RSP Remittance Services Registration Guide

A remittance service provider (RSP) is an individual, business or organisation that accepts a customer’s instructions to transfer money or property to a recipient in another location. Services may involve domestic or cross-border transfers and are not automatically exempt from regulation because the amount is small, the customer is a business or the service is provided only occasionally. Whether registration is required depends on the actual designated service, the geographical connection and any applicable exceptions.

AUSTRAC is both a financial intelligence unit and an anti-money laundering and counter-terrorism financing regulator. Enrolment adds a reporting entity to the Reporting Entities Roll; RSP registration is an additional admission process. Obtaining an account or AAN does not amount to remittance registration, and an application receipt is not approval. The 28-day period under the general enrolment rules cannot be treated as a grace period allowing a new remittance business to operate before registration.

A current registration enables the public and business partners to check the remittance provider’s registered status, assisting with commercial due diligence. However, AUSTRAC expressly states that registration does not guarantee compliance. It must not be promoted as regulatory certification, a guarantee of a bank account, an endorsement of the safety of funds or a universal financial licence covering the globe. Source:AUSTRAC Remittance business overview；AUSTRAC dormant registration enforcement guidance。

• First check which entity is responsible for accepting instructions, sending transfer messages and paying value to the recipient.
• Before commencing operations, check the registration category, legal name, validity period, additional conditions and registration status.
• Do not use a certificate of company registration, ABN, AAN or a consultancy agreement as a substitute for AUSTRAC registration approval.
• Financial institutions and certain ancillary transfer services have specific exemptions; these cannot be applied to ordinary remittance providers.

An Independent Remittance Dealer (the term commonly used in official materials is IND and IRD) provides remittance services to customers using its own products, platform or system, and may own or control multiple self-operated branches. IRSP cannot be interpreted as International Remittance Service Provider, and there is no fourth category of “international remittance licence” that arises automatically merely because a remittance crosses a border.

A Remittance Network Provider (Remittance Network Provider, RNP) allows affiliates to provide remittance services using its brand, products, platform or systems. An Affiliate uses the network under an agreement with RNP and accepts customers’ remittance instructions. An Affiliate is not required to have an equity relationship with RNP; the same business may hold more than one type of registration, but each applicable category must be applied for separately, and one registration number cannot cover different models.

The advantages depend on the business model: an independent model allows greater autonomy in product design and settlement pathways; the RNP model enables a unified brand, systems and agent coverage; an Affiliate model can reduce the work involved in building infrastructure from scratch by using an existing network. The respective trade-offs are bearing the full cost of operating compliance independently, taking responsibility for network management, and being subject to network contracts and technical arrangements. Source:AUSTRAC Remittance business overview。

• Independent online or counter remittance: first determine whether IND registration is required.
• Making a brand or platform available to different operating entities: check RNP and the registration of each Affiliate.
• Operating own remittances in addition to a pure network agent model: Affiliate and IND coverage apply separately.
• Virtual asset exchange, custody or customer virtual asset transfers: separately check VASP; holding RSP does not automatically authorise these activities.

RSP registration addresses AUSTRAC entry requirements for remittance businesses and AML/CTF oversight. It does not authorise the acceptance of bank deposits, operation of a fund, dealing in securities, provision of investment advice or provision of every foreign exchange product. If the business constitutes a non-cash payment facility, foreign exchange contract or other financial product service, the AFSL requirements must be assessed separately under the Corporations Act and any applicable exemptions; conversely, it is also incorrect to claim that every remittance involving currency exchange necessarily requires AFSL.

ASIC remade the Non-cash Payment Facilities Instrument 2026/167 in 2026, extending certain exemptions for low-risk products until April 2031. The announcement also mentions future payment licensing reform; discussions of reform, an anticipated regime or unconfirmed commencement dates must not be presented as payment licence requirements that currently apply.

On 31 March 2026, existing DCE registrations automatically transitioned to VASP registrations under the transition rules; specific transition periods have also been provided for new virtual asset services. If an RSP applicant uses stablecoins for settlement or adds crypto services, it should reclassify the services actually provided, update its risk assessment and check whether another type of registration is required, rather than trying to avoid requirements by calling the service ‘blockchain remittance’. Sources:ASIC Non-cash payment facilities notice；AUSTRAC Transitional rules。

• List, item by item, the legal character of payment facilities, foreign exchange, stored-value balances, virtual asset exchange and client custody.
• Independently verify the scope of authorisation, exemption conditions and potential retail client obligations under AFSL.
• Do not use ‘Australian FSP’ as a generic licence name without specifying the regulator and category.
• RSP Registration is not APRA's ADI authorisation, nor is it insurance for customer funds.

Business structures accepted by AUSTRAC are not limited to Pty Ltd; sole traders, partnerships and trust structures operated by an appropriate entity may also be relevant to RSP registration. Whether a business has a geographical connection with Australia must be assessed under the rules concerning designated services provided through a permanent establishment in Australia, an overseas permanent establishment of an Australian resident and relevant overseas subsidiaries. The legal concept of a permanent establishment may also include conducting business through an agent.

Merely having an Australian office address or bank account, or providing website services to Australian customers, does not automatically satisfy all geographical connection conditions. Explain whether specified services are actually provided through an Australian address, agent, system or account. An offshore RNP operating an Australian Affiliate network remains subject to specific rules even if it does not meet the general geographical connection test.

Where a foreign company itself carries on business in Australia, separately check ASIC foreign company registration, ARBN, an Australian registered office and local agent requirements. This is a different pathway from establishing an Australian subsidiary; Australian resident director requirements for Australian companies must not be applied automatically to every foreign RNP. Basis:AUSTRAC geographical connection；ASIC foreign company registration。

• Confirm the legal entity that signs client contracts and actually accepts remittance instructions.
• Map the locations and functions of Australian and overseas offices, agents, servers and settlement accounts.
• An Australian subsidiary obtains ACN; registration of a foreign company obtains ARBN. Report according to the actual structure; the two must not be used interchangeably.
• For complex cross-border or trust structures, check the legal entities and territorial application; do not provide only a local address document.

An ordinary Australian Pty Ltd must have at least one director who ordinarily resides in Australia. Directors must be at least 18 and must not be disqualified by law. A secretary is not a mandatory position for an ordinary proprietary company; if there is a secretary, at least one must ordinarily reside in Australia. The requirements for directors and secretaries of public companies are different, so the Pty Ltd rules cannot be applied to all entities. Company law does not generally require every shareholder to be an Australian citizen or resident, but other restrictions on particular investments or businesses must still be checked.

Before appointment, directors should personally apply for Director ID. An adviser may assist with preparation but cannot apply on the director’s behalf. The members’ register, directors’ register and multi-layered control structure must be accurate and complete; nominee directors or shareholding arrangements must not be used to conceal the actual controllers. Every company must have at least one member, and share classes, amounts issued, and paid and unpaid amounts should be consistent with company records.

An Australian company’s registered office must be a physical street address in Australia, not a post office box. An accountant’s or registered agent’s address may be used, provided consent to its use is obtained and records are kept. The principal place of business must reflect where the company genuinely operates; the registered office does not have to be an office used for business operations. It is inaccurate to state as a general RSP rule that “all third-party addresses or virtual offices are unlawful”. Basis:ASIC Directors and secretary；ASIC Company address；ABRS director ID。

• Retain the directors' and secretary's written consents, Director ID information and evidence of directors' ordinary residence.
• Retain the register of members, company registration records at each level and an actual control structure chart.
• Retain consent to use the registered address; prepare a lease, premises details or an operational explanation separately for the business location.
• Declare each service location to AUSTRAC, including, where applicable, agents, counters, kiosks or ATM.

Registration assessments focus on the operating experience of the business and key personnel, AML/CTF resources, and any history of legal or regulatory breaches. Key personnel should be identified by their actual governance and material decision-making responsibilities, not solely by job title or shareholding percentage. Prepare their names, dates of birth, residential addresses, contact details, responsibilities, experience, qualifications, involvement in other similar businesses, previous applications and regulatory events.

The AML/CTF compliance officer must be employed or engaged at management level, have appropriate authority, independence and resources, and meet the fit and proper requirements; if specified services are provided through or from a permanent establishment in Australia, the compliance officer must be an Australian resident. An external compliance officer may be engaged, but this does not mean a consultant can perform the role merely by providing a name, nor is there a universal requirement for everyone to hold a particular international certificate.

Generally, a compliance officer must be appointed within 28 days after first providing designated services, and AUSTRAC must be notified within 14 days of the appointment. For RSP, governance and compliance capability should be established in practice before commencing operations. If the compliance officer leaves or ceases to be qualified, arrange a replacement and notify the regulator. The compliance officer must report to the governing body at least every 12 months; this internal governance report is different from the annual compliance report submitted to AUSTRAC. Source:AUSTRAC Compliance officer。

• Identify the governing body, senior managers responsible for approving the risk assessment and policies, and the compliance officer.
• Assess integrity, judgement, bankruptcy, adverse regulatory findings, criminal history and conflicts of interest.
• Background evidence may include a national police certificate, police history checks, statutory declarations and other appropriate background checks, as required for each case.
• Do not present a uniform current entry test requiring every director, shareholder or UBO to submit the same type of NPC, with absolutely no record of any kind.

AUSTRAC is not the body that applies bank capital adequacy regulation to remittance businesses. The current published application requirements for the three types of RSP focus on risk controls, personnel, resources and actual business capability, and do not specify a uniform minimum share capital or NTA figure. Even if a A$1 share arrangement can be used to establish certain companies, this does not demonstrate that the business can undertake remittance and compliance operations.

An Independent Remittance Dealer should budget for clearing prefunding, refunds, foreign exchange exposure, staff, CDD and reporting system costs. RNP should separately budget for network access, agent due diligence, centralised reporting and monitoring staff. An Affiliate should budget under its network contract for deposits, clearing prefunding, commissions, counter equipment and staff training. Banks, business partners or additional registration conditions may require further arrangements; these should be stated separately from general statutory thresholds.

The current AUSTRAC registration page does not list a uniform government application fee schedule; this guide does not invent fees or promise permanent free registration based on third-party advertising. Company incorporation and annual review fees, document verification, consultancy, technology and assessment costs are listed separately. The industry levy is not a fixed annual registration fee payable by every RSP: AUSTRAC explains that medium and large businesses generally bear it according to factors such as revenue and the volume and value of reported transactions, and must pay upon receiving an invoice. Sources:AUSTRAC Registration documents；AUSTRAC industry levy。

• List the company's issued share capital, actual cash, client funds awaiting payment and operating budget separately.
• Specify whether each deposit or prepayment arises from a statutory condition, a bank contract or a network contract.
• Prepare a 12-month forecast of revenue and transaction volumes, explaining how compliance personnel and systems will be funded.
• If also holding AFSL, check the financial resources conditions applicable to that authorisation; do not apply the NTA figure for AFSL to every RSP.

The 2026 AUSTRAC registration form requires information about business structure, identification numbers, contact and business addresses, directors or other officeholders, beneficial owners and key personnel. The operational section covers expected revenue from registered business over the next 12 months, countries of operation, existing business accounts, third-party service providers, how customers deposit and make payments, channels, transaction volumes and values, comparable overseas authorisations, and offsetting or third-party remittance arrangements.

Supporting documents should be provided according to the entity structure and review requirements. They may include company extracts, certificates of incorporation, constitutions, partnership agreements, trust deeds, registers of shareholders and directors, a control structure chart confirmed by an authorised person, risk assessments, AML/CTF policies and personnel background checks. Official guidance states that Australian proprietary companies and sole traders are not generally required to upload all formation and control documents in every case; overseas ownership structures may require further evidence. Do not mechanically require every applicant to provide a generic “business licence” or audited historical financial statements.

RNP must also state the number of Affiliates expected to be registered over the next 3 years, when applications will begin, its policy on registration on behalf of Affiliates or consent, its policy on submitting SMR on their behalf, and training arrangements. An Affiliate adopting the RNP risk assessment and policies generally does not need to upload its own separately prepared risk assessment and policies, but must still truthfully provide details of its own circumstances and arrangements for adopting the network documents. Basis:AUSTRAC Registration document checklist。

• Entity pack: legal name, ABN and applicable ACN or ARBN, structural documents and each service location.
• Control pack: shareholders, beneficial owners, ownership and control structure, governance personnel and appropriate identity information.
• Business pack: business description, client base, countries, channels, payment receipt and offset processes, and a 12-month forecast.
• Compliance package: approved risk assessment, policies, appointments, training, monitoring and reporting processes, and outsourcing quality controls.
• Network pack: Affiliate consent date, RNP suitability assessment, superannuation agent and written responsibility arrangements.

The business plan should explain why clients use the service, who receives instructions, how funds or other value enter the system, when and by whom they are released at the place of receipt, and how each entity settles. When using overseas agents, netting or third-party funding arrangements, it is not sufficient to show only bank transfer arrows while obscuring the actual payment chain. Distinguish client transfer principal, service revenue and network settlement balances.

The risk assessment must cover money laundering, terrorism financing and proliferation financing risks, and reflect the actual circumstances relating to customers, products and services, channels and countries. Community remittance customers, international students, migrant families or B2B customers are merely potential customer groups; they are not deemed low risk. Cash, non-face-to-face onboarding, multiple unrelated payers, third-party accounts, unusual returns of funds and high-risk destinations should be addressed specifically through monitoring and enhanced due diligence.

Where material changes to products, channels, customer types, countries or technology are within the business’s control, assess them before the change; assess external risk changes or regulatory risk information as soon as practicable in accordance with the requirements. Fully review the risk assessment and policies at least every 3 years; the three-year cycle is not a reason to ignore intervening triggers. Basis:AUSTRAC Plan updates。

• Specify each legal entity, account, jurisdiction, remittance message and settlement method.
• Forecast transaction volumes, values, average spend per customer and service revenue separately.
• Set controls, responsible persons, monitoring scenarios and refusal or restriction conditions for high-risk channels.
• When entering a new market, also check local laws in the countries where payments are collected; Australian registration does not provide a passport to operate overseas.

The current AML/CTF programme comprises a risk assessment and AML/CTF policies, which include procedures, systems and controls. It must be implemented before providing designated services, documented in writing and approved by senior management. Its contents should connect governance, personnel due diligence and training, CDD, ongoing monitoring, reporting, record-keeping, value transfer information and independent assessment. It should not be limited to supplying templates that are not suited to the business.

After the reforms on 31 March 2026, the program requirements can no longer be described as universally requiring new Part A and Part B. Eligible existing entities may temporarily use the old ACIP for specified client classes, but this relates only to a specific transition for initial CDD; it is not a general licence to use the old governance, old ongoing due diligence or the entire old program unchanged for three years.

RNP must provide a network programme to registered Affiliates. Approval of that RNP risk assessment and policies by an Affiliate's senior management may satisfy the corresponding programme obligations under section 26S for the services covered; the Affiliate may still conduct its own assessment and develop its own policies, and other services not covered by the network programme must be addressed separately. Adopting network documents does not transfer all responsibility and cannot replace actual frontline implementation. Basis:AUSTRAC Plan overview；AUSTRAC Affiliate form；Section 26S ancillary transcription。

• Retain records of senior management approval dates, versions, applicable services and receipt by the governing body.
• Record which version of RNP the Affiliate has adopted, which locations and services it covers, and confirm any business not covered.
• After adverse findings from internal updates and independent assessment, implement remediation, reapproval and staff communications.
• AUSTRAC Registration approval does not amount to separate approval or certification of the business’s AML/CTF plan.

CDD involves more than just collecting passports. Customers, persons acting on their behalf and relevant beneficial owners should be identified and verified; the purpose of the service should be understood and risks assessed. Select information and reliable verification sources according to whether the customer is an individual, company, partnership, trust or other structure. Under AUSTRAC’s customer CDD framework, the beneficial owner definition includes a natural person who directly or indirectly owns 25% or more of an interest, or a natural person who effectively controls the customer. Do not look only for people holding more than 25% and overlook control.

Identify politically exposed persons and related relationships, and apply enhanced due diligence, verification of source of funds and source of wealth, and senior management approval in accordance with applicable rules and risk conditions. There should be processes for investigation, restriction, refusal and SMR assessment where a customer refuses to provide information, identity details are inconsistent, there are suspicious third-party instructions or transactions are unusual. Customer information does not have a uniform 12-month “statutory validity period”; updates should be arranged in response to ongoing due diligence, changes in information and risk triggers.

Entities that joined before 31 March 2026 and are eligible may, under the transition policy, continue using the old ACIP for specified client classes until 31 March 2029. They must record the client classes and transition dates before 1 July 2026; it cannot now be assumed that all existing entities automatically qualify for a deferral. The new ongoing CDD obligations have applied since 31 March 2026. Sources:AUSTRAC Customer due diligence；Definition of beneficial owner；Transitional rules。

• Individuals: identity information, verification results, agency relationships, purpose of services and risk rating.
• Companies and trusts: entity existence, control structure, authorisation relationships and identification of relevant natural persons.
• High risk: verify source of funds and source of wealth as required, obtain approval, and apply enhanced monitoring and controls.
• Remote and electronic verification: check data reliability, fraud risk and traceable outcomes; do not rely uncritically on a software brand.

First determine the category based on the actual business model and entity, then complete the company or other structure, control and personnel details, risk assessment, policies and operational resourcing. Create a user account and multi-factor authentication through AUSTRAC Online, and enrol the entity; an entity that already exists should not create a duplicate record. After enrolment, use the same account to complete the applicable registration form, check the read-only information and update any incorrect details in the enrolment record first.

An Independent Remittance Dealer and RNP generally submit their own applications. For an Affiliate, RNP usually first conducts a suitability assessment and obtains the candidate’s consent, then submits the application through the system. A business applying for or already holding Independent Remittance Dealer registration may apply for Affiliate registration itself if it meets conditions including written consent from RNP, but must still retain evidence of the network assessment and consent.

After submission, retain the complete forms, attachments, acknowledgements and versions; respond to each request for further information point by point and ensure the information on directors, shareholders, processes and systems is consistent. Once the relevant approval has been obtained, check the registration and conditions, then test account, settlement, staff training, reporting and customer information processes before commencing operations. Source:AUSTRAC Enrolment process；AUSTRAC Registration process。

• Step 1: Service classification, legal entity and geographical nexus assessment.
• Step 2: Complete the entity, governance, risk policies and supporting materials.
• Step 3: Create an AUSTRAC Online account and complete enrolment.
• Step 4: Submit the IND, RNP or relevant network Affiliate registration.
• Step 5: Respond to requests for further information, and keep review communications and amendment records.
• Step 6: Check approvals, registration conditions and operational readiness; submission is not a substitute for approval.

AUSTRAC states that it may take up to 90 days to assess an application; if further information is requested, the 90 days restart from the date the applicant provides the required information. This statement must not be paraphrased as guaranteed approval within a fixed 90 days after initial submission, a 90-business-day assessment, or certain approval within 6–8 weeks once documentation is complete. Time spent on commercial preparation and bank accounts is not included in this regulatory review statement.

Regulators will consider significant risks of money laundering, terrorism financing or other serious crime; the likelihood of the business actually operating; compliance resources and the experience of key personnel; criminal charges or convictions; domestic and overseas compliance history; and the history of relevant persons. For Affiliate checks, they will also assess whether candidates consent and the RNP assessment. The outcome may be approval, conditional approval or refusal.

Additional conditions may affect scale, destinations or notification arrangements and must be implemented in the business plan and systems. Whether a refusal, suspension, cancellation or conditional decision can be reviewed is governed by the written notice and Part 17A of the Act. Paying a consultant does not guarantee approval, and unauthorised business must not be continued at will while a review is under way. Basis:AUSTRAC Registration assessment and review。

• Regulatory timing: record the submission date, requests for further information, actual response dates and any new assessment period.
• Commercial timing: schedule entity and background checks, bank due diligence, network onboarding, systems and launch separately.
• On receiving conditions or an adverse decision: promptly check the review method and time limits in the notice.
• Do not invent fixed approval success rates, internal regulatory relationships or promises of obtaining a licence.

A registration application must disclose any relevant existing bank accounts and payment flows, but the official form allows applicants to state whether they already have an account. It must not be stated categorically that an Australian bank account must have been obtained before applying. Account opening and access to payment channels are subject to separate due diligence by banks and partners. Registration with AUSTRAC does not guarantee acceptance and, still less, does not guarantee that an account will never be closed.

Commercial materials should cover the ownership and control structure, source of funds, channels and countries, expected transactions, risk policies, monitoring capability and actual account use. When selecting a bank, non-bank payment provider or overseas clearing partner, check the contractual counterparty, regulatory status, flow of funds, refund terms and termination conditions; do not describe every fintech brand as a digital bank or claim that it is necessarily supportive of RSP.

Separate accounting and reconciliation of client money, restrictions on its misappropriation, and arrangements for refunds where remittance arrangements fail are important operational controls. Whether a statutory trust or client money segregation obligation applies must be assessed by reference to the product, AFSL and other applicable laws, rather than asserting that all RSP must open trust accounts under AUSTRAC. APRA's FCS applies to eligible ADI deposits; it is not an automatic safeguard for clients' claims against RSP. Sources:AUSTRAC Registration documents；APRA overview of financial claims protection。

• Clearing: record prefunding limits, settlement cycles, foreign exchange exposure, counterparty risk and reconciliation discrepancies.
• Client funds: distinguish amounts payable to clients, the entity’s own funds, and network or partner balances.
• Refunds: record the reason for failure, client instructions, verification of the original payer, reporting assessment and final disposition.
• Continuity: establish procedures in advance for stopping receipt of funds, notifying clients, refunds and preservation of records in the event of a bank or network outage.

SMR is a Suspicious Matter Report and does not depend on a large transaction or a completed transaction. Where there are reasonable grounds for suspicion, matters involving terrorism financing must be reported within 24 hours of forming the suspicion; other matters are generally to be reported within 3 business days after the day on which the suspicion is formed, subject to separate rules for specific circumstances such as legal professional privilege. An Affiliate also has SMR obligations. Under a written agreement, it may report itself or have RNP report on its behalf; simply forwarding an email to RNP does not mean that the statutory obligation has been met.

TTR applies only to physical cash of A$10,000 or more, or the equivalent in foreign currency, received or paid in the course of providing a designated service, and must be submitted within 10 business days after the transaction date. Pure electronic transfers, cheques, card payments or virtual asset value alone reaching the threshold do not trigger a cash TTR. Separate cash transactions are not automatically aggregated merely because they reach the threshold in total on the same day or within 24 hours; suspected structuring to evade reporting should be considered under SMR. TTR for cash transactions by network Affiliates is submitted by RNP.

As at the date of this guide, international transfers continue to be reported under the transitional rules as IFTI, generally within 10 business days after sending or receiving the relevant international instruction; there is no AUD 1,000 threshold. Remittance dealers are commonly involved in IFTI-DRA, and international reporting is not limited to electronic bank wire transfers. For an Affiliate using the RNP network, IFTI is reported by RNP; independent dealers are responsible for their own reporting. The exception for an instruction not carried out applies only where the rules are met, including reasonably determining within the time limit that no transfer will occur and taking reasonable steps to prevent it; a transaction-failed label alone is not grounds for omitting a report. Source:SMR Guide；TTR Guide；IFTI Guide。

• Retain timed records of identifying unusual activity, forming a reasonable suspicion, submission and acknowledgement.
• The network agreement should specify who makes the SMR determination, who submits it, when matters are escalated and how receipt is confirmed.
• Determine TTR by reference to the cash component and IFTI by reference to international instructions, designing separate trigger rules.
• Use the official names SMR, TTR and IFTI; do not use STR, CTR or SIR interchangeably as Australian form names.
• New entities use the 2026 new SMR/TTR form; eligible existing entities can complete the form transition by 30 March 2029.

The Travel Rule is not limited to crypto-assets. For applicable transfers of money, value of property and virtual assets, the ordering institution that accepts the payer's instruction, intermediary institutions that transmit messages, and beneficiary institutions that make value available to the payee must each collect, verify, transmit and monitor the required information according to their respective roles. Net settlement may also constitute a transfer of value; obligations are not avoided merely because value does not move directly across a border from the payer's account.

Applicable messages generally include payer details, the payee’s full name and tracking information; specific fields and verification requirements depend on the type of transfer and any exceptions. The originating entity should complete the applicable steps before sending the message or making the transfer; intermediaries and beneficiaries should have processes to monitor, make enquiries about, reject or manage the risks of missing or incorrect information. Physical banknotes or the physical transport of goods should be distinguished from statutory value transfer rules.

The 2029 transition for IFTI to IVTS reporting does not mean that the travel rule is not currently required. AUSTRAC allows the new global messaging data standard to be used as prescribed, but individual fields from the old and new standards cannot be combined arbitrarily, nor can FATF's expected global transition year be presented as a uniform commencement date for all Australian obligations. Source:AUSTRAC Travel rule overview。

• Map the value transfer chain corresponding to each new customer instruction and the roles of the entities involved.
• Include fields for tracing the payer, payee, account or wallet in systems and agreements with partners.
• Establish policies for missing information, incorrect payee names, further enquiries, and whether to proceed with or refuse a transfer.
• Separately check VASP and any special travel rule obligations for stablecoin or virtual asset flows.

Different records have different starting points for their seven-year retention periods. General transaction records must be retained for 7 years from creation; transaction documents provided by customers for 7 years from receipt; current CDD records generally for 7 years from completion of an occasional transaction or the end of a business relationship; and records relating to the AML/CTF program for 7 years after they are no longer used to demonstrate compliance. You cannot apply a blanket rule of deleting all files 7 years after collection.

Records may be paper or electronic and may be kept off-site or by a service provider, but must be secure, complete, searchable and sufficient to reconstruct transactions. Retain evidence of policy versions, approvals, personnel checks, customer verification results, network consents, reports and remediation. AUSTRAC does not universally require copies of all identity documents for CDD; it requires records sufficient to evidence the identification and verification process.

Even if it is a small business, a reporting entity must comply with applicable Privacy Act obligations; access controls, purpose limitations and supplier arrangements should be implemented when using cross-border cloud services, electronic KYC or outsourcing. Disclosing SMR information to a customer or another person may constitute tipping off. Under the current rules, assess whether disclosure could reasonably prejudice an investigation; do not tell a customer that they have been reported merely because of a complaint, refund or service suspension. Basis:AUSTRAC Record keeping；AUSTRACSMR and confidentiality statement。

• Set retention periods and triggering events for different categories of records.
• Retain necessary records in English or in a form readily convertible into English.
• Restrict access to SMR, identity documents and personnel screening records, and test backup recovery.
• Before exiting or selling the business, first put in place responsibility for records custody and access rights; do not destroy old records at completion.

The annual compliance report has moved to a financial-year basis. AUSTRAC’s current guidance states that the next reporting period is 1 July 2026 to 30 June 2027, with a submission window from 1 July to 30 September 2027; thereafter, reporting is due within 3 months after the end of the relevant financial year. It is no longer appropriate to make a blanket claim that reporting is due each January to March, or to present the original 30 September date as an unchanged historical rule without explaining the reform.

An entity registered only as an Affiliate of RNP and providing no other designated service may be exempt from submitting its own annual compliance report; if it also conducts independent remittance or another designated service, this must be reassessed. Where it belongs to a reporting group, one member will generally submit on behalf of the group. If there have been no transactions, or the entity has been sold, closed or acquired, it should still follow the official form instructions and removal process; simply failing to log in to the system is not appropriate.

ASIC company annual review, fees and record-keeping, and AUSTRAC reporting are separate obligations. Tax treatment should be determined according to the nature of the income and the entity’s arrangements, including ABN, TFN, PAYG and the applicable GST; customers’ remittance principal should not be treated directly as service turnover. The general GST registration threshold for ATO is AUD 75,000 GST turnover, calculated excluding items such as input-taxed supplies. The treatment of financial supplies and cross-border services requires specific analysis; a flat 10% GST should not be applied to all remittance fees. Basis:AUSTRAC annual reports；ATO GST registration；ATO financial supplies。

• Keep separate calendar entries for AUSTRAC reporting, ASIC annual reviews, tax filings and registration expiry dates.
• The reporting administrator checks the designated services, contact persons and actual operational information.
• Assess the exemption for a pure Affiliate retention model; review again if the business expands.
• Whether company financial reports and audits are mandatory must be assessed separately under company law and the entity’s circumstances; RSP registration does not mean all entities must have their financial statements audited annually.

Employees or engaged personnel performing the AML/CTF function should undergo personnel due diligence proportionate to their role and risks before starting work and on an ongoing basis. Training should cover business-specific risks, customer identification, reasonable suspicion, reporting, confidentiality and practical procedures, with learning outcomes checked through tests, sample checks or performance assessments; keeping only an attendance sheet without evidence of implementation is not sufficient.

Electronic KYC, reporting tools, RegTech and external compliance services may be used, but outsourcing does not automatically relieve the reporting entity of its responsibilities. Contracts should specify data access, service levels, spot checks, remediation of deficiencies, regulatory access, record retention and exit handover. RNP should implement network onboarding training for Affiliates, update communications, escalation of anomalies and reconciliation of back-office reporting.

Technical systems should support reliable monitoring, investigation and timely reporting in proportion to business volume and risk. The AUSTRAC official form allows applicants to describe manual or automated monitoring methods; do not invent a uniform technical standard requiring every small RSP to purchase particular software, use AI or report automatically in real time. Controls for instant-payment services must operate at a speed commensurate with risk. There should be workable alternatives and a process for stopping the acceptance of funds if systems fail. Source:AUSTRAC personnel due diligence；AUSTRAC Affiliate registration form。

• Role matrix: separately authorise front-office CDD, cashiers, monitoring, SMR determinations, report submissions and approvals.
• Outsourcing oversight: sample-based re-performance checks, report reconciliations, defect tracking and ongoing supplier due diligence.
• System testing: unusual transactions, structuring, third-party payments, changes of country, duplicate customers and reporting failures.
• Personnel changes: reassess high-risk roles and ensure continuous coverage of the compliance officer and key functions.

The current regime requires an independent assessment of the entire AML/CTF programme, including the risk assessment methodology, policy design and testing of implementation in practice; it is not limited to reviewing old Part A documents. The normal minimum frequency is at least once every 3 years, with more frequent assessments to be considered in light of the programme’s size, nature and complexity. The programme’s own periodic and trigger-based internal reviews cannot replace an independent assessment.

The evaluator may be a sufficiently independent internal or external person. There is no uniform mandatory certificate, but the evaluator must have relevant industry and AML/CTF knowledge. A person involved in developing, maintaining or implementing the plan being assessed should not evaluate their own work. The assessment report should be provided to the governing body and the senior manager responsible for approving the plan; not every business is required to engage a financial auditor annually and automatically send the report to AUSTRAC.

The first assessment must be checked against the transition rules: for entities already enrolled on 30 March 2026 that had undergone an independent review under the previous arrangements, the first assessment under the new arrangements is due no later than the later of 4 years after the most recent review under the previous arrangements and 31 March 2027. Newly regulated entities and certain entities previously covered by item 54 have deadlines in 2029–2030 determined by the final digits of AAN; these must not be applied to a newly established RSP without checking eligibility. Adverse assessment findings should prompt reassessment, policy amendments, approvals, allocation of responsibilities and follow-up testing. Updates must be recorded in writing within 14 days. Basis:AUSTRAC Independent assessment；Transitional arrangements。

• Specify the normal period, the initial transition deadline and the eligibility basis for using that deadline.
• The evaluation covers Australian customer and transaction samples, Affiliate execution and the quality of consolidated reporting.
• Retain a written assessment of the evaluator’s independence and suitability.
• Establish a register of issues, remediation owners, deadlines, evidence of completion and retest results.

An acquisition should distinguish a share transaction involving the same legal entity from a transfer of business assets to another entity. A share transaction does not mean compliance is complete merely by changing the registered name; check registration status and conditions, historical reports, control structure, compliance officer, banking and network contracts, outstanding remittances and client liabilities. If the business moves to a new legal entity, the seller’s registration number cannot be treated as registration for the new operating entity.

Changes in registration circumstances generally must be notified to AUSTRAC within 14 days of the change. These include changes to beneficial owners, key personnel, relevant criminal or civil proceedings, relevant service partners, incorrect information, name or address, new countries, cessation of registered services and overseas equivalent authorisations. After receiving an Affiliate notification, RNP must notify AUSTRAC within 7 days; this is not a general rule requiring notification within 7 days of every criminal event. Most changes to ASIC company details are subject to a separate 28-day notification rule; the two requirements cannot be substituted for each other.

A change in shareholding does not necessarily require the same entity to reapply for all registrations, and it cannot be promised that an acquisition will require no regulatory action. Changes to actual control, scope, capability or registration conditions may prompt further review; communicate with AUSTRAC in accordance with the conditions applicable to the case. Moving networks or joining a new network requires the relevant Affiliate relationship, assessment, registration and exit from the old network to be addressed. Existing network status cannot be relied on to provide services for a new network. Sources:AUSTRAC Changes to registration；ASIC company personnel and update obligations。

• Before completion: check current registration, conditions, unreported transactions, assessments and remediation, complaints and amounts payable to customers.
• Structure: track the fitness and propriety of new shareholders, beneficial owners, controllers, directors and compliance officers.
• Contracts: check change-control and consent clauses for banks, clearing partners, RNP and system suppliers.
• After completion: update AUSTRAC and ASIC and any applicable tax information separately, and retain confirmation records.
• Before expanding: assess the risks of new products, clients, channels or countries, and first obtain registration in any applicable new category.

RSP Registration is valid for 3 years. Independent operators and RNP apply for renewal through AUSTRAC Online, while RNP is also responsible for the three-year renewal of its Affiliates. An application may be made within the 90 days before expiry. If made on time within this window, the existing registration continues until the regulator makes a decision. A registration that expires without an application becomes invalid and is removed from the register; a subsequent application is treated as a new registration, and the relevant remittance services must not continue.

Renewal is not an automatic formality: check business activities, personnel, controls, partners, countries, conditions and additional form information. The 2026 reforms do not automatically invalidate existing RSP, but existing entities must update the additional registration information required by the new law before their next scheduled renewal. Do not rely on marketing claims of a “lifetime licence” or email reminders instead of internal expiry management.

When remittance services cease, complete the handling of customer funds, final applicable reports, termination of network relationships and record retention, and ask AUSTRAC to remove the relevant registration or reporting-entity record; do not mistakenly remove the whole entity if it still provides other designated services. AUSTRAC may refuse, impose conditions on, suspend or cancel registration because of serious crime risks, non-compliance, breach of conditions, lack of capacity or material false or misleading omissions, and may take other enforcement action under the law. Long-term inactivity as a 'shell registration' may also expose the entity to a requirement to withdraw voluntarily or to regulatory cancellation. Source:AUSTRAC renewal and enforcement；Onboarding and removal process；Dormant registration enforcement。

• Record expiry dates and evidence of renewal submissions separately for IND, RNP and each Affiliate.
• If suspended or cancelled, stop the affected services and proceed in accordance with the written decision, conditions and review rights.
• Before exit, hand over each of the following: outstanding remittances, refunds, final reports, client files and statutory records custody responsibilities.
• Do not buy an inactive registration and promise to commence operations immediately; the same company must also maintain genuine operational and compliance capability.

This guide uses rules published and applicable as at 5 November 2026. 31 March 2026 is the commencement date for the existing reporting entity’s significant AML/CTF reforms; it must not be described loosely as ‘April 2026’. Some obligations for newly regulated professional services and newly added virtual asset services have a 1 July 2026 commencement arrangement and must be distinguished by business category. RSP does not thereby receive a new grace period to operate unregistered.

IFTI reporting obligations remain in place until the entity’s IVTS reporting transition date, usually 31 March 2029. Only eligible existing reporting entities may choose an alternative date within the prescribed scope, no earlier than that date and no later than 30 September 2029; additional restrictions apply to international value transfers involving virtual assets. It is not accurate to describe comprehensive IVTS reporting as having replaced IFTI in 2026.

Separate transitional arrangements apply to the initial CDD and SMR/TTR forms for eligible existing entities; ongoing CDD, governance, risk policies and travel rules cannot all be deferred as a result. Arrangements for continued operation relating to eligible applications for the new VASP made before 29 July 2026 cannot be unconditionally extended to new RSP or new VASP applicants in November 2026. Basis:AUSTRAC Transitional rules；Transaction reporting form reform。

• Create an itemised register of obligations, commencement dates, applicable eligibility, transitional deadlines and responsible persons.
• Record the existing entity’s status on 2026-03-30 and the CDD transitional policy used.
• IFTI systems continue to be maintained at present, while planning is under way for the 2029 IVTS transition.
• Future payments or regulatory reforms are monitoring matters only and must not be promoted as current requirements before their commencement has been verified.

Drew Tang (Mr Tang / Drew), business manager; Rengangyongsheng (Hong Kong) Limited, English name Rengangyongsheng (Hong Kong) Limited. This guide is for use in Chinese-language business information and compliance planning on afsl8.com. It consolidates and de-duplicates the user's existing guides and has been corrected based on official materials. Verification date: 5 November 2026.

Services for discussion may include assessment of the business model and registration category, coordination of the Australian entity and director’s address, information checklists, business processes and risk assessment, AML/CTF policies, applications and requests for further information, network responsibility arrangements, bank due diligence information, changes and renewals, training and arrangements for independent assessment. Matters involving law, tax or work that must be performed by a person with specific qualifications should be handled by the relevant Australian professional; arrangements for independent evaluation must avoid having the preparer assess their own work.

We recommend that compliance personnel continue to use AUSTRAC official industry guidance, reporting guidance, regulatory risk alerts and training resources, and incorporate regulatory risk information into business assessments. Registration does not demonstrate that an adviser is certified by AUSTRAC or has a guaranteed account-opening relationship with any bank. This guide is not official advice from AUSTRAC or any other government, and does not guarantee approval, timeframes, banking access, investment returns or the safety of funds; the application of specific laws and any dispute will ultimately be determined by the competent authorities and courts.

• Business enquiries: Drew@cnjrp.com; WhatsApp +852 9298 4213; WeChat / Shenzhen mobile +86 159 2000 2080 (from user-owned sources).
• Local director services must still meet genuine residence, company law duties and compliance capability requirements; nominee-only arrangements are not provided.
• If an acquisition, cross-border expansion or addition of financial products is planned, complete a dedicated legal and contractual review first.
• Do not carry forward project success figures, professional certifications, regulatory recognition or fixed approval rates that have not been independently verified.

Complete guides to each subtype

The following are branches covering business activities, products or corporate structures; not every item corresponds to a separate statutory licence.

Frequently Asked Questions