Australia

AUSTRAC — AML/CTF, DCE registration

ASIC — Securities, derivatives, financial products, design & distribution obligations

**Exchanges**: Must register as digital currency exchange providers with AUSTRAC under the AML/CTF Act 2006. If holding customer assets or facilitating trading in financial products (e.g., derivatives, tokenized securities), an AFSL from ASIC is required under the Corporations Act 2001 and the new Corporations Amendment (Digital Assets Framework) Bill 2025.[1][2][3]

**Custody Providers**: Require an AFSL for holding customer digital assets classified as financial products, especially "tokenized custody platforms" under the 2025 Bill. This applies to platforms safekeeping crypto or real-world assets tokenized on-chain.[1][2][3]

**Payment Processors**: No specific crypto license, but if issuing stablecoins or providing remittance-like services, AUSTRAC registration is needed; AFSL may apply if resembling financial products like payment instruments.[2][5]

**Capital**: No fixed minimum for AUSTRAC registration or basic exchanges, but AFSL requires "adequate capital" based on risk (assessed case-by-case by ASIC).[2][3]

**AML/KYC**: Mandatory AML/CTF program for AUSTRAC registrants, including KYC, transaction monitoring, suspicious activity reporting, record-keeping, and designated compliance officers.[2]

**Local Presence**: Must be a registered Australian company with an ABN; fit-and-proper directors/owners with clean backgrounds; robust governance, IT security, and risk controls.[2]

Other AFSL obligations: Client asset segregation, disclosures, dispute resolution, and custody standards.[1][3]

**AUSTRAC Registration**: Submit online via AUSTRAC portal with business details, AML/CTF program, ownership structure, and compliance evidence. Approval typically 4-6 weeks if complete.[2]

**ASIC AFSL Application**: Lodge via ASIC's online portal (Connect portal) with detailed business model, financials, risk management policies, compliance plan, and responsible managers' qualifications. Involves fitness checks, potential interviews; process takes 4-12+ months. Fees apply (~A$2,000-$8,000 base + ongoing levies).[2][5]

**Corporations Amendment (Digital Assets Framework) Bill 2025 (Exposure Draft)**: https://treasury.gov.au/consultation/c2022-259046 (related consultation); full bill via Parliament post-passage.

**ASIC Info Sheet 225 (Digital Assets)**: https://asic.gov.au/regulatory-resources/digital-transformation/digital-assets-financial-products-and-services/[5]

Enrolment and registration forms: https://www.austrac.gov.au/new-enrolment-and-registration-forms-austrac-online[1]

Specific VASP enrolment and registration: https://www.austrac.gov.au/new-austrac/enrol-or-register/register-us-remittance-or-virtual-asset-service-provider

Enrol or register overview: https://www.austrac.gov.au/new-austrac/enrol-or-register[8]

Checker tool to confirm if you need to enrol/register: https://www.austrac.gov.au/check-if-you-need-enrol-and-register[9]

**Digital currency exchanges (DCEs) and virtual asset service providers (VASPs) must enrol with AUSTRAC as reporting entities providing designated services under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006.** AUSTRAC QRG: Transitioning from DCE to VASPAUSTRAC: Register as remittance or VASP

**DCEs registered as reporting entities must transition to VASP registration by updating enrolment details between 31 March 2026 and 29 July 2026 to continue providing services.** AUSTRAC QRG: Transitioning from DCE to VASP

**VASPs must both enrol and register with AUSTRAC before providing virtual asset services; registration approval is required except under transitional rules for applications before 29 July 2026.** AUSTRAC: Register as remittance or VASP

**Providers of newly regulated virtual asset services must enrol and apply for registration by 29 July 2026; transitional rules allow continued services until AUSTRAC decides on pending applications.** AUSTRAC: Register as remittance or VASP

**Current enrolled and registered DCEs/VASPs must update registration details with additional information required under new laws, starting from 31 March 2026 and before next renewal.** AUSTRAC: Register as remittance or VASP

If you provide a **designated service** with a **geographical link to Australia**, you must enrol with AUSTRAC AUSTRAC.

Enrolment must occur **within 28 days of starting to provide a designated service** AUSTRAC.

**Remittance service providers** and **virtual asset service providers** must both enrol and register with AUSTRAC AUSTRAC.

Enrolment is completed via **AUSTRAC Online** after creating a user account; select "Enrol New Business" from the Business menu AUSTRAC.

Enrolment requires business details including **legal entity**, **ABN/ACN**, **principal place of business**, **designated services**, **key personnel** (e.g., AML/CTF Compliance Officer, directors), and reporting group information if applicable AUSTRAC.

New users sign up via AUSTRAC Online with email verification and multi-factor authentication (MFA) to access enrolment AUSTRAC.

Registration (for applicable entities like remittance providers) follows enrolment and requires additional details such as services, ownership, financial statements, and criminal history AUSTRAC.

As of April 29, 2026, generally lawyers, accountants, real estate agents, conveyancers, or dealers in precious metals/stones do not need to register (enrolment only if providing designated services). However, this is expected to change with AML/CTF reforms rolling in from 1 July 2026, which will significantly impact professional services compliance.

Travel rule requirements for new VASP services, including VASPs, are deferred until **July 1, 2026**.[3]

Reporting for transfers to unverified self-hosted wallets starts **March 31, 2029** for ordering institutions.[4]

A 3-year transition (March 31, 2026–March 30, 2029) applies to broader customer due diligence shifts.[3]

Ordering VASPs must collect/verify sender/recipient details, conduct due diligence on custodial vs. self-hosted wallets, screen for sanctions, confirm secure messaging, and share data with beneficiary VASPs.[3][4]

Policies required for ML/TF risk mitigation, especially for unlicensed wallets or non-FATF compliant entities.[4]

No mandated technology; challenges include interoperability and privacy laws.[2]

The Binance fine stands out as the largest quantified penalty and a landmark court ruling[1][3].

Recent FCA 2024/25 enforcement data now reports substantial detail on major fined actions, including aggregate fine totals and specific enforcement outcomes, so it is no longer accurate to say that penalty details are generally limited or that there are no other major fined actions with full details in the results.

Search results lack comprehensive coverage of all actions; additional minor warnings or investigations (e.g., 417 registered exchanges monitored) exist but are not individually significant[2].