Australia's anti-money laundering regime changed substantially in 2026. The AML/CTF Amendment Act 2024 brought new obligations for existing reporting entities from 31 March 2026 and extended the regime to newly regulated businesses, including lawyers, accountants, real estate professionals and some virtual asset providers, from 1 July 2026. For remittance providers and digital currency exchanges, the changes affect AML/CTF programmes, governance, customer due diligence and, for crypto businesses, the scope of regulated virtual asset services.
This article sets out the dates, the main obligations and the checks remittance and crypto businesses should make now. Our page on Australian remittance and AUSTRAC registration covers registration itself.
The reforms matter for overseas groups too. Many remittance and crypto businesses serving Australian customers are part of international groups whose AML programmes are designed to UK, EU or US standards. A group programme can be a strong base, but the Australian programme must meet Australian requirements, including AUSTRAC's reporting, the local compliance officer and Australian customer due diligence rules. Group policies should include an Australian annex that sets out where local rules differ.
Key dates
| Date | Event |
|---|---|
| 31 March 2026 | Obligations begin for existing reporting entities; enrolment opens for newly regulated businesses |
| 30 May 2026 | Existing reporting entities notify AUSTRAC of their AML/CTF compliance officer |
| 1 July 2026 | Obligations begin for newly regulated businesses, including new virtual asset providers |
| 29 July 2026 | Newly regulated entities notify AUSTRAC of their compliance officer |
| 30 March 2029 | End of proposed transitional period for existing initial customer identification procedures |
| 2029 | International value transfer service reporting changes begin |
| 1 July 2029 | Earliest first independent evaluation for newly regulated businesses |
What changed for existing remittance and crypto businesses
Existing digital currency exchanges, registered remittance network providers, remittance affiliates and independent remittance dealers did not need to re-register; their registrations rolled over. But their obligations changed from 31 March 2026. Programmes needed updating to the reformed structure: a documented assessment of money laundering and terrorism financing risk, policies and procedures that respond to it, governance with a senior manager accountable for the programme, an AML/CTF compliance officer notified to AUSTRAC, and independent evaluation.
Customer due diligence
Proposed transitional rules allow existing reporting entities to keep using their current customer identification procedures for initial due diligence until 30 March 2029, or to move to the reformed requirements earlier. The transition does not cover ongoing due diligence or other obligations, which apply now. Businesses should decide whether to move early, because running two approaches side by side adds complexity, and new products may be better built to the new requirements from the start.
Whatever the choice, record it: the decision, the reasons and the plan to complete the move by March 2029. AUSTRAC will ask how the business decided, and the independent evaluation will test whether the chosen approach is applied consistently. Businesses should also check that systems can handle both approaches during the transition, for example where some customers were identified under the old procedures and others under the new.
Virtual asset businesses
The reforms widened the range of virtual asset services regulated by AUSTRAC beyond exchange between virtual assets and money. For businesses newly brought into the regime, obligations began on 1 July 2026. Crypto businesses should confirm which of their services are now regulated, whether they need to enrol or register, and how the travel rule applies to their transfers.
Businesses that provide custody, transfers or exchange between different virtual assets should pay particular attention. Services that were outside the old regime, because they did not involve exchange with fiat money, may now be regulated. Businesses should map each service against the reformed definitions, record the conclusion and, where a service is newly regulated, confirm that enrolment and registration were completed on time. Late registration should be raised with AUSTRAC promptly rather than left to be discovered.
The reformed AML/CTF programme
The reforms restructure what an AML/CTF programme must contain. In place of the old Part A and Part B structure, businesses need a programme built on a documented assessment of the money laundering, terrorism financing and proliferation financing risks they face, with policies, procedures, systems and controls that respond to those risks. The programme must be approved and overseen by senior management, kept up to date when risks change, and subject to independent evaluation.
For remittance providers, the risk assessment should cover corridors, delivery channels such as agents and digital apps, customer types and cash exposure. For crypto businesses, it should cover the virtual assets offered, transfers to and from self-hosted wallets, exposure to mixers and high-risk platforms, and counterparties in jurisdictions with weak travel rule compliance.
Remittance network providers and affiliates
Remittance networks have specific obligations for their affiliates. A remittance network provider must make sure its affiliates have appropriate AML/CTF arrangements, which in practice means onboarding checks, training, monitoring and the ability to act when an affiliate falls short. Networks should review their affiliate agreements and oversight programmes against the reformed requirements, and affiliates should confirm what their network provides and what they must do themselves.
What to check now
| Area | Question to answer |
|---|---|
| Registration | Is the business correctly enrolled and registered for every regulated service it provides? |
| Compliance officer | Was AUSTRAC notified by the deadline, and does the officer have the authority and resources needed? |
| Risk assessment | Does it reflect the reformed structure and the business's current products and corridors? |
| Policies and procedures | Do they respond to each risk identified? |
| Governance | Is there clear senior manager accountability and board oversight? |
| Customer due diligence | Has the business chosen between the transitional and reformed approaches, and recorded why? |
| Independent evaluation | Is the next evaluation scheduled and scoped to the reformed requirements? |
What AUSTRAC will look for
AUSTRAC has said it will take a supportive approach while businesses adjust, but it expects genuine effort and prompt action. In supervision, expect AUSTRAC to look for a risk assessment that reflects the business's actual products and customers, a compliance officer with real authority, evidence that the programme is followed in practice, timely suspicious matter reports and threshold transaction reports, and records that show how customer due diligence decisions were made. Businesses that can show a credible implementation plan and progress against it will be in a stronger position than those that have updated documents without changing how they operate.
Interaction with payments licensing
Australia is also reforming payments licensing. Under Treasury's draft legislation, remittance and other payment services would need an Australian financial services licence from ASIC, in addition to AUSTRAC registration. No bill had been introduced by late October 2026, but businesses should plan for both regimes. Our guide to safeguarding requirements by jurisdiction compares customer money rules, including Australia's proposed trust arrangements.
How regulatory counsel helps
We review AML/CTF programmes against the reformed requirements, support compliance officer appointments and AUSTRAC notifications, and scope independent evaluations for remittance and crypto businesses. Our money services business practice covers Australia alongside the US, Canada and the UK.