Tranche 2 · VASPs
AML compliance for virtual asset service providers
Expanded VASP obligations cover crypto-to-crypto exchange, virtual asset safekeeping and related financial services. High velocity and cross-border exposure demand strong onboarding, screening and ongoing monitoring.
Am I captured?
Expanded VASP rules cover more than the original digital-currency exchange definition.
Designated services include:
- Exchanging virtual assets for money, or virtual assets for other virtual assets
- Safekeeping or administering virtual assets or instruments that control them
- Related financial services tied to those activities
Crypto-to-crypto exchange, safekeeping and related financial services can all bring you in.
Your obligations
If you provide a designated service, you are a reporting entity. You must enrol with AUSTRAC, run a risk-based AML/CTF program, identify and monitor clients, keep records and report when the law requires it. Velocity and cross-border wallets raise the risk rating quickly. Onboarding, screening and ongoing monitoring have to keep up with the transaction, not catch up at month-end.
AUSTRAC enrolment
Enrol with AUSTRAC and keep the enrolment current — including nominating a Compliance Officer. Enrolment is how AUSTRAC knows you are a reporting entity and how it contacts you.
Risk assessment
Document how your firm could be used for money laundering or terrorism financing — clients, services, delivery channels and geography — and keep that assessment current as the practice changes.
AML/CTF program
Put in writing how the firm will meet its AML/CTF duties: who does what, how clients are identified, how higher-risk work is handled, how staff are trained and how you will check the program still works.
Customer due diligence
Identify the client (and beneficial owners where relevant), verify that identity, screen for PEPs, sanctions and adverse media, and apply extra checks when risk is higher. Repeat when circumstances change.
Reporting
Submit suspicious matter reports to AUSTRAC when you form a suspicion, and any other reports that apply to your services. Do not tip the client off that a report has been made or is being considered.
Record-keeping
Keep the program, risk assessment, identification records and transaction records for at least seven years so you can show AUSTRAC what you did and why.
How Trancher helps
Support onboarding, screening and ongoing monitoring at transaction speed, with risk scoring, reporting support and audit-ready records for high-velocity, cross-border activity.
Risk assessment and AUSTRAC-aligned program builder
Client verification (KYC/KYB) with PEPs, sanctions and adverse media screening
Ongoing monitoring and risk scoring
Reporting support (SMRs)
Staff training modules
Audit-ready records and dashboard
Three clear paths
Choose the level of support that works for your business — manage compliance yourself, add expert support when you need it, or have agreed activities managed for you.
1
Self-managed
Run your AML program through Trancher using clear workflows and built-in guidance.
From $9.99 per week.
2
Self-managed + expert support
Use the platform day to day and bring in our compliance specialists when you need help with set-up, risk assessment, program development, onboarding, training or first files.
3
Fully managed by our experts
Ask our experienced compliance specialists to manage agreed AML compliance activities on your organisation’s behalf.
How long does it take?
Most firms move from start to operational compliance within weeks.
Days 1–7
Enrolment and risk assessment underway
Days 8–21
Workflows live and team trained
Thereafter
Fully operational and audit-ready
Articles for virtual asset service providers
Crypto Transaction Monitoring: 2026 Australian Guide
What if the administrative weight of AUSTRAC compliance wasn’t a drain on your firm’s resources, but actually a driver of new, billable revenue?…
View article →
Tranche 2 Obligations: 2026 AUSTRAC Readiness Guide
What if the 1 July 2026 deadline wasn’t a threat to your firm’s productivity, but the catalyst for a more profitable advisory model? We know that…
View article →
What Happens During an AUSTRAC Audit? Guide for SMEs
An AUSTRAC audit is not a regulatory “gotcha” moment designed to catch you out. It’s a structured systems check to ensure your firm’s integrity…
View article →Questions from virtual asset service providers
Am I captured?
Virtual asset service providers are captured when they provide designated virtual asset services. Obligations depend on the specific services provided (for example exchange, transfer or certain wallet services) and whether they meet the geographical link and other statutory conditions. Not every activity involving virtual assets is automatically captured.
What are the deadlines?
Additional virtual asset-related services came under regulation from 31 March 2026. Enrolment and other timing requirements depend on when you provide the relevant designated services. Enrol within the required period (generally 28 days of first providing a designated service) and keep your enrolment current. Nominate an AML/CTF Compliance Officer.
What goes in the program?
Your AML/CTF program must include a written risk assessment of the virtual asset services you provide and the controls to manage ML/TF risks. This typically covers customer identification and verification, PEPs/sanctions/adverse media screening, transaction monitoring, suspicious matter reporting, staff training and record-keeping tailored to the specific virtual asset services you offer.
What does CDD look like in practice?
Identify and verify customers, and screen for PEPs, sanctions and adverse media before or as you provide a designated virtual asset service. Ongoing monitoring is particularly important given the nature of virtual asset transactions. Records must demonstrate who the customer is and what was checked.
How is KYC/KYB charged?
Every verification check triggers one transaction. If you are identifying individuals within an entity (for example directors, beneficial owners or authorised persons), each individual check is a separate transaction and is charged accordingly.
Disclaimer
This is a plain-English guide only and is not a determination of your firm’s status. Whether you are a reporting entity depends on the specific designated services you provide, the facts of each engagement, and the applicable items in the AML/CTF Act. If unsure, use the Am I in scope? guide or seek independent legal advice. Trancher does not provide legal advice.
Ready to simplify compliance?
Book a short overview or speak with our in-house specialists about the right path for your firm.