Australian Guide to the Former Term DCE, VASP Registration and Digital Asset Reform 2026–2027

Anti-money laundering reform and financial services reform are separate legal arrangements. AUSTRAC confirms that registered DCE automatically become VASP from 31 March 2026; they do not need to reapply to confirm their registered status, but must still complete the online service migration and update their details during the period from 31 March to 29 July 2026. Information added to the registration details by the reforms must be supplied before the next renewal. These dates are not the dates on which all services simultaneously become subject to all obligations.AUSTRAC Transitional rules DCE Migration Guide

The Corporations Amendment (Digital Assets Framework) Act 2026 is Act No. 38 of 2026. It passed both Houses on 1 April and received Royal Assent on 8 April. The commencement table in section 2 of the Act specifies 8 April 2027; ASIC’s 15 October media announcement and CP392 also use 8 April. ASIC’s earlier roadmap and September announcement stated 9 April, creating a one-day discrepancy between official sources. This guide follows the text of the Act and the later consultation explanation, rather than calculating from an old webpage date.Full text of the formal Act ASIC October implementation consultation

As at 5 November 2026, the new law has received Royal Assent but has not yet commenced. CP392 was published on 15 October 2026, with consultation closing at 5 pm on 27 November AEDT; the financial appendix, revised on 20 October, is still expressly marked as a draft. Do not promote a business as having received a new DAP/TCP authorisation that is not yet available, or describe consultation document standards as final amounts that must currently be met.

• 2026-03-31: existing DCE registrations automatically continue as VASP; the reformed principal obligations apply to 50A services.
• 2026-07-01: deferral ends for the principal AML/CTF and Travel Rule obligations for newly registrable virtual asset services, other than 50A.
• 2026-07-29: the windows for historical migration and timely registration applications for newly added services have passed; individual applicants awaiting a decision must demonstrate that they meet the transition conditions.
• 2027-04-08: the DAP/TCP framework is scheduled to commence by law, and applications for new ASIC authorisations open.
• 2027-10-07: ASIC CP392 specifies the deadline for existing relevant platforms to apply or vary; the general transition ends from 2027-10-08.

VASP is a registration status under AUSTRAC anti-money laundering regulation, not a traditional AFSL financial services licence. Reporting entity status arises from providing designated services with the statutory Australian connection; it does not arise only after a certificate has been obtained. Registration and enrolment are separate processes: entities providing registrable VASP services will generally need to complete both. AUSTRAC carries out both regulatory inspections and financial intelligence analysis. Registration does not mean that the government guarantees customer funds or endorses any particular token.VASP Registration guidance

Existing financial services law is technology-neutral. Where a token or arrangement already constitutes a security, derivative, managed investment scheme or other financial product, the related issuing, dealing, advice and custodial services may still require current AFSL authorisation, and market or clearing and settlement facilities may require separate licensing. The new 2027 platform framework is not a defence for unlicensed financial product activity in 2026. The application deadline for the ASIC INFO225 sector no-action arrangement has been extended to 30 September 2026; those who do not meet the conditions may be acting unlawfully from 1 October, and applying in time does not mean a licence has been granted.ASIC current digital asset licensing deadline reminder

The guide’s statements that all financial institutions must hold AFSL, all lending is AFSL, and customers must be covered by PI insurance are inaccurate. Consumer credit has a separate credit licensing framework; deposit-taking and some prudentially regulated activities require separate consideration of APRA requirements. Complaints, compensation arrangements, disclosure and client-money rules for services to AFSL retail clients must be assessed against the specific product and any exemptions. They cannot all be applied to an VASP that provides only virtual asset services that are not financial products.

• Layer one: Determine, item by item, whether AUSTRAC designated services and an Australian geographical link apply.
• Second layer: Check the existing financial-product status of each type of token and arrangement.
• Layer three: Check the platform and underlying asset authorisations against the 2027 DAP/TCP definitions.
• Layer four: Assess whether market, clearing and settlement, consumer credit, prudential regulation and overseas licensing requirements apply separately.

Current AUSTRAC designated services include: 50A exchanging or arranging exchanges between virtual assets and money; 50B exchanging or arranging exchanges between virtual assets; 46A virtual asset custody; 29 and 30 accepting customer instructions to transfer virtual assets or providing transferred assets to receiving customers; and 50C providing other financial designated services listed in Table 1 when participating in an offer or sale of virtual assets. 50B also includes exchanges between virtual assets of the same type. Actual business activities may trigger several categories simultaneously; a single category should not be selected based on a website name or exchange label.Official interpretation of designated virtual asset services

The concept of virtual assets is broader than the older concept of digital currency. It covers non-government-issued digitally represented value that can be transferred, stored or traded electronically and has a function as a medium of exchange, store of economic value, unit of account, investment or governance. CBDC is currency under that Act; value usable only within a game, loyalty reward points and purely collectible NFT without the statutory value functions may be excluded. This must be assessed by reference to actual rights and convertibility; not all NFT are automatically VASP businesses.

46A includes control and management under a multisignature or multiparty arrangement; custody does not require a single party to hold the complete private key. A pure software developer that does not hold or manage client assets, and a pure ancillary cloud storage provider that does not operate as a VASP, may fall outside this item. 50C requires participation in an offer or sale and the provision of another specified service in Table 1; issuing a token in isolation does not necessarily trigger 50C, but accompanying exchange or transfers for clients should prompt a separate check of 50A, 50B or 29.

• Keep a service mapping table showing business functions, funds flows, clients, asset types and designated service numbers.
• OTC, P2P arrangements and free promotions may also involve providing specified services in the course of carrying on a business.
• When also providing fiat remittance, separately check registration as an independent remittance dealer, network provider or affiliate.
• For DeFi, wallet software, NFT and stablecoins, retain specific reasons for the legal classification rather than using a name to avoid registration.

The practical value of VASP registration lies in lawfully entering Australia’s designated services regulatory framework, establishing an identity that customers can verify, and bringing anti-money laundering governance, customer due diligence and transaction monitoring under consistent management. AUSTRAC has published the VASP register, allowing the public to verify registration status. Registration does not guarantee bank account opening, the right to operate overseas or the credibility of a platform, and does not replace the ongoing fulfilment of obligations.Public VASP register explanation

The policy direction of the 2027 DAP/TCP framework is to bring platform risk, client asset management and transaction settlement within financial services law. For platforms that actually hold client assets, structured preparation can reduce omissions in the scope of authorisation and rework when transitioning in future, but the new standards may also change. The previous guide's descriptions of Australia as a globally accepted stepping stone and its unverified international rankings of prestige and recognition are not treated as facts in the formal guide. The United States MSB, Canada MSB and Hong Kong VATP have different regimes; registration in multiple jurisdictions is not automatically mutually recognised.

• Suitable for businesses with Australian customers, business connections or a physical presence that are willing to invest in day-to-day risk governance.
• Not suitable: proposals seeking only a shell certificate for resale, promising anonymous transactions or using Australian registration to cover a global market.
• The budget must cover personnel, CDD, on-chain analytics, the Travel Rule, custody security, legal, tax and audit costs—not just the application fee.

An Australian Pty Ltd is a common business vehicle, but AUSTRAC forms cater for different business structures; an Australian proprietary company must not be described as the only legal form available to every VASP applicant. If using an Australian proprietary company, at least one director must ordinarily reside in Australia. Directors must be natural persons aged 18 or over and must not be disqualified from managing corporations. The company must have at least one member and generally no more than 50 non-employee members. A company secretary is optional; if one is appointed, at least one must ordinarily reside in Australia.ASIC Rules for directors and secretary ASIC shareholder rules

A shareholder may be an individual or a legal entity; foreign shareholdings should be separately assessed for foreign investment review and relevant industry restrictions. Trace direct and indirect shareholdings, control arrangements, ultimate beneficial owners and those who control the board. Collecting passports only from those holding more than 10% does not constitute a complete AUSTRAC assessment. Directors and shareholders may be the same person, but substantive decision-making, the source of funds and the capacity to perform the role must still be demonstrable.

A newly appointed director must personally apply for Director ID before appointment. An agent can assist with assessment and preparation, but cannot apply on the director's behalf. A so-called local director service must not be a nominal arrangement without real authority; directors must understand the company's business and assume their statutory duties.ABRS Director ID

• Prepare the company constitution or applicable replaceable rules, register of members, shareholding rights and records of amounts paid.
• Prepare written director appointment consent, Director ID application records and evidence of ordinary residence.
• Provide a group ownership and control chart and registration documents for overseas parent companies.
• Disclose key personnel’s connections with similar businesses, previous registration applications, overseas regulatory licences, and breaches or disciplinary matters.

The AML/CTF compliance officer must be employed or engaged at management level, with sufficient authority, independence, resources and knowledge; where specified services are provided through a permanent establishment in Australia, the officer must be an Australian resident and pass a fit and proper assessment. External engagement is acceptable, but merely lending a name or purchasing a certificate cannot substitute for actually performing the role. The assessment includes competence, integrity, adverse criminal and regulatory history, bankruptcy and material conflicts of interest; approval is not granted mechanically on the basis of having no criminal record alone.AUSTRAC Compliance officer requirements

The standard rule is to appoint a compliance officer within 28 days of commencing designated services and notify AUSTRAC within 14 days of the appointment; a replacement and notification are also required if the officer leaves or ceases to be eligible. For operational readiness, it is advisable to identify the officer and their authority before lodgement. The statutory appointment window should not be mistaken for permission to go live without a AML system. The compliance officer must report to the governing body at least every 12 months, and records must be in English or readily convertible into English.

AFSL responsible managers are responsible for demonstrating organisational competence and are not the same statutory role as a company director or AML responsible officer. The CP392 draft guidance proposes demonstrating product and service, technical and AFSL regulatory knowledge in accordance with the DAP/TCP business requirements, and may consider relevant regulated or unregulated experience over the past ten years under RG105 Option 5. This is a proposed assessment approach, not a special exemption for digital asset responsible managers that exists as at today.CP392 and draft downloads

• Establish a responsibility matrix for the board or governing body, senior managers who approve risk assessments, the AML lead and the transaction monitoring team.
• Due diligence evidence for key persons may include police records, background checks, reference checks and applicable statutory declarations, as required by official forms and requests for further information.
• Record outsourced personnel’s permissions, hours, number of clients they can serve, conflicts of interest and replacement arrangements.
• DAP/TCP Candidate responsible managers should also provide relevant experience and a capability coverage statement for technology, custody, trading and financial services.

AUSTRAC The registration form asks for the business structure, identification numbers and addresses, projected revenue and transaction volumes for the next twelve months, countries of operation, bank accounts and third-party AML service providers. It also requires details of senior management approval of the risk assessment and the mechanism for updating it. VASP Specific questions include currencies, wallets under control, deposit and withdrawal methods, limits, service channels and overseas licences. The business plan should be capable of being cross-checked against the technical design, financial budget and customer contracts, rather than being a generic template.Official application form preparation guide

Supporting documents should be provided according to the entity structure and actual circumstances. Official guidance states that evidence of existence for an Australian proprietary company and sole trader generally need not be provided again; where ultimate ownership is overseas, ownership and control documents may need to be provided. Company registration certificates, constitutions, shareholders’ agreements, ABN and bank materials should therefore be prepared and available, but it must not be claimed that these form a fixed mandatory upload list in every case. TFN is a tax identifier and should not be entered casually into AUSTRAC transaction reports.

VASP should have a risk assessment and AML/CTF policy covering personnel due diligence, CDD, training, monitoring, reporting, record-keeping and governance. Custody businesses should also prepare private key access and recovery arrangements; exchange businesses should prepare transaction and deposit/withdrawal processes; and transfer businesses should prepare a Travel Rule data mechanism. Where an existing AFSL is required, or an application for DAP/TCP is planned, prepare additional materials such as an authorisation matrix, responsible manager, financial resources, audit, retail disclosures, and complaints and compensation arrangements.

• Entity pack: registration extract, address, constitution, ACN or other number, group control chart and signing authorities.
• Personnel pack: proof of identity, residential address, CV, training, associated businesses and regulatory proceedings.
• Business pack: user and currency scope, revenue and transaction volumes over twelve months, funds flows, wallets, and deposit, withdrawal and limit design.
• AML package: approved risk assessment, policies and procedures, monitoring rules, CDD testing, reporting exercises, records and independent assessment arrangements.
• Technology and client pack: client contracts, outsourcing agreements, information security, private-key management, asset reconciliation and exit plans.

The company’s registered office is for receiving formal and legal documents, while its principal place of business reflects its actual main place of business. ASIC permits a registered agent’s address to be used as the registered office in certain circumstances; a company that does not occupy the premises must obtain the occupier’s consent. An Australian company’s principal place of business should be a physical street address in Australia, not a PO Box. The registered office, address for notices and residential address of personnel are not the same type of information.ASIC Company address rules

VASP applications must also truthfully disclose places of business and the countries in which the business operates. Providing mail forwarding does not mean that sufficient business substance has been established, nor does it replace the residency requirements for directors and AML responsible managers. Overseas technology teams, customers and custodians may form part of a cross-border structure, but it must be clear who manages the service, who controls the wallets, who can access the records and who is responsible to customers. The business’s actual Australian connections and overseas obligations must also be assessed.

• Retain the lease, consent to use the premises or agent address agreement, and mail delivery arrangements.
• Record the registered office, principal place of business, each service location and the address for notices separately.
• For cloud services and offshore custody, document arrangements for regulatory access, data export and business continuity.
• Changes to company addresses generally require notification to ASIC within 28 days; changes affecting VASP registration information require notification to AUSTRAC within 14 days.

AUSTRAC Registration information does not prescribe a universal VASP minimum share capital or NTA amount, but compliance resources and operational capacity will be assessed. Issuing nominal shares of AUD 1, or 100 shares at AUD 1 each, only describes the company’s share arrangements; it does not mean that all regulatory funding requirements are met. Share capital, cash, net assets, regulatory NTA and client custodial assets must be distinguished: shareholder loans usually create liabilities, client funds are not capital freely available for company use, and software recorded on the books or goodwill cannot directly be treated as NTA.

CP392’s financial attachment proposes three alternative NTA models, not three thresholds that apply simultaneously or are already in force. The proposed full third-party custody concession under each model is the greatest of AUD 200,000, 0.5% of average underlying assets (capped at AUD 7 million for that percentage component), and 10% of average revenue. The concession requires all underlying assets to be held by an eligible third party or sub-custodian, with written assurance and the applicable audit report. Merely signing an outsourcing contract does not justify preparing on the basis of AUD 200,000.CP392 Financial draft, revised 20 October 2026

If the concessions do not apply, Model 1 proposes the higher of AUD 14 million and 10% of average revenue. Model 2 proposes the higher of AUD 7 million and 10% of average revenue for an operator that only safeguards underlying assets that are not financial products; in other cases, it proposes the higher of AUD 14 million and 10% of average revenue. Model 3 proposes the greatest of AUD 2 million, 0.5% of average underlying assets (capped at AUD 14 million), and 10% of average revenue, then adds AUD 500,000 for agency, AUD 750,000 for a trading venue and AUD 1 million for own-account or matched-principal activity, according to the actual DAP activities; applicable activity additions may be cumulative. TCP and mere custody of DAP cannot be assigned these trading-activity additions without analysis.

The draft also proposes requiring cash flow forecasts for at least the next twelve months, approval by directors at least quarterly, cash or cash equivalents of at least the higher of AUD 200,000 and 50% of the required NTA, liquid assets of at least 100% of the required NTA, and an annual opinion from a registered company auditor. The draft also includes CPI indexation. The above is for budgeting scenarios only; it is not a final authorisation condition as at 5 November 2026. Existing AFSL businesses continue to operate under current financial requirements and licence conditions.

• Prepare separate schedules for paid-up share capital, the balance sheet, regulatory adjustment NTA and client asset reconciliation.
• The budget includes start-up costs, at least the cash needed to sustain operations, and the costs of audit, security and an orderly exit.
• Separately model cash requirements and NTA pressures for self-custody and full third-party custody, and for each of the three consultancy models.
• Do not use customer coin deposits, customer margin or the unrealised market value of platform tokens as direct proof of regulatory capital.

First determine which designated services will be provided and the Australian connection; establish the entity, personnel, AML systems and budget, then complete enrolment and registration through AUSTRAC Online. Both are required; completing only one is not enough. In principle, a new applicant must obtain registration approval before providing registrable VASP services. An application may be approved, approved subject to conditions or refused; approval cannot be guaranteed.AUSTRAC Registration and assessment process

AUSTRAC indicates that assessment may take up to 90 days and that further information may be requested; after further information is provided, the 90-day period starts again. This timeframe is not the total period from signing to launch for every application, nor is it a promise of approval. The company formation period of 1–2 weeks, tax number period of 1–2 weeks, account opening period of 2–4 weeks and overall period of 4–6 months stated in the original guide should be treated only as old commercial estimates; this guide does not present them as official targets. Actual scheduling needs to account for overseas evidence, directors and responsible persons, banks' risk appetite, technical remediation and the number of requests for further information.

Only entities that meet the historical transition conditions for services added in 2026 and submit within the prescribed window may be able to continue providing services while awaiting a decision from AUSTRAC. The automatic continuation of existing DCE does not mean that migration of information can be ignored. If migration has still not been completed as at today, check the account, enrolment status and outstanding obligations, and communicate with AUSTRAC to rectify matters; an expired window cannot be relied on as a reason to operate now without enrolment.

• Step 1: Confirm service codes, client and currency scope, and obtain an analysis of the existing AFSL perimeter.
• Step 2: Determine the legal entity, directors, ultimate controllers and AML responsible person.
• Step 3: Complete practical testing of the risk assessment, policies, CDD, monitoring and reporting processes.
• Step 4: Complete the AUSTRAC Online account, enrolment and VASP registration form, and retain the receipts.
• Step 5: Respond to reviews and requests for further information, and record any reset dates and approval conditions.
• Step 6: After approval, check the register and conditions, commence operations and monitor the calendar for renewals, changes and reporting.

Under the new law, DAP is a facility through which an operator holds digital tokens for a customer or a person nominated by the customer, and may also provide related platform services. An agent's holding activity may be attributed to the operator, so outsourcing all custody to a third party does not automatically take the activity outside DAP. TCP is a facility through which an operator creates a single digital token for each underlying non-monetary asset, the token holder has the right to redeem or direct delivery of that asset, and the operator holds the underlying asset for the token holder. TCP is not DAP, and merely digitising a ledger does not automatically make something a digital token.Formal Act ss 761GB–761GE

The Chapter 10 transitional arrangements under the new law run for six months from the commencement date; ASIC CP392 paragraph 45 expressly states that applications for the new authorisation open on 8 April 2027, and existing relevant platforms should apply for AFSL or a variation by 7 October. Those who apply on time may continue operating under the applicable transitional provisions while ASIC assesses the application; the new amendments addressed by those provisions begin to apply after the decision date. Those who do not apply on time cannot continue operating under the general transition after 8 October. This transition does not remove financial product licensing obligations that already applied.CP392 Full text

The in-law low-value DAP issuance exemption is intended to apply after implementation subject to strict conditions: the platform of the relevant closely related group does not hold financial products; the total transaction value over the previous twelve months does not exceed AUD 10 million; the combined entry values of the underlying assets across all relevant platforms do not exceed AUD 5,000 each time a customer is credited with new assets; and a notice relying on the exemption is submitted to ASIC. This is not an annual transaction allowance of AUD 5,000, nor an automatic exemption from TCP, and it does not remove AUSTRAC obligations. Some other exceptions depend on regulations yet to be made; not all exceptions described in consultation materials can be treated as already in force.

• The licensing analysis should identify platform issuance, using a platform on behalf of clients, arranging transactions and providing advice, as well as activities involving underlying financial products.
• Existing AFSL and INFO225 applications do not necessarily include future DAP/TCP permissions; the proposed simplified variation is not an automatic upgrade.
• Display application acknowledgements, no-action eligibility, transitional rights and approved AFSL separately; do not misrepresent them collectively as approval.
• Before each planned launch or change, check the formal legislation, final standards, licence conditions and exemption notification procedure.

CP392’s draft guidance distinguishes custody-only DAP, agency DAP, principal or matched-principal DAP, trading venue DAP and TCP issuance and operation. The four DAP are not four licences already granted; this is ASIC’s proposed classification of new authorisations for 2027. A platform using multiple models at the same time may need multiple issuance authorisations, as well as trading or advice permissions for the underlying financial products.Proposed DAP/TCP guide

The proposed asset-holding standards are intended to cover arrangements for client asset rights, segregation, authorised use, personnel and security, reconciliation, redemptions and withdrawals, and service provider oversight. The proposed transaction settlement standards may address fairness, orderliness and transparency, execution, price transparency, listing review, transaction monitoring, settlement and business continuity. Consultation drafts should not be treated as a final checklist, but businesses should design processes according to their actual risks; current Corporations Act, AML, client contract and existing AFSL obligations must still be met.

• Custody only: record ownership, withdrawal rights, hot and cold wallets, key control and reconciliation.
• Agency: record client instructions, execution routing, liquidity sources and outsourced custody.
• Proprietary trading: record bilateral quotes, hedging, inventory risk and conflicts of interest.
• Trading venue: record order matching, participant rules, price surveillance and trading halt mechanisms.
• TCP: verify the existence and ownership of the underlying asset, the uniqueness of the token, redemption and delivery, and ongoing custody.

The AML/CTF plan must identify and manage money laundering, terrorism financing and proliferation financing risks based on services, clients, countries, channels, currencies and outsourcing arrangements. A template compliance plan cannot be treated as proof of actual effectiveness. Customer identity, beneficial ownership and control structures, agency relationships, transaction purpose and risk ratings must be established; source of funds and source of wealth checks, politically exposed person and relevant list screening must be carried out on a risk basis, with ongoing monitoring of accounts, on-chain activity and behavioural anomalies.

Reporting entities that were enrolled by 30 March 2026 and meet the policy conditions may, during the initial CDD transition period from 31 March 2026 to 31 March 2029, continue using compliant existing ACIP by customer category, provided they recorded the categories and transition dates in their policies by 1 July 2026. This arrangement relates only to the initial CDD; ongoing CDD and other reform obligations continue to apply from their relevant implementation dates. New applicants today cannot rely on the existing-customer due diligence exemption.AUSTRAC initial CDD transitional rules

High-risk customers, unusual transactions and customers who continue to be served when an SMR must be submitted must be subject to enhanced CDD. Record the time of alert review, the time reasonable suspicion was formed and the reasons for the action taken. Refusing or not completing a service may already give rise to an SMR obligation; do not wait for a transaction to succeed before checking.

• Establish mechanisms for checking client identity, beneficial owners, controllers, agent authority and relevant source of funds.
• Set review rules for high-risk countries, privacy coins with enhanced anonymity, mixing routes, proceeds of scams and inconsistent transaction behaviour.
• Keep records of senior management approval, personnel due diligence, role-specific training, conflicts of interest and outsourcing oversight.
• Update the risk assessment as currencies, services and technology change; re-signing an annual template is not a substitute for substantive review.

The main Travel Rule obligations for virtual asset transfers of value apply to relevant new services from 1 July 2026. A transfer service must identify its role as an ordering, beneficiary or intermediary institution, collect and transmit the applicable payer and beneficiary information in accordance with the law and Rules, and establish processes for counterparties and incomplete information. Leaving only a wallet address on-chain does not replace the transmission of Travel Rule information.AUSTRAC virtual asset services and transfer obligations

TTR applies to banknotes or coins actually received or paid in a designated service where the amount reaches or exceeds the equivalent of AUD 10,000; a report must be made within 10 business days after the transaction date. An electronic transfer, card payment, cheque or transfer consisting solely of crypto-assets for AUD 10,000 does not trigger TTR solely because of the amount; structuring to evade the threshold may give rise to SMR. SMR must generally be submitted within 3 business days after the day reasonable suspicion is formed, or within 24 hours if it relates to terrorist financing. Specified legal professional privilege information is treated differently; reporting must not be delayed while waiting for a complete investigation.TTR official requirements SMR Official requirements

IFTI and new IVTS reporting must not be conflated. The transitional rules generally defer the conversion of IVTS reporting until 31 March 2029; some eligible entities may choose another date no later than 30 September 2029. A transfer of virtual assets under items 29 and 30 alone, without transferring money or property, does not require the old IFTI; using virtual assets as a settlement tool for remittances does not automatically remove the IFTI obligation. Special transfer reporting for unverified self-hosted wallets also has a 2029 milestone, but SMR and other obligations are not suspended as a result.Reporting transition arrangements

• Establish procedures for Travel Rule data collection, secure transmission, recipient checks and escalation of missing information.
• Distinguish cash, electronic fiat currency, virtual assets and coins used as a medium for settling remittances.
• Establish the SMR 24-hour and 3-business-day clocks, the TTR 10-business-day clock, and procedures to prevent improper tipping off.
• Reserve system capacity for 2029 IVTS and unverified self-hosted wallet reporting; do not claim in advance that all future reporting requirements have been implemented.

The seven-year retention period is calculated separately by record category: CDD records must be kept for seven years from completion of an occasional transaction or the end of a business relationship; general transaction records for seven years from the date they are created, and transaction documents provided by a customer for seven years from receipt; records relating to the AML/CTF plan must be kept from the date they are created and for seven years after they cease to be relevant to demonstrating compliance with Part 1A. The period does not run from the transaction date in every case. Establish an index, access controls, backups, English-readable outputs and a process for providing material to regulators, so that transactions can be reconstructed. Official guidance also explains that customer identification obligations do not in themselves require identity documents to be copied in every case; retain the information and operational evidence used for verification, and comply with applicable privacy requirements.AUSTRAC Record-keeping details

The reforms replace the independent review of former Part A with an independent evaluation of the entire AML/CTF programme, with its frequency specified in the policies. For entities already enrolled by 30 March 2026 that already have an independent review, the first evaluation is due on the later of four years after the most recent review and 31 March 2027. For newly regulated businesses, the initial due dates are 30 June 2029, 31 December 2029, 30 June 2030 or 31 December 2030, according to the odd/even combination of the last two digits of AAN. Deferring the first evaluation does not remove the current obligation to establish and implement an AML programme.Independent assessment transitional arrangements

AUSTRAC annual compliance reporting has changed to a financial-year basis: the next period covers 1 July 2026 to 30 June 2027, with submission required within three months after the reporting period ends, namely from 1 July to 30 September 2027. The period from 2 January to 31 March must not continue to be described as a permanently current submission window. Exceptions apply to group reporting and certain designated services; where an entity is sold, closes or has no designated services, it must also complete the relevant opening question and removal procedure in accordance with the guidance.Current annual compliance reporting rules

• Both of the last two digits of AAN are odd: first evaluation for newly regulated entities is due by 2029-06-30.
• Odd penultimate digit, even final digit: until 2029-12-31.
• If both final digits are even: by 2030-06-30; if the penultimate digit is even and the final digit odd: by 2030-12-31.
• Establish a starting-date table for the retention period for transactions and CDD, an independent assessment remediation list and an annual reporting lead.
• The AML officer reports to the governing body every 12 months; this is separate from submitting an annual compliance report to AUSTRAC.

Acquiring shares in a registered entity is different from purchasing its business assets. A share acquisition retains the same legal entity, and its existing obligations, breaches and client liabilities may also remain. An asset acquisition or transfer to another company does not mean that VASP registration or AFSL is acquired with the assets. The buyer must verify the registration number, service scope, renewal date, conditions, investigations, client and wallet records, historical SMR/TTR/IFTI, banking relationships and information security. Registration is not a standalone commodity that can be detached from a business and transferred.

AUSTRAC requires notification within 14 days after changes affecting registration, including changes concerning beneficial owners, key persons, relevant litigation and regulatory action, service partners, countries, overseas licences, names and addresses, and cessation of registrable services. Remittance network providers have 7 days after receiving notification of relevant changes from affiliates; this 7-day rule is not a uniform deadline for ordinary VASP businesses.AUSTRAC change notifications

If the entity also holds AFSL, a change of control must be notified to ASIC under s912DA within 30 business days after control starts or ceases. Control also includes actual influence over board and financial or operational policies, not only direct ownership of more than 50% of shares. General changes to licence information, such as address, contact details and website, are usually due within 10 business days; separate 28-day rules apply to most changes to directors, shareholders and addresses at company level. The three sets of filings must be completed separately, and notification does not guarantee that ASIC will not review the matter again or take action in relation to the licence.ASIC change of control AFSL changes to details

• Before the transaction, confirm whether it is an equity transaction or an asset transaction, and whether new registration or a change to the authorisation is required.
• Include continued banking services, retention of responsible persons, remediation of conditions, client asset reconciliation and regulatory notifications as completion conditions.
• When adding custody, crypto-to-crypto exchange, transfers, issuance or derivatives, remap the scope; do not simply rely on the original description of DCE.
• After completion, update AUSTRAC, ASIC company details, AFSL, bank and customer contracts separately; do not assume that acquiring a shelf company is a shortcut.

After an Australian company obtains ACN, it applies for ABN and tax registrations according to its actual business activities. GST is generally assessed by whether the relevant GST turnover reaches or is expected to reach A$75,000; company registration does not mean that every company must register for GST, and total digital-asset transaction volume cannot be treated directly as taxable turnover. ATO distinguishes exchange-facilitated transaction services from direct buying and selling of coins: transaction facilitation services supplied to Australian residents located in Australia are generally taxable supplies, whereas direct trading in eligible digital currency may be an input-taxed financial supply, and supplies to overseas customers may qualify as GST-free. The position must be analysed according to the currency, service and customer location.GST registration Cryptocurrency exchange GST

Each year, the company must check its ASIC annual statement, pay the annual review fee as notified (usually due two months after the review date) and, where applicable, pass a solvency resolution within two months. A negative resolution or failure to pass a resolution on time must be notified in accordance with the rules. VASP registration alone does not make every proprietary company subject to AFSL audit, but an entity that also holds AFSL and meets the applicable company reporting conditions must comply with the financial reporting, audit and lodgement requirements that actually apply to it.ASIC company annual review

Banks assess virtual asset businesses under their own risk policies; registration does not guarantee an account. Typically, prepare documents for the entity and its controllers, the business plan, source of funds, AML policies, countries of operation, deposit and withdrawal channels, and wallet arrangements, and provide further material as requested by the bank. The original guide’s examples of CBA, ANZ, NAB and Westpac are only examples of market participants and do not indicate that they will accept an application to open an account; Westpac is not Bank of Western Australia. Account approval and regulatory applications may depend on overlapping information and should be scheduled separately.

• Budget separately for ASIC company fees, ASIC licence application or variation fees, any possible regulatory levies and consultancy fees.
• The guide’s AUD 10,000–30,000 figure must not be presented as a government fee. Do not claim an all-inclusive cost without a written quotation.
• Set up a tax calendar for GST, income tax, BAS, payroll and company record-keeping obligations; select filing frequency according to what actually applies.
• Follow the bank’s approved signatory and identity verification procedures; do not treat electronic signatures from all shareholders as a uniform statutory account-opening requirement.

VASP registration lasts for three years. An application for renewal can be made through AUSTRAC Online within the 90 days before expiry. If submitted in time within this window, registration remains in effect until AUSTRAC makes a decision. If not renewed, the registration expires and is removed from the register, and the business cannot continue providing registrable services. A new application after expiry is treated as a new registration. This rule differs from AFSL; a three-year VASP renewal must not be described as a three-year AFSL licence renewal.Registration renewal and enforcement

AUSTRAC may impose conditions on registration, suspend or cancel it, or refuse renewal because of significant money laundering, terrorism financing or serious-crime risks, non-compliance, breach of conditions, offending or litigation involving key personnel, inadequate capability, or materially false or omitted information. The entity will be notified of the decision and, where applicable, provided with internal or external review options. It is not appropriate to summarise all current consequences of breaches using the old guidance’s statement about two years’ imprisonment; the specific breach, mental elements and penalties must be assessed under current law.

When ceasing business, put in place arrangements for returning customer assets and funds relating to outstanding transactions, revoking private-key access, retaining records, handling complaints and finalising tax matters, and apply for removal from the AUSTRAC roll or register. AFSL, company registration and tax registration must be dealt with separately; a company that remains open still has annual fees and statutory obligations. AUSTRAC has advised that registered entities not conducting VASP should withdraw voluntarily rather than hold an inactive registration as a commodity over the long term.

• Set a renewal reminder 90 days before expiry and complete new registration information required by the reforms before renewal.
• Regularly exercise regulatory information responses, client asset reconciliations, fault recovery and large withdrawals.
• Investigate and remedy any breach promptly, assess any other statutory reporting obligations, and retain evidence.
• On exit, address client assets, AUSTRAC, AFSL, company and tax matters separately; deleting the website is not a substitute for deregistration.

Byline: Drew Tang (Mr Tang/Drew), Business Manager; Rengangyongsheng (Hong Kong) Limited, English name Rengangyongsheng (Hong Kong) Limited. This feature is for the Chinese-language business guide on afsl8.com and was verified as at 5 November 2026. It provides general business and regulatory information and does not replace Australian legal, tax, accounting or investment advice tailored to a particular entity, product or transaction.

Depending on the client’s needs, assistance can be provided with business scope and entity planning, preparation of company and tax information, ownership and personnel documents, risk assessments and AML/CTF policies, VASP registration and requests for further information, bank account-opening materials, acquisition compliance due diligence and an ongoing calendar. For legal classification, AFSL licensing or future DAP/TCP applications, relevant advice should be provided by appropriate Australian professionals. The service covers compliance documents and processes; it does not involve drafting national anti-money laundering regulations and does not guarantee approval, account opening, certification or an overseas licence.

This guide retains the valid business scope, establishment, personnel, documents, application, banking and maintenance matters from the original sources, while correcting errors against official information. Previous international rankings, lists of brands said to be registered, unverified government fees and future final capital amounts are not published as facts. A complete extract of the user’s original guide is saved in dce-source.md in the same directory to facilitate review of content history.

• Before starting the project, first confirm the service number, existing financial product permissions and the scope of the 2027 platform.
• Service quotations specify which work is undertaken by the consultant, an Australian lawyer, an accountant or a technology provider.
• When publishing formally, retain the relevant official links, verification date and draft status; updates must not overwrite historical deadlines that have passed.

Complete guides to each subtype

The following are branches covering business activities, products or corporate structures; not every item corresponds to a separate statutory licence.

Frequently Asked Questions