ATO Crypto Audit Checks: What Data Matching Can Reveal

The ATO does not publish a secret checklist that automatically triggers a crypto audit. It does publish a crypto-asset data-matching protocol, transaction rules and detailed record requirements. The real compliance risk is a return that cannot be reconciled to exchange, bank and wallet evidence. This guide replaces invented thresholds and scare claims with the checks an Australian investor or crypto business can perform before lodging or amending a return.

There is no official “top 10 ATO crypto audit triggers” list

Tax administrations use data, risk models and case-specific information. A mismatch can lead to a reminder, a request for information, an amendment discussion, a review or a formal audit; it does not prove evasion and does not guarantee an audit. The ATO says data matching is used both to identify non-compliance and to educate taxpayers who may have made errors.

That distinction matters. Statements such as “more than AUD 250,000 of crypto triggers an audit,” “50 trades triggers an audit” or “the ATO always gives 21 days to reply” are not supported by the published crypto protocol. Portfolio value, trade count and response time are not universal statutory trigger thresholds.

What the ATO crypto data-matching program collects

The ATO’s published crypto-assets data-matching protocol covers the 2014–15 through 2025–26 financial years. A 2024 Commonwealth Gazette notice estimates that the ATO will obtain records relating to roughly 700,000 to 1.2 million individuals and entities for each of the 2023–24 through 2025–26 years.

Published data items include customer identifiers, bank-account and wallet details, transaction dates and times, transaction types, deposits, withdrawals, quantities and coin types. The ATO can compare that information with registrations, lodged returns and its other records. The protocol’s stated aims include finding clients who may have failed to report crypto disposals and checking registration, lodgment, reporting and payment obligations.

Exchange data is not a tax calculation. Deposits, withdrawals and gross trade volume do not equal taxable gain. The taxpayer still has to connect transfers between owned accounts, determine cost base, convert values to Australian dollars, classify income and apply the correct investor or business treatment.

Ten discrepancies worth fixing before lodgment

1. Platform activity but no reported disposal

A return with no CGT or business result can conflict with records showing sales, swaps, gifts or purchases of goods and services. The ATO crypto transaction guidance lists those events as common disposals. Small gains are not ignored simply because they fall below AUD 10,000.

2. Reporting only AUD cash-outs

Crypto-to-crypto swaps can be CGT events even when no Australian dollars enter a bank account. The ATO’s investor toolkit also calls out wrapping and liquidity-pool deposits. An exchange export containing BTC-to-ETH trades cannot be reconciled to a report that includes only fiat sales.

3. Transfers mistaken for sales—or sales hidden as transfers

A movement between wallets under the same beneficial ownership is generally not a disposal. A transfer to another person, protocol or contract may be. Match owned-wallet sends to receipts by asset, quantity, time and transaction hash. Do not label every withdrawal “transfer” without proving destination ownership.

4. Missing Australian-dollar valuations

The ATO requires the value in Australian dollars at the time of each transaction. A report that uses year-end prices, current prices or unexplained USD totals cannot support cost base or proceeds. Keep the original quote currency, AUD conversion rate, source and timestamp.

5. Cost base that does not trace to evidence

For each disposed lot, preserve purchase or acquisition evidence plus incidental costs allowed in the cost base. Missing opening balances, duplicated imports and exchange closures can create zero or inflated basis. A software number is not evidence unless its lot trail can be reproduced from source records.

6. CGT discount applied to the wrong lots

Individuals and eligible trusts may qualify for the 50% CGT discount on relevant assets held for at least 12 months, subject to the detailed rules. Companies do not receive the general 50% discount, and revenue-account/business inventory does not become discounted capital merely because it was held for a year. Lot dates and taxpayer type must agree with the claim.

7. Investor and business treatment mixed together

A high trade count alone does not conclusively create a business, and calling yourself an investor does not settle the facts. Commercial purpose, repetition, organisation, scale and business-like operation contribute to the overall impression. Business crypto may be trading stock with proceeds and costs on revenue account; investment crypto is generally handled under CGT. See the investor-versus-trader guide.

8. Staking and airdrop income omitted or counted twice

The ATO says qualifying staking rewards and established-token airdrops can be ordinary income when received. That AUD income amount generally becomes part of the asset’s later CGT cost base. Omitting the receipt understates income; including it as income and then giving the token zero basis overstates the later gain.

9. Capital losses that lack a real economic disposal

Capital losses must arise from actual events and be supported. Artificial arrangements that sell and rapidly reacquire the same or substantially the same exposure mainly to generate a tax loss can raise Part IVA wash-sale concerns. A genuine market sale is not invalid merely because it produced a loss, but purpose and surrounding steps matter. Review losses separately with the Australian crypto-loss guide.

10. Derivatives, DeFi and fees forced into spot CGT

Perpetual close P&L, funding, margin interest, staking, liquidity positions and spot disposals are economically different. An engine should not treat informational opening events or position snapshots as realized income. Likewise, network fees paid in crypto can themselves reduce a holding and have CGT consequences. Keep raw fields and classify the actual event rather than relying on one generic “trade” label.

Existing ATO matching is not the same as CARF

The old article incorrectly said Australian exchanges already report “via CARF.” Australia already has a domestic crypto data-matching program. CARF is the OECD’s separate framework for standardized annual reporting and international exchange of crypto information.

Australian Treasury ran a CARF implementation consultation from November 2024 to January 2025 and later described implementation as future work while considering feedback. The public Treasury CARF consultation page says further consultation may address draft legislation and reporting formats. Do not label current ATO exchange data as CARF unless the applicable Australian legislation, commencement date and reporting period are confirmed.

This distinction does not reduce present compliance risk. The ATO’s domestic matching already obtains detailed customer and transaction data, and international information can also arrive through other legal channels.

ATO crypto record requirements

The ATO’s recordkeeping guidance requires details for each crypto asset and transaction. Keep:

• receipts for purchases, transfers and disposals;
• date and time, purpose and counterparty or wallet address;
• exchange statements and complete exports before accounts close;
• the AUD value and valuation source at transaction time;
• wallet records, public addresses and evidence that you controlled them;
• agent, accountant, legal and eligible tax-software cost records;
• staking, airdrop, mining and other acquisition evidence;
• smart-contract, liquidity-pool, bridge and wrapper transactions; and
• calculations, classifications and elections used in the return.

The standard retention rule is five years from the later of when the record is prepared or obtained, when the relevant transaction or act is complete, or the year of the CGT event. Records may need to be kept longer to cover the applicable amendment period. They must be in English or translatable to English and may be paper or electronic.

A practical pre-lodgment reconciliation

1. Build the source register: list every exchange, broker, wallet, chain, DeFi protocol and closed account used during or before the year.
2. Import complete histories: include prior-year acquisitions needed for current cost base—not only the current financial year.
3. Remove true duplicates: use exchange IDs, transaction hashes and fill IDs; do not delete similar trades merely because values match.
4. Match owned transfers: preserve network fees while preventing a self-transfer from becoming a false sale and receipt.
5. Classify events: separate investment disposals, ordinary income, business inventory, derivatives, loans, fees and non-taxable information rows.
6. Resolve missing basis and price: mark unresolved items “not calculable” rather than replacing missing evidence with zero.
7. Reconcile totals: explain differences between platform turnover, wallet flows, bank deposits and reportable gains or income.
8. Review tax profile: confirm residence, entity, investor/business status and CGT discount eligibility.

CoinTaxReporting can perform deterministic matching, AUD conversion, lot calculation and issue flags, but a clean dashboard is not sufficient if source data is incomplete. The final report should identify unresolved basis, valuation and classification issues instead of concealing them inside a numeric total. See the Australian filing workflow for return labels.

Correcting an already lodged return

If you discover omitted or incorrectly classified crypto, do not wait for a hypothetical audit threshold. Individuals can generally request an amendment through ATO online services, the ATO app, a paper form or a registered tax agent, subject to the applicable time limit. The ATO states that an amendment increasing tax is generally treated as a voluntary disclosure and may receive concessional penalty treatment, although tax and applicable interest remain relevant.

If the ATO has already notified you of a review or audit, disclose errors to the officer handling it and follow the specified process. Do not describe an amendment as a guaranteed penalty waiver. Keep the original report, corrected report, source changes and explanation of each adjustment.

What to do if the ATO contacts you

1. Verify the communication through an official ATO channel and check for impersonation scams.
2. Read the scope, requested records and response date; there is no universal 21-day crypto rule.
3. Preserve all source data and do not rewrite or delete wallet histories.
4. Reconcile the ATO-listed platforms and periods to your return.
5. Explain transfers, missing basis, business treatment and valuation methods with evidence.
6. Use a registered tax agent or qualified adviser when classification, penalties or multiple years are involved.

Respond with complete, relevant information and ask for clarification if the request is unclear. An unsupported narrative is weaker than a transaction schedule tied to exchange and blockchain evidence.

Official sources

• ATO crypto-assets data-matching program protocol to 2025–26
• Commonwealth Gazette notice: crypto-asset data-matching program
• ATO crypto-asset transactions
• ATO keeping crypto records
• ATO capital gains tax overview
• Australian Treasury CARF consultation

FAQ: ATO crypto reviews and audits

Editorial status: reviewed 1 September 2026 against the official ATO, Treasury and legislation sources linked above. This article provides general information, not individualized tax advice.

Disclaimer: This article is for general informational purposes only and does not constitute tax advice. For individual tax advice, consult a licensed tax professional.