Custodial wallet / SaaS in Australia

AUSTRAC — AML/CTF, DCE registration

ASIC — Securities, derivatives, financial products, design & distribution obligations

Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (2006) — AML/CTF, DCE registration

Corporations Act 2001 (2001) — Financial products regulation (AFSL), design & distribution obligations

VASP: DCE registration with AUSTRAC (1-3 months, no minimum capital). AFSL required if offering financial products (6-12 months, AUD 50K-5M+). Comprehensive reform proposed — Treasury 'token mapping' (2023), CASP-style authorization expected 2025-2026.

CUSTODY: AFSL required for crypto-related financial products; no standalone custody license yet. Reform will likely introduce dedicated custody framework.

EXCHANGE: DCE registration (AUSTRAC, AML-only) + AFSL if offering financial products. ASIC aggressive on crypto derivative issuers (design & distribution obligations). Debanking of crypto firms major issue — Senate inquiry 2023.

AUSTRAC (Australian Transaction Reports and Analysis Centre) is the primary regulator responsible for administering Australia's anti-money laundering and counter-terrorism financing regime

Reporting entities must enrol with AUSTRAC if they provide a designated service with a geographical link to Australia

Remittance service providers and virtual asset service providers must both enrol and register with AUSTRAC

Custody Providers: Require an AFSL for holding customer digital assets classified as financial products, especially "tokenized custody platforms" under the 2025 Bill. This applies to platforms safekeeping crypto or real-world assets tokenized on-chain.

Capital: No fixed minimum for AUSTRAC registration or basic exchanges, but AFSL requires "adequate capital" based on risk (assessed case-by-case by ASIC).

AML/KYC: Mandatory AML/CTF program for AUSTRAC registrants, including KYC, transaction monitoring, suspicious activity reporting, record-keeping, and designated compliance officers.

Local Presence: Must be a registered Australian company with an ABN; fit-and-proper directors/owners with clean backgrounds; robust governance, IT security, and risk controls.

Other AFSL obligations: Client asset segregation, disclosures, dispute resolution, and custody standards.

AUSTRAC Registration: Submit online via AUSTRAC portal with business details, AML/CTF program, ownership structure, and compliance evidence. Approval typically 4-6 weeks if complete.

ASIC AFSL Application: Lodge via ASIC's online portal (Connect portal) with detailed business model, financials, risk management policies, compliance plan, and responsible managers' qualifications. Involves fitness checks, potential interviews; process takes 4-12+ months. Fees apply (~A$2,000-$8,000 base + ongoing levies).

ASIC Info Sheet 225 (Digital Assets): https://asic.gov.au/regulatory-resources/digital-transformation/digital-assets-financial-products-and-services/

DCEs registered as reporting entities must transition to VASP registration by updating enrolment details between 31 March 2026 and 29 July 2026 to continue providing services. AUSTRAC QRG: Transitioning from DCE to VASP

VASPs must both enrol and register with AUSTRAC before providing virtual asset services; registration approval is required except under transitional rules for applications before 29 July 2026. AUSTRAC: Register as remittance or VASP

Providers of newly regulated virtual asset services must enrol and apply for registration by 29 July 2026; transitional rules allow continued services until AUSTRAC decides on pending applications. AUSTRAC: Register as remittance or VASP

Enrolment must occur within 30 days of starting to provide a designated service AUSTRAC.

Reporting entities must develop and maintain an AML/CTF program tailored to their business, conduct customer due diligence, report suspicious transactions, and maintain required records

Enrolment must occur before commencing designated services or within 28 days of starting the service

Registration is an additional requirement for higher-risk designated services (remittance and virtual asset services) and involves more detailed application and closer AUSTRAC scrutiny

AUSTRAC registration is mandatory for digital currency exchanges under AML/CTF rules, with ASIC licensing applying when services involve financial products like custody or derivatives.

Non-compliance penalties are severe: failing to enrol or register can result in fines up to AUD 210,000 for corporations and potential criminal charges, including imprisonment

The Binance fine stands out as the largest quantified penalty and a landmark court ruling.

AUSTRAC's actions affected the most entities, signaling broad sector crackdown.