AUSTRAC (Australian Transaction Reports and Analysis Centre), Australia’s leading financial intelligence and regulatory agency, has solidified its stance against companies in the crypto sector that fail to adhere to proper Anti-Money Laundering (AML) regulations. In its latest decisive action, AUSTRAC has imposed a penalty of AU$56,340 (approximately US$37,085) against CryptoLink, one of the nation’s cryptocurrency ATM operators.
The fine was issued due to “weaknesses” AUSTRAC identified in CryptoLink’s AML framework and deficiencies in reporting significant financial transactions. This measure sends a clear signal to the Australian financial market that AUSTRAC will not compromise on mitigating financial risks associated with crypto ATMs.
The Risks of Crypto ATMs and AUSTRAC’s New Focus
The number of Bitcoin ATMs in Australia has grown rapidly in recent years. According to CoinTimeATM data, the count, which stood at around 1,608 in August 2024, now exceeds 2,000. AUSTRAC views this rapid growth as creating a “high-risk money laundering pathway” for organized criminals and scammers to cash out and move stolen funds.
Consequently, AUSTRAC established its dedicated Crypto Taskforce last year. The taskforce’s mandate is to monitor Digital Currency Exchanges (DCEs) and crypto ATM operators to ensure their compliance with AML/CTF (Counter-Terrorism Financing) regulations, thereby hardening the sector against exploitation risks.
How Did CryptoLink’s Violations Occur?
AUSTRAC’s investigation identified deficiencies in two key areas of CryptoLink’s operations:
Late Reporting of Large Cash Transactions
Under Australian law, financial institutions and crypto operators must submit reports to AUSTRAC regarding large cash transactions exceeding a specific threshold within a set deadline. These reports provide early warning signs for criminal money laundering activities.
CryptoLink was found to have reported this crucial information late to AUSTRAC. AUSTRAC CEO Brendan Thomas stated that the fine was imposed to ensure “valuable intelligence information does not leak out.” The late submission of reports hindered the agency’s ability to timely identify and prevent criminal activities.
Weaknesses in the AML Framework
The AUSTRAC taskforce found that CryptoLink’s Anti-Money Laundering policies and Risk Assessments were not sufficiently robust. A crypto ATM operator is required to accurately assess the transactional risk of every customer and implement controls accordingly. CryptoLink failed to upgrade these fundamental risk assessments. These weak controls make it easier for scammers and money launderers to exploit these ATMs.
Regulatory Action and Future Commitments
In addition to imposing the fine, AUSTRAC issued an Infringement Notice to CryptoLink. Furthermore, through an Enforceable Undertaking, AUSTRAC demanded a guarantee that CryptoLink would upgrade and implement robust AML/CTF controls and risk assessments.
The Necessity of a Third-Party Review
Under the regulator’s directive, CryptoLink must undertake the following actions:
- Submission Verification: CryptoLink must engage a Third-Party Reviewer to verify all transactions submitted to AUSTRAC.
- Controls Assessment: The reviewer will thoroughly assess whether CryptoLink has implemented effective controls for large cash transactions and evaluate the efficacy of its AML and counter-terrorism financing risk assessments.
These intensive measures force CryptoLink to immediately overhaul its compliance framework.
The Future of the Australian Crypto Sector
Although CryptoLink fully cooperated and paid the fine, this incident serves as a clear warning to all crypto operators in Australia.
AUSTRAC CEO Brendan Thomas reiterated, “Scams are a huge driver of suspicious activity. Criminals are utilizing crypto ATMs to move stolen funds.”
He affirmed that AUSTRAC will continue to work collaboratively with all parts of the crypto sector, including Digital Currency Exchanges (DCEs), to protect them from exploitation, while taking firm action against operators who breach the law. The fine sends a powerful message that crypto operators must not take their risks lightly and must prioritize legal compliance.
