Launching a cryptocurrency exchange or another virtual asset business in Australia requires more than incorporating a company. Founders must determine whether their activities fall within Australia’s anti-money laundering and counter-terrorism financing framework, prepare the necessary controls, and complete AUSTRAC registration where required.
AUSTRAC—the Australian Transaction Reports and Analysis Centre—is Australia’s financial intelligence unit and anti-money laundering regulator. For businesses providing regulated virtual asset services, it is central to market entry. However, what is often marketed as an AUSTRAC “licence” is a registration, and you should understand its scope before a project begins accepting customers.
AUSTRAC licence or registration: understanding the difference
In the legal services market, “AUSTRAC licence” is commonly used as shorthand for registration with AUSTRAC. It should not be confused with an Australian financial services licence or treated as general permission to provide every type of financial service.
The relevant obligations arise under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 and associated rules. Enrolment as a reporting entity and registration as a virtual asset service provider (“VASP”) or remittance service provider are related but distinct requirements. Businesses providing registrable services must complete both processes through AUSTRAC Online.
The appropriate registration depends on the activities performed. A crypto business may need VASP registration, while a business providing registrable remittance services must address the applicable remittance registration requirements. A business offering both types of service needs to assess both regimes.
Registration establishes the business’s status under the AML/CTF framework. It does not replace any other authorisation required for its products or services. Those requirements must be assessed separately.
Get Legal Clarity for Your Business
Practical legal guidance for your next step.
Does crypto-to-crypto exchange require AUSTRAC registration?
Founders should no longer assume that only exchanges between cryptocurrency and fiat currency require registration. Australia’s 2026 AML/CTF reforms expanded the framework beyond the former digital currency exchange (“DCE”) model.
Regulated virtual asset activities now include exchanging virtual assets for money and vice versa, exchanging one virtual asset for another, certain transfer services, virtual asset safekeeping, and certain financial services connected with the offer or sale of virtual assets.
Existing registered DCE providers automatically transitioned to VASP registration from 31 March 2026. Businesses entering the market must assess their activities against the current rules rather than treating the former DCE framework as the complete position.
For a platform offering exclusively crypto-to-crypto exchange, the absence of fiat transactions is therefore not, by itself, a basis for avoiding AUSTRAC registration. The assessment must consider the service provided, the geographical link to Australia and any applicable exclusions or exemptions.
AUSTRAC registration requirements
Corporate structure and Australian presence
An Australian proprietary limited company, commonly described as a Pty Ltd company, is one possible structure for establishing local operations. Where this structure is used, at least one director must ordinarily reside in Australia. The director must understand and perform the role’s legal duties; appointing a local director does not replace effective governance.
However, incorporating an Australian subsidiary is not the only possible way a business may fall within the AML/CTF framework. AUSTRAC’s geographical-link guidance also covers foreign entities providing designated services through an Australian permanent establishment, including a branch or office.
The appropriate structure should therefore follow an assessment of where activities are conducted, who provides the services and how the Australian operation will function. Founders should avoid treating an Australian address or resident director as a substitute for that assessment.
A business-specific AML/CTF program
A tailored AML/CTF program is central to operating a regulated crypto business in Australia. Under the current framework, the program includes a documented money laundering, terrorism financing, and proliferation financing risk assessment, along with policies, procedures, systems, and controls to manage those risks.
The program must be in place before the business starts providing designated services and must be approved by a senior manager. It must also be implemented, reviewed and updated, with periodic independent evaluations.
For a cryptocurrency exchange, the documentation should reflect its actual services, customer base, geographical exposure and transaction channels. Customer due diligence, transaction monitoring, escalation and staff training should be designed around those risks.
The former description of every program as a mandatory Part A and Part B document should not be used as the complete explanation of the reformed framework. A generic template also cannot demonstrate that a business has assessed its own risks or implemented suitable controls.
Ownership and key personnel
Applicants should prepare clear information about ownership, control and key personnel. AUSTRAC’s registration guidance identifies supporting materials such as ownership and control charts, risk assessments, AML/CTF policies and evidence of personnel due diligence.
Depending on the circumstances, background-check evidence may include national police certificates, police history checks, statutory declarations or other checks undertaken by the business. It is more accurate to assess the evidence required for the people and structure involved than to assume that every applicant must submit an identical police-check package.
AUSTRAC reporting and operational obligations
AUSTRAC registration begins an ongoing compliance relationship. The business must maintain its controls and meet the reporting obligations applicable to its services.
Threshold transaction reports (“TTRs”) concern designated services involving transfers of A10,000ormoreinphysicalcurrency,ortheequivalentinforeigncurrency.Thethresholdreferstocash,ratherthaneverydigitaltransactionworthA10,000. A TTR must generally be submitted within 10 business days after the transaction day. This is particularly relevant when assessing cash-based services, including crypto ATM operations.
Suspicious matter reports (“SMRs”) are a separate obligation. A reporting entity must assess whether it has formed a suspicion on reasonable grounds of a matter covered by the legislation. An unusual transaction is a reason to investigate; it is not automatically proof of wrongdoing. General reporting deadlines are 24 hours after forming a terrorism-financing suspicion, or three business days after forming another reportable suspicion. Specific statutory exceptions require separate assessment.
Businesses must also meet applicable record-keeping, customer due diligence and compliance-reporting requirements. These responsibilities require operating procedures and accountable personnel, not policies prepared solely for the registration application.
Does every registered business pay the AUSTRAC industry contribution?
No. The AUSTRAC industry contribution levy does not automatically apply to every registered cryptocurrency business.
Liability depends on the relevant criteria, including earnings and the number and value of reported transactions. AUSTRAC explains that the levy usually applies to medium and large businesses. It should therefore be assessed separately from registration and ongoing compliance costs, rather than described as an unavoidable annual charge for every startup.
AUSTRAC registration process and timelines
Before submitting an application, founders should identify the registrable services, settle the operating structure, prepare ownership and personnel information, and develop the required risk assessment and AML/CTF policies. Consistency between the application, compliance documents and actual business model matters throughout the assessment.
AUSTRAC states that it may take up to 90 days to assess a registration application. If further information is requested, that period resets from the date the information is provided. This should not be presented as a guaranteed launch within one to three months.
An application may be approved, approved with conditions or refused. A new business should not begin providing registrable services simply because it has submitted an application; it must obtain registration approval before commencing those services, subject to any applicable transitional arrangements.
A practical launch plan should distinguish between corporate setup, application preparation, regulatory assessment and operational readiness. Each stage can have its own dependencies.
Banking and payment arrangements for crypto businesses
Registration with AUSTRAC does not guarantee that a bank or payment provider will accept the business. Banking onboarding is a separate process, and the provider must assess whether the proposed activity fits its own requirements and risk appetite.
Founders should therefore prepare their banking strategy alongside the AUSTRAC registration process. Useful materials include an explanation of the business model, ownership structure, expected transaction flows, customer markets and AML/CTF controls.
Potential arrangements may involve banks, payment providers or other financial infrastructure partners. Each option should be assessed for the services it can legally provide, its willingness to support the proposed crypto activities, settlement arrangements and operational restrictions. A provider’s fintech branding alone is not evidence that it can support the business.
How Manimama Law Firm can help
Preparing for crypto business registration in Australia requires coordination between corporate structuring, regulatory analysis and practical compliance work.
Manimama Law Firm supports businesses with structuring, registration documentation, tailored AML/CTF policies and communication with AUSTRAC. Our work focuses on aligning the application with the services the business intends to provide and preparing for the compliance obligations that continue after registration.
Contact information
Leave a request, and we will assemble not just candidates, but a team that will work toward a common goal.
If you want to become our client or partner, write to us at support@manimama.eu.
Or use our Telegram @ManimamaBot and we will respond to your request.
Join our Telegram to receive news in a convenient way: Manimama Legal Channel.
Disclaimer: The information provided in this article is intended for general informational purposes only and should not be considered as individual legal advice. For legal assistance tailored to specific circumstances, it is recommended to seek professional legal counsel.
