Australia Crypto License: How to Register with AUSTRAC in 2026

In Australia, crypto rules in 2026 look like a real financial market rulebook. 

There are two regulators:

Skip the wait. Buy a licensed company.

• AUSTRAC = AML/CTF, KYC, reporting, financial crime controls
• ASIC = licensing, conduct, consumer protection, how platforms are allowed to operate

You have the Corporations Amendment (Digital Assets Framework) Bill 2025, plus updated AML/CTF expectations. In a nutshell, Australia is trying to make crypto behave like a normal part of financial services, especially around custody, client money, solvency, and governance.

Who Regulates What

AUSTRAC polices the money flow. ASIC polices the platform and how customers get treated. The 2025 Bill expands what counts as regulated activity. Custodial wallets and custodial staking sit in the scope now. The main goal is to stop “client assets disappeared” situations by forcing proper custody standards, segregation, and solvency expectations.

The Bill also defines the key terms. So once the law names your product category, arguing around it becomes harder.

Institutional liquidity and stable banking start with compliance. Banks and counterparties read your licensing posture first, then they decide if you’re “real”. Australia’s direction also lines up well with MiCA-style standards, which helps if you already run in the EU or want to.

Why Australia Works as an APAC Base

Australia sells trust. Offshore hubs feel simple until something goes wrong. Australia’s pitch is that the rules are clear enough that “something went wrong” becomes easier to manage, and easier to explain to partners, banks, and regulators.

Policy messaging also leans on the economic upside of digital finance, with figures often framed around $24B/year in productivity gains tied to digital finance adoption. So government wants growth, but inside a controlled box.

Banking in 2026: Better, Still Selective

Client money protections in the 2025 Bill pushed banking access forward. ASIC is expected to set standards for holding client money on trust, so operators can show banks a real framework instead of vague promises. Big banks still run risk models and they prefer licensed entities. Neobanks and newer providers in Sydney and Melbourne also created more competition for operational accounts.

The future of finance is here. Trade crypto and more

AUSTRAC vs. ASIC

Most mistakes happen here since people tend to pick the wrong lane.

AUSTRAC registration is baseline if you exchange crypto. ASIC licensing becomes mandatory once you run a platform that holds client assets, or once you cross the thresholds that pull you into AFSL territory.

AUSTRAC Digital Currency Exchange (DCE) Registration

Any business exchanging digital currency for fiat, or for other digital currencies, needs AUSTRAC registration.

The scope expands further by March 2026, which captures a wider range of VASP activities, including virtual asset transfers and custody services that used to sit in the grey zone.

AUSTRAC expects a working AML/CTF setup:

• an AML/CTF Program that matches your model
• KYC that fits your risk profile
• transaction monitoring that actually detects suspicious activity
• reporting that holds up when reviewed

AUSTRAC is the “clean operations” gate, but don’t look at it as the full platform license.

ASIC AFSL: When It Becomes Mandatory

AFSL becomes the main event once you operate a Digital Asset Platform (DAP) or Tokenized Custody Platform (TCP) and you hit the thresholds.

Buy bitcoin and stocks. Signup to Coinbase today

The framework triggers AFSL if the platform:

• manages more than $5,000 per customer, or
• facilitates more than $10M total transactions over a rolling 12 months

That captures most real exchanges, custodial wallet providers, and staking platforms. AFSL obligations go past paperwork. ASIC expects competence, systems, dispute handling, and risk controls that are real.

Key expectations include:

• acting efficiently, honestly, and fairly
• organizational competence, including qualified Responsible Managers
• dispute resolution via AFCA
• risk management systems that match your product risks

Penalties for operating without the required AFSL can reach the greater of $16.5M or 10% of annual turnover.

What Counts as Regulated Products

The 2025 Bill created two categories to close the old gaps where crypto didn’t fit securities or derivatives definitions.

Digital Asset Platform (DAP)

A DAP is a facility where the operator “possesses” digital tokens on behalf of clients. The important part is “possession” meaning factual control. Control means the operator can transfer the token, exclude others from transferring it, and prove it. This catches centralized exchanges. It can also catch multi-sig setups if the operator has unilateral or joint control that amounts to real possession.

Tokenized Custody Platform (TCP)

A TCP is a facility where an operator:

Try the leading VASP data free for 1 month. No card required.

• identifies an underlying asset (money excluded)
• creates a single digital token that represents redemption rights
• holds the underlying asset on behalf of the token holder

This targets RWA tokenization directly. The issuer ends up sitting under custody and disclosure expectations similar to other financial product providers.

Custodial Staking and Wrapped Tokens

Platforms need to disclose network risks, validator performance assumptions, uptime realities, and how rewards get calculated and distributed.

Wrapped tokens can avoid being treated as a separate financial product only when the holder’s rights stay materially the same as holding the referenced asset directly. The exemption is tight, because regulators want to block “wrapper loopholes” that recreate the same risk in a new skin.

What Australia Expects from Your Setup

Australia expects local accountability. A paper entity with a mailbox stops working once you try to bank, license, and scale.

Corporate Structure: Pty Ltd

International providers usually incorporate an Australian subsidiary, typically a Pty Ltd. It’s its own legal person, lodges its own tax returns, registers with ASIC.

Resident Director

A Pty Ltd needs at least one director who ordinarily resides in Australia. Public companies (Ltd) need resident directors in a larger mix. The resident director is the local point of accountability to ASIC, AUSTRAC, and the ATO. Liability sits on that person, including governance duties and insolvent trading risk.

“Ordinarily resides” is factual. The director needs their primary residence in Australia and needs ongoing physical presence. Professional resident director services in 2026 typically price around AUD $6,250 to $20,000 per year, depending on operational risk.

Skip the wait. Buy a licensed company.

AML/CTF Compliance Officer + Responsible Managers

AUSTRAC expects an AML/CTF Compliance Officer who is fit and proper and can run your financial crime controls.

AFSL holders need Responsible Managers (RMs) with experience that matches the exact services offered. ASIC wants people who understand custody, staking, tokenized products, and the operational risk that comes with them.

Physical Office

Regulators expect a real principal place of business where records are kept and audits can happen. A P.O. box doesn’t pass. The resident director is responsible for the legitimacy of the setup.

Capital Rules

AUSTRAC registration doesn’t impose a minimum capital requirement, but AFSL does.

ASIC expects a capital base that can support an orderly wind-up and protect clients if operations fail.

ASIC also expects Surplus Liquid Funds (SLF). If the entity holds client money or property valued at $100,000+, SLF must be at least $50,000.

Travel Rule

The Travel Rule becomes mandatory for Australian VASPs on 31 March 2026.

The future of finance is here. Trade crypto and more

It requires collecting, verifying, and transmitting specific information between institutions involved in a transfer of money, property, or virtual assets. The core idea is traceability across the chain.

The rule applies to domestic and international transfers of any amount. Virtual asset transfers don’t get a de minimis carve-out.

VASPs also need policies for transfers involving unverified self-hosted wallets. Originator institutions are expected to assess whether the destination wallet is custodial or self-hosted, then apply risk-based controls.

This requirement is pushing adoption of interoperable tooling that supports secure data exchange in near real-time.

Step-by-Step: Getting It Done in 2026

Step 1: Incorporate & Appoint Resident Director

Set up the Pty Ltd and appoint the resident director. The director needs a DIN and a clean profile. ABN and TFN registration usually sits here too.

Step 2: AUSTRAC Enrolment & AML/CTF Program Build

Enrol with AUSTRAC and declare designated services, structure, and key personnel. Build the AML/CTF Program around your actual risks, including Travel Rule readiness.

Step 3: AFSL Application

Platforms above the $5k / $10M thresholds need to lodge with ASIC. The key deadline is 30 June 2026.

Buy bitcoin and stocks. Signup to Coinbase today

ASIC issued a “No-Action” position for existing businesses that lodge by that date, allowing continued operation while the application processes. New entrants usually need the license before regulated activity starts.

Step 4: Operational Readiness

ASIC expects proof that your people and systems can meet ongoing AFSL obligations. Audited financial statements aligned to Australian Accounting Standards become part of the baseline.

Buying a Ready-Made AUSTRAC-Registered Company

Some operators buy a shelf company with an existing AUSTRAC registration to enter faster.

It can save 2-3 months of incorporation and registration effort. These entities often come with ABN/ACN, clean history, and sometimes banking relationships that took time to build.

What this does is: 

• immediate activation for fiat-to-crypto and OTC services
• longer registration history can signal a compliance track record
• access to registered office support and resident director networks

A buyer still needs to appoint their own resident director and notify AUSTRAC about the change in control. A strong AUSTRAC history can also help the story when ASIC reviews an AFSL application.

Tax and Ongoing Compliance

Australia’s tax framework pushes a split between active operating income and passive income.

Try the leading VASP data free for 1 month. No card required.

Crypto is treated as property for tax purposes. Platforms mainly deal with corporate income tax and CGT on disposed assets.

Passive-heavy structures, like interest income or long-term capital gains dominance above the 80% threshold, fall into the 30% rate. Active trading revenue, fees, and advisory income typically sit in the 25% base-rate bucket for SMEs, assuming the criteria are met.

AFSL holders lodge annual audit reports and financial statements with ASIC. AUSTRAC expects annual compliance reporting for AML/CTF obligations. Deadlines are important because repeated failures can push suspension or revocation risk.

Governance and Liability

ASIC expects accountability at board and senior management level. Risk management and supervision are not optional.

Larger platforms usually need formal governance structures, often including a board setup that actively reviews audits and financial health checks, plus risk and compliance committee oversight.

Directors also carry DINs. DINs are used to prevent phoenixing, where someone dumps a company to escape liabilities and restarts the same business under a new shell. Founders end up tied to their track record through that identifier, and that’s the point.

Where This Ends Up

Australia’s licensing shift is basically a filter. Good actors get a real pathway. Casual operators get pushed out by friction.

Skip the wait. Buy a licensed company.

The Australian license plays like a Tier-1 credential in APAC. Banking becomes more realistic. Partnerships become easier to close. Counterparties waste less time debating whether you’re “serious”.

Capital, local accountability, and data-sharing controls still need to exist as real infrastructure rather than a mere slide deck. Though most teams learn that part quickly.

Frequently Asked Questions (FAQ)

Can a foreigner own 100% of the shares?

Yes. A Pty Ltd can be fully foreign-owned. The resident director rule still applies.

Is the Travel Rule mandatory in 2026?

Yes. It takes effect on 31 March 2026, including controls around transfers involving unverified self-hosted wallets.

Do you need a local bank account?

Licensing can happen without it in some cases, but operations rarely work without it. Taxes, payroll, and client money workflows become painful fast.

What does AFSL setup usually cost?

Legal and consulting costs often land around $50k to $200k, excluding NTA capital requirements and ongoing audit costs.

Do crypto businesses need both AUSTRAC and ASIC approval?

Often, yes. AUSTRAC registration covers AML/CTF and VASP obligations. ASIC licensing becomes mandatory once you hold client assets or operate a regulated digital asset platform.

The future of finance is here. Trade crypto and more

Can a crypto platform operate while its AFSL application is under review?

Existing businesses that lodge by 30 June 2026 may rely on ASIC’s no-action position. New entrants generally need approval before commencing regulated activity.

Are self-hosted wallets banned under Australia’s Travel Rule?

No. They are permitted, but transfers involving them require enhanced risk assessments and appropriate controls.

Does non-custodial or DeFi activity avoid licensing requirements?

Sometimes. Once a platform exerts factual control over assets or intermediates transactions, it may still fall within AUSTRAC or ASIC scope.

What happens if you operate without the required license or registration?

ASIC penalties can reach the greater of AUD $16.5M or 10% of annual turnover. AUSTRAC can suspend or cancel registration and pursue enforcement action.

How long does it take to get registered and licensed in Australia?

AUSTRAC registration often takes 1-3 months. AFSL applications typically take 6-9 months, depending on complexity and preparedness.