29 July 2026: The AUSTRAC Deadline Every Crypto Business Needs to Understand | VASP Australia 2026

First, the terminology shift

The reforms retire the old language. "Digital currency exchange (DCE)" is gone. You are now a virtual asset service provider (VASP), and "virtual asset" is deliberately broader than "digital currency." The net now catches activities that previously sat outside it — crypto-to-crypto exchange, virtual asset safekeeping (custody), and accepting instructions to transfer virtual assets on a customer's behalf — not just fiat-to-crypto.

That breadth is the point. It is also why the 29 July date means different things to different businesses.

Two different situations — know which one you are in

You were a registered DCE before 31 March 2026

You were automatically registered as a VASP from 31 March 2026. You do not re-register. If you were already enrolled, you do not re-enrol. AUSTRAC has confirmed this happens without any application from you.

But "automatic" stops there. You still must:

Update your enrolment information to reflect your VASP status and the new details the reformed Rules require. AUSTRAC asked existing reporting entities to update enrolment details in AUSTRAC Online between 31 March and 30 May 2026, and gave digital currency exchange providers additional time — until 29 July 2026 — to update their enrolment information as a VASP.

Notify AUSTRAC of your AML/CTF Compliance Officer. As an existing reporting entity, your deadline was 30 May 2026. If you have not done this, you are already late. Notify now.

Rebuild your AML/CTF program for the reformed Act — and check your commencement date, because it is probably earlier than you think.

This is the point most crypto businesses have wrong. If your business exchanges virtual assets for money, or arranges that exchange — the classic fiat-to-crypto exchange — the transitional deferral does not apply to you. Your reformed obligations (the rebuilt program, customer due diligence, reporting and record-keeping) commenced on 31 March 2026, not 1 July.

The 1 July date applies to the newly registrable virtual asset services: crypto-to-crypto exchange, safekeeping of virtual assets, and accepting instructions to transfer virtual assets on a customer's behalf.

If you run a fiat-to-crypto exchange, you have been under the reformed obligations since March. Most of the commentary aimed at your sector says 1 July. Check which limb you are on.

Travel Rule: 1 July 2026. The travel rule attaches to transfers of value involving virtual assets — not to exchange. Those transfer services sit inside the transitional deferral, so travel rule obligations apply from 1 July 2026.

Update your registration details with what the reformed laws require, before your next scheduled renewal. Your registration status itself does not change.

You are a newly captured crypto business

This covers crypto-to-crypto exchanges, custody providers, and businesses that accept instructions to transfer virtual assets — businesses that were not fiat-to-crypto DCEs.

For you, 29 July is the operative date: you must apply to enrol and register with AUSTRAC by 29 July 2026.

Two things that are widely misreported:

Your obligations start before your registration is approved. Your AML/CTF obligations apply from 1 July 2026 — from the moment you provide the service, not from when AUSTRAC approves you.

If you apply in time, you can keep operating while you wait. Under the transitional rules, if you apply for registration before 29 July 2026, you may continue to provide the new virtual asset services until AUSTRAC makes a decision on your registration. You do not have to stop trading on 30 July because your application is still being assessed.

What you cannot do is provide registrable virtual asset services having never applied. That is where the criminal exposure sits.

Enrolment does not "close"

A note on framing, because a lot of the commentary gets this wrong: enrolment is not a window that shuts.

The rule is that you must apply to enrol no later than 28 days after you start providing a designated service — which produces the 29 July date for services commencing 1 July. If you have not enrolled by then, you have contravened the Act and can face civil penalties. But the answer is to enrol immediately, not to assume the door has closed and stay unenrolled.

AUSTRAC publishes enrolment activity by industry and updates it regularly. If your sector's numbers are low, that is visible to the regulator.

Why "we'll deal with it after the deadline" fails

Enrolment and registration are the visible step. The work behind them takes time: confirming beneficial ownership, formally appointing and resourcing your Compliance Officer, standing up your ML/TF/PF risk assessment and AML/CTF policies, and building travel rule capability — collecting and transmitting originator and beneficiary information, and conducting due diligence on counterparty VASPs.

None of that happens in the last week of July. AUSTRAC has been clear that it expects genuine effort against a documented implementation plan, and that registrations can be cancelled and civil penalties pursued.

The AUSTRAC deadline is only the first transition

The Corporations Amendment (Digital Assets Framework) Act 2026 passed Parliament on 1 April 2026 and received Royal Assent on 8 April 2026. It commences on 9 April 2027.

It creates two new categories of financial product:

• Digital Asset Platforms (DAPs) — a facility where an operator holds digital tokens, either for themselves or on behalf of another person. In practice: exchanges, brokers, custodians, and some wallet providers.
• Tokenised Custody Platforms (TCPs) — a facility where an operator identifies and holds assets other than money, issuing a single digital token for each asset, which gives the holder a right to redeem or direct delivery of that asset. In practice: real-world asset tokenisation.

Operators of DAPs and TCPs will need to hold an Australian Financial Services Licence, unless an exemption applies.

There is a transition. A six-month transition period applies after commencement, during which existing operators may continue operating while they apply for a licence or a licence variation. Where an application is lodged in that window, the new requirements do not apply to that service until ASIC decides the application. The Act provides for an 18-month implementation timeline overall. April 2027 is not a cliff.

There is a low-value exemption — but it has more than one limb, and this is where businesses get it wrong. The exemption is not a single $10 million test. Broadly, it requires all of the following: the total market value of transactions across the operator's platforms over a 12-month period does not exceed $10 million; the value of underlying assets held for any single client does not exceed $5,000; no financial products are held under the platforms; and the operator has notified ASIC of its intention to rely on the exemption.

A business well under the $10 million transaction threshold can still fall outside the exemption on the per-client limb alone. Do not self-assess this from a headline number — get advice on your specific position before you conclude you are exempt, and equally before you spend money on an application you may not need.

AFSL applications are substantial. ASIC assesses organisational competence, compliance arrangements, financial resources, risk management, responsible managers and dispute resolution membership. If you are above the thresholds, the preparation window is open now. And the compliance program you build for AUSTRAC today should be designed with ASIC obligations in mind, because you may end up running both.

Where Veriqua fits

This is where a crypto business burns weeks it does not have — chasing enrolment fields, version-controlling policy documents, and assembling a program from scratch.

Veriqua is an Australian compliance platform built for AUSTRAC reporting entities and ASIC licensees, supporting both regimes in a single system.

Every AML plan includes the program documents module — which drafts your ML/TF/PF risk assessment and AML/CTF policies from your own business data, structured the way the reformed regime expects — along with customer onboarding and due diligence, suspicious matter and threshold transaction reporting, AUSTRAC reporting, staff training records, and board reporting. Every action lands in an audit-ready trail hosted in Australia.

Customer risk ratings, beneficial ownership registers, transaction monitoring and independent review scheduling are available from the Professional tier.

Because Veriqua supports AUSTRAC and ASIC obligations together, the program you build today extends into your AFSL compliance framework if and when the Digital Assets Framework Act applies to you. See it in two minutes, no login: demo.veriqua.com.au/start.