Reporting failures, not fraud, just shut down 96 crypto ATMs

Australia’s financial intelligence regulator just pulled 96 crypto ATMs offline in one move. According to reporting from Blockonomi and Nine.com.au, the regulator flagged what officials described as “basic” anti-money laundering and counter-terrorism financing (AML/CTF) reporting failures at Cryptolink and shut the entire network down. No hack, no fraud, no sanctions breach. Reporting obligations that keep a cash-to-crypto network compliant simply weren’t being met. 

Here’s what actually failed in the Cryptolink case, and four questions you can use to check your own program before a regulator asks them for you. 

Key findings: 

• Australia’s regulator shut down an entire crypto ATM network over reporting gaps, not fraud or a security breach. 

• The failures reported fall into ordinary categories: suspicious matter reporting, threshold transaction reporting, and customer due diligence. 

• Crypto ATMs carry higher AML risk than exchange onboarding because cash-to-crypto conversion happens fast, with weaker identity verification. 

• AUSTRAC signaled this risk category well before Cryptolink. 

• Four questions can tell you whether your program has the same gaps right now. 

What actually happened to Cryptolink? 

According to Blockonomi and Nine.com.au, Australia’s AML/CTF regulator ordered Cryptolink’s entire 96-machine ATM network offline after identifying reporting failures the regulator itself called basic. 

What counts as a basic AML/CTF reporting failure? 

Reporting obligations for crypto ATM operators generally fall into a few core categories: 

• Suspicious matter reporting. Flagging and reporting transactions that show signs of money laundering or terrorism financing, not just transactions above a dollar threshold. 

• Threshold transaction reporting. Filing reports for cash transactions above the regulatory threshold, within the required window. 

• Customer due diligence. Verifying who is using the machine, and refreshing that verification over time rather than only at first use. 

• Ongoing transaction monitoring. Watching for patterns across multiple transactions and multiple machines, not just single events. 

An ATM carries more of this risk than a typical exchange onboarding flow. It converts cash to crypto in minutes, often with limited identity checks and no transaction history to compare against. Regulators keep circling back to ATM networks for exactly that reason. 

AUSTRAC already flagged this 

Crystal’s country guide to cryptocurrency regulation and financial crime risk in Australia noted that many crypto ATMs in the country were operating with limited oversight. A webinar Crystal hosted on Australia’s crypto regulatory landscape named crypto ATMs a medium-to-high money laundering risk months before this shutdown. Back in February 2025, Crystal covered AUSTRAC suspending or declining to renew licenses for nine digital currency service providers, with over 50 investigations open at the time. Cryptolink is the same risk category, now enforced against an entire network at once. 

Frequently asked questions 

What is AUSTRAC and why does it matter outside Australia? AUSTRAC is Australia’s financial intelligence and AML/CTF regulator. Its enforcement actions signal where other regulators are likely to focus next, particularly on cash-to-crypto access points like ATMs.. 

Can a VASP be shut down for reporting failures alone, without fraud or a hack? Yes. Cryptolink’s network was suspended over reporting gaps alone, with no allegation of theft or fraud involved. 

How often should an AML/CTF program be reviewed? At minimum annually, and immediately after any material change to products, jurisdictions served, or transaction volume. 

Where can I read more about Australia’s crypto AML rules? See Crystal’s country guide to cryptocurrency regulation in Australia for the full regulatory picture. 

The takeaway 

Cryptolink’s failures were basic, which is exactly why they’re worth checking against your own program today. The four questions above are the same ones a regulator will eventually ask. Answer them on your own schedule, not during an investigation. If you want a second set of eyes on your own monitoring and reporting workflow, that’s what Crystal Expert is for. 

For informational purposes only. Not legal or compliance advice.