Inside Australia’s Historic AML Reform with AUSTRAC’s Brad Brown

Ari Redbord (00:02):

I'm Ari Redbord and this is TRM Talks. I'm Global Head of Policy at TRM Labs, we provide blockchain intelligence software to support law enforcement investigations and to help financial institutions and cryptocurrency businesses mitigate financial crime risk within the emerging digital asset economy. Prior to joining TRM spent 15 years in the US federal government, first as a prosecutor at the Department of Justice, and then as a Treasury Department official where I worked to safeguard the financial system against terrorist financiers, weapons of mass destruction proliferators, drug kingpins, and other rogue actors. On TRM Talks, I sit down with business leaders, policymakers, investigators, and friends from across the crypto ecosystem who are working to build a safer financial system.

(00:52):

On today's TRM Talks, I sit down with Brad Brown of Australian regulator AUSTRAC. But first, Inside the Lab, where I share data-driven insights from our blockchain intelligence team. On today's Inside the Lab, we're talking World Cup. While Spain is our champion, the reality is that the World Cup was a playground for scammers who built infrastructure even weeks before a single match kicked off. TRM was tracking fake ticketing sites, fixed matched betting schemes, phishing kits, and opportunistic meme coins riding the tournament's weight. This is a pattern we have seen before at every major global event. For context, roughly $35 billion flowed to scam-linked wallets in 2025, part of a record $158 billion in total illicit crypto activity. As of early June, TRM had identified four scam addresses tied to three live World Cup themed operations. The dollar amounts were not a lot, under $1,700 combined, but that's the nature of event-driven scams early on.

(02:05):

One ticketing scam on Polygon took in most of its money in a single day, suggesting a viral push drove a shortburst of victims. A fan token called World Cup was trading on one exchange with no connection to FIFA, impersonating the tournament directly, and proceeds were routing through cross-chain bridges towards Tron, a pattern tied to an estimated $1.9 billion in all-time scam funds. The point is timing. The infrastructure exists for this months before kickoff, which means there's a real window to disrupt cash out points before losses scale. Fans should be skeptical of anything not coming directly from FIFA or any other official sites and report suspicious addresses to Chainabuse or the FBI's IC3. The World Cup might be over. Spain may be the champion, but we are going to see this pattern play out over and over again from the Super Bowl to the Olympics and beyond.

(03:03):

And now AUSTRAC's Brad Brown. Today I am joined by the National Manager for Regulatory Operations for AUSTRAC, Brad Brown. Brad, thank you so much for joining TRM Talks.

Brad Brown (03:18):

Pleasure to be here, Ari. Thank you.

Ari Redbord (03:19):

If I could kick us off, I feel like there's always an interesting journey to a role like you have really overseeing a lot of the regulatory work for AUSTRAC in Australia. Would you tell me about your journey a little bit? How did you get interested in this topic?

Brad Brown (03:32):

Yeah, well, I'm going to say I've had an incredibly rewarding career. It's a career over that now spans decades. So it just means I'm showing my age, but I started within law enforcement in policing with quite a lengthy background in intelligence before I joined AUSTRAC in 2004. So I joined within our intelligence responsibilities within AUSTRAC. But over the journey and over the course of multiple years, I've also worked in our policy, which is an important consideration in terms of the anti-money laundering reforms that are just upon us. Also worked in our education space, in our international engagement, in work in terms of our Fintel Alliance and our partnership with businesses, and now more recently in terms of our regulatory responsibilities and supervisory engagements with businesses over the last four to five years. So I think it's the culmination of all of those parts of my career that sort of lead me to where I am now.

(04:40):

It's probably the focus and the engagement I've had with businesses that helps shape how I focus upon the work that I'm doing. I really believe in, even though I'm the regulator, I also really believe in the partnerships that we necessarily have with businesses and working with businesses in the first instance to achieve the right outcome. Perhaps my background leads to one consideration is that I'll also, where it's necessary, take action and I'll be assertive and necessarily expect that businesses improve and I'll support my teams in doing that as well, which is perhaps what we need to do as a regulator.

Ari Redbord (05:13):

It's really interesting in terms of your law enforcement background as well. I spent about 11 years as a federal prosecutor here in the US and then went to Treasury where I was more of a regulatory role. You don't meet a lot of people who have the combined law enforcement plus regulatory policy piece. Tell me a little bit about your law enforcement career, and then maybe how has it informed the work that you do as a regulator today?

Brad Brown (05:35):

I mean, interestingly, I'd probably say it hasn't in too many ways informed my regulatory approach. I mean, I was certainly in more of a state-based policing agency in Australia within Queensland. I think what has more informed the way I approach my current role and the role that I have as a regulator is more all of the years that I've had, and that's probably more than a decade now where I have actually worked directly with businesses on policy, directly with businesses on what they need to help them understand what they need to do. And I think that's actually really shaped how I approach my engagement with businesses more so now than perhaps anything to do with where I was in policing and law enforcement.

Ari Redbord (06:23):

We have a pretty sophisticated audience of compliance professionals, global regulators, law enforcement. It's really a cool mix. But would you just spend a moment or two talking about the role of AUSTRAC in the financial space within Australia and the mandate?

Brad Brown (06:38):

Yeah, so AUSTRAC has two primary functions. It's Australia's Financial Intelligence Unit. So as a financial intelligence unit, we collect and analyze information and generate insights and intelligence, which we then provide to law enforcement, national security, and other partners within Australia and at times internationally to assist with investigations. We are also Australia's anti-money laundering and counter-terrorism financing regulator, and that's the key part of that role that I play. And in that, we necessarily ensure that businesses are complying with the legislation in Australia. That might mean primarily that we engage in education and providing advice, et cetera, but also we'll certainly check people's homework, so to speak, and ensure they're doing the right thing. And then in certain cases where we consider there's more serious harms or systemic failures, that's where we will take a harsher approach and utilize the enforcement powers that AUSTRAC also has.

Ari Redbord (07:42):

Talk me through your role day-to-day.

Brad Brown (07:44):

Yeah, so I have multiple teams, have a large group of staff that necessarily work with me, give or take. It's about a hundred. And we conduct assessments of businesses that are regulated in Australia. So we will engage with them. We will, as I say, check their homework to actually assess whether they have put the obligations in place under law in place. That means we'll go and speak with them. We'll ask them questions, we'll inspect files, we'll interview key people in key roles at different points in time. We'll leverage our data that we have available to us in AUSTRAC to actually determine whether there are businesses that are outliers. We'll engage with our intelligence colleagues to determine whether there's anyone that we think is involved in any activity that we would actually want to see stopped and take action in that regard. So multiple teams, normally they're focused on different industries.

(08:42):

So we have a team, for example, that focuses on our payments and remittance and virtual assets. We have a team that's focused on banking and the like. We've had teams that have been focused on all of the gambling and consideration on casinos and corporate bookmakers, so sports betting.

Ari Redbord (09:02):

Getting a little more granular. It's interesting. Would you brief this group here a little bit on really the first AML or biggest AML reforms in 20 years dropped really just a few months ago? Would you walk us through what those reforms look like?

Brad Brown (09:15):

Yeah. Well, first and foremost, an incredible amount of complexity and complexity in relation to the changes that we had to put from legislation into policy and then into practice. So a whole lot of people involved, a whole lot of new systems on AUSTRAC's end, but a whole lot of engagement. It looked like, I'm going to say, the most comprehensive level of engagement and co-design with businesses that AUSTRAC has ever done in its history. Massive amount of credit has to go to our CEO, the boss of our organization and senior executive. We also looked at some of the most innovative thinking and things to put in place to assist businesses to understand the risks that they face in relation to criminal activities, but also necessarily how to apply. So AUSTRAC has now a world first in terms of program starter kits, which will help businesses, we hope, start the journey of what they have to do to be regulated.

(10:24):

And as a final point about that briefing, it's maintaining pace over probably what has been 18 months. 18 months in delivery, 18 months of engagement to get us to a point to have businesses ready, we hope, from the 31st of March when some of the obligations commenced, and more recently the 1st of July, which was the key date in the legislative timetable.

Ari Redbord (10:49):

Walk me through from a high level perspective, or what would you consider to be key takeaways from this tranche?

Brad Brown (10:57):

I mmean, the most important takeaway and change is certainly that we have expanded the regulation in Australia. So our regulation and our responsibilities now cover other businesses that we previously didn't regulate. So those that are providing legal services, accounting services, real estate services, trust and company service providers, and dealers in precious metals and stones. So that's the most significant because that has a major impact around the population that we regulate. So previously it was about 19,000. It's certainly growing every day and above 50,000 at the moment in terms of that population that we'll have responsibility for. We also expanded considerations around our virtual assets or digital currencies, crypto, whichever word you wish to use, and to align that more with the global obligations that we necessarily have to have regard to.

Ari Redbord (11:54):

It's interesting. Talk me through that a little bit. You even changed the way you refer to these types of businesses, whether they're exchanges, they were called in Australia's policy documents, digital currency exchanges. You've moved to FATFs, the way the Financial Action Task Force refers to these types of services, VASPs, virtual asset service providers. I constantly joke that depending on where I am or what audience, I never know exactly what to say. Distributed ledgers, services, CASPs in Europe, we have all kinds of crazy names for them in the United States. So FATF has really always been where I landed. And obviously this is where AUSTRAC specifically wanted to get having implemented FATF standards for years. Talk me through maybe specifically what this means for virtual asset service providers in Australia.

Brad Brown (12:41):

I was going to say, I wish it was just a name change, but no, it's not. There's a little bit more

Ari Redbord (12:45):

There's some substance here too.

Brad Brown (12:48):

So you're absolutely correct. There's more to it. And I think, as I mentioned, first and foremost, we are now more in line with the Financial Action Task Force standards, and that relates to particularly what services that are being offered by a ever-expanding and maturing financial sector, that is the virtual asset services providers. So previously in Australia, we regulated otherwise the on and off ramps. So cash to crypto, crypto back to cash. So that's now been expanded to include virtual asset to virtual assets, the safekeeping and wallets, and also the transfer of virtual assets and making value available to others. So all of those services added up led to us necessarily incorporating in the naming as it is in those standards. And importantly, also for virtual asset providers, like other businesses that we regulate, the regime now is also been adjusted to have that outcomes focus.

(13:53):

So that means really focusing upon the risks and harms that your business might be exposed to and how you respond to that. And that's going to be an important part of how we look at businesses going forward.

Ari Redbord (14:05):

I love that. It's interesting, we do have a lot of current regulators on this podcast on TRM Talks, and we are starting to see, at least from my empirical evidence of this on the show, seeing consistency around that. That globally we're seeing this outcomes, true risk-based approach. It used to be just something you would say, and now it's like we really need to move away from this checked box regime where compliance teams are just doing what they think we need to see or want to see to doing how you really mitigate risk on their platforms. Does that sound right from the conversations you're having with your global counterparts as well?

Brad Brown (14:39):

Very much so. And if it's not only with our global counterparts, it's really just thinking that we have within Australia. I mean, what do we want to see? What do we want to see minimized? We want to see that we have an impact on harms to the community. We want to have an impact on businesses that might be doing the wrong thing. So that's certainly squarely in our focus, our focus as an intelligence agency and our focus as a regulator. And absolutely agree. Other countries that we engage with definitely squarely are also focused on making sure that we protect where we can protect and we minimize the risk where we can minimize it.

Ari Redbord (15:22):

I think it's really one of the most important shifts that we've seen over the last couple of years.This has moved for regulators to really push beyond this sort of checkbox model for a lot of compliance teams. It's interesting, I feel like you have a number of roles, and part of that is, hey, you're the regulator, compliance is critical, you're looking at enforcement, but there's this other piece where you're, as an FIU, trying to mitigate risk. You want to make sure that bad actors aren't engaging with your regulated entities. When you look at the risk landscape out there, the threat landscape, what are really some threats that are top of mind for you from an illicit finance perspective?

Brad Brown (15:56):

First and foremost, I mean, again, AUSTRAC Australia has generated national risk assessments on money laundering, terrorism financing and proliferation financing. And those risks and those threats that are outlined certainly continue to stand today. I think what the most considerable elements are is just the shifts and the efforts that criminals are making in terms of exploiting the channels. The greater level of sophistication, far more digitally savvy and necessarily, which means that we have to keep pace with that and look to have an impact. As I mentioned, so the digitally enabled crime is incredibly relevant for us and the considerations that we have in place. We're having a look at necessarily implications of serious and organized crime and organized criminal groups that continue to impact our payment system, virtual assets and their transfers. So these are key threats that our intelligence capability continues to be aware of and continues to look to address.

Ari Redbord (17:07):

It's so interesting when I think about the threat landscape in Australia, and a lot of this is just sort of watching the way AUSTRAC operates in the space, scams are obviously very clearly top of mind. You've done a lot of work there over the last few years. We've seen a lot of guidance. There's been public service announcement type of activity. Talk me through how you're dealing with scams. I mean, this is a global scourge, but it's very clearly having a dramatic effect in Australia.

Brad Brown (17:32):

Yeah, I mean your point about global is certainly right. I think just for context, I think again, the Financial Action Task Force has done some work on this in the more recent times, and nearly every country that is being assessed by them is highlighting fraud as a major predicate crime to money laundering. I think the more recent statistical indications are, give or take about US $500 billion potentially globally is the impact of fraud in 2024, 25. And that plays out in Australia. That plays out in terms of necessarily the risks of frauds and scams. I think in terms of our response, our response is not just AUSTRAC. Our response is more whole of government. The scams prevention framework is being put in place in Australia. We're looking to leverage the telecommunications, the banking. Again, partnering to ensure that we can have an impact and protect as many people from becoming victims of scams.

(18:40):

I think that's, again, what it boils down to is there's an incredible amount of harm that is caused to individual people through scams. Many of them can be industrialized to such a level. They are very organized in terms of their operations and their targeting, but what it does is it hurts people.

Ari Redbord (19:01):

It's a huge focus for us at TRM. It's something we're thinking about all the time. How can we work with law enforcement? How can we work with regulators to stop this activity? It's funny, my wife is a dermatologist. She's a skin cancer surgeon. And for years she has told me about the public awareness campaigns that Australia has done in that space. The slip, slop, slap, the sunscreen. Kids are wearing rash guards on the beaches, which we just started doing here. What you're describing here makes me think of something that Australia is really very good at, and that is getting the word out to citizens about this type doing potential harm to themselves.

Brad Brown (19:36):

Messaging to the public is absolutely critical. And the more people become aware, the more they're aware of what they have to be aware of to assist themselves or potentially not be influenced, conjoled, tricked is incredibly important. And there is a lot of that messaging occurring, whether it be through AUSTRAC. But again, I'm going to say more broadly across Australia.

Ari Redbord (20:00):

No one agency, no one country can deal with this alone. I mean, we're dealing with transnational criminal organizations that are doing this stuff at scale. Absolutely. AUSTRAC supervises something like 19,000 businesses across all these different sectors. I mean, that is crazy. How do you think about private sector engagement when you're dealing with this many entities and helping to really push risk-based compliance with your regulated entities?

Brad Brown (20:29):

Yeah, I mean our focus is on intelligence-led and risk-based supervisory activities. So we leverage an incredible amount of information, intelligence and data that AUSTRAC receives. We have a significant amount of information that we get from the businesses that we regulate that helps us necessarily refine our understanding of who may have a greater level of exposure to the risks that we're trying to address. We engage with businesses frequently, so that just builds our understanding and knowledge of necessarily where we need to deploy our resources at the right point in time. We certainly do not treat all businesses the same. That's a key thing. So where we think there is a greater level of harm, you might have a greater level of scrutiny, but there's also a very large and the vast number of businesses that we regulate that our focus is more around uplift, education, guidance, communication through this, through our messaging that we provide to actually then reach the many.

(21:36):

And some of our actions and engagements will necessarily touch upon the few. And in those engagements, as I said earlier, that's where we sometimes ask the tougher questions, dig a bit deeper, identify who their customers are and whether and how they're dealing with them appropriately.

Ari Redbord (21:54):

It's interesting in answering that question, you went right to intelligence immediately. That's absolutely the key to how we engage. We think a lot about intelligence sharing, public-private, private-public. We operate something called the Beacon Network, which is the largest public-private information sharing interdiction seizure network within the crypto ecosystem. Australian Federal Police are a member of the Beacon network. They share alerts with these exchanges. Combining your law enforcement background with what you do or have done at AUSTRAC, talk me through intelligence sharing, how we can really use it at scale to stop these bad actors.

Brad Brown (22:32):

Yeah, I mean we probably have an example in AUSTRAC that we've established the Fintel Alliance, which is our public-private partnership, and I think it's had some great success in leveraging the effort and the information that's available to a whole lot of private sector and other law enforcement partners. What we learned from that, we then try to provide a level of insight to which we provide to the entire regulated population and publicly. They're available on AUSTRAC's websites, and we do different indicators, papers, and financial crime guides in relation to a range of both criminal activities, but also methodologies that criminals are looking to exploit. So I think that is a way that we provide information and regular information to the masses ultimately. And similarly, our national risk assessments and more recently our annual updates also really provide a level of information to businesses that helps them.

(23:35):

There's also an increasingly a level of engagement between law enforcement with businesses directly, and obviously there's a great opportunity for businesses to learn from that direct engagement. Oftentimes it might be through particular questions that come their way that they necessarily have to respond to, but they learn. That means they can adapt and understand maybe different risks that they face that they need to be cognizant of in their work.

Ari Redbord (24:05):

My guess is that this podcast is going to be very well received and certainly listened to by compliance professionals within Australia, certainly at regulated entities. Maybe a message to them in terms of how AUSTRAC wants to work with compliance teams, regulated entities, how they should potentially engage with you.

Brad Brown (24:26):

Yeah, I mean, first and foremost, I think our message is that we are seeking to set businesses up for success and that we achieve that by providing an incredible amount of guidance and information that's either through messaging like this or through other forms of education, through e-learning packages that AUSTRAC has. So we want businesses to understand their risks and apply their obligations based on the knowledge that we have provided them. So I think that's first and foremost. We have articulated over the course of the last 12 months a pretty clear expectation that, again, we want businesses to manage their risks. We want people to necessarily delve in and understand the risks that their businesses face. And where that doesn't occur is where there's necessarily a greater likelihood that you'll necessarily be called upon by myself or my teams as necessarily the regulator and ask questions.

(25:30):

But that is a critical and core component of our regime. Understand the risks, apply the obligations. And we have indicated particularly as it relates to the reform, that we don't expect everyone's going to be perfect. We're not looking for perfection as well. What we're looking for is best efforts. We're looking for people to apply that to necessarily give it a go, to understand what they need to do about their obligations to report suspicious matters to AUSTRAC, because that then helps what we actually do with law enforcement. Again, it's that sort of journey between being exposed to activity, looking, learning, and then actually taking action. And then that action might lead to us doing something with it.

Ari Redbord (26:15):

Terrific. I'm going to let you get out of here with this one more, and that is when you are not leading teams at AUSTRAC, helping provide clarity to the space, enforcement, compliance, what do you do for fun? What do you like to do to, I don't know, let off a little steam?

Brad Brown (26:32):

Yeah. Well, for myself personally, I'm a lover of sport. And you watch more sport when you actually can't play it. So that's necessarily all that works at the

Ari Redbord (26:41):

Moment. What are your sports? What are your teams?

Brad Brown (26:44):

Yeah, no, the Football World Cup's on at the moment, so that's worth a watch at the moment. But my normal team, so certainly the Australian Football League, which is not a round ball, but an oval-shaped ball in Australia is a key to my winter sports. And then a cricket ball and watching cricket is certainly my summer sport of choice to watch. But when I'm not doing that, I'm also now thinking about grandparenting duties when the grandson comes and visits. So that's plenty of time and effort now.

Ari Redbord (27:22):

I love that. When you played, what sports did you play? Was it also cricket and football?

Brad Brown (27:28):

Yeah, I played cricket back in the day, but definitely not that good.

Ari Redbord (27:32):

All right. I've got one more question for you, and in the context of your grandchildren, it's probably perfect. So when I was in Australia, I got turned on to these. They're very good just alone, I've decided, but the slam is just, it's a transformative food. I found a place that sells them here. These are not the ones I got in Australia. Are you a fan? Is this something you would've done with your kids? Jonno Newman on my team and Angela Hong and others, we were doing these out one morning after coffee, after a run. Tell me any fun stories about these guys?

Brad Brown (28:07):

Well, I'm going to say everyone eats Tam Tams, so that is absolutely. I should also say that one of the things I do now is actually go to the gym. So I'm actually trying to have less sugar.

Ari Redbord (28:17):

The less Tam Tams. All right. I also felt bad that I was going to bring these and show you them, but I wasn't going to send you some. But now I don't feel as bad about that for sure.

Brad Brown (28:26):

Plenty of shops here as well.

Ari Redbord (28:29):

Yeah, what I did is I ate a lot of tim tams, but I also ran around the opera house a lot when I was in Sydney that day. It's a very nice thing today. Absolutely gorgeous. Hey, Brad, thank you so much for joining TRM Talks, and thank you for all the work you do on behalf of the Australian people, and really look forward to continuing the conversation with you.

Brad Brown (28:45):

Thank you very much.

Ari Redbord (28:50):

I though Brad made some really critical points here, and there are a number of key takeaways. I think the biggest one for me is we're really seeing a global move towards this idea of outcomes, to this idea of a true risk-based approach that what's expected of compliance professionals not to just check the box or give the regulator the answer they want. It's, "Hey, how can we actually mitigate real risk that could potentially be on your platform? How can we actually stop bad actors? And how can we enable outcomes?" And I think we're seeing this global shift. We're hearing a lot of this from FATF, the Financial Action Task Force, all the conversation I'm having with FinCEN. It's really the same. We've seen speeches from US Treasury Secretary on this. Brad immediately went there where he's really pushing for this move away from checkbox compliance to something much more outcomes-oriented, actually risk-based.

(29:41):

So that was my biggest takeaway today from the conversation. But I would also say that AUSTRAC is obviously laser-focused as are a number of different key agencies across Australia on scams. And this has been a years long campaign to not only disrupt and go after the bad actors, but really help Australians from being victims of scams, and I think that it's obviously such a huge priority. So a really interesting conversation today with Brad Brown. On the next TRM Talks, I sit down with head of digital assets for Morgan Stanley, Amy Oldenberg.

(30:19):

If you love the show, leave a review wherever you're listening to it, and follow us on LinkedIn to get the latest news on crypto regulation, compliance, and investigations.

TRM Labs (30:30):

TRM Talks is brought to you by TRM Labs, the leading provider of blockchain intelligence and anti-money laundering software. This episode was produced in partnership with Voltage Productions. The music for this show was provided by iKOLIKS.

Ari Redbord (30:46):

Now, let's get back to building.