Crypto Regulation in Australia (2026 Guide)

Australia has moved from a patchwork of guidance to legislated crypto rules. Three regulators, the ATO, AUSTRAC and ASIC, each look at digital assets from a different angle, and a new law, the Corporations Amendment (Digital Assets Framework) Act 2026, is changing how platforms that hold customer crypto must operate. If you invest, trade or hold crypto in Australia, none of this makes you a regulated business, but it shapes which platforms are safe to use, what protections you have and what you must report. This guide explains who does what, what has changed, what is still to come and how to apply it in practice. It is general information, not legal or tax advice, and the details are still moving, so confirm anything important with the regulators or a qualified professional.

 

The Big Picture: Three Regulators, Three Questions

It helps to think of the regulators as answering different questions. The ATO asks whether you have paid the right tax. AUSTRAC asks whether the businesses handling your money are keeping crime out. ASIC asks whether a product or platform is being offered to you fairly and with the right licence. Some activities touch all three at once, which is why a simple account on a digital asset exchange can involve identity checks, tax reporting and consumer protection rules together. The legal risks of crypto investing sit across all three layers.

 

The ATO: Tax and Reporting

The ATO treats crypto as an asset for tax purposes, not as currency. Selling, swapping or spending it can trigger capital gains tax, and some activity, such as mining or getting paid in crypto, can be treated as income. The ATO has been open about matching data from exchanges against tax returns: it tracks crypto transactions through data matching, with penalties for errors. Its crypto rules apply capital gains tax to most disposals, and holding for more than twelve months can give access to the twelve-month CGT discount. Planned CGT changes from 2027 may alter how that discount works.

 

AUSTRAC: Anti-Money Laundering

AUSTRAC is Australia’s financial intelligence agency. Since 2018, businesses that exchange crypto for money have had to register with it as digital currency exchange providers and run anti-money laundering and counter-terrorism financing programs. In practice that is why you are asked to verify your identity through KYC checks, and why a platform may question the source of a large deposit under AML rules. The same regime raises questions about AUSTRAC and privacy, as do the rules on privacy coins.

 

The Travel Rule

The travel rule requires platforms to send identifying information about the sender and receiver along with certain transfers, in the way banks do with wire transfers. AUSTRAC’s transitional rules apply the virtual asset travel rule to existing exchange providers from 31 March 2026, with a deferral to 1 July 2026 for newly regulated virtual asset services. In practice you may notice more questions when you withdraw to a personal wallet, such as proof of ownership. Check the current AUSTRAC guidance for exact dates and thresholds, since these have moved before.

 

ASIC: Financial Products and Platforms

ASIC regulates financial products and the businesses that offer them. Crypto assets themselves have generally not been treated as a financial product in Australia just because they are crypto, but many things built around them can be, such as derivatives, managed funds and certain custody or investment arrangements. ASIC has published guidance on how existing law applies to crypto-assets, and it has pursued platforms and promoters that breached the rules. That gap between what was and was not covered is exactly what the new legislation targets.

 

The Digital Assets Framework Act 2026

The Corporations Amendment (Digital Assets Framework) Act 2026 introduces two new categories of financial product: digital asset platforms and tokenised custody platforms. Operators of these must hold an Australian Financial Services licence, bringing them under obligations similar to other financial services businesses, including safeguarding client assets, clear disclosure, avoiding misleading conduct and having dispute resolution arrangements. ASIC says the Act passed Parliament on 1 April 2026, received Royal Assent on 8 April 2026 and commences on 9 April 2027, within an 18-month implementation timeline from passage in which platforms can lodge licence applications from commencement and keep operating under relief while ASIC assesses them. ASIC has published a roadmap for that transition. Confirm the exact dates against the legislation and ASIC.

 

What It Means for Everyday Investors

Most people will not need to do anything except make better choices about where they hold crypto. Once the regime bites, licensed platforms should be held to clearer standards on custody, disclosure and complaints, while unlicensed ones will find it harder to serve Australians. Until then, you can look for signs of quality yourself, starting with whether a platform meets crypto licensing requirements and understanding licensed and unlicensed platforms. A list of the best exchanges in Australia compares the main options. A simple test is to ask three questions of any platform: who holds my assets, what happens if the company fails, and who can I complain to. If the answers are vague, treat that as a warning sign.

 

What Regulation Does Not Do

Regulation lowers risk, but it does not remove it. A licence does not guarantee a platform will survive, that its assets will hold their value or that you will be compensated if something fails. Crypto prices remain volatile, hacks still happen and platforms can still collapse, with real tax consequences when a crypto exchange collapses. Keep doing your own checks, including whether a platform publishes proof of reserves, and understand the custodial risk that comes with leaving assets on a platform.

 

Custody, Self-Custody and DeFi

The new rules are aimed at platforms that hold assets for others. Holding your own crypto in a wallet you control is not something the framework licenses, and using a decentralised protocol without an operator is a grey area that regulators are still working through. The trade-offs run through custodial and non-custodial wallets and centralised and decentralised exchanges. If you self-custody, self-custody security matters most, and DeFi tax applies whether or not a platform is regulated.

 

Crypto ATMs

Crypto ATMs, or Bitcoin ATMs, have been a particular focus for AUSTRAC because of their use in scams. Reports in 2025 and 2026 describe tighter rules, including cash limits on transactions, scam warnings on machines and enforcement action, with one operator’s registration reported as suspended in 2026. The rules may change again, so check the latest position if you use one. Anyone asked to use one by a stranger, a new online friend or a supposed official is almost certainly being scammed.

 

Stablecoins

Stablecoins sit at an awkward intersection of payments, money and investment rules, and the way they are regulated is still developing. The tax treatment of stablecoins in Australia is clearer than the licensing treatment. Because the regulatory position can change, treat any stablecoin’s promise of safety cautiously and check who issues it and how it is backed.

 

Crypto ETFs, SMSFs and Institutional Access

Regulation also determines how crypto can be reached through traditional structures, such as exchange-traded products, self-managed super funds and large trades through OTC desks. These routes come with their own compliance requirements, and the protections differ from those you have when you buy and hold crypto directly, so professional advice is worth having.

 

Businesses That Accept Crypto

If you run a business that takes crypto payments, additional obligations apply, including GST on crypto payments, record keeping and, depending on what you do, AUSTRAC and licensing questions. Broader trends are visible in crypto adoption in Australia.

 

Scams and Recourse

Regulation helps most when something goes wrong, but scammers do not follow it. Learn to avoid crypto scams, know how to report a crypto scam and understand what recovering from a scam involves. A licensed platform may give you a formal complaint pathway, while dealing with an unlicensed one offshore often leaves you with very few options. Whatever happens, keep screenshots, transaction IDs and messages, since they make it easier for regulators and police to act.

 

How Australia Compares Globally

Australia is one of many countries moving from guidance to legislation, and the way countries approach crypto regulation differs widely. Some jurisdictions license platforms, others focus on stablecoins or restrict activity. Central bank digital currencies are a separate policy track, reflected in Australia’s view on CBDCs.

 

Why the Rules Changed

The push for legislation came from a pattern that repeated around the world: platforms that held customer assets with little oversight, marketing that blurred the line between education and a sales pitch, and failures where customers discovered too late that their crypto was not segregated from the company’s own money. Regulators concluded that guidance was not enough for businesses that effectively act like banks or brokers for digital assets. The new framework is designed to close that gap by applying familiar financial services principles, such as licensing, disclosure and client asset protection, to crypto platforms, without trying to regulate the underlying blockchains themselves.

 

Using Overseas Platforms

Many Australians use platforms based overseas, sometimes because of lower fees or a larger selection of coins. That is legal for the customer in most cases, but it changes your risk. An overseas platform may not be registered with AUSTRAC or licensed in Australia, may not have local dispute resolution, and could be hard to pursue if something goes wrong. As the licensing rules take hold, some overseas platforms may restrict Australian customers or leave the market, which could force you to move funds at short notice. If you use one, check what it says about serving Australians, keep only the amounts you need on it, and never use a workaround such as a VPN to get around a restriction, since that can lead to frozen funds.

 

A Practical Checklist for Australians

Check the platform: is it registered with AUSTRAC, and does it hold, or is it applying for, the right licence?

Understand where your assets sit: a platform holding them for you brings custody risk that self-custody does not.

Keep records: the ATO expects you to keep crypto tax records of every transaction.

Report correctly: follow ATO crypto reporting rules and, if you receive an ATO crypto letter, deal with it promptly.

Get help when it is complicated: a crypto tax accountant can help, and it is worth choosing one carefully.

 

What to Watch Next

Several things are worth following over the coming year: the transition timetable under the new Act and ASIC’s guidance on it, AUSTRAC’s implementation of the travel rule and its approach to high-risk services such as crypto ATMs, the ATO’s data matching and any tax changes, and the treatment of stablecoins and tokenised assets. Because the details are still being settled, treat this guide as a snapshot and check the regulators’ own pages before you make decisions that depend on the exact rules.

 

Key Takeaways

Australian crypto regulation now has three layers. The ATO deals with tax and reporting, AUSTRAC with anti-money laundering and identity checks, and ASIC with financial products and platforms, with the Digital Assets Framework Act 2026 bringing platforms that hold customer crypto into the licensing system on a transition that runs into 2027. As an everyday investor you are not licensed, but your choice of platform, your records and your tax reporting are all affected.

Regulation improves the odds but does not protect you from bad markets, hacks or scams. Use licensed and registered platforms where you can, understand where your assets are held, keep complete records, watch for changes in the rules and confirm the details with the regulators or a qualified adviser before relying on anything you read here, including this guide.