AUSTRAC VASP guide to registration for five classes of virtual asset designated services

VASP is short for Virtual Asset Service Provider. AUSTRAC registration is intended to identify and supervise businesses providing registrable virtual asset designated services, with a primary focus on the risks of money laundering, terrorist financing, proliferation financing and other serious crime. The public register enables customers and business partners to check whether a business is registered and its registration status, helping to establish a verifiable compliance identity, but does not prove that the business is risk-free.AUSTRAC VASP overview

The practical benefits of registration are to clarify Australian AML/CTF responsibilities, establish customer due diligence and transaction-tracking systems, and provide verifiable regulatory information for banking or institutional partnerships. It is not AFSL, does not constitute government endorsement of token value, technical security or commercial success, and does not guarantee a bank account, compensation for client assets or eligibility to operate overseas. Australia has no generally available standalone “FSP licence” that can replace AFSL.

• Display regulatory information using the actual legal entity name, ABN and registration status; do not present the AUSTRAC number as a global financial licence.
• Check registration conditions, services actually operated and renewal date; do not display only a historical application receipt.
• Describe the actual roles in custody, transfer, exchange and issuance or sale; do not use the label “technology platform” to avoid service classification.

AUSTRAC explains under section 5 of the AML/CTF Act that a virtual asset is a digital representation of value that can be transferred, stored or traded electronically, is not issued by a government or its authorised issuer, and must have one of the functions specified by law, such as a medium of exchange, a store of economic value, a unit of account, investment, or related governance voting. A governance token need not first have a payment function to potentially be covered; whether an NFT is regulated depends on its function and cannot be determined solely by its transferability or name. There are relevant exclusions for government-issued digital currencies, value used exclusively in video games, and customer loyalty reward points. Digitised securities cannot be excluded categorically either: a mere electronic record of share ownership must be distinguished from a token that is itself transferable and tradable.Official guidance on designated services

Geographical connection must be assessed based on the actual operating arrangements. The main tests are providing services through a permanent establishment in Australia, or Australian residents and overseas subsidiaries of Australian resident companies providing services through an overseas permanent establishment. Merely making an offshore website available to Australian customers does not automatically satisfy the test; a local agent actually conducting business, operating an Australian server or providing specified services through an Australian account may affect the assessment, while a postal address or bank account alone does not automatically satisfy it. A company incorporated in Australia falls within the relevant resident test; the place where services are provided and the establishment arrangements still need to be analysed.Geographical connection test

• Prepare a factual description of customers, service contracts, employee agents, server control, business premises and settlement accounts.
• Identify the functions of cryptocurrencies, stablecoins, governance tokens, wrapped tokens, NFT and tokenised assets, item by item.
• Also check local AML, licensing and data transfer requirements for overseas branches and subsidiaries.

In Table 1 of section 6 of the AML/CTF Act, Item 50A covers exchanging virtual assets for Australian or foreign currency and arranging such exchanges; Item 50B covers exchanging virtual assets of the same or different kinds and arranging such exchanges; Item 46A covers controlling or managing assets or private keys for a client or their designee in the course of carrying on a VASP business; Items 29 and 30 respectively concern accepting a value transfer instruction as an ordering institution and making transferred value available to a client as a beneficiary institution. The Travel Rule also involves the intermediary role in Item 31; intermediary obligations must not be overlooked just because the guide divides the services into five categories.Original text and explanation of the five service categories

Item 50C does not mean ‘registration is required whenever a token is issued’. It requires the provision, in the course of a business involving participation in an offer or sale of virtual assets, of a specified financial service listed under another item in Table 1. One-off participation by a traditional business may also be covered, but merely issuing a token, or a bank handling a purchase payment for a customer, does not automatically constitute Item 50C. Exchange or transfer services on behalf of customers in connection with an issuance may separately trigger Items 50A, 50B or 29. Where a platform provides multiple services, all applicable services should be reported and controls configured according to the actual functions.

• Map P2P matching, OTC principal trading, clearing and settlement, custody and withdrawals separately to the statutory categories.
• Client asset retention and withdrawals generally require separate assessment under 46A and 29/30; they are not regarded as functions automatically covered by exchange registration.
• For 50C, specify the relevant Table 1 base service, the activity involving participation in the issue or sale, and the client's identity.

DCE entities that were enrolled and registered before the reforms do not need to reapply and automatically continue as VASP from 31 March 2026; their registration status does not change as a result of the reforms. Reform obligations under 50A apply from that date, while the new AML/CTF plan for registrable virtual asset services, CDD, reporting, virtual asset value transfers and some record-keeping obligations apply from 1 July 2026. Registered entities must provide the additional registration information required by the new law before their next scheduled renewal. 30 May 2026 is mainly a transitional deadline for existing reporting entities to give notification about their compliance officer, not a uniform deadline for all registration fields. Routine changes to information must still be handled under the 14-day rule.Registration and updates

For businesses already providing newly registrable services before 1 July 2026, the official transition guidance provides until 29 July to apply to enrol and register. The registration guidance makes clear that eligible applicants who submit an application for the new services before 29 July may continue providing those services while awaiting a decision. This is not a retrospective grace period for previous 50A services, nor an avenue to commence operations that any new business can invoke as at November. New entrants now generally need registration approval first; if a transitional application is refused, the relevant registrable services must cease.Transitional rules

• Check the enrolment status as at 2026-03-30, the old DCE registration and the original renewal date; do not assume all registrations expire on the same day in 2029.
• Retain evidence of the actual commencement date, the date a transitional application was submitted and the legal basis for awaiting a decision.
• Do not interpret the historical July registration window, CDD transition or regulatory education arrangements as suspending all AML obligations.

VASP registration requirements include identifying the legal form, ABN and any applicable ACN/ARBN/ARSN, group relationships, ultimate holding company, beneficial owners and key personnel. The official registration questionnaire describes beneficial owners as people who own or control more than 25% of the business and asks about the control structure; this does not mean that people who actually control the business below that ownership threshold can be left undisclosed. Key personnel are people with primary responsibility for governance and business decisions, or who participate in decisions affecting all or a substantial part of the business. They are not automatically all employees, nor are they identified solely by job title.VASP Application questionnaire

If an Australian Pty Ltd structure is used, at least one director must ordinarily reside in Australia. An ordinary Pty Ltd need not have a company secretary; if it does, at least one secretary must ordinarily reside in Australia. A separate director-number requirement applies where there are crowd-sourced funding shareholders. Directors must be at least 18 years old, meet the eligibility requirements and give prior written consent, and must apply for their own director ID before appointment. A director must apply for ID personally to ABRS; an adviser cannot complete identity verification on their behalf. Those overseas who cannot verify online may use the paper certification document process under ABRS.ASIC company personnel rules ABRS application documents

• Documents: certificate of registration, latest company extract, constitution or applicable governance rules, register of shareholders and a control chart tracing ownership through to natural persons.
• Personnel: names, former names, birth details, addresses, identity documents, roles and responsibilities, experience, and regulatory and criminal disclosures.
• Verify that the Australian resident director arrangement provides genuine governance of the entity; nominee arrangements involving no participation in decision-making are not acceptable.
• No uniform Australian shareholder-percentage requirement can be inferred from VASP’s public guidance; other reviews, such as those relating to foreign acquisitions, must be assessed separately.

The reformed responsibilities should be stated separately. Senior managers must personally approve the risk assessment, AML/CTF policies and their updates. The governing body is responsible for oversight and must be aware of risks, resourcing and compliance deficiencies. The AML/CTF compliance officer liaises with AUSTRAC and oversees and coordinates day-to-day implementation, but need not personally handle every KYC or report. The compliance officer must report to the governing body at least once every 12 months and have sufficient authority, independence, resources and professional support.Senior manager responsibilities

A compliance officer must be employed or engaged to perform the role at management level and be a fit and proper person; they must be an Australian resident when providing designated services through an Australian permanent establishment. The role may be outsourced, and in a small business a director or operator with appropriate capability and authority may perform it as well. There is no uniform rule that all VASP must hold a particular professional certificate. The usual statutory arrangement is to appoint within 28 days after commencing to provide designated services and notify AUSTRAC within 14 days of the appointment; identifying the appointee during application preparation better demonstrates operational readiness. If the officer leaves or ceases to qualify, a replacement must be appointed and notified; outsourcing does not remove the entity’s responsibility.Full compliance officer requirements

• Retain appointment letters, management authority, scope of duties, basis for Australian residence and fit-and-proper assessments.
• Check skills, integrity, serious criminal history, adverse regulatory records, bankruptcy and material conflicts of interest; reassess periodically.
• Establish cover for absences, escalation of reporting and resource support to ensure content is not deleted or altered because it is unfavourable to sales.
• For external services, verify actual capacity, conflicts involving multiple clients, confidentiality, data access and quality controls.

An Australian company must have a physical street address in Australia as its registered office; a PO Box cannot be used instead. The registered office may be an accountant’s office, but the occupier’s written consent must be obtained and retained. The principal place of business must reflect the actual location of operations and must also be a physical address. A registered office service does not establish actual operational capability for VASP, nor does it automatically determine the geographical connection for AML.ASIC Address requirements

The AUSTRAC questionnaire requires the Australian principal business or operating address, the registered office address where applicable, the website domain used to provide designated services, and every service location, including agents, kiosks and crypto ATM. For cross-border custody and transfers, the actual arrangements for management personnel, key operations, customer support, cloud service providers and data access should also be explained. The VASP guidance does not establish a uniform minimum office area or a requirement to lease a separate office independently; arrangements should be genuine, contactable, verifiable and proportionate to the scale of the business.Registered address and channel fields

• Documents: lease or consent to use the address, premises list, agency agreements and contact details for responsible persons.
• Record the address, operating entity, cash management and handling of unusual transactions for each ATM location.
• Separately record the website domain, business address and public wallet address; do not conflate the three types of address.

AUSTRAC’s VASP registration is not a prudential authorisation granted according to a uniform capital threshold. The published guidance and registration questionnaire do not specify fixed minimum share capital or minimum net tangible assets applicable to all five service categories, but the registration assessment considers AML resources, personnel experience, capability and whether the business is genuinely operating. Low company share capital does not demonstrate operational capability; it is advisable to prepare evidence of the sources of own funds, cash-flow budgets, systems costs, compliance personnel and contingency expenses. Setting aside a 12-month operating budget may be useful for business planning; it is not an official uniform requirement to provide proof of funding for 12 months.Registration assessment criteria

Share capital is the shareholders’ contribution and an account for the company’s shares; net tangible assets are the result of deducting liabilities from tangible assets, adjusted under the applicable regulatory approach, and are not interchangeable with registered share capital. If financial product custody is also provided and AFSL is required, ASIC INFO 225 states that primary custody generally requires A$10 million NTA; incidental custody is generally A$150,000. Exceptions may apply to arrangements such as eligible sub-custody or custody without holding physical assets, and at least 50% must be held in cash or cash equivalents. Check RG 166 and the applicable instrument for details. These are specific AFSL requirements, not capital requirements for all 46A or all VASP.Current ASIC financial and custody information

• List paid-up share capital, own liquid assets, client money, client virtual assets and regulatory NTA separately.
• Do not substitute client assets, uncommitted financing or future operating revenue for available compliant funds.
• Capital exceptions for primary custody, incidental custody and sub-custody must be determined by reference to the actual contract, assets and fee structure.

The official VASP questionnaire is not a short form that asks only for the company name. It asks about virtual asset categories and currency symbols, delivery channels, deposits and withdrawals, trading or time restrictions, estimated average monthly transaction numbers and values for the first 12 months after registration, and the addresses and types of assets that can be stored in company-controlled wallets. Fiat on-ramps, cash ATM, DeFi protocols and self-hosted wallets must be disclosed accurately and must not be omitted because they are not the main business.Official application fields

The application must also explain ML/TF/PF risks, the AML policy, the initial CDD for each client type, client transaction monitoring, reporting processes, personnel due diligence training, third parties and quality controls. The questionnaire accepts uploaded risk-assessment materials in support of answers, but this does not mean every application must include a prescribed business plan template, bank confirmation letter or evidence of software from a particular vendor. A business plan, technical description and funding budget can help demonstrate genuine operations and resource readiness; government-required fields must be clearly distinguished from supporting materials recommended by a consultant. Public wallet addresses may be provided as requested in the questionnaire; private keys, seed phrases or complete recovery secrets should never be given to a consultant as application attachments or uploaded to a form.

• Entity documents: registration documents, ABN/ACN and applicable numbers, group control chart, ultimate holding company and beneficial owners.
• Business materials: service processes, client locations, product classification, channels, transaction limits, first-year forecast and service address.
• Compliance materials: risk assessment, policies, approval records, KYC and monitoring rules, reporting, confidentiality and record-keeping procedures.
• Personnel documents: directors’ ID, key personnel CVs, compliance officer qualifications and authority, relevant criminal and regulatory disclosures, and training.
• Cooperation materials: existing bank account and signatory details, overseas registration, outsourcing contracts and quality controls; honestly disclose any arrangements not yet established.
• Custody and transfer materials: wallet control inventory, signing permissions, asset reconciliations, travel rule interface and risk management explanation.

Enrolment means joining the Reporting Entities Roll; registration is a further process for services that may be registered, such as VASP. The general enrolment rule requires an application within 28 days of commencing a designated service, but this does not mean that VASP may operate for 28 days without approval. A new VASP should first establish an account and enrol in AUSTRAC Online, then use the same account to complete the registration application. It may provide registrable services only after approval and once the applicable requirements are met. If the new entity has a different ABN, a new business profile must be added; it cannot use another entity's registration.Enrolment guide

AUSTRAC assesses serious-crime risks, legal and compliance history, key personnel and associates, compliance resources and genuine business intentions, and may request further information. Official guidance indicates that assessment may take up to 90 days; if further information is requested, the 90-day period restarts from the date the information is provided. It cannot be promised that the process will always be completed within three months of lodgement. The outcome may be approval, approval subject to conditions or refusal. An application acknowledgement and AAN are not proof of approved registration, and a conditionally registered entity must operate in accordance with its conditions. Whether an adverse decision can be reviewed internally or externally, and the applicable time limits, should be confirmed in the decision notice; do not use the superseded name AAT as the current appeal guidance.Registration assessment and review

• Step one: Map the five service categories and overlapping licensing requirements, and verify the entity and its Australian connection.
• Step two: Put actual personnel, the address, risk assessment, funding and technical controls in place.
• Step three: Create an AUSTRAC Online account, enrol and check the read-only fields.
• Step four: Submit the VASP registration and supporting materials, retaining versions, receipts and submission dates.
• Step five: Respond to requests for further information, assess restarting and possible communications, and do not commence operations without authorisation.
• Step six: Check the written outcome, public status, service conditions and renewal date before approving launch.

The reformed programme centres on a risk assessment under ML/TF/PF and corresponding AML/CTF policies. It no longer mechanically requires retaining the old Part A + Part B headings, and Part B must not be incorrectly described as an industry-specific custody requirement. Policies must be workable in the actual business and cover governance, personnel due diligence, training, customer identity and beneficial control verification, agent authority, PEP, high-risk customers, ongoing monitoring, reporting, the travel rule, record-keeping and outsourcing quality controls. Senior managers approve the risk assessment and policies; the governing body oversees them, and changes must be reflected promptly.Planned review and updates

The initial CDD transition does not mean that “all existing customers must be re-verified by 2029”. Only reporting entities that were already enrolled on 30 March 2026, maintained a compliant ACIP on that date and established a transition policy as required may continue using the former initial identity procedures by customer category between 31 March 2026 and 31 March 2029. Categories and the date for ceasing ACIP must be recorded by 1 July 2026, and only one initial framework may be used for the same category at the same time. The transition does not remove new ongoing CDD obligations; new services must be implemented in accordance with their commencement and applicable rules. Foreign PEPs, high-risk domestic PEPs and high-risk PEPs of international organisations are subject to senior manager approval requirements; it must not be assumed that all PEP use exactly the same procedures.Initial CDD transition rules

• Set out separate identification and verification methods for individual, company, trust, partnership and agent customers.
• Develop applicable rules for business purpose, source of funds, source of wealth and risk classification, rather than mechanically collecting the same set of information from every low-risk client.
• Specific indicators and escalation procedures are needed for high-risk on-chain sources, mixers, privacy assets, cross-chain activity and scam-victim risks.
• Using KYC or an on-chain analytics provider does not transfer statutory responsibility; retain evidence of testing, exception handling and manual review.

The Travel Rule for virtual asset transfers applies from 1 July 2026. Before accepting a customer instruction, an ordering institution must have completed verification of payer information and collect the beneficiary’s name and tracing information as required by the rules; where it forms part of a transfer chain with other institutions, it must securely transmit the required information in accordance with the applicable standards. Beneficiary and intermediary institutions must take reasonable steps to monitor for missing information. A beneficiary institution must also monitor the accuracy of the beneficiary’s name and decide, in accordance with its policies, whether to execute, suspend, refuse or investigate further. Domestic, non-incidental transfers may also trigger the requirements; they do not apply only to cross-border transfers or transfers exceeding A$10,000.Travel Rule overview

The additional virtual asset rules require an assessment of whether a wallet is custodial or self-hosted, and whether the counterparty is legally required to be registered and licensed and whether information can be transmitted securely and confidentially. Do not transfer on behalf of a customer to a beneficiary institution that is required by law to be registered but is not registered, or make assets from an unlawful originating institution available to a beneficiary. There is an exemption from transmitting information to another business for self-hosted wallets, but the ordering institution must still collect and verify information about the payer and collect beneficiary and tracing information; the beneficiary institution must still obtain payer and tracing information and, where applicable, the beneficiary’s name. The specific reporting requirement for transfers involving a self-hosted wallet whose controller has not been verified has been deferred until 31 March 2029. This does not defer existing identity, wallet classification, risk-control or SMR obligations.Additional virtual asset rules

• Assess the initiator, beneficiary and intermediary roles for each transaction; the payer and payee may be the same person.
• Record wallet classifications, checks that counterparties are licensed, recipient identity information and tracing identifiers.
• For information transmission standards, use the applicable fields under the Rules or the permitted new standard as a whole; do not mix old and new fields.
• IVMS101 may be used as an interoperability solution, but no uniform mandatory use of this commercial technical format in Australia has been verified.
• Where there are reasonable grounds why it cannot be transmitted securely, follow the statutory exception and policy, and keep a record of the reasons. Do not treat the exception as a blanket exemption.

Item 46A concerns controlling or managing virtual assets and private keys for a customer or a nominee appointed by the customer. A multi-signature arrangement or MPC requiring multiple people to sign does not mean that each VASP actually responsible for control or management is automatically exempt; an arrangement where one person cannot transfer assets alone may still be regulated. Official guidance indicates that developing self-hosted wallet software without holding or managing assets, and providing general cloud storage or other ancillary infrastructure as a non-VASP, may fall outside this item. Assessment of a decentralised protocol requires examining actual key access, upgrade permissions, management control and service activities, rather than excluding it merely because it is labelled DeFi.Official boundaries of 46A

We recommend establishing warm- and cold-wallet arrangements, signing permissions, dual-person approval, key generation and backup, recovery drills, access logs, client sub-ledgers and asset reconciliation; these are security and risk management recommendations and should not all be promoted as uniform AUSTRAC technical certification requirements. If the assets themselves are financial products and current ASIC custody rules apply, requirements such as segregating client assets from business assets apply separately. No structure should be represented as providing absolute insolvency protection merely because it is registered as a VASP or described as a trust; the contracts, asset ownership, sub-custody and insolvency-law arrangements should be reviewed.ASIC current custody overview

• For registration supporting documents, provide only public wallet addresses and asset types; do not disclose private keys, seed phrases or complete MPC recovery secrets.
• Ensure appropriate segregation of duties among signatories, transaction approvers and reconciliation personnel; for outsourced custody, check control and auditability.
• Record the legal and accounting ownership of client assets, redemption and withdrawal procedures, and emergency suspension powers.
• Cyber security testing, insurance and recovery exercises are arranged according to risk and contract; do not claim certification by AUSTRAC.

SMR uses reasonable suspicion as the standard, and a report may be required even if the service is ultimately not provided. A suspicion involving terrorism financing must be reported within 24 hours of being formed; other matters are generally to be reported within 3 business days after the day it is formed. If service continues, CDD must be enhanced as required by the rules; do not delay a report that has been triggered while waiting for the outcome of due diligence. TTR applies to physical banknotes and coins totalling A$10,000 or more, or the equivalent in foreign currency, received or paid. It is generally due within 10 business days after the transaction day. An ordinary bank transfer, card payment or cryptocurrency-only transaction does not trigger TTR solely because the amount exceeds this threshold. Split cash transactions must be assessed for SMR, rather than simply treating all separate transactions as one TTR.SMR TTR

IVTS reporting obligations are generally deferred until 31 March 2029. Some eligible existing IFTI reporting entities have alternative date arrangements, but an alternative deferred date cannot automatically be used for international transfers involving virtual assets. Until the transition, applicable IFTI must continue to be submitted under the old rules: where only a pure virtual asset transfer under Items 29/30 is provided and no money or other property is transferred, official guidance expressly states that IFTI is not required; if virtual assets are merely used as a settlement method between remittance institutions, IFTI may still need to be reported. Transaction and travel rule records are generally kept for 7 years; AML policies are retained for 7 years after their last use. For other categories, such as customer identity information, the specific statutory start date must be checked; the same start date must not be mechanically applied to every communication and training record.International reporting transition Travel Rule records

• Set separate trigger rules for SMR, TTR, IFTI/future IVTS and future unverified self-custody reporting.
• Reports must be accurate and complete, retaining the reasons for suspicion, investigation, timestamps and submission evidence; do not adopt an unsupported ‘report everything just in case’ approach.
• Do not disclose SMR-related information that could reasonably prejudice an investigation; confidentiality controls are required for customer service responses and outsourced information sharing.
• Keep links between on-chain transactions and off-chain clients to ensure transactions can be reconstructed; overseas storage must allow information to be provided promptly as required by law.

AUSTRAC Registration and bank account opening are separate processes. Banks or payment partners independently assess the source of funds, customer locations, asset types, cash risks, custody arrangements and monitoring capability, and may restrict channels or refuse to provide services. You should prepare a business plan, beneficial ownership and control chart, registration status, policies and transaction forecasts. Whether customer money accounts can be opened, and whether cross-border transactions and cash are supported, depends on the terms of the specific account. Registration does not guarantee that a bank account will be opened, and a payment service provider account must not be described as an Australian bank deposit or as deposit-protected without verification.

Costs should be itemised separately as company registration and annual review, address, personnel, legal analysis, KYC and on-chain tools, the Travel Rule, custody security, independent assessments, and bank and payment fees. The publicly available registration page of AUSTRAC does not specify a uniform application fee. This guide does not treat the original draft’s old ASIC A$576 fee or adviser quotations as current statutory fees; actual charges should be verified against current official information and the contract. ATO requires records of assets and transactions, their Australian-dollar value and related costs to be retained; tax records and AML records serve different purposes and have different retention periods. Business income, capital gains and GST must be assessed by a tax adviser according to the nature of the business; not all exchange profits can be described as personal CGT.ASIC company registration ATO crypto-asset records

• Establish separate accounting for the entity's own funds and client assets; do not omit the place-of-service assessment merely because the bank account is in Australia.
• Record the AUD valuation at the time of the transaction, service fees, network fees and the correspondence between fiat and on-chain settlement.
• Banking, software, insurance and consultancy quotes are priced independently; no fixed total cost is guaranteed.

Registration attaches to the registered entity; a registration number cannot be sold to another legal entity like a transferable commodity. An acquisition of shares will generally leave the original entity in place, but the buyer should check the registration status and conditions, renewal, genuine operations, past reports, client assets, risk deficiencies and related persons. An asset sale or a new operating entity with a different ABN must have its own business records established and its need to apply for registration assessed. Public information from AUSTRAC states that changes affecting registration, including beneficial owners, key personnel, addresses, business jurisdictions, service providers and overseas licences, must be notified within 14 days of the change. An acquisition of shares is not automatic approval by AUSTRAC of the buyer's business model.Change notification

If adding custody, ATM, crypto-to-crypto trading or a new country constitutes a material risk change that the business can control, review the risk assessment and update policies and personnel systems before implementation, with senior manager approval. Where a variation of conditions or a separate licence is required, first obtain the necessary outcome. AUSTRAC may refuse, suspend, cancel or not renew due to serious criminal risk, false or omitted information, lack of capability or no longer genuinely carrying on business. In 2025, the authorities expressly raised concerns about inactive DCE being purchased and then misused; ‘quickly buying and using a shell licence’ is therefore not a safe route.Use it or lose it announcement

• Pre-acquisition due diligence: public status, decision conditions, alignment between AAN and ABN, renewal date, historical regulatory correspondence and reports.
• Custody acquisitions require an additional inventory of assets, private key control, sub-custody agreements and client authorisations, and a secure handover plan.
• Include compliance representations, breach indemnities, document delivery and remediation responsibilities in the completion documents; do not substitute a consultant’s undertaking for a regulatory decision.
• AUSTRAC changes are generally notified within 14 days; changes to ASIC companies, personnel and shares are generally notified within 28 days. Each obligation must be met separately.

Registration is valid for three years. Renewal may be submitted within the 90 days before expiry; if submitted in time within that window, registration may continue until AUSTRAC makes a renewal decision. If renewal is not submitted in time, registration lapses and is removed from the register, and registrable services must not continue to be provided; any subsequent application is treated as a new application. The reforms did not reset the three-year period uniformly for all existing DCE. The risk assessment and policy must be fully reviewed at least every three years, and significant changes, AUSTRAC risk notifications and adverse independent assessments must trigger a review in advance or promptly; high-risk businesses may adopt more frequent checks under their policies.Registration renewal

In principle, the entire AML/CTF programme must undergo an independent evaluation at least once every three years, but special transitional arrangements apply to the first evaluation: new reporting entities are allocated 30 June 2029, 31 December 2029, 30 June 2030 or 31 December 2030 according to whether the last two digits of AAN are odd or even. For entities already enrolled on 30 March 2026 that have undergone an independent review under the previous arrangements, the first evaluation under the new arrangements must generally take place before the later of four years after the most recent review and 31 March 2027. Evaluators are not subject to a uniform mandatory qualification requirement, but must be suitable and independent of development and implementation; responses and remedial action should be recorded for any deficiencies identified. Annual compliance reporting is changing to a financial-year basis. The next reporting period covers 1 July 2026 to 30 June 2027, with submission required between July and September 2027; the outdated statement that all sectors have an end-of-March deadline can no longer be relied upon.Independent assessment Initial assessment transition Annual reporting

When exiting or ceasing services, client assets and contracts must be dealt with, records retained, registration changes notified and, as appropriate, removal from the Reporting Entities Roll and register applied for. Merely taking down a website or ceasing transactions does not automatically end reporting obligations; entities that have closed, been sold or merged, or provided no services during the period should explain their circumstances in the relevant annual reporting questions and must not omit the report without reason.Enrolment and removal

• Establish a calendar for 14-day change notifications, compliance officer appointment notices, governance reports at least every 12 months, financial-year filings and three-year renewals.
• Last two digits of AAN: odd-odd, 2029-06-30; odd-even, 2029-12-31; even-even, 2030-06-30; even-odd, 2030-12-31.
• The independent assessment report is provided to the governing body and approving senior managers; the effectiveness of controls is tested after remediation is implemented.
• Manage withdrawal of funds, data exports, records custody, complaints and outstanding regulatory requirements.

As at 5 November 2026, the current Corporations Act and ASIC INFO 225 already apply to digital assets that constitute financial products and related arrangements. Derivatives, non-cash payment facilities, managed investment schemes, securities, and related advice, dealing, market-making, custody or market activities should be analysed individually. Not every discussion about Bitcoin requires AFSL, and AUSTRAC registration does not replace authorisation for financial product services. ASIC stated in its October 2026 announcement that the industry no-action window ended on 30 September; it cannot be treated as a general exemption allowing all currently unlicensed businesses to continue operating.ASIC current digital asset guidance October 2026 announcement

The Corporations Amendment (Digital Assets Framework) Act 2026 received Royal Assent on 8 April 2026, but the commencement table in section 2 of the Act specifies 8 April 2027. The earlier ASIC roadmap stated 9 April, which does not match the October announcement or the Act’s table; this guide follows the table and the later announcement. The new DAP/TCP authorisation, asset-holding, transaction settlement and financial requirements should not be described as already implemented. As at the verification date, the CP 392 consultation remains open until 27 November 2026. The Act also provides for a six-month licensing transition after commencement, which must be assessed at the time under the applicable provisions and formal instruments; it is not a substitute deadline for VASP registration.Clause 2 of the formal Bill

• For now, first assess whether the asset and arrangement constitute a financial product; do not wait until 2027 to address existing AFSL obligations.
• Clearly label CP 392 as a proposed standard; future NTA figures cannot be applied to current AUSTRAC applications.
• Track formal legislative instruments, ASIC guidance and application windows, and update customer contracts and business scope.

Drew Tang (Mr Tang/Drew), Business Manager; Rengangyongsheng (Hong Kong) Limited, English name Rengangyongsheng (Hong Kong) Limited. This topic is intended for Australian VASP business consultancy on afsl8.com, covering classification assessments, review of entity and control structures, organisation of application materials, coordination of AML policy and system implementation, follow-up on supplementary information requests, acquisition compliance due diligence and ongoing maintenance planning. Bank introductions, arrangements for Australian-resident personnel, independent assessments and AFSL matters must be determined according to actual capabilities, independence and the engagement contract. The consultancy is not described as a licensing agent recognised by AUSTRAC or ASIC.

The regions listed in the original material—Hong Kong, Singapore, Australia, New Zealand, North America, Europe, the UK, Malaysia, the Middle East, Africa and offshore jurisdictions—can only be presented as regions about which enquiries may be made separately. They do not mean that Australian VASP registration provides cross-border authorisation, or that every country’s projects are licensed. The draft’s commercial claims of “more than ten years’ experience”, “successfully assisting hundreds of businesses” and “partnerships with friendly banks” have not been verified against official sources in this review and are not presented as facts or regulatory endorsement in this guide. This guide provides general information as at 5 November 2026. Individual cases require review by Australian legal, tax and technical professionals based on the actual structure.

• No guarantee of approval, a fixed approval timeframe, a bank account, protection of client assets from loss or absolute segregation in insolvency.
• Service quotations distinguish government charges, third-party costs and professional service fees, and avoid misleading language such as “buying a licence”.
• Can be checked directly through official webpages and public registers; significant changes to services require a fresh assessment of applicable obligations.

Complete guides to each subtype

The following are branches covering business activities, products or corporate structures; not every item corresponds to a separate statutory licence.

Frequently Asked Questions