Crypto ATMs: Is Australia taking a consistent approach to digital asset regulation?
12 November 2026
Australia's approach to regulating digital assets appears to be developing in two potentially conflicting directions.
On the one hand, ASIC is bringing digital asset businesses within a more comprehensive licensing and supervisory framework. The Corporations Amendment (Digital Assets Framework) Act 2026 extends financial services regulation to digital asset platforms and tokenised custody platforms, with the new regime commencing in April 2027.
On the other hand, the Anti-Money Laundering and Counter-Terrorism Financing Amendment Bill 2026 proposes powers to restrict or prohibit high-risk mechanisms used to provide designated services, including cryptocurrency automated teller machines (crypto ATMs).
The Parliamentary Joint Committee on Intelligence and Security has gone further, recommending that consideration be given to restricting or prohibiting crypto ATMs as a priority. The Committee relied, among other matters, on AUSTRAC's investigation of prolific crypto ATM users, which identified substantial involvement in scams and money mule activities.
These findings raise legitimate concerns about financial crime and consumer protection. However, evidence concerning a particularly high-risk group of users should not necessarily be taken as establishing that the entire delivery channel is incapable of effective regulation.
The question is whether prohibition is the appropriate response where a licensing and compliance framework already exists or is being developed.
ASIC licensing and AUSTRAC regulation serve different statutory purposes. An Australian financial services licence is not, of itself, an authorisation to conduct every form of virtual asset business, nor does it displace obligations under the AML/CTF legislation. Nevertheless, both regimes seek to establish standards of conduct, accountability and regulatory supervision.
An operator could therefore comply with applicable financial services licensing requirements, and AUSTRAC obligations yet still face restrictions preventing it from using a particular transaction mechanism.
A comparison with Canada is instructive. On 3 November 2026, the Canadian Government introduced Bill S-8, the Combatting Financial Crimes and Drug Trafficking Act. Rather than proposing a general prohibition of crypto ATMs, the legislation would prohibit their operation without the relevant provincial or territorial money services business licence, while introducing enhanced federal regulatory requirements for permitted machines. ¹
The Canadian proposal recognises the serious financial crime risks associated with crypto ATMs but distinguishes between lawful, supervised operations and those operating outside the regulatory framework.
This raises a broader question for Australian policymakers.
If the objective is to prevent scams, money laundering and other criminal activity, should the primary response be to prohibit a particular delivery channel, or to require operators to satisfy enforceable licensing, customer identification, transaction monitoring and risk management standards?
There will undoubtedly be circumstances where a prohibition is justified. However, the existence of financial crime risks does not, by itself, establish that appropriately regulated operations cannot continue.
Regulation should distinguish between the risks inherent in a service and the failure of individual operators to manage those risks.
There is also a question of timing and regulatory necessity. ASIC's new digital asset licensing framework is scheduled to commence in April 2027, with transitional arrangements extending beyond that date.
Meanwhile, AUSTRAC already possesses substantial powers to regulate individual crypto ATM operators, including imposing registration conditions, transaction limits and, where justified, suspending or cancelling registrations. Indeed, AUSTRAC has already exercised those powers. ²
While immediate action against operators presenting unacceptable financial crime risks is clearly warranted, the question arises whether broader prohibitions should be contemplated before the existing controls have been adequately assessed and the new digital asset licensing framework has been implemented. The case for additional powers should be supported by evidence that the existing regulatory mechanisms are insufficient.
As Australia develops its digital asset regulatory framework, greater coordination between ASIC's licensing regime and AUSTRAC's AML/CTF powers would help ensure that the resulting framework is coherent, proportionate and capable of distinguishing compliant businesses from those presenting unacceptable risks.
Footnotes
1. Government of Canada, Department of Finance, Protecting Canadians from Financial Crimes and Safeguarding the Integrity of the Financial and Postal Systems (3 November 2026), accompanying Bill S-8, Combatting Financial Crimes and Drug Trafficking Act. The proposed legislation would prohibit the operation of cryptocurrency ATMs without the requisite provincial or territorial licensing, while permitting licensed operators to continue subject to enhanced federal regulatory requirements. Transitional arrangements are also contemplated for jurisdictions without an existing licensing regime.
2. AUSTRAC, ECDD a key tool in identifying scam and money laundering risk (26 March 2026); AUSTRAC, AUSTRAC orders Cryptolink's crypto ATMs offline (10 August 2026). These publications illustrate AUSTRAC's existing supervisory and enforcement powers, including enhanced customer due diligence requirements and suspension of registration.
Comments