AML Compliance Guide
Log in Create Free Account

Suspicious matter reporting for Virtual asset service providerss — 2026 AUSTRAC Guide

If you provide a designated virtual asset service in Australia, you must report suspicious matters to AUSTRAC when you have reasonable grounds to suspect a customer, transfer, wallet, or transaction may be linked to crime, money laundering, terrorism financing, or attempts to hide ownership or control. This applies to virtual asset service providers because your services can be used to move value quickly across borders, through multiple wallets, and between custodial and self-hosted wallets. If you miss a report, report late, or tip off the customer, you expose your business to serious enforcement action, including civil penalties of up to $33.5 million per contravention, and criminal penalties for intentional breaches.

Your AML/CTF obligations

  1. 1. AUSTRAC enrolment
  2. 2. Compliance officer
  3. 3. ML/TF risk assessment
  4. 4. AML/CTF program
  5. 5. Customer due diligence
  6. 6. Sanctions screening
  7. 7. Suspicious matter reporting
  8. 8. Record keeping (7 years)
  9. 9. Staff training

A suspicious matter report, or SMR, is not the same as a threshold transaction report or an international funds transfer instruction report. For virtual asset businesses, the trigger is suspicion, not a dollar threshold. You must file an SMR if you form reasonable grounds to suspect that a customer is not who they claim to be, is using your platform to conceal the source of funds, is structuring activity across wallets or accounts, is linked to sanctions exposure, or is moving virtual assets in a way that does not fit their profile or stated purpose. The test is lower than certainty. You do not need proof before reporting.

What your team should do when suspicious activity appears

  • Pause and review the activity as soon as an alert, staff concern, or blockchain monitoring flag is raised.
  • Collect the facts you already hold: customer identity records, wallet addresses, transaction history, IP or device data, source of funds information, and any links to mixers, darknet services, scams, mule activity, or sanctioned persons.
  • Escalate the matter internally to your AML/CTF compliance officer or nominated decision-maker without contacting the customer about the suspicion.
  • Decide whether there are reasonable grounds to suspect. If yes, submit the SMR to AUSTRAC within 3 business days, or within 24 hours if terrorism financing is suspected.
  • Keep full records of what was detected, who reviewed it, when the suspicion was formed, what was reported, and any account restrictions or monitoring steps taken afterward.

Two deadlines matter

File an SMR within 3 business days of forming the suspicion. If the suspicion relates to terrorism financing, the deadline is 24 hours. Do not tell the customer you made, or are considering making, an SMR. Tipping off is a separate criminal offence.

For virtual asset service providers, common SMR triggers often come from wallet behaviour rather than face-to-face conduct. Examples include customers sending funds to or from high-risk exchanges, rapid pass-through activity with no commercial purpose, newly created accounts receiving large virtual asset deposits and immediately cashing out, repeated transfers involving self-hosted wallets where the customer gives evasive answers, use of multiple customer accounts controlled from the same device, and attempted transactions after sanctions screening hits. AUSTRAC’s transitional rules defer separate reporting for transfers involving unverified self-hosted virtual asset wallets until 31 March 2029 for providers already offering the relevant services before that date. That deferral does not remove your SMR obligation now. If the wallet activity is suspicious, you still report it.

Common mistakes virtual asset providers make

  • Waiting for blockchain analytics to give a perfect risk score before deciding to report.
  • Assuming only fiat withdrawals or deposits can be suspicious.
  • Treating every self-hosted wallet transfer as automatically reportable, instead of assessing whether there are reasonable grounds to suspect.
  • Telling customer support to ask the customer why their account is under review in a way that reveals an SMR may be filed.
  • Failing to link related wallets, accounts, and transaction patterns across the same customer or controller.

In practice, small VASPs need a clear escalation path built into onboarding, transaction monitoring, and wallet review processes. Your analysts and customer support staff should know the difference between an ordinary compliance query and a suspicion that must be escalated immediately. Build prompts into case management so staff record when suspicion was actually formed, because that starts the reporting clock. Good-faith reports are legally protected, and reporting to AUSTRAC is not optional if the suspicion threshold is met.

A lightweight AML platform, built exclusively for Tranche 2

Get AUSTRAC's mandates done as fast and effortless as possible.

  • Built around AUSTRAC's actual requirements
  • Single maintained compliance file
  • No compliance expertise required
  • 25 minute initial compliance setup
  • Obligations calendar & reminders
  • Instant data export
Setup: ~25 minutes Ongoing: minutes per client Price: $8 per KYC
See the product →

Frequently asked questions

Do I need to file an SMR just because a customer uses a self-hosted wallet?
No. A self-hosted wallet on its own does not automatically require an SMR. You report when you have reasonable grounds to suspect the wallet, transfer pattern, customer behaviour, or surrounding circumstances are linked to crime, concealment, sanctions risk, terrorism financing, or false identity. Separate reporting for transfers involving unverified self-hosted wallets is deferred until 31 March 2029 in the circumstances set out by AUSTRAC, but SMR obligations still apply now.
What if the transaction is only in virtual assets and no Australian dollars are involved?
You may still need to file an SMR. Suspicious matter reporting is not limited to fiat transactions and does not depend on a cash threshold. Virtual asset-to-virtual asset exchanges, transfers between custodial and self-hosted wallets, and suspicious safekeeping activity can all trigger an SMR if they are part of a designated service you provide.
Can I keep providing the service after I lodge an SMR?
Sometimes, but that is a risk decision for your business. Lodging an SMR does not automatically require you to close the account or stop the transfer, but you should consider whether continuing would expose you to sanctions, fraud, money laundering, or other legal risk. If sanctions screening identifies a sanctioned person, providing the service is a strict-liability criminal offence.
What does it cost to file an SMR with AUSTRAC?
AUSTRAC does not charge a filing fee for an SMR. The real cost is internal: staff time, monitoring systems, case review, and record keeping. For a small VASP, the practical issue is having a process that lets you identify and escalate suspicious wallet activity quickly enough to meet the deadline.
Who in my business should decide whether an SMR is lodged?
Your AML/CTF compliance officer or another clearly authorised senior decision-maker should make that call, but frontline staff must know when to escalate. In a virtual asset business, support staff, onboarding staff, and transaction monitoring analysts often see the first warning signs. Your procedure should say exactly who reviews the case, who approves the report, and how the decision is documented.

Related guides