How should crypto businesses in Australia structure compliance when they may fall under both AUSTRAC and ASIC rules?

Why This Matters for Security Teams

Crypto businesses in Australia often fail compliance by treating AUSTRAC and ASIC as overlapping labels instead of separate legal tests. AUSTRAC focuses on AML and CTF obligations for digital currency exchange services, while ASIC becomes relevant when the business is dealing in a financial product, providing financial services, or operating in a way that brings the Corporations Act into scope. That means the same customer journey can trigger different controls, evidence sets, and reporting lines depending on the product and the legal character of the activity. NIST Cybersecurity Framework 2.0NIST Cybersecurity Framework 2.0 is useful here because it helps teams separate governance, protection, detection, and response responsibilities even when the regulatory perimeter is fragmented. The practical risk is not just a failed audit. It can include weak onboarding, poor transaction monitoring, incomplete record keeping, and licensing gaps that only surface when the business expands into custody, staking, tokenised assets, or other higher-risk services. In practice, many security teams encounter regulatory scope creep only after a new product launches, rather than through intentional design.

How It Works in Practice

A workable structure starts with an activity-by-activity regulatory map. Each product, service, and workflow should be tagged to the relevant obligation set, then owned by a named control owner. That usually means one compliance baseline for AUSTRAC obligations, another for ASIC-triggering activities, and a shared layer for security, identity, and record management. NIST SP 800-53 Rev 5 Security and Privacy ControlsNIST SP 800-53 Rev 5 Security and Privacy Controls is a practical reference for turning legal requirements into control families such as access control, audit logging, incident response, and system integrity.

• Define which services are AUSTRAC-regulated, which are ASIC-regulated, and which require both.
• Document the rationale for each classification so product, legal, risk, and engineering teams use the same scope map.
• Build KYC, customer screening, and transaction monitoring to satisfy AML/CTF needs while preserving evidence for financial-services oversight.
• Separate privileged access, change approval, and logging for custody, exchange, and treasury functions.
• Maintain incident playbooks that cover suspicious transfers, account takeover, sanctions hits, and disclosure obligations.

For identity and access governance, NIST SP 800-63 Digital Identity GuidelinesNIST SP 800-63 Digital Identity Guidelines helps structure identity proofing, authenticator strength, and session assurance where account abuse or mule activity is a concern. If the business is handling customer data at scale, ISO/IEC 27001:2022 Information Security ManagementISO/IEC 27001:2022 Information Security Management is also a sensible governance anchor, especially when controls must be demonstrated across multiple regulatory obligations. These controls tend to break down when product teams launch tokenised or custodial features without re-running the regulatory scoping exercise, because the original AML-only control set no longer matches the actual service model.

Common Variations and Edge Cases

Tighter compliance mapping often increases operational overhead, requiring organisations to balance faster product delivery against clearer regulatory boundaries. Best practice is evolving for hybrid crypto firms, because there is no universal standard for how to document dual-regime coverage across all product types. Some businesses can keep AUSTRAC and ASIC obligations in separate control registers, while others need a single integrated compliance operating model with distinct policy annexes and evidence packs. The right choice depends on how intertwined the services are, how frequently products change, and whether customer funds or custody arrangements are involved.

Edge cases usually appear when the business starts to resemble a broader financial platform rather than a pure exchange. That includes custody, yield products, wrapped or tokenised exposures, broker-like activity, or referral structures that influence whether the firm is “merely facilitating” or actually providing a regulated service. FATF Recommendations - AML and KYC FrameworkFATF Recommendations - AML and KYC Framework remains useful for interpreting why customer due diligence and transaction monitoring cannot be treated as checkbox controls. For firms with cross-border customers or outsourced operations, ISO/IEC 27002:2022 Information Security ControlsISO/IEC 27002:2022 Information Security Controls can help translate governance into specific operational safeguards. The hardest cases arise when legal character changes by feature, because a service that is unregulated at onboarding can become regulated once custody, execution, or token design is introduced.

Related resources from NHI Mgmt Group

• How should gambling operators govern crypto wallets under new compliance rules?
• How should crypto businesses implement transaction monitoring when they need both compliance and privacy controls?
• How should virtual asset platforms govern crypto listings under tighter regulatory rules?
• Which controls matter most when a crypto market comes under new licensing and reporting rules?