AUSTRAC Suspends Cryptolink and Shuts Down 96 Crypto ATMs Over Reporting Failures

• Australia’s financial crime regulator takes tougher action after the operator failed to meet reporting requirements despite an earlier compliance undertaking.

Meat of the Story

Australia has suspended Cryptolink’s registration for three months, forcing its 96 cryptocurrency ATMs across the country to stop operating. The action follows failures to submit required reports and respond to a request for information from the regulator. It is not the first compliance problem involving the operator. Cryptolink had already faced enforcement action and agreed to improve its controls. The latest suspension shows that regulators are willing to shut down high-risk crypto businesses when promised improvements do not translate into reliable day-to-day compliance.

Analysis

The Australian Transaction Reports and Analysis Centre, AUSTRAC, has suspended the registration of Cryptolink Pty Ltd for three months, effectively taking its 96 cryptocurrency ATMs offline across Australia. The suspension began on 9 August 2026 and prevents Cryptolink from providing virtual asset services during the period.

The action follows concerns about Cryptolink’s ability to meet its reporting obligations and manage the risks associated with its cash-to-crypto business.

The operator had already come under AUSTRAC’s scrutiny. In October 2025, the regulator issued Cryptolink with a $56,340 infringement notice and accepted a court-enforceable undertaking addressing weaknesses in its anti-money laundering controls. Those concerns included late reporting of large cash transactions and weaknesses in the company’s assessment of money laundering and terrorism financing risks.

The earlier undertaking required independent reviews of Cryptolink’s reporting, controls for large cash transactions and risk assessment. Yet AUSTRAC subsequently identified further failures, including missing required transaction reports and a failure to respond to an information request.

AUSTRAC’s decision reflects growing regulatory concern over crypto ATMs, which allow customers to convert physical cash into cryptocurrency quickly. The regulator has described the sector as particularly vulnerable to scams, money laundering and money mule activity.

 Compliance implications

The Cryptolink case demonstrates that regulators are looking beyond whether a crypto business has written compliance policies. They want evidence that those controls actually work.

For crypto ATM operators, that means accurately identifying customers, monitoring transactions, reporting qualifying cash transactions on time and maintaining a reliable assessment of the risks facing the business.

AUSTRAC’s earlier action required Cryptolink to review whether all required transaction reports had been submitted and whether its controls for large cash transactions were effective.

The case also shows that regulatory undertakings are not the end of an enforcement process. Where a business is given an opportunity to correct weaknesses but continues to fall short, the consequences can become significantly more serious.

Why the update matter

Crypto ATMs sit at a sensitive point between physical cash and digital assets. Cash can be difficult to trace to its original source, while cryptocurrency can be moved quickly between wallets and across borders.

AUSTRAC has previously reported serious misuse of crypto ATMs. Its taskforce estimated that 85% of transactions made by the 90 most prolific crypto ATM user were linked to scam proceeds or money mule activity.

The Cryptolink suspension therefore sends a wider message to the crypto industry: reporting failures are not minor administrative mistakes when they affect a high-risk financial channel.

For operators in Nigeria and across Africa, the lesson is relevant as crypto businesses and digital asset providers face increasing regulatory scrutiny. A licence or registration provides the right to operate, but it does not protect a business from enforcement if its controls fail in practice.

Compliance Takeaway

A compliance programme must work in real life, not just on paper. Crypto businesses should treat transaction reporting, customer checks, risk assessments and regulatory requests as core operational responsibilities. Repeated failures can move a company from remediation to suspension.