Discover the latest risk insights to be aware of if you’re a virtual asset service provider.

On this page

From 1 July 2026, anti-money laundering and counter-terrorism financing (AML/CTF) obligations apply to virtual asset service providers (VASPs). 

As part of these obligations, you need to conduct a money laundering and terrorism financing (ML/TF) risk assessment and know what suspicious activity to look for with your customers. The following suspicious activity indicators will help you to identify potential ML/TF, as well as other serious criminal activities. 

This page provides an overview and does not cover every risk, or every product or service, relevant to virtual asset service providers. 

You must consider information we’ve communicated to you that’s relevant to your money laundering, terrorism financing and proliferation financing risks.

This information will help you to:

  • understand money laundering risks in your sector
  • inform your ML/TF risk assessments
  • strengthen your AML/CTF policies
  • identify suspicious activity. 

Background

Our money laundering national risk assessment found VASPs pose a high money laundering risk in Australia and our terrorism financing national risk assessment found virtual assets were being used to finance terrorist activity. 

While our risk assessment on proliferation financing identified no specific risks for VASPs, your awareness of these risks is essential. This page focusses on the money laundering and terrorism financing risks for VASPs.

Who may exploit your services

Australians are often the target of overseas scams, cybercrime and ransomware attacks. These proceeds of crime are then laundered before being moved offshore. 

Cryptocurrency ATMs and using virtual assets for overseas remittance make the system more vulnerable.

Violent extremists across the ideological and religious spectrum in Australia are increasingly using virtual assets. For some, they’re a key channel to move and store funds. 

Australian authorities have detected: 

  • low-value virtual asset transfers directly from local entities to digital wallets controlled by offshore terrorist organisations
  • privacy coins and stablecoins are popular at times of market volatility. 

Other virtual asset services likely to be exploited for terrorism include:

  • peer-to-peer (P2P) traders within overseas or decentralised VASPs, to hide the money source and destination
  • cryptocurrency ATMs to convert cash to virtual assets
  • mixer services to distance the wallet holder and source of funds.

Criminals are attracted to VASPs because they: 

  • offer speed and global reach – transactions are almost instant and irreversible, making it challenging to detect and stop illicit use
  • move money overseas with low visibility.

Providing designated services

The term virtual asset service providers (VASPs) used here describes individuals or businesses providing designated services for customers. 

VASPs include businesses offering exchange services between fiat currency and virtual assets. Transactions can also include different virtual asset types.

Main risks

The 4 areas of money laundering risks are: 

Kinds of customers

A sector’s size and its customers’ risk profile affect its overall ML/TF vulnerabilities. Recent data suggests that 17% of Australians have traded in virtual assets. That’s 3.6 million people. 

Your professional services are an easy target for a range of illegal activities. You should consider a range of factors when assessing customer risk when working with: 

  • known or suspected criminals
  • non-residents, especially from high-risk jurisdictions
  • politically exposed persons (PEP), because of exposure to fraud, bribery, corruption and links to high-risk jurisdictions. You must always treat foreign PEPs as high-risk customers
  • customers you have limited face-to-face interaction with
  • customers connected to industries with higher ML/TF risks, including but not limited to those identified in Australia’s national risk assessments
  • customers where the business structure or relationship makes it difficult to identify the true beneficial owner
  • customers from high-risk countries identified as involved in corruption, organised crime or serious fraud.
  • customers from high-risk countries providing funding, support or have known terrorist organisations operating within them
  • customers on Australian or United Nations Security Council targeted financial sanctions lists or those who are are close associates of entities on these lists.   

We expect you to understand and assess your customer’s ML/TF risks. We also expect you to have appropriate systems and controls to manage and mitigate these risks. 

This includes:

  • having robust customer due diligence (CDD) and enhanced CDD
  • both on-chain and off-chain (traditional) transaction monitoring processes
  • assessing the risk of your customer’s location.

Kinds of services

Your professional services are an easy target for a range of illegal activities. You handle cash and provide products and services that allow the transfer and store of value. 

Transfer of value

Your services offer speed, global reach and anonymity. You can help criminals with fund flows to and from foreign jurisdictions with low visibility. 

Money laundering through virtual assets includes using: 

  • mixers and tumblers
  • offshore providers
  • peer-to-peer (P2P) trades
  • over-the-counter brokers.

These processes make it difficult to tell what’s legitimate and what’s not. You may not realise you’re helping criminals. 

Cryptocurrency ATMs

Cryptocurrency ATMs are at high risk of criminal exploitation and money laundering.

Crypto ATMs may also be in businesses considered high-risk, such as:

  • convenience stores
  • tobacconists
  • remitters
  • pawn shops. 

Criminals can easily buy virtual assets through them with cash made from crime. 

Learn more about frauds and scams involving crypto ATMs

If you’re a remittance service provider with crypto ATMs you’re at particular risk, as your services combines 2 high-risk channels.

Store of value

Virtual assets are accessible and anonymous making them a prime target for money launderers. However, these assets can lose value due to market volatility. Additionally, blockchain transactions are visible to anyone using them. 

Criminals in Australia prefer more stable services provided by banks and remittance services. 

Stablecoins

Criminals favour stablecoins to store value on the blockchain, as they hold their value. Algorithmic stablecoins may appeal for long-term investing, but criminals favour asset-backed stablecoins for laundering money.

Non-fungible tokens 

Non-fungible tokens (NFT) are an investment that risks criminal exploitation. However, there is little evidence of criminals using them in Australia. 

Cold wallets

Criminals use cold wallets to store assets off the blockchain. These wallets can hide assets without connection to a regulated VASP, which authorities can easily monitor. 

Delivery channel risk

Delivery channel risk refers to how you onboard and provide services to customers. 

Your services rely on online transactions through websites and mobile apps. There’s limited or no face-to-face interaction with customers. This increases your risk of: 

Cash transactions mean you’re at greater risk of being exploited for money laundering. VASPs accepting cash, and those with crypto ATMs, have an even higher cash-related risk. 

VASPs use secure couriers to move cash generated by crypto ATM services. This outsourcing can create ML/TF risks by extending and complicating your delivery chain. Poor governance can worsen this risk. 

Foreign jurisdiction risk

You may deal with customers, transactions and activities with links in foreign jurisdictions. Exposure to foreign jurisdictions creates ML/TF risks. It provides opportunities: 

  • for illicit funds to move overseas that are the proceeds of crime committed in Australia
  • to fund terrorist activity or proliferation of weapons of mass destruction
  • for the proceeds of foreign money laundering to be brought into Australia. 

International transactions can: 

  • add complexity
  • hide beneficial ownership and the true customer
  • increase the risk of tax evasion
  • make it harder for authorities to investigate or prosecute alleged criminal activity.

The virtual asset market is complex and ‘borderless’, as assets aren’t tied to a country or currency. Factors that increase ML/TF risks include links to a country:

  • with weak governance or AML/CTF regulations, or that is a tax haven or secrecy jurisdiction
  • with high rates of corruption, tax evasion, or other serious crime
  • subject to Australian sanction laws or similar restrictive measures. This includes countries believed high-risk or non-cooperative by the Financial Action Task Force (FATF)
  • financing or supporting terrorist acts, or associated with a terrorist organisation engaged in proliferation of weapons of mass destruction, or a country used for diverting funds for proliferation financing
  • in a conflict zone
  • known for people trafficking. 

The lists on this page aren’t exhaustive. You should consider other indicators specific to your business’s individual risk profile and circumstances.

This guidance sets out how we interpret the Act, along with associated Rules and regulations. Australian courts are ultimately responsible for interpreting these laws and determining if any provisions of these laws are contravened. 

The examples and scenarios in this guidance are meant to help explain our interpretation of these laws. They’re not exhaustive or meant to cover every possible scenario.

This guidance provides general information and isn't a substitute for legal advice. This guidance avoids legal language wherever possible and it might include generalisations about the application of the law. Some provisions of the law referred to have exceptions or important qualifications. In most cases your particular circumstances must be taken into account when determining how the law applies to you.

Last updated: 16 Oct 2025
Page ID: 1369

Was this page helpful?

Was this page helpful?
Please note that feedback you provide here will be used only for the purpose of improving our website. If you have a specific question about your AML/CTF obligations, please contact us.