AUSTRAC pulls 45 registrations in a year: what gets a VASP struck off

45 businesses off the register in a year

On 7 September 2026, the Australian Transaction Reports and Analysis Centre (AUSTRAC) said it had cancelled, suspended or refused to renew 45 registrations in the past year. The businesses were remittance service providers and VASPs. AUSTRAC removed each one from its registers.1

AUSTRAC named two of them. It cancelled the registration of BA Digital Ventures Pty Ltd, trading as GetCoins, on 4 June 2026.2 AUSTRAC acted with the National Anti-Scam Centre (NASC) after customer complaints. It said the business was "allegedly exploited by organised cryptocurrency investment scams".1

AUSTRAC also suspended the registration of Cryptolink Pty Ltd for three months from 9 August 2026. The suspension took Cryptolink's 96 ATMs offline.3 Separately, AUSTRAC has started an investigation into Western Union.1

Seven ways to lose a registration

Under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act), a VASP must be registered with AUSTRAC before it provides virtual asset services. A registration lasts three years.4

AUSTRAC's guidance says:

"We may suspend or cancel your registration if we think your business poses a significant ML/TF or other serious crime risk."4

ML/TF means money laundering and terrorism financing. For suspensions, cancellations and conditions, AUSTRAC's guidance cites sections 75C(2), 75G(1), 75H(1), 76E(2), 76J(1) and 76K of the AML/CTF Act.4

AUSTRAC's release gives seven grounds for the 45 actions. The businesses:

• lacked the operational capacity to begin or continue trading
• were dormant or inactive
• had not provided designated services for extended periods
• were insolvent
• failed to hold the appropriate registration
• did not notify AUSTRAC of material changes
• otherwise involved significant money laundering or terrorism financing risk.1

Only the last ground is about money laundering risk itself. The other six are failures of operations, governance or administration.

A registered business must tell AUSTRAC about changes within 14 days. A business that does not apply to renew loses its registration and must reapply as a new applicant.4

Who has to act: registered VASPs and their counterparties

If you hold an AUSTRAC registration, the seven grounds apply to you whether or not you have ever filed a late report.

Timeline

1. Late 2024

   AUSTRAC starts supervisory engagements with ATM operators that exchange cash for virtual assets.3

2. October 2025

   AUSTRAC accepts an enforceable undertaking from Cryptolink and issues a $56,340 infringement notice.3

3. 12 November 2025

   AUSTRAC cancels five VASP registrations on the same day.2

4. 29 January 2026

   AUSTRAC refuses to renew three VASP registrations.2

5. 4 February 2026

   AUSTRAC cancels three more VASP registrations.2

6. 4 June 2026

   AUSTRAC cancels GetCoins.2

7. 29 July 2026

   Last day for providers of newly regulated services to apply and keep operating while AUSTRAC decides.4

8. 9 August 2026

   AUSTRAC suspends Cryptolink for three months.3

9. 7 September 2026

   AUSTRAC announces the 45 actions.1

10. About 9 November 2026Upcoming

    Cryptolink's three-month suspension period ends.3

15 VASP cancellations in seven months, against 10 in five years

AUSTRAC publishes every VASP registration decision, with the entity name, company number and date. It does not publish the reason.2

By our count, AUSTRAC made 21 VASP registration decisions in the 12 months to 7 September 2026:

AUSTRAC did not split the 45 by sector. Its remittance register lists 24 actions in the same 12 months: 12 cancellations, 6 suspensions and 6 refusals to renew.5 With our 21 VASP decisions, that makes 45.

AUSTRAC is cancelling faster. AUSTRAC cancelled 10 VASP registrations between September 2019 and June 2024. It cancelled 15 between November 2025 and June 2026.2

AUSTRAC decides in batches. Five cancellations share the date 12 November 2025. Three share 4 February 2026. Three refusals to renew share 29 January 2026.2 Same-day batches fit a sweep of dormant registrations, which is one of AUSTRAC's stated grounds. That is our reading, and AUSTRAC has not confirmed it.

AUSTRAC requested information before both named actions. AUSTRAC asked GetCoins for information to assess whether it could manage its money laundering risks.1 Cryptolink did not submit threshold transaction reports and did not respond to an AUSTRAC request for information.3 Cryptolink had met the conditions of its enforceable undertaking. AUSTRAC suspended it after the later reporting failures.

What to check this month

Registration

• Find your registration end date. Apply to renew in the 90 days before it.4
• Give one named person ownership of the 14-day change notifications. Changes include beneficial owners, key personnel, new countries and foreign licences.4
• Update your registration details with the information the reforms require. AUSTRAC expects this before your next renewal.4
• Tell AUSTRAC if you stop providing a registrable service.4

Reporting

• Reconcile the last 12 months of threshold transaction reports and suspicious matter reports against their deadlines.
• Treat each AUSTRAC request for information as a deadline. Give it a named owner and an internal due date.

KYC and counterparty due diligence

• Check each counterparty VASP and remitter against AUSTRAC's published decisions.2
• Repeat the check on a schedule. AUSTRAC can suspend a registration between your periodic reviews.

KYT and investigations

• Review transfers to and from the VASPs AUSTRAC has cancelled since November 2025.
• Where a customer sends funds to a platform linked to investment-scam complaints, open a case. Assess whether a suspicious matter report is due.

Not yet public: the Cryptolink decision, the sector split and AUSTRAC's reasons

What Cogentic handles, and what your team keeps

Cogentic's agents turn alerts into investigations, trace the transfers behind them and draft suspicious matter reports. Cogentic records each step for audit. If AUSTRAC requests information, your team has the case history, evidence and decisions in one place.