AUSTRAC VASP registration and 2026 transition guide

Decide whether registration is required

A VASP must both enrol and apply for registration. The registration requirement commonly applies to businesses providing virtual-asset exchange, exchange-arrangement, safekeeping or customer transfer services. A lawyer, accountant, real estate agent, conveyancer or precious-metals dealer does not generally need VASP registration merely because it sends or receives virtual assets incidentally to another service, but the actual service must still be tested against the designated-service provisions.

Registration is not a notification-only process. AUSTRAC can assess the applicant's ownership, key personnel, criminal and regulatory history, operational capability and ability to manage ML/TF risk. It may refuse, suspend, cancel or impose conditions on a registration. A new applicant must not start registrable virtual asset services until registration is approved unless a specific transitional rule lawfully permits continued operation.

Apply the 2026 commencement dates correctly

The updated obligations for the pre-existing item 50A exchange of virtual assets and fiat currency applied from 31 March 2026. Under the transitional rules, specified obligations for newly registrable virtual asset services other than item 50A were deferred until 1 July 2026. The deferral covered AML/CTF programs, CDD, reporting, transfer-of-value and specified record-keeping obligations for those new services; it did not erase obligations attached to another designated service already being provided.

The 1 July deferral has ended. Current operations should therefore apply the live program, CDD, reporting, travel-rule and record-keeping framework to the services for which those obligations apply. Preserve the implementation decision and date for each product rather than using a single organisation-wide commencement assumption.

Understand the two transition pathways

Keep the AUSTRAC receipt number, submission date, services selected, current status and any correspondence or conditions. An incomplete internal task or draft registration form is not evidence that an application was submitted by the deadline.

• Existing DCE provider: registration rolled over automatically to VASP from 31 March 2026; AUSTRAC's online guide required the business to transition its designated services and update its enrolment details between 31 March and 29 July 2026.
• Newly regulated virtual asset service operating before 1 July 2026: the provider had until 29 July 2026 to apply to enrol and register.
• Timely transitional applicant: AUSTRAC says a provider only supplying the new services could continue while AUSTRAC decided the application if it applied before 29 July 2026.
• New or late applicant after the deadline: the ordinary position is that registrable services cannot start before registration approval; do not self-extend the expired grace period.

What to do after a missed deadline

First, verify the entity's current enrolment and registration status in AUSTRAC Online and, where relevant, its presence on the public VASP register. Identify exactly which services have been supplied since each commencement date. Do not rely on a former DCE label, an old registration screenshot or a pending internal update as proof that every new service is covered.

Second, contact AUSTRAC promptly and obtain advice for the entity's facts. Preserve a chronology of services, applications, receipts, status screens and communications. Seek Australian legal advice where the ability to continue operating, remediation or potential non-compliance is uncertain. The business should not describe itself as AUSTRAC-registered for a service unless the statement accurately reflects its current status and any conditions.

Maintain registration after approval

Registration generally lasts three years. AUSTRAC says renewal can be requested during the 90 days before expiry; a timely renewal application allows registration to continue while AUSTRAC decides it. If renewal is not made and registration lapses, the provider is removed from the register and can no longer provide the registrable services.

Keep registration information current. AUSTRAC's registration guidance identifies changes that must be notified, generally within 14 days, and registration conditions must be built into operational controls. Governance should review legal entity details, ownership and beneficial owners, directors and key personnel, services, locations, agents, technology and compliance capability whenever the business changes.