AUSTRAC Removes 45 Businesses: AML/CTF Compliance Lessons for Fintechs and VASPs

Introduction

According to a recent update, the Australian Transaction Reports and Analysis Centre (AUSTRAC) has removed 45 businesses from its registers after cancelling, suspending or refusing to renew their remittance and virtual asset service provider (VASP) registrations during the past year. The actions show the regulator’s increasing scrutiny of high-risk payment, remittance and virtual asset businesses, including those with limited operational capacity, registration failures or significant money laundering and terrorism financing risks.

The announcement raises practical issues for Australian fintechs, remittance providers and VASPs, including registration decisions, operational readiness, AML/CTF risk management and reporting obligations. These requirements can affect whether a business continues providing regulated services. This article outlines why AUSTRAC removed these businesses and what your fintech, remittance or VASP business can do to stay compliant and keep its registration.

Interactive Tool: Check Your AUSTRAC Registration & Compliance Risk

Why Did AUSTRAC Cancel, Suspend or Refuse to Renew 45 Registrations?

On 7 September 2026, AUSTRAC announced that it had cancelled, suspended or refused to renew 45 remittance and VASP registrations during the preceding year. The decisions did not all relate to proven AML/CTF breaches. AUSTRAC took different forms of regulatory action for operational, registration and financial crime risk concerns.

The businesses included entities that:

• lacked the operational capacity to begin or continue trading;
• were dormant or inactive;
• had not provided designated services for extended periods; or
• were insolvent.

Other reasons included:

• failing to hold the appropriate registration;
• failing to notify AUSTRAC of material changes; and
• presenting significant money laundering or terrorism financing risks.

Registration Requirements Applicable to Australian Fintechs

Differences Between Registration & Enrolment for Fintechs

Enrolment and registration are separate obligations. Section 51B of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (‘AML/CTF Act’) requires a person commencing to provide a designated service to apply for enrolment as a reporting entity within 28 days, subject to the statutory exceptions.

Part 3, Division 1 of the Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (Cth) (‘AML/CTF Rules’) sets out the information required for enrolment.

Registration applies only to businesses providing specified registrable services:

• Remittance providers must be registered under Part 6, Division 3 of the AML/CTF Act; and
• VASPs must be registered under Part 6A, Division 3 of the AML/CTF Act.

Section 74 and Section 76A of the AML/CTF Act prohibit unregistered persons from providing the relevant registrable services.

When AUSTRAC Can Cancel or Suspend or Refuse to Renew Registration

AUSTRAC may cancel a remittance registration under Section 75G(1) of the AML/CTF Act where:

• continued registration involves, or may involve, a significant money laundering, terrorism financing, people smuggling or other serious crime risk;
• the person has breached one or more registration conditions; or
• another relevant matter specified in the AML/CTF Rules applies.

Under Section 75G(1A) of the AML/CTF Act, the AUSTRAC CEO may also cancel a registration if there are reasonable grounds to believe that the registered person no longer carries on a business requiring registration.

For VASPs, corresponding cancellation powers appear in Section 76J(1) and (2) of the AML/CTF Act. The additional matters specified in Rule 4-25 of the AML/CTF Rules also apply to both registration regimes.

Suspension powers are provided under Sections 75H and 76K of the AML/CTF Act, with the grounds set out in Rule 4-17 of the AML/CTF Rules. These grounds include significant financial crime risks, breaches of registration conditions, ongoing contraventions, insufficient operational capability and certain adverse findings involving the registered person or its key personnel.

A suspension may last up to three months and may be extended once for up to a further three months under Rule 4-19.

Renewal decisions are governed by Sections 75J and 76L of the AML/CTF Act and Rule 4-30 of the AML/CTF Rules, which sets out the matters AUSTRAC must consider when determining a renewal application.

Insights from Recent AUSTRAC Regulatory Actions

Completed Regulatory Decisions Involving GetCoins & Cryptolink

AUSTRAC cancelled the registration of BA Digital Ventures Pty Ltd, trading as GetCoins, on 4 June 2026 after requesting information about its operations and ability to manage money laundering risks following customer complaints.

AUSTRAC stated that GetCoins was allegedly exploited by organised cryptocurrency investment scams; this was not presented as an established finding against the business.

The GetCoins cancellation highlights the importance of being able to demonstrate, when AUSTRAC requests information, that a business can manage the money laundering risks associated with its operations, particularly where customer complaints suggest potential scam activity.

Also, AUSTRAC suspended Cryptolink Pty Ltd’s registration for three months from 9 August 2026, requiring its 96 cryptocurrency automatic teller machines to stop operating. The suspension followed failures to:

• submit required threshold transaction reports (TTRs) under Section 43 of the AML/CTF Act; and
• respond to an AUSTRAC information request.

Notably, this occurred despite an enforceable undertaking accepted in October 2025 and a $56,340 infringement notice paid by Cryptolink.

The Cryptolink suspension highlights the importance of maintaining accurate and timely regulatory reporting and responding promptly to AUSTRAC information requests, even after earlier compliance issues have been addressed.

Ongoing Investigations into Western Union

AUSTRAC commenced an investigation on 1 September 2026 into Western Union Financial Services Australia Pty Ltd and The Western Union Company. The investigation concerns the management of high-risk payment channels, customers and affiliates, rather than the conduct of Western Union’s affiliates.

The investigation is ongoing and does not establish a contravention. AUSTRAC is examining Western Union’s:

• AML/CTF program;
• transaction monitoring; and
• governance arrangements.

This includes whether its systems identify and manage risks associated with money laundering and terrorism financing, including transaction patterns linked to child sexual exploitation.

The investigation highlights AUSTRAC’s scrutiny of how businesses identify and manage risks associated with high-risk payment channels, customers and affiliates.

How Can Fintechs and VASPs Reduce the Risk of AUSTRAC Regulatory Action?

Maintaining Operational Readiness and Registration

Registration depends on more than an application. Under Rule 4-15 of the AML/CTF Rules, AUSTRAC must consider:

• a business’s operational readiness;
• its ability to comply with the AML/CTF Act and the AML/CTF Rules;
• appropriate experience; and
• proposed resourcing.

A business should maintain suitable personnel, governance arrangements, resources and operational capacity after registration. Insufficient capacity, inactivity and failure to provide designated services were among the reasons AUSTRAC identified for its recent regulatory action.

Operational capability is also relevant to cancellation under Section 75G(1) of the AML/CTF Act for remittance providers and Section 76J(1) for VASPs, together with Rule 4-25 of the AML/CTF Rules, which applies to both regimes.

Fintechs should regularly check that their registration details remain accurate, their business continues to provide registrable services, and their operations retain the capability required for compliance; where those checks raise concerns, it may be prudent to seek advice from AML/CTF lawyers for fintechs and regulated businesses.

Notifying AUSTRAC of Material Changes

Failing to notify AUSTRAC of material changes was one of the reasons for AUSTRAC’s recent actions.

Registered remittance network providers, independent remittance dealers and remittance affiliates that applied for registration on their own behalf must notify AUSTRAC of changes that could materially affect registration under Section 75M(1) of the AML/CTF Act.

Other registered remittance affiliates must notify their remittance network provider under Section 75M(2), which must then notify AUSTRAC under Section 75M(3). Registered VASPs have a corresponding direct notification obligation under Section 76P(1).

Notifications must be provided in the approved form within 14 days of the change arising under Sections 75M(4) and 76P(2). However, a remittance network provider must notify AUSTRAC within seven days of receiving notification from an affiliate under Section 75M(3) and (4).

Rule 4-34 of the AML/CTF Rules identifies additional matters that must be reported, including:

• changes to registrable details;
• beneficial ownership;
• foreign registrations;
• assisting persons; and
• the cessation of registrable services.

Assessing and Reviewing ML/TF Risks

An AML/CTF program must address the risks arising from a fintech’s designated services. Under Section 26C of the AML/CTF Act, reporting entities must undertake an ML/TF risk assessment of the money laundering, terrorism financing and proliferation financing risks associated with those services, having regard to factors such as their customer types, delivery channels and the countries they deal with.

Section 26D(1) and (2) of the AML/CTF Act requires reporting entities to review their ML/TF risk assessment:

• before significant changes within their control, or as soon as practicable after changes outside their control;
• as soon as practicable after AUSTRAC communicates relevant risk information; and
• at least once every three years.

Rule 5-1 of the AML/CTF Rules also requires a review if an independent evaluation report contains adverse findings about the ML/TF risk assessment. The review must be undertaken as soon as practicable after the governing body receives the report.

Under Section 26D(4) of the AML/CTF Act, the reporting entity must also update its ML/TF risk assessment to address any issues identified by the review, within the applicable statutory timeframe.

Maintaining Effective AML/CTF Policies and Controls

Section 26F(1) of the AML/CTF Act requires reporting entities to develop and maintain AML/CTF policies, procedures, systems and controls that manage and mitigate money laundering, terrorism financing and proliferation financing risks, and ensure compliance with applicable AML/CTF obligations. AML/CTF compliance lawyers can help assess whether these controls are fit for purpose.

Key controls include:

• customer due diligence;
• monitoring unusual transactions and behaviours;
• suspicious matter reporting;
• controls for transfers of value, including the obligations of ordering and beneficiary institutions. Where relevant, reporting entities must also address their applicable statutory obligations concerning virtual asset transfers.

Maintaining Governance and Responding to AUSTRAC Requests

Section 26H of the AML/CTF Act establishes the governing body’s responsibilities for the AML/CTF program, while Sections 26J and 26K require reporting entities to designate and have an AML/CTF compliance officer.

The AML/CTF Rules further specify the governance and reporting arrangements:

• Keeping the governing body informed: Rule 5-6 of the AML/CTF Rules requires AML/CTF policies to address the provision of information to the governing body so that it can fulfil its responsibilities under Section 26H(1) of the AML/CTF Act.
• Providing regular reporting: Rule 5-7 of the AML/CTF Rules specifies requirements for reporting by the AML/CTF compliance officer to the governing body.

Reporting entities should also maintain accurate and timely reporting processes, including for responding to AUSTRAC requests. Cryptolink’s suspension, for example, followed missed threshold transaction reports and a failure to respond to an AUSTRAC information request.

Under Section 75N(1) and (2) of the AML/CTF Act, the AUSTRAC CEO may request further information in writing when making decisions under Part 6 of the AML/CTF Act, concerning remittance registration and is not required to decide until the requested information has been provided. The corresponding powers for VASP registration decisions are provided under Section 76Q(1) and (2) of the AML/CTF Act.

Consequences of AUSTRAC Cancelling or Suspending a Fintech Registration

Consequences for Continuing Regulated Services

A business with a cancelled or suspended registration cannot continue providing the registrable services covered by that registration.

Section 74(1), (1A) and (1B) of the AML/CTF Act prohibit the provision of specified registrable remittance services by persons who are not appropriately registered. Similarly, Section 76A(1) prohibits the provision of registrable virtual asset services by persons who are not registered VASPs.

These restrictions also apply where registration has been suspended, subject to the limited exceptions in Rule 4-18 of the AML/CTF Rules, which preserves registration status for renewal and notification purposes only.

Breaching these restrictions can create both criminal and civil exposure.

Under Section 74(2) of the AML/CTF Act, an offence involving the provision of registrable remittance services without the required registration, or a breach of registration conditions, carries a maximum penalty of 2 years’ imprisonment or 500 penalty units, or both. Section 74(10) also identifies the underlying restrictions in Subsections (1), (1A), (1B) and (1C) as civil penalty provisions.

Similarly, Section 76A(3) establishes the corresponding offence for unauthorised virtual asset services or breaches of registration conditions, carrying a maximum penalty of 2 years’ imprisonment or 500 penalty units, or both. Section 76A(11) identifies the underlying restrictions in Subsections (1) and (2) as civil penalty provisions.

AUSTRAC’s September 2026 announcement stated that businesses with cancelled registrations could no longer operate.

Potential Enforcement Exposure & Available Review Processes

Subsequent offences can attract higher penalties where the statutory conditions are met. Under Section 74(4) of the AML/CTF Act, a further contravention following a previous AUSTRAC direction under Section 191(2), or an accepted undertaking under Section 197, can carry up to 4 years’ imprisonment or 1,000 penalty units, or both.

Section 74(6) provides for a maximum penalty of 7 years’ imprisonment or 2,000 penalty units, or both, where the relevant direction or undertaking has occurred on more than one occasion. Section 76A(5) and (7) establish corresponding penalties for virtual asset service providers.

Decisions to cancel remittance or VASP registrations are reviewable decisions under Part 17A of the AML/CTF Act, as provided for in Sections 75G and 76J.

Before making a cancellation decision, the AUSTRAC CEO must generally give written notice of the proposed decision and allow 28 days for the affected person to make a submission under Section 75Q(1) or Section 76S(1), respectively. However, the AUSTRAC CEO is not required to provide this notice where it would be inappropriate because of the urgency of the circumstances under Section 75Q(2) or Section 76S(2).

An application for reconsideration of a reviewable decision made by a delegate of the AUSTRAC CEO must contain the information specified in Rule 11-3 of the AML/CTF Rules, in accordance with Section 233D of the AML/CTF Act.

A suspension may also be revoked under Rule 4-22 of the AML/CTF Rules if the AUSTRAC CEO is satisfied that the circumstances supporting the suspension no longer justify it.

Conclusion

AUSTRAC’s September 2026 actions show that fintechs and VASPs must maintain accurate registration details, operational capability and effective AML/CTF controls. Ongoing risk assessment, sound governance and timely reporting remain central to continued registration and lawful operation.

To prepare for AUSTRAC’s requirements, contact Click Legal for AML/CTF compliance services for fintechs and VASPs, including a review of registration status, risk management arrangements and reporting processes.

Frequently Asked Questions