Australia May Give Financial Watchdog Power to Ban Crypto ATMs

Australia's cybersecurity minister is drafting legislation that would hand the country's financial intelligence agency the authority to restrict or outright ban crypto ATMs — a move that could reshape the third-largest Bitcoin ATM market in the world just three years after it barely existed. And the two companies with the most to lose control nine out of every ten machines in the country. The proposed law wouldn't impose an immediate ban. Instead, it would arm the Australian Transaction Reports and Analysis Centre (AUSTRAC) with discretionary power to act against "high-risk products" — a category that explicitly includes crypto ATMs. With 2,008 machines now operating across the country, the corporate reality behind Australia's crypto ATM boom is far more concentrated — and far riskier — than it first appears. Three brand names dominate: Localcoin (868 machines), CoinFlip (682 machines), and Bitcoin Depot (267 machines). Both Bitcoin Depot and CoinFlip are major U.S. operators currently facing attorney general lawsuits — Bitcoin Depot in Massachusetts and Iowa, CoinFlip in Iowa — along with civil investigative demands from Missouri. Bitcoin Depot (NASDAQ: BTM) also faces the first-ever securities fraud allegations against a Bitcoin ATM operator. Together, these two U.S. operators account for 949 machines, or 47% of Australia's entire crypto ATM fleet, and both carry the worst regulatory records in the industry.

2,008

Crypto ATMs in Australia (up from 67 in Aug 2022)

2,900%

Growth in Australian crypto ATM count since 2022

3rd

Australia's global rank for crypto ATM installations

90%

Market share held by just three operators (two U.S., one Canadian)

What the Draft Legislation Actually Does

Minister Tony Burke announced the proposal during a speech at Australia's National Press Club in October 2025. The key detail: this isn't a ban. It's a power grant. AUSTRAC would receive authority to restrict or prohibit high-risk products at its own discretion — without needing to go back to Parliament each time. Burke was explicit about the reasoning: authorities are struggling to trace illicit funds flowing through crypto ATMs, and he views the machines as a money-laundering risk disproportionate to their transaction volume.

"I'm not pretending for a minute that everybody who goes in and uses a crypto ATM is a problem, but proportionately what's happening is a significant problem in an area which is much harder for us to trace."

— Tony Burke, Australian Minister for Cybersecurity and Home Affairs

The approach is deliberately structured to avoid legal challenge. By giving AUSTRAC the power rather than mandating a specific outcome, Burke sidesteps the risk of an industry lawsuit contesting a legislatively imposed ban. AUSTRAC would decide independently whether to restrict, regulate, or prohibit machines based on its own risk assessment. The legislation would also cover future "high-risk products" that haven't emerged yet — creating a standing regulatory toolkit rather than a one-time fix. The approach is softer than New Zealand's outright ban but potentially more dangerous for the industry long-term. Operators can plan for a ban; they can't plan for unpredictable discretionary authority that could be exercised at any time based on AUSTRAC's evolving risk assessment.

The Corporate Reality: Two U.S. Operators With the Worst Industry Records Control 47% of Australia's Market

Understanding Australia's crypto ATM market requires understanding who actually controls it — and how much regulatory baggage they carry. According to data from Coin ATM Radar, three brand names dominate: Localcoin (868 machines), CoinFlip (682 machines), and Bitcoin Depot (267 machines). CoinFlip and Bitcoin Depot are separate companies — both U.S.-based, both publicly facing serious enforcement actions at home. Together, they operate 949 machines in Australia, accounting for 47% of the national market.

Australia's Crypto ATM Market — By Operator:

Localcoin: 868 machines — Canadian-based operator headquartered in Toronto. 43% of the market. No known comparable U.S.-style enforcement actions.
CoinFlip: 682 machines — 34% of the market. Facing an AG lawsuit in Iowa, a civil investigative demand from Missouri, and an F-rated Trust Score (20/100) on our operator rankings. Scam/fraud complaints documented.
Bitcoin Depot (NASDAQ: BTM): 267 machines — 13% of the market. Facing AG lawsuits in Massachusetts and Iowa, a civil investigative demand from Missouri, first-ever securities fraud allegations against a Bitcoin ATM operator, and an F-rated Trust Score (0/100) — the lowest of any operator we track.
Others: 191 machines — fragmented smaller operators. 10% of the market.

The concentration is extraordinary. Just three companies — Localcoin, CoinFlip, and Bitcoin Depot — control 90% of all crypto ATMs in Australia. And two of those three are U.S. operators carrying the worst regulatory records in the entire Bitcoin ATM industry. This corporate structure matters enormously for the regulatory analysis. When AUSTRAC evaluates the risk profile of Australia's crypto ATM market, it's looking at two American operators that together hold 47% of the market — both named in the Iowa AG's joint lawsuit, both targeted by Missouri's civil investigative demands, and both carrying documented compliance failures that are among the most severe ever alleged against Bitcoin ATM companies. If AUSTRAC decides to take action against either or both U.S. operators based on their American enforcement records, the impact would be seismic. A decision targeting CoinFlip alone would affect 682 machines — over a third of the national market. An action against Bitcoin Depot would hit another 267. Combined enforcement against both would eliminate 949 machines — nearly half of every crypto ATM in Australia — in one regulatory sweep. Bitcoin Depot is one of two publicly traded Bitcoin ATM operators filing with the SEC (the other being Athena Bitcoin Global, OTCID: ABIT). Both the Bitcoin Depot and CoinFlip brands have been named in the Iowa AG's joint lawsuit, and both received civil investigative demands from Missouri's AG as part of the broadest coordinated U.S. regulatory action in Bitcoin ATM history.

The U.S. Enforcement Records That Followed Them to Australia

The evidence from American enforcement actions against both operators is damning — and both brought their practices to Australia while those enforcement actions were building. Bitcoin Depot faces the worst regulatory record in the industry. The Iowa AG's investigation found that 98.16% of high-value transactions were scam-related. The Massachusetts AG found that 83% of high-value transactions at Bitcoin Depot machines were linked to fraud, with a median victim age of 67. Bitcoin Depot is accused of "drip pricing" — advertising one Bitcoin price on screen, then adding a separate undisclosed fee of 15–25% at the final confirmation. The Massachusetts AG specifically alleges the company charged fees in 7,000+ transactions that exceeded its own posted 23% cap. And the Massachusetts case includes securities fraud claims — a first for the industry — alleging the company misled investors about scam rates. CoinFlip faces its own enforcement problems. The Iowa AG sued CoinFlip alongside Bitcoin Depot, alleging similar patterns of scam facilitation and fee deception. Missouri's AG issued a civil investigative demand to CoinFlip as part of the same coordinated crackdown that targeted Bitcoin Depot, Athena Bitcoin, RockItCoin, and Byte Federal.

Key U.S. Enforcement Findings About the Two Companies Controlling 47% of Australia's Crypto ATMs:

98.16% of high-value Bitcoin Depot transactions in Iowa were scam-related
83% of high-value Bitcoin Depot transactions in Massachusetts were scam-related
Median victim age: 67 (Massachusetts) — predominantly elderly consumers
Drip pricing alleged against both Bitcoin Depot and CoinFlip — fees hidden until final confirmation
7,000+ transactions where Bitcoin Depot charged fees exceeding its own posted 23% cap
Securities fraud claims against Bitcoin Depot in Massachusetts — a first for the Bitcoin ATM industry
Iowa AG sued both Bitcoin Depot and CoinFlip in the same enforcement action
Missouri AG issued civil investigative demands to both operators, along with three others
Both operators carry F-rated Trust Scores — the lowest tier of any operators we track

Now consider the timing. As both Bitcoin Depot and CoinFlip expanded into Australia, they were simultaneously generating the compliance failures that would later justify regulatory action back home. While they were installing machines in Australian convenience stores and shopping centers, Iowa investigators were documenting that 98% of high-value transactions on Bitcoin Depot machines were scam-related. While they were building dominant market share, Massachusetts investigators were finding elderly victims losing their savings. The Australian market gave both operators a fresh runway for growth; their U.S. operations gave regulators the ammunition to shut them down.

Localcoin: Clean on Paper, But Transparency Has Limits

With both Bitcoin Depot and CoinFlip carrying severe U.S. enforcement baggage, Localcoin is the only major player in Australia's crypto ATM market without comparable regulatory problems. Its 868 machines make it the single largest operator by brand — and its regulatory profile is central to the Australian debate. Localcoin is a Canadian-based company headquartered in Toronto that expanded internationally into Australia and other markets. In Canada, the company operates under the country's money services business registration framework, which requires registration with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) — the Canadian equivalent of AUSTRAC. Based on publicly available information, Localcoin has not faced the kind of high-profile attorney general lawsuits or enforcement actions that have hit Bitcoin Depot and CoinFlip in the United States. Canada's regulatory approach to crypto ATMs has generally been less aggressive than the current U.S. multi-state crackdown. Canadian operators must register with FINTRAC as money services businesses and comply with anti-money laundering and know-your-customer requirements, but the kind of targeted enforcement actions — state AG lawsuits alleging scam facilitation, drip pricing, and securities fraud — that have defined the U.S. landscape don't have a direct parallel in Localcoin's Canadian regulatory history. That said, the absence of public enforcement actions is not the same as a verified clean record. Canada's regulatory environment for crypto ATMs is less transparent than the U.S. system, where attorney general actions, court filings, and investigative demands become public records. FINTRAC does not routinely publish compliance findings for individual money services businesses the way U.S. state regulators do.

What we know about Localcoin's regulatory posture:

No known public enforcement actions comparable to those facing Bitcoin Depot and CoinFlip in the U.S.
Registered with FINTRAC as a money services business in Canada — a baseline compliance requirement, not an endorsement
CEO publicly welcomed regulatory dialogue with Australian authorities, taking a cooperative tone
Canadian regulatory transparency is limited — FINTRAC does not routinely disclose individual compliance findings
Absence of public action ≠ confirmed clean record — we cannot independently verify Localcoin's full compliance history across all jurisdictions where it operates

The distinction matters because Localcoin controls 43% of the market. If AUSTRAC's new discretionary authority is exercised, it will need to make judgments about individual operators, and Localcoin's actual compliance record — not just its publicly visible one — will be central to that assessment. Localcoin's cooperative tone with regulators is encouraging, but operators have previously touted their compliance infrastructure publicly while facing lawsuits alleging those same measures were inadequate.

Did Two Operators' Aggressive Expansion Spoil the Market for Everyone?

This is the question Australian regulators, rival operators, and the broader global industry should be asking: would AUSTRAC be drafting legislation to ban crypto ATMs if the two U.S. operators controlling 47% of the market hadn't exported the same practices that drew attorney general lawsuits back home? Consider the timeline. Australia had 67 crypto ATMs in August 2022. By late 2025, it had 2,008. That 2,900% explosion was driven overwhelmingly by aggressive expansion from Bitcoin Depot, CoinFlip, and Localcoin. But of those three operators, only Localcoin arrived without a trail of U.S. regulatory problems — though as noted above, its own compliance record deserves more scrutiny than a simple "clean" label. When two operators controlling 47% of a national market face enforcement actions alleging scam facilitation rates above 80% and systematic fee deception, regulators don't think in terms of surgical strikes — they think in terms of category risk. Two independent compliance failures across 949 combined machines is arguably worse than one, because it suggests the problems are systemic to certain operators rather than isolated incidents.

The uncomfortable pattern:

Two U.S. operators aggressively expand into Australia, deploying a combined 949 machines — 47% of the entire market
Both operators face lawsuits and investigative demands in the U.S. alleging they knowingly profited from elderly scam victims and hid fees through drip pricing
Both carry the worst regulatory records of any Bitcoin ATM operators tracked by this publication
Australian authorities observe money laundering and fraud concerns at crypto ATMs and draft legislation to potentially ban the entire category
Every operator in the country — including Localcoin and smaller players with no comparable compliance failures — now faces potential shutdown

The collateral damage is real. Localcoin, a Canadian operator with 868 Australian machines and no known comparable enforcement history, now faces potential restrictions or an outright ban because it operates in the same market as two operators whose compliance failures made international headlines. Smaller operators — the 191 machines run by various independent companies — face the same existential threat. When regulators decide an entire product category is too risky, clean operators get swept up with troubled ones. This is the fundamental cost of the "move fast, comply later" approach. Bitcoin Depot and CoinFlip together captured 47% of the Australian market through aggressive expansion, and now their documented failures in the U.S. are providing regulators in Canberra with the justification to regulate — or potentially eliminate — the entire Australian crypto ATM industry. The operators who did things right have every reason to be furious. It's a dynamic the U.S. Bitcoin ATM market already knows well. The Massachusetts AG's investigation into Bitcoin Depot, the Iowa lawsuits against both Bitcoin Depot and CoinFlip, the Missouri civil investigative demands targeting five operators simultaneously — each of these actions makes the regulatory environment harder for every operator, including those with clean records like America Bitcoin ATM, Coinhub, and Knack Kiosk.

Industry Response: A Study in Contrasts

A CoinFlip spokesperson pushed back against the proposal, telling Cointelegraph that crypto ATMs are already subject to strict rules and Know Your Customer verification, which includes submitting valid government-issued identification before conducting any transaction. The spokesperson said the machines have cameras, pre-transaction monitoring via blockchain analytics, and real-time scam warnings to help curb bad actors.

"Crypto ATMs are an important bridge between the physical and digital world, taking cryptocurrency out of the cloud and into the physical world using a familiar experience."

— CoinFlip spokesperson, statement to Cointelegraph

CoinFlip's argument that existing safeguards are sufficient carries a particular irony. The company is currently a co-defendant with Bitcoin Depot in the Iowa AG's lawsuit and is responding to a civil investigative demand from Missouri's AG — both of which allege those very safeguards were inadequate. You can't tell Australian regulators "we already have safeguards in place" while American prosecutors are simultaneously documenting how those same safeguards allegedly failed. Localcoin CEO Tristan Fong struck a markedly different tone:

"We have not yet been formally consulted but welcome open dialogue with regulators. We also appreciate the government's interest in moving quickly. The authorities may have reasonably concluded that consultation periods would unnecessarily slow them down in this situation. It is our belief that they are proceeding with good intentions."

— Tristan Fong, CEO of Localcoin

The contrast is telling. Localcoin — the operator without known comparable enforcement actions — focused on collaboration. CoinFlip — a company facing active lawsuits in the U.S. — emphasized self-regulation and argued the machines should be left alone. Fong also flagged that compliance requirements could burden smaller operators — a concern that, if history is any guide, tends to accelerate market consolidation toward larger players who can absorb regulatory costs. In Australia's case, the market is already dominated by three brands controlling 90% of machines. There's little room for smaller players even before new regulations arrive. Bitcoin Depot did not provide a separate public statement in response to the proposal. AUSTRAC had already tightened the screws before this legislative proposal. In June 2025, the agency rolled out new operating rules and transaction limits for crypto ATMs, following earlier crackdowns on non-compliant machines.

Australia Follows New Zealand in a Growing Global Pattern

Australia's move follows New Zealand's outright ban on crypto ATMs, which that country framed as a crackdown on criminal cash conversions. Both Australia and New Zealand are part of the Five Eyes intelligence alliance and share concerns about transnational financial crime. If Australia follows through, it could signal a broader Commonwealth pivot away from crypto ATMs.

Timeline of Global Crypto ATM Regulatory Escalation:

August 2022: Australia has just 67 crypto ATMs; private operators begin rapid expansion
2024–2025: U.S. attorneys general in Massachusetts, Iowa, DC, and Missouri launch investigations and lawsuits against major operators including Bitcoin Depot and CoinFlip
June 2025: AUSTRAC implements new operating rules and transaction limits for Australian crypto ATMs
2025: New Zealand bans crypto ATMs entirely
October 2025: Australia drafts legislation granting AUSTRAC authority to ban or restrict crypto ATMs
January 2026: Missouri AG issues simultaneous civil investigative demands to five operators — the broadest coordinated U.S. action yet

The pattern is clear: jurisdictions are converging on the view that crypto ATMs require either much stronger oversight or elimination. Australia's explosive growth — from 67 machines to over 2,000 in roughly three years — likely triggered the urgency. That kind of expansion, driven substantially by U.S. operators with documented compliance failures, is exactly what draws regulatory attention.

What This Means for Australian Consumers

If you use a crypto ATM in Australia, nothing changes immediately. The legislation is still in draft form, and even if passed, AUSTRAC would need to decide how to exercise its new power. But the trajectory is unmistakable.

For consumers using crypto ATMs in Australia:

No immediate changes. This is draft legislation, not an active restriction. Your local machine is still operational.
Know who operates your machine. Bitcoin Depot and CoinFlip together run 949 machines in Australia — both face serious enforcement actions in the U.S. If AUSTRAC takes action against either operator, those machines could go offline.
Expect stricter requirements ahead. Even before an outright ban, AUSTRAC could impose lower transaction limits, additional identity verification, or mandatory cooling-off periods.
Be aware of fees. Both Bitcoin Depot and CoinFlip face fee transparency lawsuits in the U.S. Check what you're actually paying — the displayed Bitcoin price and the actual price you pay often differ by 15–25%.
Scam risk is real and documented. If anyone — a government official, tech support agent, romantic interest, or investment advisor — tells you to deposit cash at a Bitcoin ATM, it's a scam. Full stop. See our consumer protection resources.
Save your receipts. If restrictions are eventually imposed and machines are removed, having transaction records will be important for any future claims or tax documentation.

What This Means for Operators

The Australian situation crystallizes a problem that extends well beyond one country: when operators with poor compliance records dominate a national market, they poison the regulatory environment for the entire industry. Two U.S. operators controlling 47% of a market — both facing active lawsuits at home — create severe contamination risk. For Bitcoin Depot (NASDAQ: BTM), Australia represents another regulatory front opening while it's still fighting on multiple others. The company is defending against attorney general lawsuits in Massachusetts and Iowa, responding to a civil investigative demand from Missouri's AG, and contending with the first-ever securities fraud allegations against a Bitcoin ATM operator. Now its 267 Australian machines may fall under AUSTRAC's discretionary authority to restrict or shut down. As a publicly traded company already facing securities fraud allegations from the Massachusetts AG, Bitcoin Depot's obligation to disclose material risks is under intense scrutiny. A potential AUSTRAC action affecting its Australian operations would almost certainly qualify as material information requiring SEC disclosure. For CoinFlip, the stakes are even larger in pure machine count. With 682 machines in Australia — more than twice Bitcoin Depot's footprint — CoinFlip has the most direct exposure to any AUSTRAC enforcement action. The company is already a co-defendant in the Iowa AG's lawsuit and responding to Missouri's civil investigative demand. An AUSTRAC action could force CoinFlip to choose between the compliance costs of satisfying a new Australian regulatory regime and the financial hit of exiting a market where it operates nearly 700 machines. For Localcoin and smaller Australian operators, the lesson is brutal: your compliance record may not save you when your competitors' failures give regulators the political mandate to act against the entire category. But Localcoin's strategic positioning — publicly welcoming regulatory engagement, maintaining a cleaner regulatory profile — at least gives it a credible argument for differential treatment if AUSTRAC opts for targeted rather than blanket action.

Key operator takeaways:

Market concentration by troubled operators amplifies regulatory risk. Bitcoin Depot and CoinFlip together control 47% of Australia's market — and both face active U.S. enforcement actions. A single AUSTRAC decision targeting these operators could eliminate nearly half of all machines.
Bad actors create industry-wide risk. Australia's proposal targets all crypto ATMs, not just those operated by companies facing U.S. lawsuits. Clean operators pay the price for those who didn't invest in compliance.
Compliance history follows you across borders. Operators can no longer outrun bad behavior by expanding internationally. Regulators share intelligence, and your enforcement record in one jurisdiction becomes evidence in another.
The "toolkit" model may spread. If Australia's flexible-authority approach is seen as effective, expect other jurisdictions to replicate it. This is worse for operators than a one-time ban, because it creates ongoing uncertainty.
Proactive engagement matters. Localcoin's approach — publicly welcoming regulatory dialogue — is the right strategic move. Arguing machines should be left alone while facing active lawsuits alleging compliance failures is not.
Securities disclosure obligations intensify. Bitcoin Depot (NASDAQ: BTM) will need to assess whether the Australian proposal constitutes a material risk requiring SEC disclosure — compounding its existing securities fraud exposure from the Massachusetts AG case.
CoinFlip's 682-machine Australian footprint is its largest single-country regulatory risk outside the U.S. If AUSTRAC acts, CoinFlip faces a binary choice: spend heavily on compliance or abandon a major international market.

For operators without Australian exposure, the lesson is still relevant. Regulatory contagion is real. When one major jurisdiction acts, others follow. The U.S. multi-state crackdown, New Zealand's ban, the UK's FCA enforcement, and now Australia's draft legislation form a pattern that isn't going away. And the pattern accelerates every time a major operator's compliance failures make headlines in a new country.

What to Watch Next

The critical question isn't whether Australia gives AUSTRAC this power — Burke has signaled clearly that it's coming. The question is what AUSTRAC does with it, and whether the damage to the Australian market could have been avoided if the two dominant U.S. operators had taken consumer protection as seriously as market expansion. AUSTRAC already imposed new operating rules and transaction limits in June 2025, suggesting it prefers graduated regulation over outright prohibition. But the political environment has shifted. New Zealand's ban created a regional precedent, and the growing body of evidence from U.S. enforcement actions — documenting scam rates as high as 98% on Bitcoin Depot machines — gives AUSTRAC data to justify aggressive action. Watch for four things. First, whether AUSTRAC evaluates Bitcoin Depot and CoinFlip based on their U.S. enforcement records — and if so, whether it treats the two operators as a combined risk factor given that they jointly control 47% of the market. Second, whether either company begins quietly reducing its Australian footprint before the legislation passes. Companies fighting AG lawsuits in multiple U.S. states while staring down potential AUSTRAC action have every incentive to cut their exposure; if Australian machine counts start dropping, that's the signal the regulatory math no longer works. Third, whether Localcoin and smaller operators can differentiate themselves enough to survive a regulatory action that their competitors' behavior provoked — and whether Localcoin's own compliance record holds up under the closer scrutiny that AUSTRAC's new authority would bring. Fourth, whether Bitcoin Depot's SEC disclosures begin reflecting the Australian regulatory risk. If the company's next quarterly filing doesn't mention the AUSTRAC proposal as a material risk factor, that omission itself could become part of the securities fraud narrative already developing in Massachusetts. A market that went from 67 machines to 2,008 in three years did so largely on the back of aggressive expansion by operators who now face enforcement actions on two continents. Australia's government has decided that era is over. The industry's remaining question is whether the operators who did things right will be punished alongside those that didn't — or whether AUSTRAC will be sophisticated enough to distinguish between the companies that created this problem and those that were just trying to build a legitimate business.

Australia May Give Financial Watchdog Power to Ban Crypto ATMs — and Two Companies Control 90% of the Market