This is the second time AUSTRAC has acted against Cryptolink. Its Cryptocurrency Taskforce, formed in late 2024, found late reporting and weak risk assessments at the company and accepted an enforceable undertaking in October 2025, alongside an A$56,340 infringement notice that Cryptolink paid. That undertaking was supposed to close the gap. AUSTRAC had also imposed a sector-wide A$5,000 cash-transaction limit on crypto ATM deposits and withdrawals in June 2025, part of a broader tightening that predates this suspension by more than a year. When a company that already survived one enforcement round lapses again, the regulator is left with a narrower set of explanations, and none of them favor leniency.
The scale AUSTRAC is reacting to is real. In a media release tied to the government's push for expanded powers, Thomas said Australia had 23 crypto ATMs six years ago, 200 three years ago, 1,200 when the Taskforce was formed at the end of 2024, and roughly 2,000 today — third-most of any country. AUSTRAC estimates almost 150,000 transactions and more than $275 million move through those machines annually, with about 99% of that volume made up of cash deposits for crypto purchases. In a sample of the 90 most active crypto ATM users nationally, AUSTRAC and its law enforcement partners found 85% were scam victims or money mules who had been tricked or coerced into moving money, and people aged 50 to 70 — a group Thomas has flagged as most vulnerable to scams — account for almost 72% of transaction value.
Parliament is already moving to make actions like this easier to take at scale. The AML/CTF Amendment Bill 2026, introduced to the House of Representatives on March 12, would let the AUSTRAC CEO restrict or prohibit a reporting entity's use of a "high-risk mechanism" — crypto ATMs are the example used throughout the government's own materials — by legislative instrument, without needing to build an individual enforcement case first. The Parliamentary Joint Committee on Intelligence and Security has since reviewed the bill and called cryptocurrency ATMs a significant channel for scams and financial crime, recommending the minister treat restrictions or prohibitions as a priority.
Read the two actions together and the sequencing looks less like coincidence than groundwork. Cryptolink's suspension shows AUSTRAC can already dismantle a non-compliant operator's entire network under its existing registration and enforceable-undertaking powers, without new legislation. What the pending bill adds isn't the ability to act — it's the ability to act against a whole category of machines at once, based on AUSTRAC's own risk assessment, rather than waiting for a specific operator to miss a specific filing. Cryptolink gave the regulator a case study in exactly the failure mode the bill is designed to let it pre-empt.
Other Australian crypto ATM operators — Coinflip and Localcoin chief among them by machine count — now have a three-month window while Cryptolink's network sits dark to decide whether this was a warning about one company's compliance program or a preview of what a "high-risk mechanism" designation could do to the whole channel once AUSTRAC doesn't need a reason tied to any single operator at all.
