Cryptolink met its undertaking. AUSTRAC suspended it anyway
Australia's AML regulator took 96 crypto ATMs offline for three months from 9 August 2026. The grounds were not the case that opened the file, but the routine reports that stopped arriving after it closed.
Australia's AML regulator took 96 crypto ATMs offline for three months from 9 August 2026. The grounds were not the case that opened the file, but the routine reports that stopped arriving after it closed. The register shows why: 2026 is the steepest enforcement year the virtual asset sector has had.
The reports that stopped arriving cost Cryptolink its registration
AUSTRAC, Australia's anti-money laundering regulator, suspended the registration of Cryptolink Pty Ltd for three months from 9 August 2026, taking its 96 cryptocurrency ATMs offline. The stated grounds were not the 2025 case that put Cryptolink under an enforceable undertaking, but what came after it: missed threshold transaction reports and an unanswered request for information.
The sequence matters. In October 2025 AUSTRAC's Cryptocurrency Taskforce identified alleged contraventions at Cryptolink, including late reporting of threshold transactions and weaknesses in its money laundering risk assessments. The company signed an enforceable undertaking, a court-enforceable commitment to fix named deficiencies, and paid a $56,340 infringement notice, a fixed penalty issued without court proceedings.
By AUSTRAC's own account, Cryptolink met the conditions in that undertaking. What it then failed to do was ordinary: lodge threshold transaction reports, the mandatory filings for cash transactions of A$10,000 or more that every reporting entity handling cash owes within ten business days, and answer AUSTRAC's request for information. The regulator concluded it was, in its words, too high risk to continue operating at present.
Cryptolink was given the opportunity to comply but could not meet its obligations despite the enforceable undertaking.
Brendan Thomas, AUSTRAC Chief Executive Officer. Media release, 10 August 2026
Cryptolink has not published a response, and AUSTRAC's account is the only public record of the decision. AUSTRAC said it will monitor the company for compliance with the suspension.
AUSTRAC has taken more registration actions in 2026 than in the five previous years combined
AUSTRAC's public register lists 16 registration actions against virtual asset service providers in 2026 to 13 August: ten cancellations, three suspensions and three refusals to renew. The five years from 2021 to 2025 produced 14 in total. Cryptolink's suspension is one entry in the steepest enforcement year the register has recorded.
The register also shows the pace continuing after Cryptolink. Three days later, on 12 August 2026, AUSTRAC suspended a second provider, Worldwide Money Transfer Pty Ltd. The register records the action; no accompanying media release has been published.
The curve has an infrastructure behind it. AUSTRAC stood up a Cryptocurrency Taskforce and began supervisory engagements with crypto ATM operators in late 2024. On 3 June 2025 it placed standing conditions on every crypto ATM provider: a $5,000 limit on cash deposits and withdrawals, enhanced customer due diligence, mandatory scam warnings on the machines, and more robust transaction monitoring. The scale being supervised is small in machine terms and concentrated in cash: AUSTRAC projected roughly 150,000 transactions and about $275 million a year through the sector, around 99% of it cash deposited to buy cryptocurrency. Machine numbers grew from 23 in 2019 to more than 1,800 by mid-2025.
Fig. 01: VASP registration actions by year of decision — Source: AUSTRAC register, updated 13 Aug 2026
| 2021 | 4 |
| 2022 | 2 |
| 2023 | 1 |
| 2024 | 1 |
| 2025 | 6 |
| 2026 to 13 Aug | 16 |
The tripwire is ordinary reporting, and the file does not close
For a registered virtual asset service provider, the operational lesson from Cryptolink is that supervision does not end when an enforceable undertaking is satisfied. AUSTRAC suspended the company over routine obligations: lodging threshold transaction reports on time and answering an information request. Both sit in the ordinary reporting pipeline, not in a remediation project.
That pattern is not unique to crypto. Across AUSTRAC's recent actions, and in the UK Gambling Commission's enforcement record, the stated failing is rarely the absence of a control; it is a control or a process that existed and did not run. Australia's new reporting forms raise the stakes on exactly this pipeline: from 1 July 2026 both threshold transaction reports and suspicious matter reports demand more structured detail, on a transition clock that runs to March 2029.
The proportionality question sits underneath the sector conditions, and it is worth naming rather than arguing. A $5,000 cash cap, enhanced due diligence and mandatory warnings apply to every user of a channel where, on AUSTRAC's own 2025 data from nine providers, users over 50 accounted for almost 72% of transaction value and a large share of scam victims. Whether that friction is proportionate to that harm is the judgment the conditions embody; AUSTRAC has said it will keep their effectiveness under review.
Using Didit for crypto ATM and VASP onboarding
The obligations in this story are AUSTRAC's enhanced customer due diligence condition and the monitoring that feeds accurate reports. ID Verification at $0.15 per check covers identifying the customer at the machine or the app, Transaction Monitoring at $0.02 per transaction surfaces the patterns a threshold or suspicious matter report is built from, and Wallet Screening (KYT) at $0.15 per screening checks the destination wallet. Current module prices are listed on the pricing page.
The reporting itself stays with the reporting entity. Didit does not lodge threshold transaction reports or suspicious matter reports, does not answer AUSTRAC information requests, and does not run an enforceable undertaking's remediation. Verification and monitoring help you produce the data those obligations consume; nothing bought from a vendor makes a reporting entity compliant, and Cryptolink's case shows the pipeline itself is what gets tested.
Frequently asked questions
Why did AUSTRAC suspend Cryptolink?
AUSTRAC suspended Cryptolink Pty Ltd's registration as a virtual asset service provider for three months from 9 August 2026. AUSTRAC said that after meeting the conditions of its October 2025 enforceable undertaking, Cryptolink subsequently failed to meet basic reporting obligations, particularly threshold transaction reports, and did not respond to an information request.
Can Cryptolink operate its crypto ATMs during the suspension?
No. AUSTRAC said Cryptolink is no longer allowed to operate its 96 cryptocurrency ATMs while the three-month suspension runs, and that it will monitor the company to ensure it complies with the suspension.
What conditions apply to all crypto ATM operators in Australia?
Since 3 June 2025 AUSTRAC has placed conditions on crypto ATM providers: a $5,000 limit on cash deposits and withdrawals, enhanced customer due diligence obligations, mandatory scam warnings, and requirements for more robust transaction monitoring.
Does completing an enforceable undertaking protect a registration?
Cryptolink's case shows it does not. AUSTRAC's own account is that the company met the conditions stipulated in its enforceable undertaking and was suspended over obligations that came afterwards: lodging threshold transaction reports and answering an information request. An undertaking closes a remediation project, not the file.
Related reading
- The new AUSTRAC SMR form asks for a lot more detail — The reporting pipeline that tripped Cryptolink, after its 1 July 2026 redesign.
- AUSTRAC's transition timeline, 2026 to 2029 — Three dates run the new forms transition for every reporting entity.
- Cash for gold makes you an AML reporting entity — How the A$10,000 threshold transaction report works in another cash-heavy sector.
- Gambling Commission enforcement: the control existed and did not work — A UK regulator's cases show the same failure shape AUSTRAC described here.
Sources
- AUSTRAC orders Cryptolink's crypto ATMs offline — AUSTRAC media release · 10 August 2026 · suspension, grounds and all Thomas quotes
- Virtual asset registration actions — AUSTRAC public register · last updated 13 August 2026 · source of every action count in Fig. 01
- Scams, fraud and other illicit activity: AUSTRAC puts crypto ATM operators on notice — AUSTRAC media release · 3 June 2025 · sector conditions, age and volume data
- Cryptolink enforceable undertaking (redacted and signed) — AUSTRAC · October 2025 · the undertaking Cryptolink met before the suspension
Who wrote this
Tuan Nguyen — Growth · Didit
Writes about identity verification, fraud and compliance at Didit.
Last reviewed 24 Aug 2026 against the sources above
Related articles
- Altify Partners with Didit to Strengthen Investor Onboarding and Screening
- We give AI a simple job: try to break Didit
- Know Your Agent: Why Every LLM Platform Is About to Need Identity Verification
- The UK's first A7 alert describes a network built to pass identity checks
- A four-digit merchant code decided whether memecoin buyers faced KYC
- Korea let a crypto exchange pull government records for KYC instead of asking for documents