Australia is entering a new chapter for crypto rules. The government has tabled the AML/CTF Rules 2025. These rules establish deadlines for cryptocurrency and financial platforms. By March 31, 2026, current reporting firms and crypto providers must comply. By July 1, 2026, additional industries, referred to as “tranche 2,” will also join. Therefore, every exchange, broker, and wallet custodian must prepare early.
What’s changing, and why it matters now
The new rules expand AML/CTF duties beyond banks and payment firms. They now cover crypto platforms, custody services, and value transfers. AUSTRAC designed them to match global FATF standards. Moreover, the rules account for stronger checks against scams, fraud, and terrorist financing. They were tabled in Parliament on August 29, 2025, after thorough consultation. AUSTRAC has also set its 2025–26 priorities. It will focus on outcomes, quality reporting, and real-time risk responses.
The 2026 timeline at a glance
Deadlines are fixed and leave little room for delay. By March 31, 2026, current reporting entities must follow the new rules. This includes banks, remitters, and payment services already under AUSTRAC. Moreover, Virtual Asset Service Providers (VASPs) must also comply. These include exchanges, brokers, and wallet services. New VA services must enrol and register by the same date.
Another deadline arrives soon after. By July 1, 2026, rules expanded to cover “tranche 2” industries. This includes sectors that were not part of the first stage. Therefore, legal, real estate, and other gatekeeper professions must prepare. AUSTRAC has promised more guidance through 2026. Updates will explain reporting duties and monitoring steps. Finally, crypto platforms should not wait for last-minute clarifications. Clear timelines are set, and regulators will expect full action on time.
Who is in scope in crypto (VASPs & digital asset platforms)
The new rules target a wide range of crypto services. They cover exchanges that swap crypto for money or other crypto coins. Custody providers and wallet services also fall under this scope. Value transfers between users are an important focus. From March 31, 2026, all VASPs must register with AUSTRAC. Moreover, platforms that hold customer assets face extra rules under the Treasury’s proposal. This will bring licensing and custody standards close to banking levels. Both reforms run side by side but connect on compliance. Therefore, crypto businesses must prepare for dual oversight and strict governance checks.
The headline obligations crypto firms must meet
Crypto firms face several new duties under the AML/CTF Rules. They must enrol with AUSTRAC if they offer regulated services. VASPs must also complete registration steps within the given time frame. In addition, firms must refresh AML/CTF programs and risk reviews. They need to test threats linked to scams, cross-border transfers, and fraud. Furthermore, businesses must strengthen customer due diligence. That means tighter ID checks, ownership verification, and enhanced reviews of risky clients.
They also must update transaction monitoring systems. Reports will shift toward the International Value Transfer Service model. This aligns crypto reporting with global standards. Another major step is the new Travel Rule. It requires firms to send payer and receiver details with transfers. Beneficiaries must confirm data before releasing funds. Therefore, every platform must adapt systems and staff training before deadlines hit in 2026.
Key system and data changes to prioritise in 2025–Q1 2026
Crypto firms must upgrade their systems before the deadlines. They need new data models to capture travel rule fields. These fields include payer names, addresses, and unique transaction codes. Missing or wrong data must trigger alerts. Moreover, firms must set controls for exception handling. They cannot allow incomplete records to pass unchecked.
Platforms also need strong interoperability tools. Choosing a travel-rule messaging solution is now critical. Sunrise issues will occur when partners cannot share data. Therefore, bilateral agreements will be needed for smooth transfers. Firms must plan these links early.
Monitoring must also improve. Businesses should tune systems for crypto red flags. Examples include chain-hopping, mixers, and risky wallets. Sanctions exposure must also be flagged quickly. In addition, every check must be auditable. AUSTRAC will demand proof of effective outcomes. Hence, platforms must build systems that record actions, alerts, and follow-ups in detail.
Governance, people, and vendor risk
Strong governance is now a core demand. Boards must show direct oversight of compliance. The MLRO must hold enough resources and authority. Moreover, independent reviews must test AML programs each year. Without clear accountability, firms risk AUSTRAC scrutiny.
Trained Staff is also key to success. Staff must receive training on the new AML rules. Firms should also include skilled officers. They must handle reporting, monitoring, and risk reviews. Therefore, resourcing plans should be written and approved by leaders.
Third-party risk is another focus area. Vendors manage data transfers, custody, and liquidity. Contracts must expressly include obligations for compliance. In addition, service providers must ensure fast responses to data checks. Binance’s recent case shows that AUSTRAC expects strong vendor oversight. Firms that fail in due diligence can face audits. Finally, crypto businesses must treat vendors as partners in risk control, not just tech suppliers.
90-Day Readiness Checklist
Crypto firms must act fast with a clear plan. In the first four weeks, they should run a gap review. This means checking current policies against the 2025 rules. Also, they must confirm enrolment and registration steps with AUSTRAC. Moreover, they should choose a travel-rule provider and update policies.
During weeks five to eight, firms must shift to building. They should upgrade data systems, add travel rule messaging, and test new CDD steps. Transaction monitoring tools must also adjust for value transfer flows. Therefore, firms should document progress and prepare evidence for regulators.
Weeks nine to twelve require practice. Staff must train on systems and new reporting rules. Dry runs will help test controls. Finally, boards should approve results and prepare attestation plans.
What’s still evolving (and what to watch)
Some reforms remain in motion even as deadlines near. AUSTRAC will release core guidance in late 2025. Extra guidance for tranche-2 sectors will follow by December 2025. Updates will continue during 2026, so firms must track changes. Moreover, guidance will cover practical steps like reporting forms and monitoring tools.
Treasury is also designing a digital asset platform licensing. This links with custody, audit, and client-asset protections. ASIC may enforce these standards through the AFSL framework. Therefore, platforms will need controls that meet both AML and licensing duties.
International standards could also shift. FATF guidelines might become stricter. In addition, foreign rules may influence AUSTRAC’s expectations. Crypto platforms must watch these signals closely. Staying ahead can cut compliance costs and reduce sudden risks.
Bottom Line
The clock is ticking for Australian crypto platforms. By March 2026, AUSTRAC expects full compliance. This includes enrolment, registration, and new travel-rule systems. Firms must also update AML programs and strengthen customer verification. Moreover, reporting rules will shift to the value transfer model.
July 2026 will bring tranche-2 reforms into scope. This creates extra duties for more industries. Therefore, crypto firms cannot delay their planning. Building systems, training staff, and testing programs now will save time later. AUSTRAC will focus on results, not excuses. Finally, early preparation will protect platforms from risk and heavy regulatory pressure.
