Items 29/30: Customer virtual asset transfers

The original listed 2026-05-30 as the deadline for all existing DCE to update their registration details. Official information explains that this date was a transitional deadline for existing reporting entities to notify details of their compliance officer. New registration details must be added by the next scheduled renewal, and ordinary changes are generally to be notified within 14 days.

The original said that time spent providing further information did not count towards the 90 days. Current AUSTRAC guidance states that, when further information is requested, the 90-day period restarts on the date the additional information is provided. This is not a total maximum of 90 days or a fixed promise of approval.

The original described 2026-07-29 as a permanent commencement grace period for all new VASP. This was a specific historical transition window for newly registrable services. New entrants can no longer generally operate while applying, and this window cannot be used to satisfy section 50A requirements retrospectively.

The original said that all new obligations commence on 1 July. The dates must be distinguished: section 50A applies from 31 March; the main obligations for newly added services apply from 1 July; and there are separate 2029 reporting and ACIP arrangements.

The draft incorrectly says the CDD transition requires all existing customers to be re-verified by 2029-03-30. Officially, eligible entities already enrolled on 2026-03-30 continue using ACIP, according to customer category, under the initial CDD framework transition until 2029-03-31. This does not exempt them from ongoing CDD.

The draft broadly extends the travel rule for self-hosted wallets to 2029-03-30. Current wallet classification, information collection, verification where applicable, risk controls and SMR must already be addressed. Reporting of specified transfers involving unverified self-hosted wallets is deferred until 2029-03-31.

The original said that all cross-border virtual asset transfers require IFTI reporting. Official guidance expressly states that a transfer solely of virtual assets under 29/30, with no money or other property involved, does not require IFTI. Where a cryptocurrency is used as a fiat remittance settlement instrument, IFTI may still be required; the future IVTS has separate transitional arrangements.

The original mechanically retained Part A + Part B and described Part B as industry-specific measures. Under the reformed framework, the program centres on risk assessment and policy; the original explanation of Part B was also incorrect.

The draft presents the board as invariably responsible for approving policies and risk assessments. The reforms specify individual approval by senior managers, oversight by the governing body, and coordination of day-to-day implementation by the compliance officer. These roles may be combined in a small business, but their responsibilities must be identified separately.

The draft uniformly requires a compliance officer to hold a professional qualification but omits the applicable Australian residency conditions. Officially, the management-level role may be filled by an external appointee or by an internal person concurrently holding another role, and there is no uniform mandatory certificate. When services are provided through an Australian permanent establishment, the person must be an Australian resident and fit and proper.

The original treated providing services through an overseas website to Australian residents as, by itself, a geographical connection. Official guidance requires factual tests, including a permanent establishment and the overseas conduct of business by residents; customers, an address or a bank account alone are not necessarily sufficient.

The draft excludes all securities and financial products from virtual assets and uses transferability as a general test for NFT. The analysis must instead be functional: financial products and virtual assets may overlap, and governance functions may independently meet the definition.

The draft broadly treats any temporary holding, multisignature arrangement or smart contract as custody, while excluding all DeFi. Under 46A, the service must also involve actually controlling or managing assets for a customer in the course of carrying on a VASP business. Pure software and non-VASP ancillary infrastructure have different boundaries.

The draft generalises Item 50C to all token issuance or related financial activity. It requires participation in the offer or sale and the provision of another financial service specified in Table 1. Mere issuance, and ancillary payments by a bank not participating in the issue, are not automatically covered.

The original described asset segregation, cold wallets and similar measures as uniform AUSTRAC certification requirements and promised insolvency protection. These must be distinguished from AML risk-control recommendations, current ASIC financial product custody rules and the contractual and insolvency-law effects.

Capital note: no uniform minimum share capital or NTA has been identified for the five categories of AUSTRAC registration; A$10 million, for example, relates to specific current AFSL financial product custody rules. Operating budgets and client assets must not be conflated with regulatory capital.

The draft treats the 2026 digital asset framework as implemented. The commencement table in section 2 of the Bill and the October 2026 ASIC announcement specify commencement on 2027-04-08; this conflicts with the 9 April wording in the earlier roadmap. As at the verification date, CP 392 remains under consultation and must not be treated as an effective VASP capital or custody standard.

The draft omits changes to annual compliance reporting by financial year and the phased first independent assessment. The next annual report is to be submitted from July to September 2027. The first independent assessment must be determined under the transition based on whether the AAN is odd or even or on the existing review date.

The original treated 2026-06-30 as the first launch date of the public register. Official news on 2026-04-02 had already stated that it was publicly searchable; 30 June was only the date of subsequent information. It is therefore not retained as a definite first launch date.

The original claimed that hundreds of VASP registrations were cancelled in 2023–2024, without corresponding official support. On 2026-04-02, official information disclosed that recent action had contacted 128 inactive businesses, of which 62 had exited through regulatory action or voluntarily. These figures must not be misattributed.

The original draft recommended Volt Bank, fixed company registration and consultancy fees, and a 4 to 6-week timeframe for success. These claims have not been substantiated by current official sources and are not retained as a list of available banks, current government fees or a guarantee of approval.

The draft uses AAT as the current external review pathway, which is no longer appropriate. The specific eligibility and time limits for internal and external reviews should be determined from the notice of an adverse decision and the current framework.

The draft’s generalisations about all offences and maximum fines have not been checked against current law provision by provision. This guide does not reuse a uniform two-year or fixed-amount table; enforcement depends on the specific provision, conduct and current penalties.

Claims in the draft about more than ten years’ experience, hundreds of successful cases, bank partnerships and cross-border capabilities have not been verified and must not be used as claims of official certification, approved outcomes or guarantees. Retain the authentic specified signature and company name as requested by the user.