AUSTRAC takes 96 Cryptolink crypto ATMs offline

AUSTRAC announced on 10 August 2026 that it had suspended Cryptolink Pty Ltd's virtual-asset-service-provider registration for three months. The suspension began on 9 August and prevents the company from operating its network of 96 cryptocurrency ATMs across Australia.

The AUSTRAC notice says Cryptolink did not submit required threshold transaction reports and did not respond to an AUSTRAC information request. Chief executive Brendan Thomas said those failures left the regulator with continuing concerns about the company's ability to manage high-risk transactions through cash-to-crypto machines.

AUSTRAC describes Cryptolink as a virtual-asset service provider and explains that its machines allow customers to exchange cash for cryptocurrency. The physical network therefore combines a registration dependency with transaction-reporting controls: once the registration is suspended, the consequence is not confined to a back-office remediation plan but reaches every customer access point.

Cryptolink had already been subject to an enforceable undertaking accepted in October 2025. AUSTRAC says its Cryptocurrency Taskforce had identified alleged anti-money-laundering and counter-terrorism-financing contraventions, including late threshold-transaction reporting and weaknesses in the company's AML/CTF risk assessments. The regulator says Cryptolink met the conditions in that undertaking but subsequently failed the separate reporting and information-response requirements that led to the current suspension. The current action affects the whole physical network.

AUSTRAC also issued a $56,340 infringement notice in connection with the earlier matter, which Cryptolink paid. Payment of that notice is not described as ending the three-month suspension. The registration action instead removes the authority on which the company relies to operate the 96 machines while AUSTRAC monitors compliance.

The sequence separates three forms of evidence that a virtual-asset business may otherwise manage in different teams. Threshold reports must be submitted when required, a formal regulator request must reach an owner who can answer it within the required process, and the risk assessment must explain how the business identifies and mitigates exposure created by cash-funded crypto transactions. A prior remediation programme does not prevent a later suspension when those basic controls fail again.

The notice does not publish a reinstatement checklist or an exact end-of-day timestamp for the three-month period. It says AUSTRAC will monitor Cryptolink to ensure compliance with the suspension and will continue its supervisory work with crypto ATM operators, which began in late 2024 alongside the creation of the Crypto Taskforce.

AUSTRAC's account also distinguishes completion of an enforceable undertaking from continued compliance afterward. Cryptolink is described as having met the undertaking conditions before failing the later reporting and information-request tests. The next evidence set must therefore show sustained operation of the controls, not only closure of the earlier action plan.

For other operators, the record to test is concrete: evidence of complete and timely threshold reporting, a controlled register of information requests and responses, and a current AML/CTF risk assessment covering the machine network and high-risk transactions. The next official milestone will be AUSTRAC's decision on Cryptolink's position during or at the end of the suspension; until then, the 96 ATMs remain offline under the action announced on 10 August 2026.