Crypto License in Australia 2026: AUSTRAC, ASIC & the Digital Assets Framework

AUSTRAC, the Australian Transaction Reports and Analysis Centre, is the AML/CTF regulator and financial-intelligence unit. Under the AML/CTF Act 2006, any person providing a designated service with a geographical link to Australia must enrol with AUSTRAC before commencing; entities providing virtual-asset designated services (such as DCE/VASPs) must also be registered before providing the service. Mandatory Digital Currency Exchange (DCE) registration commenced on 3 April 2018 following Royal Assent of the AML/CTF Amendment Act 2017. From 31 March 2026 existing DCE providers were auto-rolled into the new VASP framework under the AML/CTF Transitional Rules 2026, and new VASP enrolment opened. AUSTRAC’s remit covers customer due diligence, transaction-monitoring, suspicious-matter and threshold-transaction reporting (TTRs above A$10,000), record-keeping for seven years, and, from 1 July 2026, the Travel Rule on every virtual-asset transfer with no de-minimis threshold.

The Australian Securities and Investments Commission (ASIC) licences financial-services conduct through the AFSL. Historically, ASIC’s regulation of crypto was primarily engaged where the arrangement was a financial product (derivatives, MIS interests, certain stablecoins), although ASIC also used general consumer-law and market-integrity powers in adjacent cases. Under the Corporations Amendment (Digital Assets Framework) Act 2026, ASIC’s perimeter expands to capture Digital Asset Platforms (DAPs) and Tokenised Custody Platforms (TCPs); the draft de-minimis thresholds discussed in advisory commentary are A$5,000 per customer and A$10M annual volume, with the precise statutory mechanics set by rules under the Act. ASIC’s Service Charter targets are 150 days for 70% of complete applications and 240 days for 90% — roughly 5–8 months in practice, although actual timeframes vary by file. AFCA membership is a precondition to lodging.

• AML/CTF Act 2006 — the principal Australian AML/CTF statute. Sets the reporting-entity framework, designated-services list, CDD obligations and AUSTRAC’s enforcement powers. An entity providing a virtual-asset designated service under the AML/CTF Act 2006 is a reporting entity for that service (the Act itself does not use the term “VASP”).
• AML/CTF Amendment Act 2024 — received Royal Assent on 10 December 2024. Introduces new virtual-asset designated services and extends the Travel Rule to VASPs, commencing 1 July 2026. AUSTRAC’s AML/CTF Transitional Rules 2026 govern the migration.
• Corporations Amendment (Digital Assets Framework) Act 2026 — received Royal Assent 8 April 2026; commences 9 April 2027. Creates the DAP and TCP statutory categories in the Corporations Act and makes the AFSL mandatory once de-minimis thresholds are exceeded. ASIC’s 18-month implementation roadmap runs from Royal Assent, with full compliance required by roughly October 2027.
• ASIC INFO 225 — updated 29 October 2025 to cover digital-asset businesses; on the same date ASIC issued a separate class no-action letter. Operators must lodge a complete AFSL application by 30 September 2026 to rely on the no-action position.
• Financial Transaction Reports Act 1988 — REPEALED on 7 January 2025, 28 days after Royal Assent of the AML/CTF Amendment Act 2024. Its obligations are now subsumed into the AML/CTF Act 2006; legacy FTR records remain subject to confidentiality and retention rules.

Track 1 covers operators who stay below both de-minimis thresholds: no customer holds more than A$5,000 of digital assets with you, and annual transaction volume stays under A$10M. Exceeding either number flips you into Track 2. There is no “average” calculation, no grace period, and no rounding. AUSTRAC DCE/VASP registration remains mandatory: you submit the application, pass fit-and-proper checks, and operate under the AML/CTF Act 2006 with full Travel Rule obligations from 1 July 2026.

This track suits brokers, OTC desks, and niche retail platforms that can credibly cap individual balances and turnover. The trade-off is hard ceilings on commercial growth. The first customer who deposits A$5,001, or the first month that pushes annual volume over A$10M, moves the business into Track 2 retroactively, so prepare the AFSL pathway before you reach either limit.

Track 2 is the mainstream exchange path under the Digital Assets Framework. Once either threshold is breached, the business operates a Digital Asset Platform (DAP) as defined in the Corporations Act and must hold an Australian Financial Services Licence from ASIC alongside its AUSTRAC registration. The deadline matters: existing operators must lodge a complete AFSL application by 30 September 2026 to retain ASIC’s class no-action protection during DAF transition. Miss that date and you lose the safe-harbour while the application is processed.

AFCA membership is a precondition for digital-asset AFSL applicants serving retail clients: you must join the Australian Financial Complaints Authority before lodgement, not after. ASIC’s Service Charter targets 150 days for 70% of complete applications and 240 days for 90%, so realistic end-to-end is 6 to 12 months. See the 30 September 2026 deadline breakdown and AUSTRAC’s VASP registration page for the concurrent workstreams.

Track 3 is the new statutory category created by the DAF Act 2026: Tokenised Custody Platforms (TCPs) that issue tokens representing custodied real-world assets such as tokenised gold, tokenised equities, or tokenised fund units. TCP sits alongside DAP as a parallel regulated entity type in the Corporations Act. If your model is “customer deposits an asset, we issue a token that represents it”, you are a TCP, not a DAP, and the AFSL authorisations you need differ accordingly. Custodial/depository service authority brings RG 166 Net Tangible Asset requirements scaling up to AUD 10M.

Operationally, TCP applicants face the same 30 September 2026 lodgement deadline for no-action coverage, the same AUSTRAC DCE/VASP registration, and the same DAF timeline: the DAF Act commences 9 April 2027, with full compliance expected by approximately October 2027 at the end of ASIC’s 18-month implementation roadmap measured from Royal Assent. Choose this track only if your token genuinely represents a custodied off-chain asset. Mislabelling a DAP as a TCP triggers the wrong authorisation set and forces a re-application.

The standard vehicle is an Australian proprietary limited company (Pty Ltd) incorporated under the Corporations Act 2001. ASIC issues an Australian Company Number (ACN) on incorporation, and an Australian Business Number (ABN) is required to operate.

• Resident director — at least one director must ordinarily reside in Australia under s 201A of the Corporations Act 2001. Every director must be 18 or older, consent in writing, and not be disqualified under Part 2D.6.
• ACN + ABN — ACN is issued automatically by ASIC on incorporation; the ABN is required for tax, GST and operational purposes and is expected by AUSTRAC for virtual asset designated services.
• Registered Australian address — a real Australian street address able to receive legal documents. A virtual office with genuine hot-desk access proportionate to team size is acceptable; a PO Box is not.

This is the biggest area where market commentary misleads applicants. The AFSL capital requirements that actually bind a digital-asset business come from RG 166, not from the share-capital line on the company's constitution.

RG 166 tests AFSL applicants on two layers: a qualitative “adequate resources” test under s 912A(1)(d), plus prescribed quantitative minimums that scale with the authorisations sought. For digital-asset platforms holding client money or providing custody, the prescribed minimums look like this:

The practical takeaway: budget for an operating bank balance of at least AUD 150,000 in cash from day one, and size NTA against the custody and client-money flows you actually intend to run.

Every DCE/VASP applicant must lodge a board-approved AML/CTF program with AUSTRAC. From 31 March 2026, the legacy Part A / Part B split was removed. AUSTRAC now expects a single, integrated, risk-based program proportionate to the nature, size and complexity of the business, with these minimum components in place before enrolment:

• Fit-and-proper compliance officer — a designated AML/CTF Compliance Officer who satisfies the fit-and-proper test and is responsible for implementing the program, notified to AUSTRAC.
• ML/TF/PF risk assessment — documented assessment of money laundering, terrorism financing and proliferation financing risks across customers, products, channels and jurisdictions.
• KYC/CDD procedures — identification, verification and ongoing customer due diligence aligned with the AML/CTF Act 2006.
• Transaction monitoring — rules-based and behavioural monitoring feeding into Suspicious Matter Reports and Threshold Transaction Reports.
• Internal audit — independent review of the AML/CTF program, conducted at a frequency proportionate to risk.
• Board-approved policy — the AML/CTF program itself must be adopted and signed off by the company's board.

AUSTRAC reviews the suitability of directors, beneficial owners and the AML/CTF Compliance Officer as part of DCE/VASP enrolment. The single most-misquoted requirement here is the age of police checks.

• National Police Certificates — must be issued within 6 months prior to the application date, not 12. Older certificates are rejected and force a re-application loop.
• Coverage — checks are required for each director, the AML/CTF Compliance Officer, and beneficial owners holding 25% or more.
• Foreign-resident officers — equivalent overseas police certificates, with certified translations where applicable, also within the 6-month window.

Membership of the Australian Financial Complaints Authority is mandatory for any digital-asset AFSL applicant serving retail clients. The AFCA application must be accepted, not merely submitted, before the AFSL is lodged.

• Who must join — retail-facing digital-asset operators. Wholesale-only operators serving sophisticated investors are not required to enrol.
• Sequencing — AFCA acceptance is a precondition to relying on ASIC’s class no-action position by 30 September 2026; treat onboarding as an early workstream, not a closing step.
• Run-off cover — members must remain in AFCA for at least 1 year after ceasing the retail digital-asset service to handle any tail complaints.

The AUSTRAC Travel Rule commenced on 1 July 2026 under the AML/CTF Amendment Act 2024. From that date, every virtual-asset transfer your VASP makes or receives must carry prescribed originator and beneficiary information, and you must perform counterparty due diligence on the receiving VASP before releasing funds. See AUSTRAC — Travel Rule overview for the binding scope.

Your VASP must (a) collect and transmit the legally required data fields on outbound transfers, (b) screen inbound transfers for completeness and sanctions exposure, and (c) maintain a counterparty VASP due-diligence file you can produce on AUSTRAC request. Plan integrations against a travel-rule messaging protocol (TRP, IVMS 101, or equivalent) before go-live.

VASPs file three principal report types with AUSTRAC, each with its own trigger and timing. These obligations apply in addition to ASIC reporting if you also hold an AFSL.

• TTR — Threshold Transaction Reports — physical-currency transactions of A$10,000 or more (or foreign-currency equivalent). See AUSTRAC — Threshold transaction reports.
• SMR — Suspicious Matter Reports — no value threshold; filed whenever you form a reasonable suspicion that a transaction relates to a money-laundering, terrorism-financing or proceeds-of-crime concern.
• IFTI — International Funds Transfer Instructions — required for instructions to transfer money or property into or out of Australia, in either direction.

From 1 July 2026, AUSTRAC releases new TTR and SMR forms; legacy XML and web-form formats are deprecated on the same date. New VASPs and existing reporting entities must use the new forms from day one, so budget engineering time to switch over before the cut-off. Full details: AUSTRAC — Changes to transaction reporting.

Australia runs three separate retention clocks, and your records-management policy needs to track all three: AML/CTF records, ATO tax records, and AUSTRAC change-of-details notifications.

Design archival around the longest applicable clock (7 years for AML/CTF) and treat the 5-year ATO window as a subset. Some CGT cost-base records must be retained beyond 5 years, so consult your tax adviser before deleting any acquisition or disposal documentation.

Every VASP must formally appoint an AML/CTF Compliance Officer, document the appointment in its AML/CTF program, and notify AUSTRAC. The Compliance Officer reports to the board on AML/CTF performance and produces the annual compliance report that AUSTRAC may inspect on request.

• Formal appointment — named individual recorded in the AML/CTF program with defined authority and reporting lines.
• Board reporting — periodic written reports on AML/CTF risk, incidents, and program performance to the board or governing body.
• Annual compliance report — submitted to AUSTRAC each reporting cycle covering the entity’s AML/CTF activity for the year.
• Notification deadlines — existing reporting entities were required to notify AUSTRAC by 30 May 2026 (already passed); new VASP entrants notify within their enrolment timeline.

Australia operates a two-tier corporate income tax. The lower 25% base-rate-entity rate applies only where the company satisfies both conditions: (a) aggregated turnover under AUD 50 million, and (b) no more than 80% of assessable income classified as base-rate-entity passive income (BREPI: interest, dividends, royalties, net capital gains, etc.). Companies failing either test pay the standard 30%. Turnover alone is not the test: a small crypto holding company that earns most of its income from passive token yields can be pushed to the 30% bracket even with sub-AUD 50M revenue. See the ATO company tax rate changes guidance for the BREPI mechanics.

Australia’s headline GST rate is 10%. Since 1 July 2017, crypto-to-fiat and crypto-to-crypto exchanges have been treated as input-taxed financial supplies. The exchange does not charge GST to the user, and customer-facing transactions are effectively GST-free. The trade-off is that exchanges cannot claim full input tax credits on their acquisitions related to those supplies, which affects how operators recover GST on infrastructure, software, and professional services. Full guidance at the ATO — GST and digital currency exchanges.

CGT applies on the disposal of crypto held on capital account, including sale for fiat, swaps for other crypto, gifts, and use to purchase goods or services. Resident individuals (and trusts) who hold crypto on capital account for at least 12 months are entitled to the 50% CGT discount on the resulting gain. A scheduled reform takes effect from 1 July 2027, replacing the flat 50% discount with a CPI-plus-30% model; the existing 50% discount remains in force for the FY 2025–26 income year. See ATO — Crypto asset investments.

Founders, directors, and Australian-resident employees of a crypto business are taxed at progressive personal rates. The brackets for FY 2025–26 (resident individuals) are:

A Medicare levy of 2% applies in addition to the brackets above (low-income thresholds and exemptions apply). Source: ATO — Tax rates for Australian residents.

The ATO distinguishes sharply between three activities:

• Staking rewards — treated as ordinary income at the market value of the tokens on receipt, regardless of whether the holder later disposes of them.
• Crypto mining as a business — mined tokens are ordinary (business) income; trading stock rules apply, and operating expenses are deductible.
• Hobby mining — not ordinary income. Mined coins are taxed under CGT on disposal with a cost base of zero, so the full sale proceeds are the capital gain.

Misclassifying hobby activity as a business (or vice versa) is a common audit trigger. See ATO — Staking rewards and airdrops.

The AUSTRAC industry contribution levy is a sector-funding charge payable by reporting entities that either have earnings of AUD 100 million or more in the most recent financial year, or file a large volume or value of transaction reports. Meeting either condition is enough to trigger the levy. AUSTRAC estimates that only around 5% of reporting entities meet the threshold in any given year, so most early-stage DCE/VASP operators are out of scope at launch but should plan for the levy as transaction volume scales. Full mechanics at AUSTRAC — Industry contribution levy.