Buying an AUSTRAC-registered business: no approval, harder diligence

Vocabulary first, because it drives the deal mechanics. AUSTRAC registers businesses; it does not license them. Registration under Part 3A of the AML/CTF Act 2006 is an anti-money-laundering fitness gate, not a prudential licence, and there is no capital requirement anywhere in the regime. A registration is not a certificate you hand over; it is a status attached to the company. Acquiring the company acquires the status - and the obligations that come with it.

For a share sale, that means there is nothing to pre-approve. Unlike a change-of-control regime built around a statutory pre-clearance window, AUSTRAC sets no gate a buyer must pass before completing. The trade-off is that the regulator keeps every lever it needs after money has changed hands: notification duties, fitness testing, renewal, and cancellation for dormancy. The gate does not disappear. It moves past closing.

The first post-closing duty is fast. A registered business must tell AUSTRAC of changes to its circumstances that could affect its registration - and that expressly includes any change to its beneficial owners or key personnel - within 14 days of the change occurring (Act ss 75M(4), 76P; AML/CTF Rules 2025, ss 4-34). A beneficial owner is defined on AUSTRAC's forms as someone who owns or controls more than 25% of the business. A remittance network provider relaying changes for its affiliates has a shorter clock of 7 days.

There is a practical wrinkle in mid-2026. AUSTRAC's digital form for updating registration details was still in development as of July 2026, and its stated posture is record-and-wait: keep a record of the change and update the details once the form is available, and it will not take enforcement action in the meantime. A buyer completing now should document the intended notification and the date the change occurred, not assume the duty is met because no form yet exists.

AUSTRAC may suspend or cancel a registration whenever it considers the business poses a significant money-laundering, terrorism-financing or other serious-crime risk. The named grounds reach the new owners directly: where key personnel (including associates, including offshore) are charged or convicted, face adverse management-related proceedings, no longer have the required operational capability or experience, or where materially false or misleading information was given (Act ss 75C(2), 75G(1), 75H(1), 76E(2), 76J(1), 76K).

The three-year renewal is where this becomes concrete. Renewal is not administrative; it is a fresh assessment against the same fitness criteria, and a buyer inherits the seller's renewal date. The window opens 90 days before expiry, and a registration that is not renewed lapses and is removed from the register. In other words, the buyer's own history, structure and programme are tested in full at a date the buyer did not choose.

It is tempting to read the absence of a pre-approval as speed. It is closer to the opposite. In a pre-clearance regime the regulator reads the buyer's file, tests it against fixed criteria inside a bounded window, and either approves or objects before completion - the scrutiny is front-loaded and, once cleared, largely settled. Compare the UK approach in our section 178 walkthrough, where a 60-working-day clock even carries deemed approval on silence.

AUSTRAC front-loads none of that. No one signs off on the transaction, so nothing about it is settled by closing. The risk of a post-closing suspension or cancellation, on grounds that reach the buyer's own people and the entity's real activity, sits entirely with the buyer. That is why diligence here has to run deeper than a registry check: the seller's compliance substance, activity reality, reporting history, open AUSTRAC correspondence and renewal date all have to be verified before completion, because no regulator decision stands between the buyer and the downside.

AUSTRAC has said, publicly and specifically, that it polices the sale of registered shells. In its 29 April 2025 "use it or lose it" release, CEO Brendan Thomas warned that inactive businesses are "vulnerable to being bought and co-opted by criminals", and AUSTRAC said it aims to limit the improper sale and use of registered exchange businesses. It can cancel a registration where it has reasonable grounds to believe the business is no longer carrying on the registrable activity.

The enforcement is not theoretical. AUSTRAC published more than ten VASP and DCE registration cancellations between November 2025 and June 2026, three refusals to renew on a single day in January 2026, and a suspension in April 2026 that hit both the VASP and the remittance registers at once - a direct warning for dual-registration lots. That is why SKY7's live Australian lot, an AUSTRAC DCE and IRD dual registration offered through a share sale, is presented for verification rather than as a shelf. A dormant target is not a shortcut.