Australia’s financial intelligence agency has suspended Cryptolink’s crypto ATM operations for three months after finding failures in transaction reporting and raising ongoing concerns over the company’s handling of high-risk activity.
Summary
- Cryptolink’s 96 Bitcoin ATMs have been suspended for three months over compliance concerns.
- AUSTRAC cited failures involving threshold transaction reports and an unanswered information request.
- Cryptolink previously paid a A$56,340 penalty after alleged reporting and risk assessment failures.
- Australia has tightened crypto ATM controls after authorities linked the machines to scams and money laundering risks.
According to the Australian Transaction Reports and Analysis Centre, Cryptolink’s registration as a virtual asset service provider was suspended from Aug. 9, preventing the company from operating its 96 Bitcoin ATMs during the three-month period.
AUSTRAC CEO Brendan Thomas said the regulator remained concerned about Cryptolink’s ability to manage high-risk transactions through its crypto ATMs. The latest action follows an enforceable undertaking imposed on the operator in October 2025 over separate compliance failures identified by the agency’s Cryptocurrency Taskforce.
Cryptolink operates machines that allow customers to exchange cash for Bitcoin, with most of its 96 Australian ATMs located in major cities including Sydney, Melbourne and Brisbane.
Cryptolink crypto ATMs suspended over reporting failures
In outlining the reasons for the suspension, AUSTRAC said Cryptolink had failed to meet basic reporting requirements, particularly its obligations involving threshold transaction reports.
The company also failed to respond to an information request from the regulator, according to AUSTRAC.
“As part of our continued focus on digital currency as a money laundering risk, AUSTRAC has ongoing concerns about the company’s ability to manage high-risk transactions through its CATMs,” Thomas said.
Cryptolink had already been subject to regulatory action before the suspension. In October 2025, the company entered into an enforceable undertaking with AUSTRAC after the agency’s Cryptocurrency Taskforce identified alleged breaches involving late transaction reporting and shortcomings in its risk assessments.
AUSTRAC also issued Cryptolink an infringement notice worth A$56,340 as part of the earlier enforcement action. The company subsequently paid the penalty.
The three-month registration suspension now prevents Cryptolink from providing the registered virtual asset services covered by the order, effectively taking its Australian Bitcoin ATM network offline for the duration of the suspension.
Australia has tightened controls on crypto ATMs
Cryptolink’s suspension comes after more than a year of regulatory scrutiny of Australia’s crypto ATM sector, which has expanded rapidly while attracting attention from financial crime authorities.
Australia has the largest crypto ATM market in the Asia-Pacific region. Speaking at the National Press Club in Canberra in October 2025, Home Affairs Minister Tony Burke said the number of machines had increased from 23 six years earlier to about 2,000.
Burke said Australia had become the world’s third-largest crypto ATM market at the time, while authorities had linked some activity involving the machines to scams, fraud, money laundering, illicit drug transactions and other criminal activity.
Citing AUSTRAC data, Burke said 85% of funds passing through crypto ATMs among the highest-volume users were associated with scams or money mules.
AUSTRAC had started increasing its scrutiny of operators months earlier. In March 2025, the agency warned crypto ATM providers about compliance with Australia’s anti-money laundering rules before conducting targeted investigations into the sector.
By June, the regulator had introduced a A$5,000 cash transaction limit for crypto ATM deposits and withdrawals. Operators were also required to conduct stronger customer due diligence and place scam warnings at their machines.
At the time, Thomas said the conditions were intended to protect consumers from scams while reducing the ability of criminals to exploit crypto ATM businesses.
Crypto ATM scams have caused millions in losses
Authorities have also documented cases in which scammers directed victims to crypto ATMs to transfer money.
Tasmania Police reported in July 2025 that 15 victims had lost an estimated A$2.5 million through scams involving crypto ATMs. The average victim was 65 years old and lost about A$165,000, while one person lost A$750,000.
Detective Sergeant Turner said some victims suffered consequences that affected retirement plans and forced them to sell assets before relying on social support payments.
Police identified romance scams, investment fraud, impersonation of government authorities and technology support scams among the methods used against the victims. In such cases, fraudsters persuaded or pressured victims to deposit cash at crypto ATMs and send the resulting digital assets to wallets controlled by the scammers.
The transfers created an additional problem for victims because cryptocurrency transactions sent to a scammer-controlled wallet generally cannot be reversed through the mechanisms available for some traditional financial transfers.
Australia’s response stopped short of the approach adopted across the Tasman Sea. New Zealand announced a ban on crypto ATMs in June 2025 as part of measures intended to prevent criminals from converting illicit cash into digital assets.
Australian authorities instead moved toward tighter limits, customer checks and regulatory supervision of operators.
AUSTRAC has expanded crypto transfer requirements
Regulatory requirements for Australian crypto businesses have continued to develop outside the ATM sector as well.
From July 1, 2026, Australia’s crypto travel rule introduced additional data requirements for virtual asset transfers handled by regulated businesses. AUSTRAC’s framework covers services including crypto-to-fiat and crypto-to-crypto exchange, virtual asset transfers, custody and certain services connected with token offerings.
Under the regulator’s guidance, businesses handling covered transfers must collect, verify and transmit specified information about the parties involved in a transaction.
For transfers involving self-hosted wallets, AUSTRAC requires the sending institution to determine whether the receiving wallet is custodial or self-hosted. While information does not have to be passed to another institution when no other regulated intermediary exists, the business must still collect and verify payer information and obtain relevant payee and tracing information.
The requirements apply alongside Australia’s existing financial intelligence reporting system. AUSTRAC previously said it received more than 2 million threshold transaction reports and more than 450,000 suspicious matter reports during the preceding reporting period.
Cryptolink’s reporting practices had already drawn regulatory attention months before the latest suspension, with the October 2025 enforceable undertaking requiring the company to address deficiencies identified by AUSTRAC’s Cryptocurrency Taskforce.
The company paid the associated A$56,340 infringement notice, while its latest three-month VASP registration suspension took effect on Aug. 9.
