AUSTRAC suspends Cryptolink’s 96 crypto ATMs over AML/CTF concerns

Dig Deeper

The Backstory

Australia’s crypto-ATM crackdown moves from warning to shutdown

AUSTRAC’s suspension of Cryptolink’s registration marks a sharper phase in Australia’s effort to police crypto businesses that handle cash, speed and anonymity in the same transaction chain. The action is not an isolated compliance dispute. It follows a year in which the financial intelligence agency has pushed banks, bookmakers, casinos and digital-asset businesses to prove that their anti-money laundering and counter-terrorism financing controls match the risks created by high-volume digital payments.

Crypto ATMs sit at the intersection of several regulatory concerns. They allow customers to convert cash into digital assets, often quickly and outside the systems that traditional banks use to monitor account behavior. For AUSTRAC, that makes basic reporting obligations central to supervision. Threshold transaction reports, suspicious matter reporting, customer monitoring and risk assessments are not administrative details. They are the tools authorities use to detect criminal proceeds entering the financial system.

The suspension also shows how AUSTRAC is using escalating interventions. Cryptolink had already been subject to an enforceable undertaking and an infringement notice. The regulator’s latest move indicates that remediation alone may not protect a business if subsequent reporting failures suggest that controls are not embedded in day-to-day operations. In practical terms, the case tells other virtual asset service providers that compliance obligations continue after a settlement, undertaking or audit is completed.

AUSTRAC has widened its focus beyond casinos

Australia’s AML enforcement agenda first drew global attention through major casino and banking cases, but the current cycle extends well beyond those sectors. Online wagering operators have become a prominent target because they process large volumes of money through digital accounts, sometimes with limited friction for customers. AUSTRAC has repeatedly framed that model as attractive to criminals seeking to move or disguise funds.

That broader campaign was evident when the regulator ordered Bet365 to overhaul its AML/CTF systems under an enforceable undertaking. The case stemmed from an investigation that began after an independent audit and focused on risk methodology, suspicious transaction detection and reporting. The undertaking requires Bet365 to deliver progress reports through 2027 and gives AUSTRAC direct access to information needed to monitor compliance.

The Bet365 action followed earlier scrutiny of leading bookmakers, including Sportsbet. In that case, AUSTRAC said the Flutter-owned operator had completed remediation after concerns over risk assessment, customer monitoring and suspicious matter reporting. The regulator’s decision to clear Sportsbet after required AML/CTF remediation shows that AUSTRAC’s enforcement model can end with a business returning to ordinary supervision. But it also underscores the difference between satisfying a remediation plan and maintaining compliance once oversight pressure eases.

That distinction is central to Cryptolink. AUSTRAC said the company met the conditions of its earlier enforceable undertaking but then failed to meet basic reporting obligations and did not respond to a request for information. The suspension therefore rests not just on historic deficiencies but on the regulator’s assessment of current risk.

Entain case highlights legal stakes for enforcement strategy

AUSTRAC’s assertive posture has not gone uncontested. Its civil case against Entain, owner of Ladbrokes and Neds in Australia, illustrates both the scale of possible penalties and the legal complexity of applying AML rules to modern gambling and payments models. The regulator alleges Entain failed to maintain systems capable of detecting suspicious transactions involving 17 high-risk customers who collectively moved more than AU$152 million through their accounts from 2016 to 2020.

But the case also exposed limits in AUSTRAC’s pleadings. The agency dropped key allegations against Entain after they conflicted with its own published guidance on remittance arrangements. The proceeding continues, and individual contraventions can still carry severe penalties. Yet the amendment matters because it shows that enforcement is moving into contested legal territory where guidance, statutory interpretation and business models can collide.

For crypto ATM operators, that legal environment cuts both ways. On one hand, AUSTRAC may be cautious about bringing claims that have not been tested in court. On the other, the Cryptolink action did not require a court ruling on novel legal interpretation. It was based on registration status, reporting failures and nonresponse to supervisory inquiries. Those are more direct grounds for administrative intervention, especially where the regulator has already classified the business as high risk.

The result is a compliance landscape in which AUSTRAC can use multiple tools: infringement notices, enforceable undertakings, civil proceedings and registration suspensions. Businesses that rely on digital onboarding, rapid deposits or cash-to-crypto conversion face the strongest pressure because they combine scale with potential opacity.

Crypto demand is rising as regulators scrutinize the rails

The action against Cryptolink comes as crypto payments are moving closer to regulated gambling and financial services, not farther away. Operators and payment companies increasingly see digital assets as a customer-demand issue. That commercial pressure is visible in the U.S., where Paysafe launched Pay with Crypto for online gaming operators, supported by MoonPay. The product lets players connect crypto wallets, undergo verification and convert deposits into dollars for gaming accounts.

The payments push reflects a broader belief that regulated operators would rather capture crypto demand inside licensed channels than leave it to offshore or informal markets. Paysafe has argued that many U.S. players own or want to use cryptocurrency, while state rules are beginning to accommodate crypto-to-cash models. Wyoming became the first U.S. state to permit “digital, crypto, and virtual currencies” for wagering payments under HB 133, and other states have allowed conversion-based deposits.

That trend gives context to the Australian crackdown. AUSTRAC is not attempting to stop digital assets from entering mainstream payments. Rather, it is insisting that businesses handling those assets meet the same or higher standards expected of other high-risk financial channels. The more crypto products are integrated into gambling, deposits, stored value and prediction markets, the more regulators will expect controls that identify customers, monitor behavior and report suspicious activity in real time.

The growth of institutional crypto reinforces that point. Citadel Securities’ US$400 million investment in Crypto.com at a US$20 billion valuation shows that large financial firms increasingly view digital assets as part of the future market structure. Crypto.com’s expansion into tokenized securities, derivatives and prediction markets illustrates how quickly crypto platforms are moving beyond simple spot trading.

The lesson for operators is operational proof

Cryptolink’s suspension signals that AUSTRAC is looking for evidence that compliance systems work continuously, not just on paper or during remediation. For operators, that means risk assessments must be current, transaction monitoring must reflect evolving typologies and reporting obligations must be met on time. Failure to answer regulator requests can become as damaging as the underlying control weakness because it suggests management cannot or will not demonstrate control.

The stakes are commercial as well as legal. A three-month suspension of 96 crypto ATMs removes a business from the market, disrupts customers and can damage relationships with banks, landlords, payment partners and suppliers. For a sector already dependent on trust from counterparties, regulatory interruption can have consequences beyond the suspension period.

The broader message is directed at every business moving money through digital or semi-anonymous channels. Gambling operators, crypto exchanges, payment processors and ATM networks are being judged by their ability to manage financial-crime risk at speed. As crypto adoption rises and payment products become more sophisticated, regulators are likely to focus less on whether digital assets should exist and more on whether the firms monetizing them can prove they know who is using their systems, where the money comes from and when activity should be reported.