Crypto Regulation in Australia: 2026 Update

Crypto regulation in Australia is entering a decisive phase. The country has moved from a relatively permissive, principles-based approach toward a structured licensing regime for digital asset businesses. Exchanges, custodians, and token issuers operating in or from Australia now face concrete compliance obligations under both existing financial services law and a new wave of digital asset-specific legislation. This guide covers the current regulatory framework, the key authorities involved, licensing requirements, anti-money laundering obligations, consumer protection rules, and the practical steps businesses must take to remain compliant.

Australia does not have a single, dedicated crypto statute. Instead, digital asset businesses operate under a layered framework built on several existing laws, supplemented by recent reforms specifically targeting the sector.

The Corporations Act 2001 is the primary instrument. Where a crypto product meets the definition of a financial product - such as a managed investment scheme, derivative, or non-cash payment facility - it falls under the Act and requires an Australian Financial Services Licence (AFSL) issued by the Australian Securities and Investments Commission (ASIC). ASIC has consistently applied this test to stablecoins, yield products, and tokenised securities, meaning a significant portion of the market is already regulated under existing law.

The Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act) covers a separate but overlapping category. Digital currency exchange providers are designated reporting entities under this Act and must register with AUSTRAC, Australia';s financial intelligence agency. Registration, customer due diligence, transaction monitoring, and suspicious matter reporting are all mandatory. Recent amendments to the AML/CTF Act have expanded the definition of covered services and tightened obligations for custodial wallet providers.

The Payment Systems (Regulation) Act 1998 and the emerging payments licensing framework administered by the Reserve Bank of Australia (RBA) add a third layer, particularly relevant for stablecoin issuers and payment-focused crypto businesses. The RBA has published guidance indicating that certain stablecoins may qualify as stored-value facilities subject to prudential oversight.

Australia';s Treasury has driven the most significant recent changes. The Digital Assets (Market Regulation) Bill, which has been the subject of extensive consultation, proposes a dedicated licensing regime for digital asset platforms. Under the proposed framework, a Digital Asset Platform Licence would be required for businesses that operate a trading platform, provide custody services, or facilitate the exchange of digital assets above defined thresholds.

The proposed regime draws on the AFSL model but introduces asset-specific requirements. Licence applicants must demonstrate adequate capital reserves, segregation of client assets, robust cyber-security controls, and clear disclosure of fees and risks. Platforms serving retail clients face stricter obligations than those operating exclusively in the wholesale market.

Token issuers are addressed separately. The framework distinguishes between financial product tokens - which remain under the Corporations Act - and non-financial digital assets. For the latter category, a lighter disclosure regime applies, but issuers must still publish a standardised token mapping document that classifies the asset and discloses material risks.

ASIC has also updated its regulatory guidance on crypto assets, clarifying when a token constitutes a financial product and what marketing and disclosure standards apply. The guidance reinforces that labelling a product as a "utility token" does not, by itself, remove it from the financial product definition if it exhibits investment characteristics.

In practice, founders should consider engaging legal counsel before launching any token or platform, because misclassification at the outset creates significant retrospective liability. A common mistake is assuming that a product is outside ASIC';s remit simply because it uses blockchain technology.

Every business that provides digital currency exchange services in Australia must register with AUSTRAC before commencing operations. This is a hard legal requirement under the AML/CTF Act, and operating without registration exposes a business to civil penalties and potential criminal liability.

The registration process involves submitting a detailed application covering the business structure, ownership, key personnel, and the nature of services offered. AUSTRAC assesses whether the business poses an unacceptable money laundering or terrorism financing risk. Businesses with complex offshore ownership structures or those operating in higher-risk markets face more intensive scrutiny.

Once registered, ongoing obligations include:

• Maintaining a current AML/CTF programme that identifies, assesses, and mitigates risks.
• Conducting customer identification and verification (know-your-customer, or KYC) before providing services.
• Monitoring transactions for suspicious activity and filing suspicious matter reports (SMRs) with AUSTRAC promptly.
• Submitting annual compliance reports and threshold transaction reports for cash transactions above the statutory threshold.

Recent amendments to the AML/CTF Act introduced the "travel rule" for virtual assets, aligning Australia with the Financial Action Task Force (FATF) Recommendation 16. Under the travel rule, originating virtual asset service providers must collect and transmit beneficiary and originator information alongside transfers above a defined value threshold. Many smaller operators underestimate the technical infrastructure required to comply with this rule.

AUSTRAC has demonstrated a willingness to pursue enforcement action. Penalties for serious or systemic AML/CTF failures can reach hundreds of millions of dollars, as demonstrated by high-profile cases in the broader financial sector. Crypto businesses should treat AML/CTF compliance as a core operational function, not a box-ticking exercise.

If your business is assessing its AUSTRAC obligations or preparing a registration application, contact info@vlolawfirm.com. We can assist with documents and filings.

The Australian Taxation Office (ATO) treats most digital assets as property for tax purposes, not as currency. This classification has significant practical consequences for businesses and individual investors alike.

Capital gains tax (CGT) applies to disposals of digital assets, including sales, exchanges, and the use of crypto to purchase goods or services. The CGT discount - which reduces the taxable gain by fifty percent for assets held longer than twelve months - is available to individuals and trusts but not to companies. Businesses that hold crypto as trading stock apply ordinary income rules rather than CGT.

The ATO has published detailed guidance on the tax treatment of specific scenarios, including:

• Mining and staking rewards, which are treated as ordinary income at the time of receipt.
• Airdrops, which may be income or capital depending on the circumstances.
• DeFi transactions, including liquidity provision and yield farming, where the ATO has signalled that each interaction may constitute a taxable event.
• Wrapping and unwrapping tokens, which the ATO may treat as a disposal triggering CGT.

A non-obvious requirement is that businesses must maintain detailed transaction records for every crypto event, including the date, the AUD value at the time of the transaction, the counterparty, and the purpose. The ATO has data-matching arrangements with domestic exchanges and can cross-reference reported income against exchange records. Many founders underestimate the record-keeping burden, particularly for businesses with high transaction volumes.

GST treatment of digital assets has also evolved. The ATO';s position is that most crypto-to-crypto transactions are not subject to GST, but businesses providing crypto-related services - such as exchange or brokerage - may have GST obligations depending on their structure and client base.

ASIC is the primary conduct regulator for crypto businesses that fall within the financial product perimeter. Its mandate covers misleading or deceptive conduct, unlicensed financial services, and failures to meet disclosure obligations.

Under the Australian Consumer Law and the ASIC Act, making false or misleading representations about a crypto product - including on social media or through influencer marketing - is prohibited regardless of whether the product is a financial product. ASIC has taken enforcement action against crypto promoters for misleading advertising, and the regulator has signalled that it will continue to prioritise consumer harm in the sector.

For businesses holding an AFSL or operating under the proposed digital asset platform licence, conduct obligations include:

• Acting efficiently, honestly, and fairly in all dealings with clients.
• Providing a Financial Services Guide (FSG) and, where personal advice is given, a Statement of Advice (SOA).
• Maintaining adequate dispute resolution arrangements, including membership of the Australian Financial Complaints Authority (AFCA).
• Complying with design and distribution obligations (DDO), which require issuers and distributors to identify a target market for each financial product and ensure distribution is consistent with that target market.

A common mistake made by foreign operators entering the Australian market is assuming that a regulatory approval from another jurisdiction - such as a European MiCA licence or a US money transmitter licence - provides any standing in Australia. It does not. Australian law applies independently, and ASIC has been explicit that overseas authorisation does not substitute for local compliance.

Scenario one: a European exchange with MiCA authorisation seeks to onboard Australian retail clients. It must still obtain an AFSL or operate under the proposed digital asset platform licence, register with AUSTRAC, and comply with Australian consumer protection law. The MiCA licence is irrelevant to Australian regulators.

Scenario two: a domestic startup launches a token that offers holders a share of platform revenue. ASIC is likely to classify this as a managed investment scheme or a security, requiring either an AFSL and a compliant product disclosure statement, or an exemption. Proceeding without legal advice in this scenario creates serious regulatory risk.

Businesses entering or expanding in the Australian crypto market should approach compliance systematically. The regulatory environment is complex, multi-layered, and actively enforced.

The first step is a product classification analysis. Every token, platform feature, and service must be assessed against the Corporations Act financial product definitions and the AML/CTF Act';s designated service categories. This analysis determines which licences and registrations are required before launch.

The second step is AUSTRAC registration, which must be completed before any digital currency exchange services commence. The registration application should be supported by a draft AML/CTF programme, a risk assessment, and documentation of the business';s ownership and control structure.

The third step is AFSL assessment. If any product or service constitutes a financial product, the business must either hold an AFSL, operate under an existing licensee as an authorised representative, or qualify for a specific exemption. The AFSL application process is detailed and can take several months, so early engagement with ASIC is advisable.

The fourth step is tax structuring. Businesses should establish record-keeping systems capable of capturing every taxable event from day one. Retrospective reconstruction of transaction histories is costly and error-prone.

The fifth step is ongoing compliance monitoring. Australian crypto regulation is evolving rapidly. Businesses must track legislative developments, ASIC guidance updates, and AUSTRAC enforcement priorities to ensure their compliance programmes remain current.

To discuss how these steps apply to your specific business model, contact info@vlolawfirm.com. We can help structure the setup correctly the first time.

Does a foreign crypto business need a local licence to serve Australian customers?

Yes, in most cases. If a foreign business provides financial products or services to Australian retail clients, it must hold an AFSL or operate under an exemption, regardless of where the business is incorporated. ASIC applies a "sufficient nexus" test and has taken action against offshore operators targeting Australian users. Additionally, any business providing digital currency exchange services must register with AUSTRAC, even if it has no physical presence in Australia. Operating without the required authorisations exposes the business to civil penalties, injunctions, and potential criminal liability for key personnel.

How long does it take to obtain an AFSL, and what does it cost?

The AFSL application process typically takes between six and twelve months from submission to grant, depending on the complexity of the application and ASIC';s current workload. Applications require detailed documentation covering the applicant';s organisational competence, financial resources, risk management systems, and compliance arrangements. Professional fees for preparing a comprehensive AFSL application generally start from the low tens of thousands of Australian dollars, and ongoing compliance costs - including responsible manager obligations, audit requirements, and AFCA membership - add to the total cost of holding a licence. Businesses should budget for both the application phase and the ongoing cost of maintaining authorisation.

What is the difference between AUSTRAC registration and an AFSL for a crypto business?

These are separate requirements that address different regulatory concerns. AUSTRAC registration under the AML/CTF Act is mandatory for digital currency exchange providers and focuses on preventing money laundering and terrorism financing. It requires KYC procedures, transaction monitoring, and suspicious matter reporting. An AFSL, issued by ASIC under the Corporations Act, is required when a business provides financial products or financial services, and it focuses on market conduct, disclosure, and consumer protection. Many crypto businesses need both: AUSTRAC registration for their exchange function and an AFSL for any financial product they issue or distribute. Failing to obtain either when required is a separate and independent breach.

Australia';s approach to crypto regulation is maturing rapidly. The combination of existing financial services law, AML/CTF obligations, and new digital asset-specific legislation creates a demanding compliance environment for businesses of all sizes. Proactive legal structuring - before launch, not after - is the most effective way to manage regulatory risk and build a sustainable operation in the Australian market.

VLO Law Firms advises international clients on crypto regulation in Australia. We can assist with product classification analysis, AUSTRAC registration, AFSL applications, AML/CTF programme development, and ongoing compliance monitoring. To request a consultation, contact: info@vlolawfirm.com