On 10 August 2026, AUSTRAC announced it had suspended the registration of Cryptolink Pty Ltd, the operator of 96 cryptocurrency ATMs across Australia. The suspension runs for three months from Sunday 9 August, and for those three months the machines are not allowed to operate. (AUSTRAC media release)
A regulator switching off a national network of machines is a headline on its own. But the detail that should make every newly regulated firm sit up is why. Cryptolink was not suspended for the contraventions AUSTRAC originally found. It had already paid for those. It was suspended for what happened afterwards.
The Timeline Is the Lesson
Walk through the sequence, because the order of events carries the whole point.
October 2025. AUSTRAC's Cryptocurrency Taskforce identifies alleged contraventions of the AML/CTF laws at Cryptolink, including late reporting of threshold transactions and weaknesses in its risk assessments. Cryptolink enters into an enforceable undertaking and pays a $56,340 infringement notice. (AUSTRAC media release)
The remediation. Cryptolink works through the undertaking, and here is the part most coverage will skip: it met the conditions. The formal remediation project, the part everyone treats as the hard part, succeeded.
Then the routine. Having completed the undertaking, Cryptolink subsequently failed to meet basic reporting obligations, particularly threshold transaction reports. When AUSTRAC asked for information, it did not respond. AUSTRAC CEO Brendan Thomas: "Cryptolink was given the opportunity to comply but could not meet its obligations despite the enforceable undertaking."
August 2026. Registration suspended, 96 machines off.
The project was fine. The routine failed. That is what took the business offline.
This Extends a Pattern AUSTRAC Has Been Building All Year
If you have followed AUSTRAC's enforcement run this year, the Cryptolink suspension is not an outlier. It is the sharpest version yet of a message the regulator keeps sending.
When AUSTRAC finalised its enforceable undertaking with Sportsbet in July, the CEO was explicit that closing the undertaking did not lower the bar going forward. (What the Sportsbet undertaking means for Tranche 2) When it reopened an investigation into Tabcorp nine years after that company's original penalty, the message was the same: remediation is not a finish line. (The Tabcorp lesson)
Cryptolink is what happens when a business hears that message and still treats the undertaking as the whole job. The regulator's measure of you is not the remediation project. It is whether the ordinary obligations keep being met after everyone stops paying attention.
Two Failures, Both Boring
Strip the crypto branding off this story and the failures AUSTRAC named are almost embarrassingly ordinary.
The required reports were not filed. A threshold transaction report is due within 10 business days when a customer transacts $10,000 or more in physical currency (AUSTRAC, threshold transaction reports). For a cash-to-crypto ATM operator, those reports are not an edge case. They are the core of the business meeting its obligations. They stopped arriving.
The regulator's questions were not answered. AUSTRAC asked for information and got nothing. Whatever the internal reason, from the outside a firm that does not respond to its regulator is indistinguishable from a firm with something to hide, and AUSTRAC said as much by deeming the company "too high risk to continue operating at present". (AUSTRAC media release)
Neither failure required sophisticated wrongdoing. Both are the kind of thing that happens when nobody in the business owns the routine.
Why This Lands on Tranche 2 Desks
Cryptolink is a virtual asset service provider, and VASPs operate under a registration AUSTRAC can suspend. If you are an accountant, lawyer, conveyancer, real estate agent or jeweller, you enrol rather than register, and AUSTRAC cannot switch your practice off the same way. Its tools for you are the ones it has been using all year: infringement notices, enforceable undertakings, ordered external audits and civil penalties. (What AUSTRAC penalties actually look like)
But the obligations Cryptolink failed are the ones you now carry. Since 1 July 2026 every Tranche 2 firm has been on the same event-driven clocks:
- A suspicious matter report within 24 hours for terrorism financing, 3 business days for everything else, counted from when you form the suspicion (AUSTRAC, suspicious matter reports).
- A threshold transaction report within 10 business days when a client pays you $10,000 or more in physical currency (AUSTRAC, threshold transaction reports).
- An annual compliance report each year, lodged in the 1 July to 30 September window (AUSTRAC, annual compliance reports).
No portal reminder starts the first two clocks. The event does, and you are the only one who knows the event happened. We wrote about that structure in what actually replaces the deadlines after enrolment, and about the week-to-week rhythm that keeps the routine alive in how to actually run your program.
One more uncomfortable note. "We don't take cash" is the standard professional-services answer to the TTR obligation, and it is usually true. But it is a policy, not a fact of nature. The day a client's relative settles an invoice with banknotes, the 10-business-day clock is running whether or not your program contemplated it. AUSTRAC's own starter kits for the new sectors ship with a TTR effectiveness check form for exactly this reason. If your program says no cash, make sure the front desk knows that is a rule and not a description. (We unpack the whole $10,000 rule, linked payments and the structuring twist in the TTR piece.)
What to Do This Week
Four checks, none of which take an afternoon.
- Name the owner of the routine. Not the program document. The routine: who files reports, who watches the deadlines, who opens mail from AUSTRAC. If the answer is "whoever notices", you have the Cryptolink structure with better intentions.
- Trace how a TTR would actually get filed. From "a client just paid cash" to "report lodged in AUSTRAC Online", with names and days. If you cannot narrate it, ten business days is shorter than it sounds. (Our walkthrough of SMR and TTR filing)
- Decide who answers the regulator. AUSTRAC correspondence needs an owner and a same-week service standard. Cryptolink's suspension notice cites the unanswered request for information as part of the reason. Silence is treated as risk.
- Check your evidence trail for the quiet weeks. A routine that leaves no trace when nothing happens looks identical to a routine that stopped. Monitoring you can prove is the asset here. (The record-keeping rules)
Where AML Mate Fits
AML Mate's reports module exists for precisely the failure that took Cryptolink offline: it tracks SMR and TTR deadlines from the triggering event, flags anything overdue on the dashboard, and keeps the filed record with the dates attached, so the routine leaves evidence without anyone maintaining a spreadsheet. The free compliance check at /check will tell you in five minutes whether your reporting path has an owner-shaped hole in it.
The regulator has now shown, twice in five weeks, what it does about businesses that finish the project and drop the routine. Sportsbet got the good ending. Cryptolink got the other one.
This article is general information, not legal advice. For advice specific to your circumstances, consult a qualified AML/CTF professional.