How to Register with AUSTRAC in Australia VASP / DCE Registration & AML/CTF Checklist

If you operate or plan to launch a cryptocurrency exchange, wallet service, or any other virtual-asset business with an Australian nexus, AUSTRAC registration in Australia is a mandatory legal prerequisite. The 2025–2026 reforms to the Anti-Money Laundering and Counter-Terrorism Financing framework have formalised Virtual Asset Service Provider (VASP) regulation, expanded the scope of designated services, and introduced a publicly searchable register that banks, institutional partners, and customers now routinely check before onboarding a crypto counterparty. Non-registration is not merely an administrative oversight it exposes operators to criminal penalties, civil enforcement action, and the practical inability to maintain banking relationships in Australia.

This attorney-authored guide consolidates every step, document requirement, timeline, and compliance obligation into a single, actionable resource. It is published by Global Law Experts and reflects the legislative position as at mid-2026.

At a Glance Who Must Register and Why It Matters

• Registration trigger: Any person or entity that provides designated digital currency exchange or virtual asset services with an Australian connection must enrol and register with AUSTRAC before offering those services to customers.
• Public register: AUSTRAC now maintains a publicly searchable register of registered providers. Appearing on this register is increasingly treated as a baseline due-diligence requirement by banking partners, payment processors, and counterparties.
• Travel Rule obligations: The rollout of Travel Rule requirements for virtual-asset transfers means that registered providers must collect, verify, and transmit originator and beneficiary information raising the operational bar and the reputational cost of non-compliance.

Regulatory risk: Operating without AUSTRAC registration can result in criminal prosecution (penalties of up to two years’ imprisonment and significant fines), civil penalty orders, remedial directions, and enforceable undertakings. Perhaps equally damaging, unregistered operators will find it almost impossible to open or retain Australian bank accounts.

What You’ll Find in This Guide

This page is structured to take you from initial eligibility assessment through to post-registration compliance. Specifically, it covers:

1. A 10-step practical registration process with document requirements and compliance milestones.
2. An eligibility checklist identifying who must and who need not register.
3. A comparison of AUSTRAC registration versus AFSL licensing, with a decision table.
4. Realistic timelines, common pitfalls, and cost considerations.
5. A downloadable one-page AUSTRAC registration checklist.
6. Anonymised case examples illustrating real-world registration projects.
7. A comprehensive FAQ section addressing the most common questions about AUSTRAC registration in Australia.

Legal Basis and Recent Reform Snapshot

AUSTRAC registration obligations are grounded in the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act), as amended. The 2025–2026 reforms brought the VASP regime into closer alignment with FATF and FSB guidance on virtual assets, introduced the Travel Rule for virtual-asset transfers, and expanded the definition of designated services to capture a broader range of crypto activities. Operators should treat the AUSTRAC explanatory statements to the AML/CTF Rules as essential reading for understanding the scope and mechanics of these changes.

How to Register with AUSTRAC 10 Practical Steps for VASPs and DCEs

The following step-by-step process covers AUSTRAC registration from initial eligibility screening through to post-registration compliance obligations. Each step identifies the key actions, documents, and regulatory references you will need.

Step 1 Eligibility Check: Are You a DCE or VASP?

Begin by determining whether your business provides a designated service under the AML/CTF Act. A designated service in the digital-currency context includes exchanging digital currency for fiat (or vice versa), exchanging one digital currency for another, transferring virtual assets on behalf of another person, and providing custodial or safekeeping services for virtual assets. The territorial nexus is critical: if the service is provided through a permanent establishment in Australia, to or from an Australian customer, or using Australian infrastructure, registration is required. Note that operating a self-hosted (non-custodial) wallet alone without providing exchange or transfer services for or on behalf of another person does not ordinarily trigger a registration obligation, though this boundary is narrow and fact-specific.

Step 2 Enrol Versus Register: Understand the Two-Stage Process

AUSTRAC operates a two-stage system. First, you must enrol via AUSTRAC Online, which gives your business access to AUSTRAC’s reporting and compliance portal. Second, you must apply for registration on the DCE/VASP Register. Enrolment is an administrative gateway; registration is the substantive regulatory step that places your business on the public register and authorises you to provide designated services. Existing DCE registrations have a three-year life and must be renewed before expiry failure to renew means the business drops off the register and must cease providing designated services.

Step 3 Assemble Required Company and Identity Documents

Prepare the following before submitting your application:

• Corporate records: Certificate of incorporation, current ASIC extract, ACN/ABN, registered office details, and constitution.
• Ownership and control: A beneficial-ownership table identifying every individual who holds 25% or more of the entity (or exercises significant control), with verified identity documents for each.
• Proof of authority: A signed resolution or letter authorising the applicant to act on behalf of the entity, plus identification of the nominated contact officer.
• Business description: A clear description of the designated services to be provided, target customer segments, jurisdictions of operation, and projected transaction volumes.

AUSTRAC’s Business Profile Form (ABPF) explanatory guide provides field-by-field instructions for completing enrolment and registration forms.

Step 4 Develop Your AML/CTF Program

Every registered VASP must have a written, board-approved AML/CTF program before commencing operations. The program must include two parts: Part A (customer identification and verification procedures) and Part B (an assessment of money-laundering and terrorism-financing risks specific to your business). Key elements include customer risk ratings, transaction-monitoring rules, escalation procedures, staff training schedules, and a requirement for independent review (audit or assurance) at intervals prescribed by the AML/CTF Rules. Board-level sign-off is not optional AUSTRAC expects evidence that the governing body has reviewed and endorsed the program.

Step 5 KYC, Customer Due Diligence, and Enhanced Due Diligence

Your AML/CTF program must operationalise robust Know Your Customer (KYC) and Customer Due Diligence (CDD) procedures. At a minimum, this means verifying the identity of every customer before providing a designated service, using reliable and independent source documents or electronic verification. For high-risk customers including politically exposed persons (PEPs), customers from high-risk jurisdictions, and customers with complex ownership structures enhanced due diligence (EDD) procedures must be applied. Ongoing customer due diligence, including transaction monitoring and periodic re-verification, is mandatory.

Step 6 Recordkeeping and Systems Readiness

Registered providers must retain prescribed records for a minimum of seven years. Records include customer identification data, transaction records, AML/CTF program documents, and suspicious-matter reports. Your systems must be capable of generating reports in the formats required by AUSTRAC Online including threshold transaction reports (TTRs), international funds transfer instructions (IFTIs), and suspicious matter reports (SMRs). Investing in a compliant record-management system before registration avoids remediation orders post-registration.

Step 7 Understand Your Reporting Obligations

Registered VASPs have ongoing reporting obligations to AUSTRAC, including:

• Threshold transaction reports (TTRs): Required for transactions of AUD 10,000 or more (or the foreign-currency equivalent).
• Suspicious matter reports (SMRs): Must be submitted within prescribed timeframes whenever you form a suspicion on reasonable grounds that a transaction may be related to an offence, tax evasion, or proceeds of crime.
• Cross-border transfer notices: Required for international virtual-asset transfers, aligned with the Travel Rule framework.

Failure to report is an offence. AUSTRAC’s amended AML/CTF Rules detail the reporting cadence, formats, and exemptions.

Step 8 Travel Rule Readiness

The Travel Rule requires registered VASPs to collect, verify, and transmit originator and beneficiary information when facilitating virtual-asset transfers. Key data points include names, account identifiers, and (for transfers above applicable thresholds) addresses and identification numbers. Exemptions apply in limited circumstances for example, transfers to or from self-hosted wallets may attract modified obligations. Transitional dates and operational guidance have been published by AUSTRAC; industry observers expect full enforcement from 1 July 2026 in line with the transitional rules. Evaluate vendor solutions for Travel Rule messaging interoperability early: this is a technical build that takes weeks to implement, test, and certify.

Step 9 Submit the Application

Once your compliance infrastructure is in place, submit the registration application through AUSTRAC Online. Common form fields include entity details, registrable information (services to be provided, jurisdictions, ownership), attestations regarding compliance-program readiness, and declarations by responsible persons. There is no government fee for AUSTRAC registration itself, but budget for legal, compliance, and system costs. Ensure every field is completed accurately incomplete applications are the most common cause of processing delays.

Step 10 Post-Registration Compliance

Registration is the beginning, not the end, of your compliance obligations. Immediately upon registration:

• Appoint an AML/CTF compliance officer with appropriate seniority and authority.
• Notify AUSTRAC of any changes to registrable details (ownership, services, contact information) within the prescribed timeframe.
• Maintain your registration: DCE registrations expire after three years renewal applications must be lodged before expiry to avoid dropping off the register.
• Schedule independent reviews of your AML/CTF program at intervals required by the Rules.

Practical Templates and Downloadable Forms

To support your application, AUSTRAC publishes the Business Profile Form (ABPF) explanatory guide for enrolment and registration. A one-page AUSTRAC registration checklist (PDF) consolidating every document and milestone referenced in this guide is available for download see the checklist section below.

Who Must Register Eligibility Checklist

Under the AML/CTF Act and associated Rules, AUSTRAC registration is required if all three of the following conditions are met:

• Designated service: You provide one or more designated services involving digital currency or virtual assets including exchange, transfer, safekeeping, or administration of virtual assets for or on behalf of another person.
• Australian connection: The service is provided through a permanent establishment in Australia, to an Australian customer, or the service is otherwise connected with Australia under the Act’s geographic nexus tests.
• For or on behalf of another: You provide the service for or on behalf of another person (not solely for your own account).

Quick win: Run the three-part test above against every product and service in your offering within 48 hours. If even one product triggers all three conditions, begin the enrolment process immediately.

When You Do NOT Need to Register

Certain activities and entities fall outside the registration requirement. Common exemptions and borderline cases include:

• Self-hosted (non-custodial) wallet providers: If you provide software that enables users to hold and manage their own private keys without custody or transfer services, registration is generally not required. However, if your platform facilitates exchanges or transfers for users, the exemption will not apply.
• Narrow foreign wholesale services: Offshore entities providing services exclusively to wholesale counterparties with no Australian customer-facing operations may fall outside the territorial nexus though this is assessed on a case-by-case basis.
• Class orders and AFSL exemptions: Certain exemptions under s911A(2) of the Corporations Act may relieve specific financial-services obligations, but these do not relieve AML/CTF registration requirements, which operate under separate legislation. Do not conflate the two regimes.

Do You Need an AFSL Too? Quick Decision Table

Many crypto businesses assume that AUSTRAC registration is their only regulatory obligation. In practice, if your product involves a financial product such as tokenised securities, derivatives, managed investment schemes, or interest-bearing crypto products ASIC may require you to hold an Australian Financial Services Licence (AFSL) in addition to AUSTRAC registration. The table below summarises the key differences.

When both apply: A custodial exchange listing tokenised securities must hold both AUSTRAC registration (for the exchange and transfer of virtual assets) and an AFSL (for dealing in financial products). Similarly, platforms offering crypto lending or yield products that constitute managed investment schemes or debentures will need an AFSL. ASIC has signalled that digital-asset businesses providing financial products must apply for a licence, and enforcement action has followed for non-compliant operators.

Typical Timelines for AUSTRAC Registration

Common Pitfalls

• Under-estimating AML/CTF program scope: Many applicants treat the AML/CTF program as a template exercise. AUSTRAC expects a risk-assessed, board-approved program with independent testing not a generic policy document.
• Incomplete beneficial-ownership transparency: Failing to identify and verify all beneficial owners particularly in multi-layered corporate structures or where offshore entities are involved is a frequent cause of rejection or remediation requests.
• Missing renewal windows: DCE registrations auto-expire after three years. Operators who miss the renewal deadline must cease providing designated services until re-registered.
• Banking relationship withdrawal: Australian banks actively check the AUSTRAC public register. Businesses that allow their registration to lapse or that never register risk having accounts frozen or closed with little notice.
• Weak EDD for high-risk flows: Enhanced due diligence is not optional for high-risk customers, correspondent relationships, or transactions involving high-risk jurisdictions. AUSTRAC’s enforcement history demonstrates that inadequate EDD is a common enforcement trigger.

Cost Considerations

• Internal build: Policy drafting, AML/CTF compliance officer appointment, monitoring-system configuration, and staff training typically cost in the tens of thousands of Australian dollars, scaling with the complexity and volume of services offered.
• External advisers and lawyers: Depending on the complexity of the business model, offshore structures, and number of designated services, external legal and consulting fees generally range from AUD 10,000 to AUD 100,000.
• Ongoing costs: Budget for compliance-officer remuneration, transaction-monitoring system subscriptions, independent-review costs, Travel Rule vendor fees, and AUSTRAC Online reporting maintenance.

One-Page AUSTRAC Registration Checklist

The following checklist summarises the must-have items for your AUSTRAC registration application. A downloadable PDF version AUSTRAC-registration-checklist.pdf is available for your compliance team.

• Entity details: ACN/ABN, registered office, certificate of incorporation, current ASIC extract.
• Ownership and control table: Names, identification documents, and percentage holdings for all beneficial owners (25%+ threshold or significant control).
• AML/CTF program: Board-approved Part A (customer identification procedures) and Part B (risk assessment), with evidence of independent review schedule.
• KYC and CDD procedures: Documented customer-identification and verification workflow, including EDD triggers and escalation processes.
• Systems and recordkeeping: Confirmation that transaction-monitoring, record-retention, and AUSTRAC Online reporting systems are operational.
• Compliance officer: Name, role, and contact details of the nominated AML/CTF compliance officer.
• Travel Rule capability: Evidence of systems or vendor arrangements to collect, verify, and transmit originator/beneficiary data for virtual-asset transfers.
• Attestations: Signed declarations by responsible persons confirming accuracy of information and compliance readiness.

Real-World Examples

Case A Exchange Onboarding: DCE to VASP Transition

A mid-size Australian digital currency exchange that had been registered as a DCE since 2022 needed to transition to the expanded VASP registration framework ahead of the 2026 reforms. Key challenges included implementing Travel Rule-compliant messaging infrastructure, remediating gaps in its EDD procedures for high-risk customers, and satisfying a new banking partner’s enhanced due-diligence requirements. By conducting a gap analysis against the amended AML/CTF Rules, building a Travel Rule data-transmission capability with an interoperability vendor, and updating its AML/CTF program with board endorsement and independent assurance, the exchange completed the transition, retained its public-register listing, and secured new banking relationships within four months.

Case B Token Issuer: AFSL and AUSTRAC Coordination

A fintech issuing tokenised fractional interests in real-world assets determined that its tokens constituted financial products under the Corporations Act triggering an AFSL requirement in addition to AUSTRAC registration. The parallel application required careful sequencing: the AUSTRAC registration was completed first (within eight weeks), while the AFSL application involving responsible-manager appointments, financial-resource adequacy testing, and ASIC engagement ran concurrently and was granted approximately nine months later. Coordinating both applications from the outset avoided duplication in governance and compliance infrastructure, reducing total advisory costs by approximately 30%.

Global Law Experts provides crypto licensing and AUSTRAC registration services for Australian and international operators. Detailed case studies of Australian VASP registration projects are available on request.

Sources

• AUSTRAC Virtual Asset Service Providers Overview
• Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (consolidated)
• AUSTRAC Travel Rule Guidance
• AUSTRAC Explanatory Statements Relating to Amendments to the AML/CTF Rules
• ASIC Deadline Looms for Digital Asset Businesses to Apply for a Licence
• FATF / FSB Updated Guidance for a Risk-Based Approach to Virtual Assets and VASPs
• AUSTRAC Enrol and Register as a DCE Provider
• AUSTRAC DCE Providers: Time to Renew Your Registration
• AUSTRAC AML/CTF Transitional Rules 2026
• Corporations Act 2001 s911A(2) Exemptions