AUSTRAC is taking decisive steps to clean up its Digital Currency Exchange (DCE) register, warning that dormant or inactive exchanges risk losing their registration under a new compliance campaign dubbed the ‘use it or lose it’ blitz.
The crackdown targets DCEs that appear inactive, with AUSTRAC directly contacting businesses that have not demonstrated trading activity. With 427 currently registered exchanges, AUSTRAC believes a “significant proportion” are no longer operational, posing risks to the integrity of the register and to consumers.
In a recent press release, AUSTRAC Chief Executive Officer Brendan Thomas labelled DCEs a high-risk sector and that inactivity opens the door for criminals to exploit a company’s enrolment status.
Inactive businesses are vulnerable to being bought and co-opted by criminals
We’re aiming to protect consumer confidence in AUSTRAC registration and limit the potential for improper sale and use of DCE businesses.
As registration with AUSTRAC is a legal prerequisite for offering cryptocurrency-to-fiat services (including crypto ATMs), maintaining an accurate and up-to-date register is critical. Registrants are required to notify AUSTRAC if their business model changes or if they cease to provide DCE services.
This latest initiative follows AUSTRAC’s broader push to tighten oversight of digital assets, including previous enforcement actions and guidance on anti-money laundering (AML) risks related to crypto. DCEs have been in AUSTRAC’s crosshairs for some time, having previously moved to crack down on unregistered cryptocurrency ATMs and implemented stronger expectations around AML/CTF compliance for DCEs.
Businesses identified as inactive and who fail to respond to AUSTRAC’s inquiries will have their registrations cancelled, with their names published on AUSTRAC’s website. However, businesses may re-apply should circumstances change.
The regulator also announced that it will soon launch a publicly searchable DCE register, allowing customers to easily verify whether a crypto exchange is registered and subject to AUSTRAC’s regulatory oversight.
“We want to make sure the public isn’t misled about the services a business is legally allowed to provide,” said Thomas. “Our message is simple—if you’re not offering services, update your status or risk removal.”
The move signals AUSTRAC’s intent to tighten control over the crypto sector and address AML/CTF compliance in areas like suspicious matter reporting and transaction monitoring. While the introduction of a public register is welcome to help consumers identify compliant operators, more work will need to be done to educate consumers of the changes and how to spot non-compliant operators and scams. AUSTRAC’s actions come ahead of legislative changes to be implemented in March 2026 which will transition the DCE regime to a broader VASP regime covering a wider range of virtual asset businesses and introducing new compliance obligations including the travel rule for virtual assets.
