AUSTRAC's 2026 external audit of Airwallex

analysisOn 22 January 2026 Bradley Brown, AUSTRAC's National Manager, Regulatory Operations, acting as delegate of its chief executive, issued Airwallex Pty Ltd a notice under subsection 162(2) of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006. He stated that he had reasonable grounds to suspect that the company, a reporting entity, had contravened and/or was contravening sections 36, 41, 81 and 82 of the Act, and required it to appoint an external auditor. The notice records a suspicion that justifies an audit; it is not a finding that the Act was contravened. The company must engage the auditor within 14 days after AUSTRAC authorises a nominated individual, and the report is due to AUSTRAC within 180 days of the engagement. The audit covers 1 January 2024 to the date of the notice and must assess the company's money laundering and terrorism financing risk assessment, its transaction monitoring program (including child sexual exploitation risks), suspicious matter reporting under section 41, enhanced and ongoing customer due diligence, know-your-customer controls including duplicate accounts, and governance and board oversight under section 81. Failure to comply is an offence and a civil penalty provision. Airwallex said an external auditor was appointed in February 2026, with the final report expected during the 2026 financial year; AUSTRAC has indicated that the report will inform what, if any, further action it takes and will not be made public, and no result is recorded up to October 2026. ^{1 2 3}

analysisAUSTRAC announced the order the same day, describing the audited business as the Airwallex Designated Business Group, which according to the group's disclosure consists of Airwallex Pty Ltd, Airwallex SVF Pty Ltd and Airwallex Capital Pty Ltd. Its chief executive Brendan Thomas said AUSTRAC takes such action where it suspects serious non-compliance, and that it was concerned that Airwallex's transaction monitoring program had not been attuned to the full range of risks it faces, that the company had not demonstrated an acceptable understanding of who its customers are and what reporting may be required, and about how well it identifies and reports suspicious matters and oversees these obligations. The audit is at Airwallex's expense, and its results are to inform AUSTRAC whether further regulatory action is required. These are the regulator's concerns at the start of an audit, not its conclusions. An Airwallex spokesman said the company would cooperate and welcomed the audit as a transparent opportunity to independently validate its program, that it had zero tolerance for financial crime, that any customer unable to comply is promptly terminated, and that it expected the audit to validate its framework; the company added that AUSTRAC had audited its program in 2024 and an independent external auditor had validated its Australian program in 2025. ^{1 2 3 4 5}

analysisAUSTRAC's deputy chief executive Katie Miller told an Australian newspaper that Airwallex was one of several payment companies the agency had looked at, that a key concern was the use of payment platforms by "money mules" moving money for crimes such as online child sexual abuse, and that because Airwallex onboards customers almost entirely remotely the agency saw such platforms as a high-risk channel for illicit funds. She described sector risks and the agency's concerns without saying that wrongdoing had been established, and said Airwallex had cooperated, provided the information requested and made a range of changes and improvements in response to the agency's concerns. ⁴

analysisAn Australian newspaper reported that AUSTRAC ordered the audit because it suspects that payments by criminals for child sexual abuse material are hidden among the money flowing through Airwallex's systems, and an Australian financial newspaper reported that AUSTRAC had started investigating Airwallex six months before January 2026 over suspicions the platform was being used to fund child sexual abuse. The newspapers themselves state that these claims have not been proven; AUSTRAC's own notice and release refer to monitoring, reporting and governance obligations, with child sexual exploitation among the risks the monitoring must cover. Airwallex said its financial integrity systems are world class, and Jack Zhang defended the company on LinkedIn, writing that good decisions come from first principles and primary sources rather than headlines or hearsay. ^{1 2}

analysisA social-media post by an anti-money laundering consultancy, summarising a paywalled newspaper report, said that users from China had allegedly opened "suspicious" Airwallex accounts through New Zealand entities, bypassing stricter Australian controls and prompting scrutiny from AUSTRAC. The underlying report is not among the retained records, the post does not name the Airwallex company involved, and no regulator statement in the case mentions New Zealand accounts. ³

analysisAirwallex told a news agency that AUSTRAC had audited its anti-money laundering and counter-terrorism financing program in 2024 and that an external, independent auditor had validated its Australian program in 2025, and a spokesman told an Australian newspaper that the 2024 audit found it had implemented appropriate systems and controls; no report of either audit is among the retained records. After the notice Zhang wrote on LinkedIn that Airwallex had never planned an IPO in 2026 "or even next year", and the company said it had no set timeline for listing; these are statements of intention, not a decision of any authority or exchange. ^{1 2 3 4}

analysisIn April 2026 the group appointed Elana Rubin as independent chair of its Australian board and Sir Bill English as an independent non-executive director; the announcement does not name the legal entity whose board this is, and a Wesfarmers notice of September 2026 lists English as a director of Airwallex Holdings (Australia) Pty Ltd and chairman of Airwallex (New Zealand) Limited, both since March 2026, and not of Airwallex Pty Ltd. The group also appointed Carolyn Renzin, based in New York, as Chief Regulatory and Compliance Officer to lead its global regulatory and compliance program; a fintech trade publication reported plans to increase compliance spending by 70 per cent and the governance team by 50 per cent in 2026. An Australian financial newspaper wrote that Rubin and English would provide governance oversight to the group as it deals with the AUSTRAC investigation, a characterisation the company disputes: Lucy Liu said the appointments were not a direct response to AUSTRAC: "It's not really about AUSTRAC. It's about improving our governance as we scale." ^{5 6 7 8 9}

analysisAirwallex said in May 2026 that an external auditor had been appointed in February 2026, with the final report expected during the 2026 financial year, and that it was co-operating fully with AUSTRAC and the auditor. An Australian newspaper reported in April 2026 that the audit was progressing in line with the regulator's timeframes, that the report would inform what further action, if any, AUSTRAC takes, and that it would not be made public. In April 2026 Liu said the audit was ongoing and that Airwallex had co-operated fully; in August 2026 she described the probe as industry-wide rather than company-specific, and Zhang said he believed it was part of an industry-wide effort to monitor fintech companies. AUSTRAC's published list of external-audit notices shows four issued in 2026, to Airwallex Pty Ltd, Binance Australia, MHITS Limited and Bankstown District Sports Club, and earlier notices including WorldRemit and Western Union in 2025; Airwallex Pty Ltd is the only Airwallex company on the list. No outcome of the audit is in the retained records up to October 2026. ^{1 2 3 4 5}