If you're an Australian crypto investor still operating on the assumption that the ATO has a vague awareness of your trades, it's time for a recalibration. The ATO has been running a formal crypto data-matching program since 2019, and the current iteration covers every financial year from 2014–15 through 2025–26. Each year it collects records on between 700,000 and 1.2 million individuals and entities. If you've used an Australian exchange in the last decade, you are almost certainly in that data set.

That was the position last year. What's actually new in FY26 is the regulatory scaffolding around it. With the Corporations Amendment (Digital Assets Framework) Bill 2025 passing on 1 April 2026, crypto exchanges and custody providers are now formally subject to AFSL licensing. Reporting is no longer something exchanges do under voluntary cooperation. It is structural.

Here's what that means for your next return, in plain English.

What the ATO already has on you

The data the ATO collects from designated service providers (DSPs) is not a high-level summary. It is a forensic-grade dossier. According to the ATO's own program protocol, DSPs hand over both client identification details and full transaction details.

Client identification covers your name, date of birth, residential address, phone number, email, and even social media accounts linked to your exchange profile. Transaction details include bank account details used for deposits and withdrawals, wallet addresses, transaction dates and times, transaction types, deposit and withdrawal amounts, transaction quantities, and the specific coin types traded.

In other words: if you bought 0.1 BTC on an Australian centralised exchange in March 2019, paid in AUD from your everyday account, and then sent it to an external wallet, the ATO can reconstruct that timeline. The records are kept for five years and are matched against your tax returns automatically.

Designated service providers: the list you'll never see

Here's a quirk of the program. The ATO will not publish the list of which exchanges and custody platforms are designated service providers. The rationale is that naming them would create commercial disadvantage. The practical effect is that you cannot assume any given exchange is outside the net.

What the ATO does publish is the selection criteria. A DSP is a business operating in Australia under Australian law that provides a crypto designated service for individuals or businesses. Designations are reviewed annually. If an exchange operates in Australia, holds Australian customers, and processed crypto transactions during the relevant years, it is structurally eligible. Read into that what you will.

For users of offshore exchanges with no Australian nexus, the ATO's direct data feed is weaker. That is not the same as being invisible. Bank transfers to and from those platforms still leave a trail, and the OECD's Crypto-Asset Reporting Framework (CARF), which Australia has committed to implementing, will progressively close that gap with international information-sharing arrangements.

What's new in FY26: licensing turns reporting into infrastructure

The Digital Assets Framework Bill, which became law on 1 April 2026, introduces two new regulated categories: Digital Asset Platforms (DAPs) and Tokenised Custody Platforms (TCPs). Both require an Australian Financial Services Licence (AFSL) from ASIC. Smaller platforms holding less than $5,000 per customer and facilitating under $10 million in annual transactions are exempt, but the major exchanges Australians actually use are not.

Why this matters for tax: AFSL-holding entities operate under continuous compliance obligations, including disclosure and consumer protection requirements. They are now structurally integrated into Australia's financial services regulatory perimeter rather than operating beside it. The ATO's data-matching program is no longer a one-off arrangement layered on top of voluntary cooperation. It now sits on top of formally licensed financial entities.

Separately, stablecoin payment platforms are being brought into the payments framework via the Treasury Laws Amendment (Payments System Modernisation) Bill 2025. The direction of travel is clear. Crypto is being absorbed into the existing reporting and supervisory architecture rather than treated as an exception.

How the ATO uses the data

The data does not sit in a vault. It is actively matched against tax returns. If your reported activity doesn't reconcile with the records from your DSP, you get a letter.

The first contact is usually a soft prompt. It's an email or letter pointing out that the ATO has data showing crypto activity and asking you to confirm or amend your return. If you correct your return voluntarily at this stage, you typically avoid penalties. Ignore it and the process escalates: further review, audit, automatic assessments, default notices. Interest and penalties get added at the back end.

In 2025 the ATO confirmed it had received data on more than 1.2 million Australian crypto account holders. The prompt letters are not exotic. They are routine, automated, and at this scale, statistically likely if there is any mismatch between your DSP records and your lodged return.

If you've already received one, we've written a full guide on how to respond.

One sharp warning: scammers know the ATO sends these letters and are imitating them. Genuine ATO correspondence will never ask you to make a payment via an unusual channel or click a suspicious link. If in doubt, log into myGov directly rather than following links in an email.

What to actually do before 31 October 2026

Lodgment day for individuals self-preparing their FY26 return is 31 October 2026. If you use a registered tax agent, you may have a later concessional deadline, but only if you're already on their books.

Before then, three priorities.

First, reconcile every account. Pull transaction history from every CEX, DEX, wallet, and chain you've touched in FY26. Crypto-to-crypto trades are CGT events. Staking rewards and most airdrops are ordinary income at the AUD value on receipt. DeFi positions can be both, depending on the mechanics. None of this is optional, and the ATO has the data to check the disposal side.

Second, if you've under-reported in earlier years, amend before they ask. Voluntary amendments through myGov consistently result in better outcomes than waiting for a prompt letter. The general rule: the earlier you correct, the smaller the penalty exposure.

Third, run the numbers with software built for the ATO's specific rules, including personal-use asset exemptions, the 12-month CGT discount, and the income versus investment distinction. Manual spreadsheets across multiple wallets and chains is where reporting errors are born.

Summ handles ATO-formatted reports natively, including the myTax workflow, full crypto-to-crypto reconciliation, NFT and DeFi support, and amendment-ready historical returns going back to 2014–15. The full Australian crypto tax guide walks through everything the ATO expects this year, including CARF-relevant changes ahead.

The bottom line

The "is the ATO actually watching" question is settled. The data is collected. The reporting is now structurally embedded in licensed entities. The matching is automated. What's still in your control is whether you lodge a clean return before they prompt you to.

Import your transactions and generate a free report preview.