On-shore VASP in Australia

VASP: DCE registration with AUSTRAC (1-3 months, no minimum capital). AFSL required if offering financial products (6-12 months, AUD 50K-5M+). Comprehensive reform proposed — Treasury 'token mapping' (2023), CASP-style authorization expected 2025-2026.

AUSTRAC — AML/CTF, DCE registration

ASIC — Securities, derivatives, financial products, design & distribution obligations

Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (2006) — AML/CTF, DCE registration

Corporations Act 2001 (2001) — Financial products regulation (AFSL), design & distribution obligations

EXCHANGE: DCE registration (AUSTRAC, AML-only) + AFSL if offering financial products. ASIC aggressive on crypto derivative issuers (design & distribution obligations). Debanking of crypto firms major issue — Senate inquiry 2023.

CUSTODY: AFSL required for crypto-related financial products; no standalone custody license yet. Reform will likely introduce dedicated custody framework.

Custody Providers: Require an AFSL for holding customer digital assets classified as financial products, especially "tokenized custody platforms" under the 2025 Bill. This applies to platforms safekeeping crypto or real-world assets tokenized on-chain.

Exchanges: Must register as digital currency exchange providers with AUSTRAC under the AML/CTF Act 2006. If holding customer assets or facilitating trading in financial products (e.g., derivatives, tokenized securities), an AFSL from ASIC is required under the Corporations Act 2001 and the new Corporations Amendment (Digital Assets Framework) Bill 2025.

Capital: No fixed minimum for AUSTRAC registration or basic exchanges, but AFSL requires "adequate capital" based on risk (assessed case-by-case by ASIC).

AML/KYC: Mandatory AML/CTF program for AUSTRAC registrants, including KYC, transaction monitoring, suspicious activity reporting, record-keeping, and designated compliance officers.

Local Presence: Must be a registered Australian company with an ABN; fit-and-proper directors/owners with clean backgrounds; robust governance, IT security, and risk controls.

Other AFSL obligations: Client asset segregation, disclosures, dispute resolution, and custody standards.

AUSTRAC Registration: Submit online via AUSTRAC portal with business details, AML/CTF program, ownership structure, and compliance evidence. Approval typically 4-6 weeks if complete.

ASIC AFSL Application: Lodge via ASIC's online portal (Connect portal) with detailed business model, financials, risk management policies, compliance plan, and responsible managers' qualifications. Involves fitness checks, potential interviews; process takes 4-12+ months. Fees apply (~A$2,000-$8,000 base + ongoing levies).

Digital currency exchanges (DCEs) and virtual asset service providers (VASPs) must enrol with AUSTRAC as reporting entities providing designated services under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006. AUSTRAC QRG: Transitioning from DCE to VASPAUSTRAC: Register as remittance or VASP

DCEs registered as reporting entities must transition to VASP registration by updating enrolment details between 31 March 2026 and 29 July 2026 to continue providing services. AUSTRAC QRG: Transitioning from DCE to VASP

VASPs must both enrol and register with AUSTRAC before providing virtual asset services; registration approval is required except under transitional rules for applications before 29 July 2026. AUSTRAC: Register as remittance or VASP

Enrolment must occur within 30 days of starting to provide a designated service AUSTRAC.

Reporting entities must develop and maintain an AML/CTF program tailored to their business, conduct customer due diligence, report suspicious transactions, and maintain required records

Travel Rule adopted — threshold: AUD 10,000 (threshold transaction reporting)

Evidence fact au.tax not found (may have been renamed).

Non-compliance penalties are severe: failing to enrol or register can result in fines up to AUD 210,000 for corporations and potential criminal charges, including imprisonment

The Binance fine stands out as the largest quantified penalty and a landmark court ruling.

AUSTRAC's actions affected the most entities, signaling broad sector crackdown.