On 2 April 2026 Australia's AML/CTF regime expanded its coverage of crypto and virtual assets in three meaningful ways at once:
- The old Digital Currency Exchange (DCE) category was renamed and broadened to Virtual Asset Service Providers (VASPs) — matching the FATF and international standard.
- Crypto-to-crypto exchanges and digital asset transferors (businesses that move crypto for clients without holding it) came into scope for the first time.
- AUSTRAC switched on a public, searchable register of every registered VASP in Australia.
If you don't run a crypto business, your first instinct might be to scroll past. Don't. The reforms re-shape three things that every Australian business — and especially every Tranche 2 firm enrolling between now and 29 July 2026 — needs to factor into its CDD process from this week onwards.
What Actually Changed on 2 April
The headline shift is regulatory perimeter. Before 2 April, only entities that exchanged crypto for fiat had to register with AUSTRAC. That meant a large slice of the Australian crypto sector — token-to-token traders, crypto-asset transferors, custodians of crypto on behalf of clients — sat outside the regime.
That gap closed. (AUSTRAC media release)
The new VASP category covers, broadly:
- Exchange between virtual assets and fiat currencies
- Exchange between one virtual asset and another
- Transfer of virtual assets on behalf of a customer
- Custody / administration of virtual assets on behalf of a customer
- Participation in or provision of financial services related to issuing virtual assets
Every entity providing any of those services to Australian customers must now be enrolled and (where required) registered with AUSTRAC. And the register is public.
The Public Register Is the Quietly Important Bit
AUSTRAC has had a register of DCEs for years, but until 2 April it was internal and only searchable by AUSTRAC staff and law enforcement. Now any member of the public — and every onboarding clerk at every Australian business — can look up a counterparty by name or ABN and check:
- Is this VASP registered?
- Is the registration current?
- Has it been suspended or refused?
This sounds administrative. It is not. For Tranche 2 firms it changes the standard of care.
Before 2 April: if your real estate agency accepted a $400,000 deposit from a client who said they'd just sold Bitcoin through "an exchange", you could reasonably document that you had no practical way to verify the exchange's regulatory status.
From 2 April: there's a public register at a permanent AUSTRAC URL. If you didn't check it, your file is weaker. (Customer due diligence checklist)
This is the same direction of travel AUSTRAC pushed onto banks years ago when ASIC's professional registers became searchable: the existence of the lookup makes not looking up a CDD failure.
Who's Affected — Beyond Crypto Firms
This is the part most Tranche 2 firms will miss. The VASP reforms touch businesses that don't think of themselves as crypto-adjacent.
Real estate agents and conveyancers. Source of funds is the headline risk in Tranche 2 conveyancing. (Source of funds vs. source of wealth) When a buyer's deposit traces back to "I sold crypto", you now have an enforceable expectation that you'll identify the exchange and check it on the VASP register. If the exchange isn't registered, that is a material fact for your risk assessment.
Accountants and tax agents. Any client whose business model involves crypto-to-crypto trading is now your client and a regulated entity. Your role doesn't change, but the conversation about their compliance posture should — because their AUSTRAC obligations now affect documentation you'll need from them for your own CDD.
Lawyers structuring transactions involving digital assets. Token issuance, custody arrangements, crypto-backed loans — all of these now have a registered counterparty on the other side. Your file should reflect that you confirmed the counterparty's VASP status.
Jewellers and high-value goods dealers. Customers occasionally pay with crypto-equivalent transfers. The VASP whose rails carried that payment is now identifiable.
AUSTRAC Cleaned the Register Before Publishing It
A detail worth pausing on. Before flipping the public switch, AUSTRAC ran what it called a "targeted review of the DCE register" late in 2025. The agency:
- Engaged with 128 inactive businesses
- Saw 62 of them exit the sector — through registration action or voluntary withdrawal
That is roughly half. The signal is direct: AUSTRAC is happy to use registration tools as a de facto enforcement mechanism. If the agency cannot satisfy itself that you are operating, it will move to cancel — and from now on that cancellation is publicly visible to every prospective counterparty.
For Tranche 2 firms the parallel is sharp. Once enrolment is open and the regime is live, "I enrolled but never operationalised the program" will not be a stable position. AUSTRAC will move to clean its register of Tranche 2 entities the same way it cleaned the DCE register.
What This Means for Your CDD Process — Practical Changes
You should update three operational things this month:
1. Add a VASP register check to your CDD checklist for any client whose source of funds touches crypto. Document the URL, the date checked, the registration number returned, and the result. (Beneficial ownership and verification)
2. Update your risk assessment for crypto-touching clients. A client whose declared source of funds is "I traded on a registered Australian VASP" is materially lower risk than a client whose source is "I traded on an offshore exchange". Make sure your Part A risk methodology reflects that. (Risk assessment template)
3. Treat unregistered crypto activity as a red flag, not a curiosity. If a counterparty is providing services that look like VASP services and they're not on the register, that's a reportable concern — both for your own CDD purposes and, if facts support it, for an SMR. (SMR worked examples)
Why AUSTRAC Did This Now
The timing is deliberate. The VASP reforms commenced on 2 April 2026 — eleven weeks before Tranche 2 obligations start on 1 July. That's not coincidence. AUSTRAC is sequencing:
- Step 1 (April): Tighten the crypto perimeter and make the VASP register public.
- Step 2 (July): Bring 90,000+ professional services entities into scope. (What 1 July 2026 means)
- Step 3 (late 2026 onwards): Use enforcement tools — audit notices, civil penalty actions — across both groups, with full visibility into how money moves between them.
The crypto sector and the professional services sector are not separate compliance problems. They're the same flow. Money laundered through real estate frequently arrives via an exchange. Money laundered through a law firm trust account frequently leaves via one. The 2 April reforms close the half of that loop AUSTRAC could see least clearly.
The One-Sentence Summary
From 2 April 2026 there is a public, searchable list of every legitimate crypto business in Australia — and the absence of a name from that list is now an enforceable input into your CDD process.
If you onboard a client between now and 1 July, that lookup belongs on your checklist whether you think of yourself as a crypto-aware business or not.
Run a free compliance check — two minutes, no signup, see whether your CDD process reflects the post-2 April standard. Or start a 14-day free trial and generate a Tranche 2-ready AML/CTF program that includes VASP register checks in your client onboarding flow.
Sources: AUSTRAC — public register media release (2 April 2026); AUSTRAC — digital currency exchange provider registration actions; AUSTRAC — DCE provider page.