AUSTRAC Suspends Cryptolink’s Registration Over AML/CTF Reporting Failures

Australia’s financial crime regulator, the Australian Transaction Reports and Analysis Centre (AUSTRAC), has suspended the registration of cryptocurrency ATM operator Cryptolink Pty Ltd for three months, preventing the company from operating its network of 96 cryptocurrency ATMs across Australia.

The suspension, effective August 9, 2026, follows AUSTRAC’s concerns about Cryptolink’s ability to meet core anti-money laundering and counter-terrorism financing (AML/CTF) obligations. The action highlights continued regulatory scrutiny of crypto businesses operating high-risk cash-to-crypto channels.

Reporting failures trigger regulatory action

According to AUSTRAC, Cryptolink failed to meet key reporting obligations, including requirements to submit threshold transaction reports (TTRs). The company also failed to respond to an AUSTRAC request for information, raising further concerns about its ability to manage financial crime risks associated with its ATM network.

The suspension follows earlier regulatory intervention. In October 2025, AUSTRAC accepted an enforceable undertaking from Cryptolink after its Crypto Taskforce identified alleged AML/CTF contraventions, including late threshold transaction reporting and weaknesses in the company’s AML/CTF risk assessments.

Cryptolink also paid a $56,340 infringement notice issued by AUSTRAC at the time.

Although the company completed the conditions of the enforceable undertaking, AUSTRAC subsequently determined that Cryptolink remained too high-risk to continue operating after further failures to maintain its reporting obligations.

AUSTRAC increases scrutiny of crypto ATM operators

The enforcement action forms part of AUSTRAC’s broader supervisory focus on the cryptocurrency sector. The regulator has conducted supervisory engagements with crypto ATM operators since late 2024 and established a dedicated Crypto Taskforce to address financial crime risks associated with digital currency businesses.

The case demonstrates that AML/CTF remediation cannot be treated as a one-time exercise. Completing an enforcement undertaking does not eliminate the need for ongoing transaction reporting, updated risk assessments, effective monitoring, and timely engagement with regulators.

Why It Matters for Compliance

For virtual asset service providers (VASPs) and other crypto businesses, the Cryptolink action reinforces the importance of demonstrating sustained compliance after regulatory remediation.

Firms operating high-risk channels such as cryptocurrency ATMs should ensure transaction reporting remains accurate and timely, AML/CTF risk assessments reflect current exposure, and regulatory information requests are addressed promptly.

The suspension also signals that regulators are prepared to restrict or halt crypto operations where businesses cannot demonstrate continued compliance with fundamental AML/CTF obligations.

Compliance Takeaway

Crypto businesses should treat regulatory remediation as an ongoing control obligation rather than a completed project. Strong reporting processes, current risk assessments, effective monitoring, and responsive regulatory engagement are essential to maintaining authorization and demonstrating continued AML/CTF compliance.