AUSTRAC's three-month suspension of Cryptolink Pty Ltd wasn't due to a complete disregard for compliance. The company had completed an enforceable undertaking, paid a $56,340 infringement notice, and addressed earlier violations. So, what went wrong? Cryptolink viewed remediation as an endpoint rather than a starting point. For crypto ATM operators and other virtual asset service providers (VASPs), this case highlights why continuous compliance requires ongoing operational discipline, not just project completion.
If you're operating crypto ATMs or similar high-risk channels, here's how to build a compliance program that withstands regulatory scrutiny after remediation.
The Problem: Why Continuous Compliance Matters
Cryptolink's suspension, effective August 9, 2026, followed its failure to submit threshold transaction reports (TTRs) and respond to an AUSTRAC information request. These aren't minor oversights. They're fundamental AML/CTF obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act).
The regulatory message is clear: completing an enforcement action doesn't reset your risk profile. If you can't maintain basic reporting and risk assessment obligations after remediation, regulators may restrict or halt your operations.
For VASPs operating 24/7 automated channels like crypto ATMs, the stakes are higher. You're processing cash-to-crypto conversions without face-to-face verification, creating inherent money laundering risks that require constant monitoring.
What You Need Before Starting
Before building or rebuilding your compliance program, ensure you have:
Regulatory foundation:
- Current registration with your financial intelligence unit (FIU), in Australia, that's AUSTRAC; in the U.S., FinCEN registration as a money services business (MSB)
- A designated AML/CTF compliance officer with authority to halt transactions
- Access to your regulator's reporting portal (AUSTRAC's Online Forms and Regulatory Environment in Australia; BSA E-Filing System in the U.S.)
Operational infrastructure:
- Transaction logs from all ATMs with timestamps, amounts, wallet addresses, and device IDs
- Customer identification data collection capability at each device
- A case management system or structured spreadsheet to track TTRs, suspicious matter reports (SMRs), and regulator correspondence
Risk assessment framework:
- Written AML/CTF risk assessment documenting risks specific to your ATM locations, transaction limits, and customer base
- Risk rating methodology that assigns scores based on transaction patterns, geographic risk, and customer behavior
If you're missing any of these components, pause and build the foundation first.
Step-by-Step Implementation
Step 1: Automate Threshold Transaction Reporting
Manual TTR submission is where most operators fail. Set up automated alerts:
Configure transaction thresholds:
- Set your system to flag any transaction at or above AUD $10,000 (or USD $10,000 in the U.S.)
- Include aggregated transactions from the same customer within a rolling 24-hour window
- Track by device ID, wallet address, and any customer identifier collected
Build a daily reconciliation process:
- Each morning, export all flagged transactions from the previous day
- Cross-check against submitted TTRs to identify gaps
- If you find unreported transactions, submit within 10 business days of the transaction date (AUSTRAC requirement)
Create a submission checklist:
- Customer identification details (if collected)
- Transaction amount, date, time
- Receiving wallet address
- ATM location and device ID
- Submit via AUSTRAC Online Forms or your regulator's portal
Assign one person to own this process. If they're out, assign a backup. Cryptolink's failure to respond to an information request suggests gaps in accountability.
Step 2: Update Your Risk Assessment Quarterly
Your AML/CTF risk assessment can't be static. Schedule quarterly reviews:
Review these risk indicators:
- New ATM locations (higher-risk areas like border regions or areas with limited banking access)
- Changes in average transaction size or frequency
- Regulatory updates from AUSTRAC's Crypto Taskforce or your local FIU
- Typology alerts from the Egmont Group or FATF
Document changes in writing:
- Update your risk assessment document with new risks identified
- Adjust transaction monitoring rules if needed (e.g., lower thresholds in high-risk locations)
- Get sign-off from your compliance officer and senior management
Link risk changes to controls:
- If you add ATMs in a Grey List jurisdiction's border area, document enhanced due diligence measures
- If transaction sizes increase, recalibrate your monitoring thresholds
Step 3: Respond to Regulator Requests Within 48 Hours
Cryptolink's failure to respond to AUSTRAC's information request was a critical error. Build a response protocol:
Centralize regulator correspondence:
- Create a dedicated email address monitored by at least two people
- Set up auto-forwarding to your compliance officer and general counsel
- Log all requests in a tracking spreadsheet with received date, due date, and status
Acknowledge immediately:
- Reply within 24 hours confirming receipt
- If you need more time, request an extension with a specific date
- Never ignore a request, even if you think it's duplicative or unclear
Assign resources:
- Designate who will compile the response
- Set internal deadlines two days before the regulator's deadline
- Review responses for completeness before submission
Step 4: Monitor for Suspicious Patterns
Threshold reporting isn't enough. You need ongoing transaction monitoring:
Set up red-flag alerts:
- Structured transactions just below AUD $10,000 (e.g., $9,500 repeated transactions)
- Rapid-fire transactions from the same device within minutes
- Transactions to wallet addresses previously flagged in law enforcement bulletins
Review alerts weekly:
- Assign a compliance analyst to review flagged transactions
- Document your decision to file or not file a suspicious matter report (SMR)
- If filing, submit within three business days of forming suspicion (AUSTRAC requirement)
Maintain an audit trail:
- Keep records of all monitoring reviews for seven years
- Document why you dismissed alerts as false positives
- This evidence matters if AUSTRAC conducts a supervisory engagement
Validation: How to Verify It Works
Run these checks monthly to confirm your program is functioning:
TTR completeness test:
- Pull all transactions ≥ AUD $10,000 from the past month
- Cross-reference against submitted TTRs
- Target: 100% match rate
Information request drill:
- Simulate a regulator request (e.g., ask your compliance officer to request transaction data for a specific ATM)
- Measure response time from request to delivery
- Target: full response compiled within 48 hours
Risk assessment currency check:
- Review the date on your current risk assessment document
- Confirm it reflects ATMs added or removed in the past 90 days
- Target: no assessment older than three months
If any test fails, treat it as a control breakdown and remediate immediately.
Maintenance: Ongoing Tasks
Compliance isn't a project you complete. Schedule these recurring tasks:
Daily:
- Review and submit TTRs for prior-day transactions
- Check regulator email for new requests
Weekly:
- Review transaction monitoring alerts
- File SMRs for confirmed suspicious activity
Monthly:
- Run validation tests (TTR completeness, response drill)
- Review ATM transaction volumes for anomalies
Quarterly:
- Update AML/CTF risk assessment
- Train staff on new typologies or regulatory guidance
- Review and update transaction monitoring rules
Annually:
- Conduct independent audit of AML/CTF program
- Review and update policies and procedures
- Submit annual compliance report to AUSTRAC (or equivalent)
Cryptolink's suspension shows that regulators expect sustained compliance, not episodic remediation. If you're operating high-risk channels like crypto ATMs, treat these tasks as non-negotiable operational requirements. The cost of maintaining compliance is far lower than the cost of a three-month suspension.
