VIRTUAL ASSETS · EXPANDED SCOPE
AML/CTF compliance for Australian virtual asset service providers
The reforms widened this sector considerably. Registered digital currency exchanges rolled over automatically; a much broader set of virtual asset services came into scope alongside them, with a staggered set of dates that are easy to misread.
Already regulated? The regime still changed.
The reforms did not just add new sectors. From 31 March 2026 the program structure, customer due diligence framework and governance obligations changed for every existing reporting entity, and independent reviews of Part A became independent evaluations of the whole program. A program that was compliant in February needed rebuilding, not refreshing.
- 31 March 2026Registered DCE providers automatically became registered VASPs; item 50A services must comply
- 1 July 2026Deferred obligations begin for new registrable virtual asset services, including the travel rule
- 29 July 2026Enrolment and registration deadline if you began providing a new registrable service before 1 July 2026
- 31 March 2029Reporting begins for transfers involving unverified self-hosted wallets
Are you captured?
If you were a registered digital currency exchange provider, you became a registered virtual asset service provider automatically on 31 March 2026 — no re-application needed. The harder question is whether services you already offer became registrable virtual asset services, and which deadline applies to each.
Likely captured
- Exchanging between virtual assets and fiat currency
- Exchanging between one virtual asset and another
- Transferring virtual assets on behalf of a customer
- Safekeeping or administering virtual assets, or the means of control over them
- Providing financial services related to an offer or sale of a virtual asset
- Acting as an intermediary passing on a transfer message
Generally outside scope
- Providing non-custodial wallet software alone, with no control over customer assets
- Publishing market data, analytics or research
- Mining or validating for your own account
Capture depends on the designated services you provide — not on your profession, your licence or your job title.
What you need in place
Enrol and register with AUSTRAC
Every reporting entity has to be on the register. Enrolment is the entry point for everything else, including how your evaluation timing is set.
Appoint an AML/CTF compliance officer
A named person with the authority, seniority and time to run the program — and AUSTRAC has to be notified of the appointment.
Write an ML/TF risk assessment
Covering your customers, the designated services you provide, your delivery channels and the jurisdictions you deal with, with the reasoning visible.
Document your AML/CTF policies
Policies, procedures, systems and controls that follow from the risk assessment, approved by a senior manager rather than filed unread.
Run initial customer due diligence
Identify and verify your customer before you provide the designated service, at a depth that matches the risk you have assessed.
Screen for sanctions, PEPs and adverse media
Screening at onboarding and again over the life of the relationship, with the result recorded either way.
Trace beneficial ownership
Where the customer is a company, trust or other arrangement, identify who ultimately owns or controls it — and show how you got there.
Keep ongoing customer due diligence running
Monitoring is not an onboarding task. Relationships have to be reviewed and re-screened as risk and circumstances change.
Report suspicious matters
Submit suspicious matter reports within the required timeframes, plus threshold transaction reports where they apply to you.
Keep records
Generally seven years, with the retention clock starting at different points depending on the record type.
Train your people
Risk-appropriate AML/CTF training for staff, refreshed over time and delivered to new starters as they join.
Have the program independently evaluated
An independent evaluation of the whole program on the cycle your policies set, with findings tracked to closure.
Confirm which of your services fall where
Item 50A services (exchange between virtual assets and fiat) had to comply from 31 March 2026. Other new registrable virtual asset services had program, CDD, reporting, transfer-of-value and record-keeping obligations deferred to 1 July 2026.
Implement the travel rule for virtual asset transfers
Travel rule obligations for virtual asset transfers apply from 1 July 2026 for the newly registrable services.
Plan for unverified self-hosted wallet reporting
Reporting on transfers involving unverified self-hosted wallets is deferred to 31 March 2029, but AUSTRAC expects you to begin planning the system and policy changes now.
See the evidence, not just the promise.
How True Comply helps
Identity verification at onboarding speed
Verification and liveness that works for a fully remote, high-volume customer base.
Sanctions and PEP screening with a real audit trail
Every hit and every clearance recorded with the reasoning behind it.
Entity and ownership tracing for corporate customers
Institutional and corporate accounts traced to their beneficial owners.
Ongoing monitoring across the customer base
$1 per person per month, so risk changes surface without a manual sweep.
A program written for the reformed framework
Scoped to which of your services fall under which commencement date.
Advisory for registration and supervisory engagement
Senior judgement when registration conditions or AUSTRAC attention are in play.
Free to start. $1 per person per month for ongoing monitoring.
Start with your first checks at no cost, then keep your whole client book monitored for a dollar a person a month.
Questions, answered.
Related insights
- Getting compliant
Your AML/CTF obligations, in plain English
6 min read
- How to
How to run customer due diligence that stands up
6 min read
- How to
Beneficial ownership: finding who is really behind a company
5 min read
- Assurance
Your first independent evaluation: what AUSTRAC actually expects
6 min read
Compliance you can prove.
Tell us where you're at and we'll help you work out what applies to your business.
No jargon, no obligation.