Cryptolink underscores commitment to compliance and protecting customers through AUSTRAC undertaking
Cryptolink Pty Ltd today confirms it has entered into an enforceable undertaking with the Australian Transaction Reports and Analysis Centre (AUSTRAC) — the first of its kind in Australia’s cryptocurrency sector. Alongside the undertaking, AUSTRAC has issued an infringement notice.
The matter arises from a series of delayed threshold transaction reports (TTRs) submitted to AUSTRAC. Cryptolink has acknowledged these lapses, which fell short of its own standards for regulatory compliance. The company has worked closely and constructively with AUSTRAC to resolve the matter and strengthen internal controls.
As part of its remediation, Cryptolink is continuing to undertake a substantial uplift of its AML/CTF compliance infrastructure. This includes commissioning independent third-party reviews, implementing enhanced transaction monitoring systems, improving risk assessments and intensifying staff training. These efforts will impose substantial costs and require significant time to embed fully, but they are essential to restoring confidence and aligning the business with regulatory expectations.
A spokesperson for Cryptolink said:
“Our customers are central to everything we do. While we regret the shortcomings that led to this outcome, we are committed to turning this into an opportunity to build a more robust, resilient and trusted platform. The outcome with AUSTRAC — though serious — reflects a fair approach by the regulator, and we appreciate their willingness to engage constructively.”
Cryptolink acknowledges concerns raised in the Australian Financial Review about the misuse of cryptocurrency ATMs as “getaway cars” for scammers. In that article, critics argue that scammers criminally misuse cryptocurrency ATMs, instructing victims to buy and transfer cryptocurrency under false pretences. Scam activity is a nationwide problem affecting both traditional and non-traditional finance. Financial service providers play an important role in protecting their customers from scams and have a responsibility to design their products and services responsibly, implement effective safeguards and educate their customers.
To be clear, Cryptolink does not condone or support the misuse of cryptocurrency ATM services for illicit purposes. Recognising the harm scams cause, the company has implemented a range of measures to protect its customers:
- Clear warnings before every transaction
Cryptolink's cryptocurrency ATMs display prominent, plain-English scam alerts prior to every transaction. These alerts explain common scam typologies and advise customers not to proceed if anyone has asked them to buy and send cryptocurrency. Customers are encouraged to contact us first if they are unsure.
- Reinforcement across channels
On-screen warnings are supported by physical signage on ATMs and scam alerts displayed on screen and sent via SMS during onboarding.
- Customer education
Cryptolink's website provides detailed guidance on how scams operate and how to spot warning signs early.
- Targeted transaction monitoring
Cryptolink's AML/CTF program is designed to detect indicators of scam activity and other suspicious behaviour. It evolves continually with operational learning and guidance from AUSTRAC, the Financial Action Task Force (FATF) and other authoritative bodies. The program combines automated systems and manual processes, integrating commercial and proprietary solutions, including: data collection, enrichment, screening and analysis services; blockchain analytics tools; and, sophisticated software systems.
- Responsive risk-management actions
Detected indicators inform dynamic risk assessments and trigger risk-management actions including enhanced due diligence, suspicious matter reporting, or restrictions on access to services where appropriate.
- Blocking known illicit activity
Cryptolink maintains and updates a blocklist of cryptocurrency wallet addresses linked to criminal activity, including scams, using internal investigations and trusted third-party sources to prevent further misuse.
- Easy reporting
Customers can submit reports via Cryptolink's “Report a Scam” page (https://www.cryptolink.com.au/report-a-scam). Insights from reports feed directly into the company's controls and monitoring.
Cryptocurrency ATMs serve legitimate needs for Australians who use cash, prefer non-custodial arrangements, or need a simple on- and off-ramp without online accounts. Cryptolink believes in the transformative potential of cryptocurrency and while its adoption has not come without challenges, the company is confident that stakeholders can work together to overcome those challenges and realise the benefits of an improved financial system that includes a variety of cryptocurrency-based services.
Targeted, risk-based regulation protects customers and helps regulators focus on bad actors while enabling legitimate customers and the community at large to benefit from new opportunities associated with this transformative technology. Cryptolink welcomes scrutiny and views it as a healthy sign of Australia’s unwavering commitment to ensuring the integrity of its financial system. This includes:
- AUSTRAC's ongoing engagement with the sector, which has been of great benefit;
- the forthcoming Virtual Asset Service Provider (VASP) reforms in March 2026, which will introduce licensing, transparency and oversight across the cryptocurrency sector, raising the bar for compliant operators and helping restore trust in legitimate services; and
- broader efforts by the Australian Government, including the Treasury’s work in recent weeks.
Cryptolink will continue to work both internally and in cooperation with AUSTRAC and other stakeholders to strengthen protections and improve outcomes across the sector.
Anyone who believes they have been affected by a scam involving cryptocurrency ATMs can contact Cryptolink for guidance, support and referral to law-enforcement or regulatory bodies. Do so by emailing support@cryptolink.com.au or using the “Report a Scam” page on the company's (https://www.cryptolink.com.au/report-a-scam).
Media contact:
media@cryptolink.com.au
