AUSTRAC & High-Risk Payments in Australia: A Compliance Guide for Merchants

TL;DR: AUSTRAC,  Australia's financial intelligence and AML/CTF regulator, oversees all designated service providers in Australian payment processing, including digital currency exchanges, remittance dealers, and high-risk payment processors. High-risk merchants operating in Australia must understand whether their business triggers AUSTRAC registration, what AML/CTF obligations apply, and which payment providers are best positioned to serve their vertical compliantly in 2026.
Australia has one of the most sophisticated anti-money laundering frameworks in the Asia-Pacific region, and one of the most active enforcement track records. AUSTRAC (the Australian Transaction Reports and Analysis Centre) has levied some of the largest AML fines in global history, including a $1.3 billion AUD penalty against Westpac in 2020 and a $700 million AUD settlement with Commonwealth Bank in 2018.
For high-risk merchants targeting Australian consumers or processing Australian payments, AUSTRAC compliance is not background noise. It is a primary operational requirement that shapes which payment providers will work with you, what your merchant account approval process looks like, and what ongoing reporting obligations your business carries.

Who Is AUSTRAC and What Does It Regulate?

AUSTRAC: operates under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act), Australia's primary AML legislation. It has two mandated functions:
Regulatory and supervisory function: AUSTRAC registers and supervises Reporting Entities, businesses providing designated services that carry AML/CTF risk.
Financial intelligence function: AUSTRAC collects, analyses, and disseminates financial intelligence from transaction reports submitted by Reporting Entities, sharing intelligence with domestic and international law enforcement.
Who Qualifies as a Reporting Entity?
Any business providing designated services under Schedule 1 of the AML/CTF Act must register with AUSTRAC and comply with its AML/CTF programme obligations. For high-risk merchants and payment providers, the most relevant designated services include:
- Remittance services: transferring money or value on behalf of customers
- Digital currency exchange (DCE): exchanging Australian dollars for cryptocurrency or vice versa
- Stored value card services: issuing or redeeming prepaid payment cards
- Bullion dealing: buying and selling gold or other precious metals
- Merchant banking/acquiring services: providing acquiring services to merchants (this captures payment gateways and acquirers directly)
- Loan and finance services: (limited scope relevant to payments)
The merchant acquiring designation is significant: it means any payment gateway or acquirer processing Australian payments is itself a Reporting Entity with AUSTRAC obligations, independent of the merchant's own status.

AUSTRAC's AML/CTF Act Reforms: Phase 2 (2024–2026)

The AML/CTF Act is undergoing its most significant reform since 2006, the Phase 2 reforms, legislated in 2024 and coming into force progressively through 2026. These reforms expand the scope of regulated entities significantly.
What Phase 2 Adds
Phase 2 extends AUSTRAC reporting obligations to a range of previously unregulated professions including lawyers, accountants, real estate agents, and trust and company service providers. While these professions are not payment providers themselves, they are frequently involved in the corporate structures through which high-risk merchants and offshore merchants operate, meaning their enhanced due diligence requirements directly affect merchant onboarding processes.
Key Phase 2 changes relevant to high-risk payment processing:
- Tranche 2 professional services: Lawyers and accountants involved in payment structuring or corporate structures for high-risk merchants now carry their own AUSTRAC obligations, affecting the due diligence they apply and the documents they can certify
- Enhanced UBO transparency: The reforms strengthen beneficial ownership disclosure requirements, making it harder for complex offshore structures to obscure controlling interests
- Technology neutrality: The reformed Act applies to digital asset service providers more explicitly, closing gaps that existed for DeFi-adjacent services

AUSTRAC Registration: What High-Risk Merchants Need to Know

Do You Need to Register Directly with AUSTRAC?
Like Canada's FINTRAC framework, the question of direct AUSTRAC registration is critical, and the answer depends on whether the high-risk merchant is providing a designated service themselves.
Business Type
AUSTRAC Designated Service
Registration Required
Crypto exchange / DCE
Digital currency exchange
✅ Yes
Remittance / money transfer
Remittance dealing
✅ Yes
Prepaid card issuer
Stored value card services
✅ Yes
Online gambling operator
Not directly designated*
⚠️ State/territory licence required
Nutraceuticals / supplements
Standard retail
❌ No
Adult content subscription
Standard digital services
❌ No
Forex broker
Via AFSL - ASIC regulated
✅ ASIC (not AUSTRAC directly)
iGaming merchant (payments only)
Not designated as merchant
❌ No - but payment provider is
 
Online gambling operators in Australia are primarily regulated under state and territory gambling legislation and the Interactive Gambling Act 2001 (IGA) at the federal level. They are not directly designated under the AML/CTF Act, but their payment processors are.
Registration Process for Designated Service Providers
For high-risk merchants that do provide designated services (DCE, remittance):
- Register via AUSTRAC's online portal, AUSTRAC Online
- Provide business details, principals, UBOs, and service descriptions
- AUSTRAC processes registration, typically 5–10 business days
- Registered entities receive an AUSTRAC registration number
- Registration must be renewed annually
Registration is free. The compliance programme obligations that follow are where the real investment occurs.

AUSTRAC AML/CTF Programme Obligations

All AUSTRAC Reporting Entities must maintain a documented AML/CTF Programme, a written set of policies, procedures, and controls addressing the entity's specific money laundering and terrorism financing risks.
Part A - AML/CTF Programme (Standard)
The standard programme covers:
- ML/TF risk assessment: documented assessment of the risks specific to the business, its customers, and its products
- Board and senior management oversight: formal governance structure for AML/CTF
- AML/CTF Compliance Officer: a designated responsible individual
- Employee due diligence: screening and training of staff
- Customer identification programme (CIP): Know Your Customer procedures
- Ongoing customer due diligence: transaction monitoring and customer risk assessment updates
- Independent review: external audit of the AML/CTF programme at defined intervals
Part B - KYC Identification Procedures
Part B covers the specific identification and verification requirements for different customer types:
- Individual customers: Photo ID (passport, driver's licence) + proof of address; biometric verification for digital onboarding
- Corporate customers / merchants: Company registration, director identification, UBO verification back to natural persons
- Trusts: Trust deed, trustee identification, beneficiary identification
- Foreign customers: Enhanced verification; additional screening against international sanctions and PEP lists
For offshore merchants seeking Australian merchant accounts through Australian-regulated payment providers, the Part B verification requirements apply at onboarding, expect to provide full UBO chain documentation, company registration from the home jurisdiction (apostilled where required), and director ID verification.
Transaction Reporting Obligations
All AUSTRAC Reporting Entities must submit:
Report Type
Trigger
Deadline
Threshold Transaction Report (TTR)
Cash transaction ≥ $10,000 AUD
Within 10 business days
International Funds Transfer Instruction (IFTI)
Any international wire in or out
Within 10 business days
Suspicious Matter Report (SMR)
Any suspicious transaction or behaviour
Within 3 days (24 hours for terrorism financing)
 
IFTIs are particularly relevant for offshore merchants and payment providers, every international payment in or out of Australia triggers an IFTI report. AUSTRAC receives tens of millions of IFTIs annually and uses them as the primary data source for financial intelligence analysis.

High-Risk Verticals in Australia: Regulatory Context

iGaming and Online Gambling
Online gambling in Australia operates under a complex federal-state framework:
- The Interactive Gambling Act 2001 (IGA) prohibits unlicensed online casino-style gambling to Australian residents at the federal level
- Sports betting and racing are permitted under state/territory licences, making Australia one of the world's largest licensed sports betting markets (approximately $7.4 billion AUD in annual wagering, 2025)
- State-licensed sports betting operators can access Australian payment processing, but must work with payment providers willing to service licensed gambling operators
Payment processing for gambling in Australia is managed primarily through Visa, Mastercard (credit cards for gambling was banned in 2020, debit only), PayID (Australia's real-time payment rail), and specialist gambling payment gateways.
Cryptocurrency and Digital Assets
Australia is a leading Asia-Pacific crypto market, with approximately 25% of Australian adults having owned or used cryptocurrency (2025 Roy Morgan survey). DCE registration with AUSTRAC has been mandatory since 2018 and is enforced, AUSTRAC has cancelled the registrations of multiple non-compliant DCEs.
The Australian Treasury is progressing a crypto asset licensing framework that goes beyond AUSTRAC registration, a dedicated digital assets licence regime expected to be finalised in 2025–2026, which will add a regulatory layer above AUSTRAC registration for crypto payment processing businesses.
Forex and Financial Services
Forex and CFD brokers operating in Australia require an Australian Financial Services Licence (AFSL) from ASIC (the Australian Securities and Investments Commission), separate from AUSTRAC registration. AFSL-licenced firms are also AUSTRAC Reporting Entities through their remittance and financial service activities.

Top Payment Processors for High-Risk Merchants in Australia (2026)

 
Provider
High-Risk Verticals
AUSTRAC Status
Key Strength
Elavon (US Bank)
E-commerce, select high-risk
Via bank affiliate
Scale, global connectivity
Windcave (formerly Payment Express)
iGaming, e-commerce, subscriptions
AUSTRAC Reporting Entity
Strong APAC coverage
Braintree (PayPal)
Digital goods, subscriptions
AUSTRAC Reporting Entity
Developer-friendly, PayPal integration
Latitude Financial
Consumer finance, retail
AFSL + AUSTRAC registered
Australian domestic focus
Paidy / Zip
BNPL + high-risk e-commerce
AUSTRAC Reporting Entity
BNPL specialist, local presence
Nuvei
iGaming, crypto, forex
AUSTRAC + international
Best global + Australian coverage
CorvusPay
Adult, nutraceuticals, offshore
International with AUS acquiring
High-risk specialist
 
PayID: Australia's real-time bank transfer system (operated by NPP Australia), is essential domestic infrastructure. Like Canada's Interac, PayID transactions carry no chargeback mechanism and are widely used for gambling, digital goods, and subscription payments. Access requires a relationship with an Australian-licensed payment provider that participates in the NPP (New Payments Platform).

Pros and Cons of Australian High-Risk Payment Processing

Pros
- Large, high-spending market: Australia's average consumer e-commerce spend was approximately $2,320 AUD per capita in 2025 (Australia Post Inside Australian Online Shopping Report)
- PayID availability: Real-time, chargeback-free domestic payment rail, gold standard for high-risk merchants managing dispute ratios
- Clear AUSTRAC framework: Australia's AML regime is rigorous but well-documented and consistently enforced, navigable with proper compliance investment
- Licensed iGaming access: State-licensed sports betting creates a compliant pathway for gambling payment processing
- Strong crypto framework: AUSTRAC DCE registration provides a clear compliance pathway for crypto-adjacent high-risk merchants
- English-language market: Low operational overhead relative to multilingual Asia-Pacific markets
Cons
- Credit card gambling ban: Australian credit cards cannot be used for gambling transactions since 2020, limits processing options for wagering merchants
- AUSTRAC enforcement intensity: Australia has one of the highest AML fine records globally; non-compliance risk is real and expensive
- Phase 2 reform complexity: Expanding AUSTRAC scope creates new compliance obligations for professional service providers involved in high-risk merchant structures
- IGA federal prohibition: Online casino-style gambling to Australian residents is federally prohibited, limits the iGaming market to sports betting and racing for licensed operators
- Currency conversion: Offshore merchants settling in AUD face conversion costs; AUD is a lower-liquidity currency than USD/EUR
- Geographic distance: Time zone and operational distance create support challenges for non-APAC-based payment providers

Frequently Asked Questions

Q: Does an offshore merchant need to register with AUSTRAC directly? A: Only if the offshore merchant is providing a designated service, DCE, remittance, stored value, to Australian customers. Standard e-commerce merchants (selling goods or digital content) are not directly designated. Their payment providers are the Reporting Entities. Always confirm with a licensed Australian AML consultant.
Q: Can high-risk merchants accept PayID payments from Australian customers? A: Yes, through an Australian-licensed payment provider that participates in the NPP. Offshore merchants cannot hold a PayID directly but can access PayID payment collection through a local PSP intermediary.
Q: What is the penalty for operating as an unregistered DCE in Australia? A: Operating an unregistered digital currency exchange in Australia is a criminal offence — maximum penalties include imprisonment and/or significant fines. AUSTRAC has cancelled DCE registrations and pursued criminal referrals for serious non-compliance.
Q: How does AUSTRAC compare to FINTRAC in Canada? A: Both are financial intelligence units administering AML/CTF frameworks with MSB/DCE registration requirements. AUSTRAC is generally considered to have a stronger enforcement track record, evidenced by the billion-dollar penalty actions against major Australian banks. Both require similar compliance programme structures.
Q: Are BNPL (Buy Now Pay Later) services regulated by AUSTRAC? A: BNPL regulation in Australia is evolving. The Australian government passed legislation in 2024 bringing BNPL under the National Consumer Credit Protection Act, but BNPL providers are generally not AUSTRAC Reporting Entities unless they also provide designated services. This may change as Phase 2 reforms progress.
Q: Which Australian payment method has the lowest chargeback risk for high-risk merchants? A: PayID, Australia's real-time bank transfer system, carries no card scheme chargeback mechanism, making it the lowest-risk payment method for high-risk merchants managing Visa VAMP or Mastercard ECP ratios. It is the Australian equivalent of PIX in Brazil or iDEAL in the Netherlands.

Final Thoughts

Australia presents a commercially attractive, regulatory complex environment for high-risk merchants. The AUSTRAC framework is rigorous, but it is also clear, consistently enforced, and navigable with the right compliance infrastructure and payment provider relationships. The merchants who succeed in the Australian market are those who invest in understanding their AUSTRAC obligations before they are needed, not after an enforcement action prompts the question.
→ Compare AUSTRAC-registered high-risk payment providers and Australian merchant account solutions on TheFinRate's payments directory. https://thefinrate.com/austrac-high-risk-payments-in-australia-a-compliance-guide-for-merchants/