The ATO Knows About Your Crypto — Here's Exactly How

Every year, Australian taxpayers who haven't declared their crypto gains discover the same uncomfortable fact: the ATO already knew. The agency has run a formal crypto data-matching program since 2019, and by 2026 it has been expanded and supplemented with increasingly sophisticated analytical tools. If you've used an AUSTRAC-registered Australian exchange and not declared your gains, the probability that the ATO has the data to find you is high and getting higher.

Where the ATO gets the data

The primary source is direct data collection from designated service providers — the category covering AUSTRAC-registered Digital Currency Exchanges. Australian exchanges are legally required to report customer data to the ATO under the designated service provider reporting regime. The information reported typically includes your name, address, date of birth and TFN, account creation and verification details, transaction history, and AUD values at time of transaction. This data is cross-referenced against tax returns.

How far back can they go?

The standard amendment period for income tax is four years from the date of assessment. The ATO can go back further — up to six years — where it reasonably suspects tax avoidance. In cases involving deliberate fraud, there is no time limit. The ATO treats cryptocurrency as an area of heightened non-compliance risk.

What triggers an audit

Data matching flags are the primary trigger, but not the only one. The ATO also conducts risk-profiling based on declared income versus lifestyle indicators, receives tip-offs, and uses data from overseas jurisdictions through international information exchange agreements. Australia is a signatory to the Common Reporting Standard (CRS) — relevant for Australians who use offshore exchanges.

What to do if you haven't declared

The ATO operates a voluntary disclosure program. Taxpayers who come forward before the ATO contacts them receive significantly reduced penalties. Interest charges still apply, but penalties for a voluntary disclosure can be as low as 5% of the shortfall, versus up to 75% for deliberate evasion. Engage a registered tax agent with crypto experience before the ATO makes contact.

Record-keeping in practice

The ATO requires records to be kept for at least five years from the date of the relevant transaction. For crypto: the date of each transaction, AUD value at the time, type of transaction, wallet address, and fees paid. Crypto tax software like Koinly or CoinLedger automates most of this by connecting to your exchange accounts via API.

This is general information only, not tax advice. Speak to a registered tax agent for advice specific to your circumstances.