AUSTRAC Registration vs AFSL: Understanding the Difference for Crypto Exchanges

Introduction

For early-stage crypto founders and foreign exchanges entering the Australian market, the distinction between registration with the Australian Transaction Reports and Analysis Centre (AUSTRAC) and obtaining an Australian Financial Services Licence (AFSL) is a critical compliance issue. These are two separate regulatory requirements with distinct purposes; AUSTRAC registration addresses anti-money laundering and counter-terrorism financing (AML/CTF) obligations, whereas an AFSL is required for businesses providing financial services involving digital assets classified as financial products under the Corporations Act 2001 (Cth).

A dangerous misconception persists that holding an AUSTRAC registration number equates to being fully licensed to operate a crypto exchange in Australia. This misunderstanding creates significant legal risk, as AUSTRAC registration offers no protection from the consequences of operating without an AFSL. With major reforms set to introduce mandatory dual obligations in 2025, a clear understanding of both regimes is more critical than ever for lawful operation.

AUSTRAC & ASIC: Understanding Their Distinct Roles

AUSTRAC & Anti-Money Laundering Obligations

AUSTRAC serves as the nation’s financial intelligence unit, with a mandate anchored in the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth). Its primary purpose is not consumer protection, but rather the gathering of financial intelligence to combat money laundering, terrorism financing, and other serious financial crimes. AUSTRAC’s role is fundamentally about intelligence gathering for the government.

Entities providing “designated services,” such as a Digital Currency Exchange (DCE) that exchanges fiat currency for digital currency, are considered reporting entities. These entities must comply with several key obligations, which are procedural and investigative in nature. This ensures that businesses have adequate systems to identify users and report specific activities.

Core obligations for reporting entities include:

Obligation	Description
Enrolling and Registering with AUSTRAC	Businesses must register with AUSTRAC before providing any designated digital currency exchange services.
Implementing an AML/CTF Program	A comprehensive AML/CTF program must be developed, tailored to the business’s specific risks.
Customer Identification	Conducting customer due diligence, commonly known as Know Your Customer (KYC) procedures, is required to verify the identity of all customers.
Reporting to AUSTRAC	Reporting entities must submit reports on suspicious matters, transactions involving A$10,000 or more, and all international funds transfers.

ASIC & Consumer Protection for Financial Products

In contrast, ASIC is the corporate, markets, and financial services regulator. Its authority is derived from the Corporations Act 2001 (Cth), and its core responsibilities include consumer protection, maintaining market integrity, and ensuring financial service providers act “efficiently, honestly and fairly.”

ASIC’s jurisdiction over the crypto industry is triggered only when a digital asset is classified as a “financial product,” which makes understanding financial products a critical first step for any crypto business. The classification depends on the asset’s specific features and the rights it confers, not its technological label. If a crypto asset functions like a traditional financial product, it falls under ASIC’s regulatory oversight.

Examples of crypto-assets that may be classified as financial products include:

Asset Classification	Description
Interests in a Managed Investment Scheme	This can occur when investor funds are pooled in a common enterprise where investors lack day-to-day control.
Securities	A token may be a security if it provides rights similar to shares, such as ownership or a share in profits.
Derivatives	This applies if a crypto asset’s value is derived from an underlying asset, such as a “wrapped token.”
Non-Cash Payment Facilities	Stablecoins or other crypto assets used to make payments may fall into this category.

Registration & Licensing: Scope & Requirements

AUSTRAC Registration for Digital Currency Exchange 

Registration with AUSTRAC is a mandatory obligation for any entity providing a “designated service.” For a crypto exchange, this primarily involves the act of exchanging fiat currency, such as the Australian dollar, for a digital currency, or vice versa. This requirement is rooted in the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth).

It is important to note several key aspects of this registration:

• The registration is strictly for AML/CTF compliance purposes.
• It does not provide any form of authorisation to sell or deal in financial products.
• It does not serve as a regulatory seal of approval for the safety or legitimacy of the business model.

AUSTRAC’s definition of a DCE is deliberately broad. It captures any service provider that facilitates these currency conversions, including both online platforms and crypto ATMs.

AFSL Obligations for Regulated Financial Products

An AFSL is required if a crypto exchange offers services or products that are classified as “financial products” under the Corporations Act 2001 (Cth). Unlike AUSTRAC’s focus on transaction reporting, an AFSL is centred on consumer protection and market integrity.

The classification of a digital asset as a regulated financial product depends on its specific characteristics and the rights it confers to the holder. Common examples of crypto-assets that may be considered financial products include:

Asset Classification	Description
Interests in a managed investment scheme (MIS)	This can apply where customer funds are pooled in a common enterprise to generate a financial benefit, and the customers do not have day-to-day control.
Securities	A token may be classified as a security if it provides rights similar to shares, such as ownership, voting rights, or a share in profits.
Derivatives	This includes crypto-assets that derive their value from an underlying asset, such as a “wrapped token” that represents another token on a different blockchain.
Non-cash payment (NCP) facilities	This can apply to stablecoins or other crypto-assets that are designed and used to make payments to multiple parties.

Holding an AFSL imposes significant ongoing AFSL compliance and regulation obligations on a crypto business. These obligations include:

• Maintaining adequate financial resources.
• Appointing qualified Responsible Managers.
• Conducting annual audits.
• Establishing dispute resolution systems.

For platforms providing custodial services, there are often substantial capital adequacy requirements, such as holding a minimum of $10 million in Net Tangible Assets (NTA).

Defining ‘Exchange’ vs. ‘Financial Market’: AUSTRAC & ASIC

A critical point of distinction lies in how AUSTRAC and ASIC define an “exchange.”

Regulator	Definition of “Exchange” / “Market”
AUSTRAC	The definition of a Digital Currency Exchange (DCE) provider is broad and transactional, capturing any entity that facilitates the exchange between digital currency and fiat currency.
ASIC	The definition of a “financial market” is narrower and more structural, applying only to a facility where offers to acquire or dispose of financial products are regularly made or accepted.

Therefore, a crypto exchange might be a DCE provider requiring AUSTRAC registration but not be operating a financial market that requires an Australian Market Licence from ASIC, especially if it only trades assets that are not classified as financial products.

The Dangerous ‘Full Compliance’ Misconception

Why AUSTRAC Registration Is Not a Licence

A dangerous fallacy exists among some crypto exchange founders: holding a registration number from AUSTRAC is equivalent to being fully licensed to operate a financial service. This belief is incorrect and exposes businesses to significant legal risk.

AUSTRAC registration is fundamentally an enrolment obligation for intelligence purposes, not a licence to provide financial services. The primary role of AUSTRAC is to act as Australia’s financial intelligence unit, with a mandate anchored in the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth).

Its focus is on combating money laundering and terrorism financing by requiring reporting entities, such as a digital currency exchange provider, to monitor and report transactions. This registration confirms that an entity acknowledges its reporting duties; it does not authorise the sale of financial products or provide any consumer protection.

In contrast, an AFSL is issued by ASIC under the Corporations Act 2001 (Cth). An AFSL is required for businesses that provide financial services in relation to financial products.

Crucially, AUSTRAC registration offers zero statutory protection against enforcement action by ASIC for unlicensed dealing in financial products.

Risks of Unlicensed Conduct & ASIC Enforcement

Operating a crypto exchange or other digital asset platform that provides financial services without holding an AFSL when one is required carries severe penalties. ASIC actively targets unlicensed conduct, and possessing an AUSTRAC registration number provides no defence against prosecution for breaching the Corporations Act 2001 (Cth).

The consequences for operating without the necessary AFSL are substantial and can cripple a business. These penalties may include:

Penalty Type	Details
Financial Fines	Corporations can face fines of up to $16.5 million per offence.
Imprisonment	Individuals involved in the unlicensed operation may face imprisonment for up to five years.
Other Sanctions	ASIC has the power to disqualify directors, seek court orders for customer remediation, and suspend or cancel an AFSL if one is eventually obtained.

ASIC has a track record of pursuing enforcement action, including AFSL audits and investigations, against crypto firms for unlicensed conduct, even when those firms were registered with AUSTRAC. For instance, proceedings against entities like BPS Financial Pty Ltd and Web3 Ventures Pty Ltd (Block Earner) concerned allegations of providing unlicensed financial services, demonstrating that AML/CTF compliance does not shield a business from ASIC’s scrutiny under financial services laws.

Liability Gaps & Consumer Protection Risks

Limited Recourse for Hacks Under AUSTRAC

Relying solely on an AUSTRAC registration creates a significant liability gap for both consumers and the crypto platform itself. AUSTRAC’s mandate is anchored in the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), positioning it as a financial intelligence unit focused on preventing financial crime, rather than on consumer protection.

AUSTRAC has no legislative power to:

• intervene in commercial disputes,
• recover lost funds, or
• compensate consumers.

If a crypto exchange suffers a hack, insolvency, or operational failure resulting in the loss of client assets, AUSTRAC’s involvement is limited. Its primary concern is to investigate whether the event was linked to money laundering or terrorism financing and ensure reporting obligations were met. It does not provide recourse for affected customers.

AFSL Conduct Standards & Compensation Mechanisms

In stark contrast, the AFSL regime, enforced by ASIC, establishes robust consumer protection standards. An AFSL holder is legally bound by the Corporations Act 2001 (Cth) to provide its financial services “efficiently, honestly and fairly.” This overarching duty is supported by several specific AFSL obligations designed to protect client interests.

Key consumer protection mechanisms under the AFSL regime include:

Protection Mechanism	Description
Dispute Resolution	Licensees must have both internal and external dispute resolution systems, giving clients access to bodies like the Australian Financial Complaints Authority (AFCA).
Compensation Arrangements	For retail clients, AFSL holders must have arrangements in place to compensate them for losses.
Asset Custody Standards	ASIC’s Regulatory Guide 133 (RG 133) sets out minimum standards for holding assets, including crypto assets, requiring segregation from company funds and robust security controls.
Risk Management	AFS licensees must maintain adequate risk management systems to mitigate operational, market, and cybersecurity risks.

If a licensed crypto platform fails to meet these standards, leading to a loss of client funds, ASIC can prosecute the entity and its directors for breaching their conduct obligations. This provides a clear path for consumer redress and holds the asset exchange accountable in a way that AUSTRAC registration does not.

Navigating Dual Obligations & Future Reforms

The Digital Asset Platform Licensing Framework

The Australian government is addressing the regulatory gap for crypto exchanges with the proposed Corporations Amendment (Digital Assets Framework) Bill 2025, which introduces significant digital asset platform reforms. This legislation introduces a formal licensing framework, bringing most custodial crypto platforms under the existing AFSL regime governed by the Corporations Act 2001 (Cth). The reform is guided by the principle of “same activity, same risk, same regulatory outcome.”

Under this new framework, two new categories of financial products are introduced, which will require many crypto businesses to obtain an AFSL:

Category	Description
Digital Asset Platforms (DAPs)	This category applies to any facility where an operator holds one or more digital tokens on behalf of a client. It is designed to capture services such as: Crypto exchanges Brokerage platforms Custodial wallet providers
Tokenised Custody Platforms (TCPs)	This category covers facilities where an operator holds an underlying asset, such as gold or shares, and issues a unique digital token representing the right to redeem that asset.

An AFSL becomes mandatory if a platform holds digital assets exceeding A$5 million in total, or more than A$1,500 for any single client. While there are exemptions for smaller operators, these businesses must formally notify ASIC.

Preparing for Mandatory Dual Registration

The evolving regulatory landscape means that most crypto exchanges in Australia will soon face mandatory dual obligations. Crypto businesses will be required to:

• Hold an AUSTRAC registration for AML/CTF compliance
• Obtain an AFSL to legally provide financial services involving digital assets

This integrated model ensures that platforms are secure from financial crime while also offering robust consumer protection.

Early-stage founders and existing digital asset platform operators should begin preparing for this transition immediately to avoid business disruption. The draft legislation provides a 12-month transition period; however, businesses must submit their AFSL application within the first six months to be eligible.

Proactively mapping your current and future obligations is a critical step toward ensuring a smooth transition into this new, comprehensive regulatory framework.

Conclusion

Understanding the distinction between AUSTRAC registration and an AFSL is critical, as they serve separate purposes of anti-money laundering and consumer protection, respectively. Relying solely on AUSTRAC registration creates significant legal risk, a gap the Australian government’s 2025 reforms will close by mandating dual compliance for most crypto businesses.

To navigate this evolving financial system and ensure your platform is compliant, contact our expert lawyers at AFSL House about your AFSL application today. Our expert AFSL lawyers provide specialised services designed to turn these complex regulatory challenges into strategic opportunities, securing your platform’s future in Australia’s modernising payment ecosystem.

Frequently Asked Questions (FAQ)