Ramp and Rails: AUSTRAC steps up VASP supervision

AUSTRAC has recently launched two supervisory campaigns targeting virtual asset businesses as new AML/CTF reforms come into effect. One of these initiatives, the “ramps and rails” campaign, specifically targets over-the-counter crypto-to-cash operators. The other targets local digital currency exchange operators. This follows the transition from the “digital currency exchange” regime to the expanded “virtual asset service provider” (VASP) framework earlier this year.

The VASP framework was introduced under the Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth), which implements significant reforms to Australia’s AML/CTF regime as it applies to digital currency businesses. The shift aligns Australia more closely with international standards, including the Financial Action Task Force (FATF) Recommendations on virtual assets. As a result, VASPs are now subject to enhanced AML/CTF obligations subject to limited transitional relief.

Importantly, the expanded VASP definition captures a broader range of crypto-related products and services, including businesses facilitating fiat on- and off-ramps, custody arrangements, value transfer, brokerage services, exchanges and other intermediary services. Digital asset businesses should carefully assess whether they are carrying on new designated services and ensure that their AUSTRAC registration is up to date. Entities newly captured will need to ensure they are appropriately registered with AUSTRAC and have compliant AML/CTF programs in place.

As part of the “ramps and rails” campaign, AUSTRAC is engaging with industry participants to supervise how effectively crypto businesses are complying with their AML/CTF obligations. The campaign targets 36 crypto businesses and focuses on business models, service channels, scale of operations, and the effectiveness of AML/CTF risk management frameworks.

AUSTRAC is also engaging with 27 local crypto exchanges, with a focus on reform readiness and improvements to governance arrangements.

In particular, AUSTRAC is likely to scrutinise:

• customer due diligence processes, including KYC procedures;

• transaction monitoring and reporting (such as suspicious matter reports and threshold transaction reports);

• enterprise-wide and product-level risk assessments tailored to crypto-specific typologies; and

• governance, oversight, and the overall effectiveness of AML/CTF programs.

  
  

This development comes at a time when regulatory expectations are increasing, and transitional rules are in place. AUSTRAC’s concurrent supervisory activity signals a clear expectation that businesses will move quickly to align with their updated obligations.

AUSTRAC Chief Executive Officer Brendan Thomas emphasised the significance of the reforms, stating:

This is more than a name change. It reflects how this sector has evolved and ensures our regulatory framework remains relevant.

What now?

Businesses in the digital assets space should act promptly to:

• assess whether they fall within the VASP definition;

• apply for or update their AUSTRAC registration;

• review and uplift AML/CTF programs (including customer due diligence and transaction monitoring procedures);

• review and ensure they have a robust AML/CTF risk assessment in place; and

• ensure operational readiness for heightened regulatory scrutiny (including reporting obligations).

Written by Steven Pettigrove and Sophie Nguyen