AUSTRAC has refused to renew a crypto ATM operator’s registration and placed operating conditions, including transaction limits, on other Australian crypto ATM providers.

The conditions come after an AUSTRAC taskforce flagged worrying trends in crypto ATM compliance.

AUSTRAC CEO Brendan Thomas said over several months, the taskforce observed customer activity that bears the hallmarks of scams, fraud, and other illicit activity.

“The taskforce has uncovered disturbing trends which have confirmed that cryptocurrency ATMs are being used for scam/fraud-related transactions,” Mr Thomas said. 

“Surprisingly, the 60 to 70 age group were identified as the one of the most prolific users of crypto ATMs in Australia.

“It is a huge concern that people in this demographic are over represented as customers using cash to purchase cryptocurrency and, as evidence suggests, that a large number of 60-70 year old users are victims of scam activity.”

AUSTRAC’s Cryptocurrency Taskforce obtained data from 9 crypto ATM providers showing that the majority of crypto ATM users are over 50 years of age and account for almost 72 per cent of all transactions by value - 60-70 year olds alone accounted for 29 per cent of all transactions by value. 

AUSTRAC is now working with law enforcement partners and crypto ATM providers on strategies to address suspicious activity.

“As part of AUSTRAC’s work to protect the financial system from criminal abuse, we’ve placed a number of conditions on crypto ATM operators, including a $5,000 limit on cash deposits and withdrawals, enhanced customer due diligence obligations, mandatory scam warnings, and requirements for more robust transaction monitoring.”

“The conditions are designed to help protect individuals from scams by deterring criminals from directing them to a crypto ATM, as well as to protect businesses from criminal exploitation.”

“In light of the risks and harms we consider it is absolutely necessary to ensure the sector meets minimum standards and reduces the criminal misuse of crypto ATMs.”

“We will keep the effectiveness of these conditions under review, and adjust if needed.”

While the $5,000 cash limits only relate to crypto ATM providers, AUSTRAC expects digital currency exchange providers to consider imposing similar limits if they accept cash for crypto transactions. 

“This will reduce their exposure to money laundering, terrorism financing and other serious crime risks.” 

The AFP-led JPC3* has developed educational materials, which are being placed close to crypto ATMs to educate potential victims on scams, including information on how they work, warning signs, and how to report and seek help.

Also off the back of the taskforce, AUSTRAC refused to renew the registration of crypto ATM operator, Harro’s Empires, after exhibiting ongoing risks that its CATMs could be exploited.

“This action draws a clear line in the sand and serves as a warning to other digital currency exchange providers that aren’t meeting their responsibilities under the AML/CTF Act.”

In just two years, the number of crypto ATMs in Australia increased more than 15 times, from just 23 operating in 2019, 60 in 2022, to more than 1,200 in 2024. There are now upwards of 1,800 active crypto ATMs.

AUSTRAC has projected that almost 150,000 transactions occur annually, with about $275m being moved using crypto ATMs. The vast majority of those transactions - about 99% - are cash deposits for the purchase of cryptocurrencies, mostly Bitcoin, Tether and Ethereum.

“Crypto can be a high risk investment, but people who consider and are willing to accept those risks may find them a convenient vehicle for investment, said Mr Thomas.”

“However, I would warn anybody who is asked to use one of these machines to send funds to someone to stop and think twice, as once your money is gone it is almost impossible for authorities to retrieve it.”

“AUSTRAC will continue to monitor this space and we will take more action if needed, where and when we see harm occurring.”

If you have concerns you may have fallen victim to a scam or fraud, do not transfer any more funds. Report it to police via ReportCyber and to Scamwatch to help others avoid similar scams.

*JPC3 - Joint Policing Cybercrime Coordination Centre. An AFP-led centre designed to combat cybercrime by facilitating collaboration between law enforcement and intelligence services.