AUSTRAC registration for an overseas virtual asset business

The group is comparing two arrangements. In the direct operation, an Australian company contracts with users and provides the exchange, transfer and custody service. The Mauritius company may supply development, monitoring or other support under an agreement. Its own role still needs classification, particularly if its personnel control assets or execute instructions.

In the restricted technology arrangement, an existing Australian provider contracts with users and operates the service. The Mauritius company supplies specified software and support. Design this option so that the supplier cannot accept customer transfer instructions, arrange exchanges, move assets or alter production signing permissions. These are recommended limits for this particular supplier model; merely calling a service technical does not establish an exemption.

For either arrangement, record who sets prices, accepts orders, receives fiat, controls each wallet, approves withdrawals and handles recovery. Include shared signing powers, administrator credentials and emergency overrides. The contracts and the working system must describe the same allocation.

First, identify whether the asset meets the statutory virtual asset definition. Its rights and functions matter, including the exclusions in s 5B of the AML/CTF Act. Then map each function against the designated services in s 6(2), table 1:

• Exchanging or arranging exchange between money and virtual assets falls within item 50A; exchange between virtual assets falls within item 50B.
• Safekeeping falls within item 46A. The definition reaches control or management of assets or private keys for a customer, including through an intermediate contractual arrangement.
• Accepting a payer's transfer instruction and making transferred value available to the payee are different roles under items 29 and 30. An intermediary passing transfer messages may provide item 31.
• Item 50C concerns another designated service supplied in connection with an offer or sale of virtual assets. It does not classify every token issue or software project by itself.

The exchange, custody and issuance-related items contain business conditions. Items 29 and 30 are registrable virtual asset services when the transfer includes virtual assets, subject to the statutory exclusions. Item 31 does not itself become a registrable virtual asset service, although other AML obligations may arise. Assess remittance registration separately where the design includes money transfers. (AML/CTF Act, s 5, definition of registrable virtual asset service; ss 6, 63A, 76A.)

Next, apply the geographical link to each provider. The ordinary alternatives cover service through the provider's Australian permanent establishment, or through a foreign permanent establishment where the provider is Australian resident or a subsidiary of an Australian resident company. The Act supplies its own residence and permanent establishment tests. A business location or agent can matter; an Australian customer's address alone does not establish every element. (AML/CTF Act, ss 6(6), 14, 21.)

An Australian operating subsidiary will need its own assessment. Its incorporation does not automatically make its Mauritian parent the same provider or transfer the subsidiary's registration upstream. Conversely, keeping the contract offshore does not resolve activities conducted through Australian personnel or agents.

Check a further branch if the supplier operates a network through which others provide transfer services. Item 32A has different treatment, including an exception to the ordinary geographical-link requirement. The exclusion for infrastructure that solely enables transfer messages is narrower than a general software-provider exemption. (AML/CTF Act, ss 6(6), 63A(10)(a).)

The decision sequence is therefore: identify the asset, identify the service and provider, test geography and exceptions, then determine registration and ongoing obligations. Record a separate result for each company.

Apply the sequence to each company:

1. Service: If its actual conduct meets a listed service, continue to the scope test. If it does not, check other designated services before concluding that AUSTRAC obligations do not arise.
2. Network branch: If item 32A applies, assess its separate registration and geographical treatment. The ordinary test below does not apply to that item.
3. Ordinary geographical branch: If the service is provided at or through the company's Australian permanent establishment, the link is met. Otherwise, it must be provided through the company's foreign permanent establishment and the company must be Australian resident or a subsidiary of an Australian resident company. If neither route applies, the ordinary link is absent.
4. Obligation branch: If the service meets the definition of a registrable virtual asset service and the required link, with no applicable exclusion, a new November entrant needs effective registration as a virtual asset service provider (VASP) before launch. If only item 31 applies, assess enrolment and the applicable AML obligations; that item alone does not require VASP registration.

The Australian company should enrol through AUSTRAC Online and apply for the relevant VASP registration. Enrolment, application and effective registration are distinct steps. A new applicant must wait until registration takes effect before providing the registrable service. Check any conditions in the decision. (AML/CTF Act, ss 51B, 76A, 76D–76E.)

The transition does not provide a new November application with permission to operate pending approval. Section 14 of the Transitional Rules ties its relevant concessions to applications made no later than 29 July 2026 and other conditions. A provider relying on an earlier application must demonstrate that it satisfies those conditions; the concession is not transferable to a new applicant merely by contract.

Do not promise approval within 90 days. The statutory period runs from the latest relevant application, information-response or submission date. AUSTRAC can extend it by up to 30 days in specified circumstances. Failure to decide within the applicable period ordinarily produces a deemed refusal, not approval. (AML/CTF Act, s 76D(4)–(5).)

Prepare ownership and control records, beneficial-owner identification, key personnel histories, foreign permissions, service locations, banking information and outsourcing arrangements. Explain the assets supported, expected activity, wallets controlled and the sources of customer deposits and withdrawals. The risk assessment and policies must fit that operating model. AUSTRAC assesses operational readiness, resources and relevant risks; a generic policy pack will not establish those facts. (AML/CTF Rules 2025, ss 4-4–4-9, 4-14–4-15.)

AUSTRAC VASP registration does not authorise a financial services business. Assess the token, the complete customer arrangement and each service under the Corporations Act 2001, ss 763A–765A, 766A–766E and 911A. Payment functionality, investment returns, derivatives and custody of financial products can change the answer. A trading or settlement facility may also require a separate permission. (Corporations Act, ss 767A, 791A, 768A, 820A.) Offshore solicitation has its own financial-services test under s 911D.

The High Court's 2026 Block Earner decision illustrates why the complete arrangement matters. It held the Earner product to be a financial investment and a derivative, reversing the material 2025 appellate outcome. That conclusion concerned the product's actual terms; it did not classify every crypto asset alike. (ASIC v Web3 Ventures Pty Ltd [2026] HCA 21, [39]–[44], [56], [61]–[75].)

The Digital Assets Framework is enacted. It introduces digital asset platforms and tokenised custody platforms as financial product categories from 8 April 2027. Its six-month transition, and extension for qualifying applications lodged by 7 October 2027, concern the new amendments. They do not suspend existing licensing requirements. Assess the defined platforms and any exemption against the proposed facts. As at 4 November 2026, ASIC's October consultation standards remained proposals. (Digital Assets Framework Act, s 2; sch 1 items 1–2, 67, 98, inserting ss 761GB–761GD and 1730–1733; ASIC CP 392, pp 5–6, [45].)

A new November business also cannot assume access to ASIC's separate class no-action position. The updated letter required relevant steps by 30 September 2026 and imposed an earlier-service condition. Eligible timely applicants may retain conditional protection while awaiting a decision. This policy is distinct from a licence and from the 2027 statutory transition. (ASIC class no-action letter, 25 June 2026, paras 1, 5–7.)

For an Australian proprietary subsidiary, provide at least one director ordinarily resident in Australia and an Australian registered office. A foreign company operating directly must instead assess the foreign-company registration provisions, including their pending-application exception, local-agent and office requirements. Neither route settles the AUSTRAC or ASIC analysis. (Corporations Act, ss 142, 201A(1), 601CD, 601CF–601CG, 601CT.)

An AML/CTF compliance officer must be fit and proper and have management-level authority, competence, independence and resources. Australian residence is required where the reporting entity provides designated services through an Australian permanent establishment. The officer may be employed or engaged. The governing body retains oversight, and a senior manager must approve the risk assessment and policies. Appointing and preparing these people before the application and launch is the recommended sequence, even though the Act contains specific designation and notification time limits. (AML/CTF Act, ss 26H–26P; AML/CTF Rules, s 5-14.)

Development, support and monitoring work can be allocated offshore if the applicable permissions, controls and data rules allow it. The Australian requirements above do not impose a universal rule that every employee, server or key must be local. The provider nevertheless needs access to records, authority over outsourced decisions and people capable of challenging exceptions.

Outsourced performance leaves the reporting entity responsible. Distinguish an agent performing its procedures from statutory reliance on another institution's customer checks. A foreign licence or group relationship does not by itself satisfy the reliance conditions. (AML/CTF Act, ss 37–38.)

The AML/CTF programme must address money laundering, terrorism financing and proliferation financing risks. Customer onboarding should establish the required identity and beneficial-ownership information, risk classification and purpose of the relationship. Build ongoing monitoring, enhanced diligence and escalation into the service. Any use of the transitional identification procedures requires the prescribed conditions and migration planning; it does not postpone ongoing risk management. (AML/CTF Act, ss 26B–26F, 28, 30, 32; Transitional Rules, ss 7–8.)

For transfers, implement the Travel Rule according to the company's ordering, beneficiary or intermediary role. Capture and verify the required information, exchange it with the relevant institution and address missing or unreliable information. Establish whether the counterparty wallet is self-hosted or held by a custodian, and assess the custodian's licensing or registration position. The law prohibits specified transfers involving a custodian that requires permission but lacks it. (AML/CTF Act, ss 64–66A; AML/CTF Rules, pt 8.)

Self-hosted wallets need a distinct workflow. The absence of a receiving institution changes the information-passing obligation; it does not remove all customer checks or wallet diligence. A narrow initial-diligence exemption for certain occasional withdrawals below A$1,000 has cumulative conditions, including linked transactions. Do not turn it into a general exemption for small crypto transfers. (AML/CTF Rules, s 8-8(8); AML/CTF (Class Exemptions and Other Matters) Rules 2007, ch 4.)

Set reporting clocks in the case-management system. Suspicious matter reports normally require submission within three business days, or 24 hours for terrorism-related suspicion. Threshold reports concern qualifying cash transactions. Existing international funds transfer reporting continues where applicable during the transition. For virtual asset transfers, the new international value transfer and unverified self-hosted-wallet reporting obligations are deferred until 31 March 2029. That deferral does not postpone the Travel Rule. (AML/CTF Act, ss 41, 43; Transitional Rules, ss 9–11.)

Assign an owner for the annual compliance report and the different seven-year record-retention periods. The first reporting period under the AML/CTF Rules 2025 ends on 30 June 2027, with the report due within three months. Retain searchable customer, transaction and decision records even if a supplier changes. (AML/CTF Rules, s 9-9; AML/CTF Act, ss 107–111.)

The Mauritius company needs its own home-country analysis. Services conducted in or from Mauritius engage the Virtual Asset and Initial Token Offering Services Act 2021 (VAITOS Act). Match its actual functions to the licence classes: exchange, transfer, custody, issuance-related services and marketplace operation are separately described. Check the grant and conditions rather than infer permission from the group description. (VAITOS Act, ss 2–3, 7; second sch.)

A Mauritius VASP must maintain a physical office and be directed and managed from Mauritius. It must also have, at all times, a senior executive who is approved by the Financial Services Commission (FSC), is a natural person resident in Mauritius and is at least at senior management level. Changes to the scope of its business or legal structure require prior written FSC approval under s 13. The ancillary-services exclusion can support genuine technology supply, but not an unexamined assumption that an asset-control role is ancillary. Review public marketing and referral arrangements against the Mauritius solicitation provisions as well. The provision presumes that communications, advertisements or activities accessible to the general public target investors in Mauritius. (VAITOS Act, ss 3(2)(e), 10, 13, 15, 34A; third sch.)

If a Mauritius custodian places assets with an Australian subcustodian, the latter must hold an equivalent licence and be subject to equivalent regulation. The Mauritius custodian must notify the FSC of its equivalence assessment before deposit, exercise due diligence and conduct at least annual reviews, and have a written agreement. AUSTRAC registration alone does not demonstrate equivalent custody regulation. The Mauritius custodian retains responsibility. (Virtual Asset and Initial Token Offerings Services (Custody of Client Assets) Rules 2022, rr 2, 5(4), 10–11.)

Where the Mauritius company acts as an originating, beneficiary or intermediary VASP, its Mauritius transfer-information duties also apply. The Australian reporting transition does not postpone them. (VAITOS Act, s 19; Virtual Asset and Initial Token Offerings Services (Travel) Rules 2022, rr 3–6.)

Map customer-data access in both directions. Australian disclosure to a separate Mauritius recipient requires analysis under the Privacy Act and Australian Privacy Principle 8, including any available exception and continuing accountability. Small size does not automatically remove AML-related activities from coverage. Mauritius outbound transfers need a lawful s 36 basis; processor arrangements require the relevant written protections. Resolve safeguards and any authorisation requirement before production access. (Privacy Act 1988, ss 6E(1A), 16C, sch 1 APPs 6, 8, 11; Mauritius Data Protection Act 2017, ss 31(4), 35–36.)

Use five stages, with a named owner and an evidence condition at each stage.

1. Define the service. Legal and product leads should approve an entity and service map, token-rights schedule, customer terms and complete wallet-control diagram. Resolve which company provides each regulated function and which features must wait.
2. Verify the operator. Compliance should obtain the proposed partner's registration, conditions and any required Australian financial services licence (AFSL) authorisations. For the direct route, assemble the application and governance evidence. The Mauritius lead should produce the FSC permissions, conditions and required approvals.
3. Agree responsibilities. Legal and operations should settle service scope, customer contracting, permitted access, subcontracting, audit and regulator access, information delivery, reporting ownership, incident escalation, business continuity and exit. Allocate custody rights, reconciliation and asset return where relevant. Make missing permissions and controls conditions precedent to the affected service.
4. Test the allocation. Security and compliance should demonstrate that supplier accounts cannot exceed the agreed powers. Test recovery, withdrawal approval, incomplete Travel Rule messages, suspicious-activity escalation, reconciliation and retrieval of records. Record failures and retest the affected controls.
5. Authorise launch and changes. The accountable management team should check effective permissions, approved policies, trained personnel and completed tests. Maintain a register of conditions, renewals, report dates and proposed changes. Reassess new tokens, yield, payment functionality, customers, countries and signing powers before deployment.

A partner agreement must leave responsibility where the law places it. In ASIC v BPS Financial Pty Ltd [2025] FCAFC 74, [106]–[119], an authorised-representative agreement did not establish that the company supplied its own product as the licensee's representative. The facts defeated the claimed exception. Apply that discipline to both the documents and the operating system.

Choose the direct route where the group wants its Australian company to own and operate the customer service. Choose restricted technology supply only where the commercial arrangement can accommodate the limits described above. If the Mauritius supplier gains asset control, accepts orders or takes its own customer obligations, stop treating the original supplier assessment as sufficient and reclassify the role.

Before release, confirm six things: the actual provider is identified; every service and geographical link is mapped; current permissions are effective; the Mauritius role is permitted; customer data can lawfully move; and the controls match the contracts. A failed condition should delay the affected feature or require a narrower design.

The Australia licensing hub provides the wider jurisdiction context. For a different destination and custody structure, read Singapore crypto custody licence choices for a Mauritius provider. Groups also planning EU services can consult the separate Digital Asset Licensing (MiCA / CASP) page.