTRAC only registers legal entities-companies, partnerships, or trusts. Individuals cannot register. If you’re running a crypto service as a sole trader, you must incorporate a company first. There are no exceptions.
