Australia’s virtual asset sector is running out of time to meet incoming compliance requirements. From 1 July 2026, the AUSTRAC Tranche 2 reforms extend Australia’s anti-money laundering and counter-terrorism financing compliance requirements to a wider range of virtual asset services.
This includes replacing the concept of “digital currency” with a broader “virtual asset” definition, defined under the AML/CTF Amendment Act 2024. The reforms will very soon apply to crypto-to-crypto exchanges, custodial wallet services, virtual asset transfers, and related financial services.
Affected virtual asset service providers, therefore, have weeks to meet the obligations that come with the change, if they haven’t already done so. The reforms are substantial, as they direct who must register with AUSTRAC, how businesses assess and monitor risk, and what they should report and retain.
Existing digital currency exchanges cannot assume that their current registration covers the newly regulated services either, and offering a designated service, minus the right registration in place, is tantamount to a criminal offence.
With the deadline encroaching, it is a top priority for the affected firms to get a clear view of what AUSTRAC Tranche 2 requires and the quickest route to meet compliance.
What do virtual asset service providers need to know?
Everything You Need to Know About AUSTRAC Tranche 2
Australia builds its oversight of virtual asset businesses through the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, which the financial intelligence agency AUSTRAC administers.
From 1 July 2026, the Tranche 2 reforms pull a wider range of virtual asset services into the regulated net and rework how providers report and monitor activity.
How to Quickly Comply With AUSTRAC Tranche 2
With the 1 July 2026 deadline only weeks away, most virtual asset service providers have likely cleared the first two stages of compliance: mapping their designated services, preparing AUSTRAC enrolment details, running enterprise risk assessments, and drafting policies proportionate to those risks.
What is next is the third stage, involving implementation and training.
Stage Three: Implement and Train
At this stage, the virtual asset service provider has to build and switch on the systems that screen customers against sanctions lists, monitor transactions for unusual activity, identify which relationships carry higher risk, and escalate alerts for investigation as they surface.
Onboarding comes first to verify each customer’s identity, be it individuals or businesses. Higher-risk cases, such as a politically exposed person or businesses tied to a high-risk jurisdiction, may require source-of-funds information and senior management sign-off before the relationship goes ahead.
The same systems carry another duty. The crypto service provider must collect and transmit originator and beneficiary information whenever the provider sends virtual assets to another regulated provider. The obligation mirrors FATF Recommendation 16, known as the crypto Travel Rule.
Notably, AUSTRAC does not mandate any particular technology. A control can be automated or manual, so long as it stays proportionate to the risks the business faces. While many providers lean on blockchain analysis tools to support monitoring, the law cares about outcomes rather than any named software.
Two governance steps complete the stage. The provider appoints a designated compliance officer at the management level to own AML/CTF compliance and act as the liaison with AUSTRAC, a role that needs real authority, access to information and organisational independence. It then trains staff so the controls hold up day to day.
Making the right call in your verification and monitoring partner is imperative. Sanctions lists shift, transaction volumes climb, customer risk profiles change, and travel rule information has to move reliably between counterparties.
A partner that brings onboarding, screening, transaction monitoring and case escalation into one connected workflow lets you keep your AML/CTF controls consistent as the business scales.
The Travel Rule Is the Hardest Part to Operationalise
The Travel Rule is possibly where most providers find the implementation gap widest. Two issues take prime focus space: interoperability and unhosted wallets.
Travel Rule Interoperability Needs
Firstly, Travel Rule may be global in principle, but is fragmented in practice. AUSTRAC, for example, sets the obligation to exchange originator and beneficiary data without mandating how that data should move.
The result is a patchwork of competing protocols, none universally adopted, and a “sunrise” problem in which jurisdictions switch on their rules at different times.
When a sending and receiving provider sits on incompatible systems, the transfer stalls or fails outright, which can lead to a compliance breach.
The workable answer is protocol-agnostic coverage. Sumsub, for one, aggregates the major Travel Rule protocols like Code, GTR, Sygna, TRP and its own across a network of 2,100+ VASPs, with a secure email fallback for counterparties that cannot otherwise be reached.
Unhosted Wallets Verification
The next challenge involves unhosted wallets. FATF asks providers to distinguish between hosted wallets, managed by a third party such as an exchange, and unhosted wallets, controlled directly by the holder.
For transfers to an unhosted wallet, the originating VASP may not be required to transmit data onward, but it is still expected to collect, verify and run the necessary checks, which means establishing who actually controls the wallet.
That is trickier, since the counterparty has passed no KYC and answers to no custodian. The ideal fix is to ask the holder to prove control: either by signing the transaction with their private key, or by sending a token microtransaction, called the Satoshi test, from the unhosted wallet in question.
Beyond satisfying the Travel Rule itself, by verifying unhosted wallets, a virtual asset service provider can demonstrate control over even its hardest-to-trace transfers. This, in turn, reduces its exposure risk to fraud and signals to customers that the platform takes the integrity of their funds seriously.
How to Pick the Ideal Verification Partner
With a short window of time left, many VASP firms can still meet the deadline by quickly selecting a verification partner. Choosing a verification partner is critical, as they will sit across onboarding, monitoring, and reporting with you.
The strongest candidates pair smooth, user-friendly onboarding with AI-driven transaction monitoring, backed by comprehensive regulatory experience in crypto know-your-customer (KYC) compliance.
Look for a partner that supports the travel rule and offers a full-cycle verification platform, spanning the entire customer lifecycle from onboarding to monitoring and reporting.
Demonstrated familiarity with FATF guidance is another strong signal, as is a clear grasp of the risks specific to the crypto space.
Eugene Choo, Senior Business Development Manager, Sumsub, said during the webinar:
Many believe that addressing Tranche 2 requires a highly specialised, elusive solution. In reality, Tranche 2 is an extension of existing AUSTRAC mandates. For compliance providers familiar in this space, this isn’t uncharted territory—it’s a continuation of the infrastructure we’ve always provided. Our platform is built to seamlessly adapt the moment regulators revise their standards.
Sumsub is built around this full-cycle model, and that too at scale. Its platform supports global onboarding across more than 14,000 document types in over 50 languages, then adapts to risks, regulations, and market demands, such as AUSTRAC Tranche 2.
More than 4000+ companies worldwide rely on Sumsub’s technical expertise, including global fintech companies like Reap, payment infrastructure providers like BVNK, and the Interpol.
For a practical walkthrough of preparing ahead of the 1 July deadline, sign up for Sumsub’s on-demand AUSTRAC Tranche 2 webinar. If you prefer to move right away, book a demo with Sumsub to start building your compliance setup today.
Featured image edited by Fintech News Singapore based on an image by f11photo on Magnific
