Crypto regulation in Queensland: federal rules, state gaps and the 2027 licensing cliff

Who actually regulates crypto here

The single most common misconception we encounter is that Queensland has its own crypto rules. It does not, and understanding the division of labour saves a lot of wasted searching.

AUSTRAC is the primary regulator for anyone providing exchange services. Under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, a business that exchanges Australian dollars for digital currency must be registered, must identify its customers, must monitor transactions and must report suspicious and large-cash activity. This applies uniformly across the country.

ASIC regulates crypto where it constitutes a financial product — a managed investment scheme, a derivative, a tokenised security — and, from April 2027, will license crypto platforms themselves. It also runs Moneysmart, whose investor warning list is one of the more practically useful consumer tools in this space.

The ATO determines the tax treatment, which we cover separately on our crypto tax page. Treasury writes the policy. The ACCC, through Scamwatch, collects scam data.

Queensland's own contribution is narrower but real: the Office of Fair Trading handles consumer matters where a Queensland business is involved, and the Queensland Police Service investigates fraud through its Financial and Cyber Crime Group. Neither licenses anyone to do anything with crypto.

How the rules changed, in order

Australian crypto regulation moved further between 2025 and 2026 than in the seven years before it. If your understanding of the landscape predates 2026, it is out of date.

AUSTRAC and the VASP regime

For consumers, AUSTRAC registration is the single most useful signal available, and since 2026 it is one you can verify yourself. It tells you that a business has identified itself to the Australian government, accepted ongoing obligations, and is subject to supervision and penalties. It does not tell you the business is solvent, well run, or a good place to keep your money — those are different questions with different answers.

What a registered VASP owes you, and owes the government, includes customer identification and verification, an AML/CTF program, ongoing transaction monitoring, suspicious matter reporting, Threshold Transaction Reports for cash of AU$10,000 or more within ten business days, and — since the 2026 expansion — Travel Rule compliance on virtual asset transfers with no de minimis carve-out.

That last one explains something readers frequently ask about. If an exchange asks who owns the external wallet you are withdrawing to, or requires you to confirm it is your own, that is the Travel Rule rather than an arbitrary intrusion. It is also why the "just withdraw to an unnamed address" workarounds discussed on forums increasingly fail.

The AFSL regime from April 2027

This is the most consequential change on the horizon, and it will reshape which platforms exist in Australia.

The Corporations Amendment (Digital Assets Framework) legislation creates two new categories of regulated financial product. A Digital Asset Platform covers exchanges and platforms that hold crypto on behalf of customers — which is to say almost every retail exchange Australians use. A Tokenised Custody Platform covers tokenisation of real-world assets. Both will require an Australian Financial Services Licence from ASIC, with the framework commencing 9 April 2027 after a six-month transition.

The exemption threshold is worth noting because it defines who leaves the market: platforms holding under $5,000 per customer and facilitating under $10 million in annual transactions fall outside the regime. Every platform of consequence is far above that, which means every platform of consequence needs a licence.

Our reading — and it is a reading rather than a fact — is that this produces consolidation. An AFSL is expensive to obtain and expensive to maintain, requiring capital, compliance staff, dispute resolution membership and audited processes. Smaller Australian operators will either be acquired, exit, or shrink beneath the threshold. For consumers the trade is fewer platforms with stronger protections, including AFCA membership and the consumer machinery that comes with being a licensed financial services provider.

One practical implication for right now: when comparing platforms, it is reasonable to ask whether they have lodged an AFSL application. The businesses that missed the 30 June 2026 lodgement deadline for ASIC's no-action protection are in a materially different position from those that did not.

Crypto ATM conditions, specifically

Crypto ATMs are the most heavily conditioned corner of the Australian market, and Brisbane readers encounter these rules directly. The conditions AUSTRAC imposed from 3 June 2025 are:

• AU$5,000 cap on cash deposits and withdrawals per customer
• Mandatory scam warnings displayed on the machine
• Enhanced customer due diligence — meaningful identity verification, not a phone number alone
• Strengthened transaction monitoring for suspicious patterns
• Threshold Transaction Reports for cash of AU$10,000 or more, within ten business days

AUSTRAC has also been granted expanded powers over the sector and has signalled it will keep targeting operators that fall short. The August 2026 Cryptolink suspension is the template: a penalty, then an enforceable undertaking, then registration suspension and 96 machines dark. Exchanges that accept cash have been encouraged to adopt equivalent controls even though the conditions technically bind ATM operators.

For a customer, the practical upshot is on our ATM page: you cannot move more than AU$5,000 in cash through a machine, you will be identified, and structuring a larger amount across transactions or machines is a criminal offence rather than a workaround.

What Queensland itself regulates

Very little, and it is worth stating clearly because people search for state-level rules that do not exist.

There is no Queensland digital currency licence. There is no crypto-specific state tax — stamp duty and land tax do not attach to crypto, and there is no state capital gains impost. Queensland Fair Trading handles consumer complaints where a Queensland business is involved, under the Australian Consumer Law. The Queensland Police Service investigates fraud through its Financial and Cyber Crime Group, which as we cover on our scam page has been active and specific in its warnings to Brisbane residents.

Brisbane City Council has no crypto role whatsoever. A machine in a convenience store on Albert Street is equipment in a shop, governed by the same planning and tenancy rules as a vending machine. We mention this only because "Brisbane City Council crypto permit" is a search people make, and the answer is that there is no such thing.

If you are starting a crypto business in Brisbane

Not our main audience, but the questions arrive often enough to answer. This is general information and not legal advice — get proper advice, because the penalties here are severe and personal.

Enforcement is real, and recent

It is easy to read regulation as theoretical. The 2025–26 record says otherwise. An ATM operator was penalised $56,340 and given an enforceable undertaking in 2025; when that did not fix its reporting, its registration was suspended for three months in August 2026 and its entire 96-machine fleet stopped working the same day. That is a business effectively ended by a compliance failure, not a fine absorbed as a cost of doing business.

For consumers, the enforcement record is genuinely useful information. It means the register is not decorative, that a platform's registration status reflects something real, and that a platform which loses it can go dark without notice — which is a risk worth factoring in if you keep balances anywhere.