Yes. Crypto exchanges are reporting entities under the AML/CTF Act 2006, and the exchange of digital currency for money (and vice versa) has been a regulated designated service since 2018. The reform does not make exchanges newly regulated; instead, it expands the regime by adopting the broader terms "virtual asset" and "virtual asset service provider" (VASP) and capturing additional designated services from 31 March 2026. This is earlier than the 1 July 2026 start date that applies to tranche 2 sectors such as lawyers and accountants.

From 31 March 2026 the new virtual asset designated services in Table 1 of the Act capture: exchanging a virtual asset for money or money for a virtual asset, or making arrangements for that exchange (item 50A); exchanging a virtual asset for another virtual asset (item 50B); providing a virtual asset safekeeping service such as controlling private keys (item 46A); accepting instructions to transfer virtual assets or making transferred virtual assets available to customers (items 29 to 30); and providing financial services in connection with the offer or sale of a virtual asset where the business participates in that offer or sale (item 50C). "Making arrangements" means a VASP can be captured without performing every element of the exchange, for example by operating a peer-to-peer exchange platform.

A virtual asset is a digital representation of value that can be transferred, stored or traded electronically and is not issued by or under the authority of a government body, and that functions as a medium of exchange, a store of value, a unit of account or an investment, or that enables governance voting. This captures cryptocurrencies such as Bitcoin, Ether and Monero, stablecoins such as USDC, USDT and AUDD, and NFTs that store or represent economic value. It excludes Central Bank Digital Currencies (defined as money), in-game currencies, loyalty points, and purely collectible NFTs.

Yes. A virtual asset service provider must both enrol and apply for registration with AUSTRAC, and from 31 March 2026 you must not provide virtual asset designated services until AUSTRAC has confirmed your registration. AUSTRAC scrutinises applications, can take up to 90 days to decide (the clock resets if it requests more information), and assesses operational readiness, the AML/CTF experience of key personnel, and the criminal and compliance history of beneficial owners. Registration runs for 3 years, and material changes to beneficial owners or key personnel must be notified within 14 days.

Initial customer due diligence (CDD) must be completed before the exchange provides a designated service to the customer, which means before opening an account and before transferring or making virtual assets or money available to them. The exchange must identify and verify the customer (and any beneficial owner or person they act for), confirm whether they are a politically exposed person or subject to sanctions, and assign an ML/TF risk rating that sets the depth of verification. Real-time identity verification (document, biometric and government-database checks) lets exchanges meet these obligations while protecting retail conversion.

Enhanced customer due diligence (ECDD) is mandatory whenever a customer's ML/TF risk is high and in specific circumstances, including foreign politically exposed persons, customers connected to FATF high-risk jurisdictions, unusually large or complex transactions, or where a suspicious matter report obligation arises. The Rules also impose a specific VASP measure: you must apply enhanced CDD to any customer who deposits or receives physical currency in exchange for virtual assets, including through a crypto ATM, and collect and verify their source of funds. ECDD also includes establishing source of wealth and stepping up monitoring.