AUSTRAC suspends 96 Cryptolink crypto ATMs

AUSTRAC ordered 96 Cryptolink cryptocurrency ATMs offline for three months on Aug. 10 and suspended the company’s virtual asset service provider registration. The suspension runs until early November while the regulator monitors compliance.

The regulator said Cryptolink failed to submit required threshold transaction reports and did not respond to an information request, leaving AUSTRAC concerned that continued operation of the cash‑to‑crypto kiosks posed an unacceptable money‑laundering risk.

The machines let customers buy cryptocurrency with cash and send it directly to an external digital wallet. AUSTRAC has flagged cash purchases at bitcoin ATMs as higher risk because operators may not always verify identity and transfers generally cannot be reversed once funds leave the kiosk.

The action follows AUSTRAC enforcement on Oct. 31, 2025, when the agency alleged late reporting of large cash transactions and weaknesses in Cryptolink’s anti‑money‑laundering and counter‑terrorism financing risk assessments. At that time Cryptolink agreed to use third‑party reviewers to assess reporting and controls and paid an infringement notice of A$56,340 without admitting liability.

AUSTRAC said conditions under the earlier enforceable undertaking were initially met, but later failures to file basic reports and the refusal to provide requested information prompted the current suspension.

According to Brendan Thomas, AUSTRAC’s chief executive: “As part of our continued focus on digital currency as a money laundering risk, AUSTRAC has ongoing concerns about the company’s ability to manage high‑risk transactions through its CATMs.” He added: “Cryptolink was given the opportunity to comply but could not meet its obligations despite the enforceable undertaking.”

Regulatory scrutiny of crypto kiosks has increased internationally. In the United States, lawmakers proposed measures in June after reported losses to crypto ATM scams exceeded $333 million in 2025, seeking transaction limits, scam warnings, tighter customer due diligence and expanded record‑keeping. State actions include a Missouri lawsuit alleging fraud and inadequate fee disclosures against an operator with more than 140 kiosks and a Tennessee law that required operators to remove or deactivate crypto ATMs by July 1; a federal court allowed the Tennessee ban to take effect after operators sought to block it.

AUSTRAC created a Crypto Taskforce and has conducted supervisory engagements with ATM operators since late 2024. The regulator said it will enforce the offline period while it assesses whether Cryptolink can meet reporting and control obligations.