Canberra finally answered a question the industry has been shouting into the wind for years: do digital asset platforms live inside Australia’s existing financial services regime, or outside it? The draft answer, released this week, is unambiguous—inside. Crypto service providers that hold or move customer tokens are to be brought under the Australian Financial Services Licence (AFSL) umbrella, with ASIC in the driver’s seat and a tailored rulebook for custody, staking, and settlement. It’s a pragmatic choice, and it reads like policy written by people who’ve watched a few cycles and prefer plumbing to platitudes.
What changes, precisely
- Two new “financial products”: the bill inserts digital asset platforms (DAPs) and tokenised custody platforms (TCPs) into the Corporations Act—a crisp way to scope exchange, brokerage, wallet/custody, staking, wrapping, and transactional functions that involve holding client tokens. If it looks like a platform that safekeeps and moves assets at a client’s direction, it’s in scope.
- AFSL or bust (with a low-value carve‑out): operators must hold an AFSL and meet general obligations—act efficiently, honestly, fairly; design and distribution; audits—plus new, platform‑specific standards for custody and transaction/settlement. A narrow exemption exists for small, low‑risk operators (≤ A$5,000 per client and < A$10 million annual flow, with notice to ASIC).
- Supervisors realigned: ASIC becomes the primary conduct regulator for licensed platforms; AUSTRAC keeps AML/CTF registration and oversight; APRA’s stored‑value facility regime is flagged for stablecoins, pushing fiat‑backed tokens toward bank‑grade rules. Translation: one set of hands on conduct, another on money‑laundering risk, and prudential guardrails for “digital cash.”
The obligations with teeth
- Custody and controls: ASIC minimum standards for safekeeping (segregation, key management, reconciliation, incident response), enforceable platform rules, and a DAP/TCP Guide—a tailored, plain‑English disclosure in place of a PDS for these products.
- Staking, wrapping, and infrastructure services: the draft explicitly captures staking services, issuance of wrapped tokens, and core token‑infrastructure operations when client assets are held or used—closing the “we’re just software” loophole that failed consumers in past blowups.
- Penalties sized for grown‑ups: civil penalties scale to the greater of A$16.5 million, three times the benefit, or 10% of annual turnover—numbers chosen to dissuade casual non‑compliance and make enforcement bite.
Timelines and transition
Treasury opened consultation on September 25 with submissions due October 24, signaling intent to move briskly from exposure draft to a final bill. In parallel, ASIC is updating INFO 225 (its crypto guidance) and has granted targeted, temporary relief to intermediaries distributing Australian‑issued stablecoins to ease the migration into the new regime—a bridge intended to prevent “cliff effects” while licences are processed.
What this fixes (and what it doesn’t)
- Fixes: regulatory perimeter fog. If a business holds client tokens and provides transaction functions, it needs an AFSL and must meet custody and conduct standards known to courts, auditors, and insurers. It also gives banks and payment rails fewer excuses to de‑bank legitimate, licensed operators.
- Doesn’t fix: issuer wild‑west. The draft sets obligations on platform operators, not token issuers per se, and it leaves non‑financial digital assets outside the AFSL net unless other laws bite. International venues courting Australians remain a supervision challenge unless they localize or geofence.
The industry read, without the PR gloss
Good platforms get what they’ve been asking for: clarity that unlocks institutional onboarding and insurer coverage, at the cost of real compliance. Marginal shops face a choice—professionalize quickly or exit. Expect consolidation, AFSL partnerships (white‑labelling under a principal licence), and a cottage industry of DAP/TCP Guides, custody audits, and ASIC‑ready controls. The small‑operator carve‑out is tight by design; it protects hobby projects and pilots, not quasi‑exchanges wearing a hoodie.
A quick checklist for teams recalibrating to AFSL
- Map scope: every function where client tokens are held or moved—trading, brokerage, staking, wrapping, settlement. If a client’s private key risk sits with the platform, assume in‑scope.
- Build the triad: AFSL licensing plan (fit and proper, competence, financial resources), ASIC‑grade custody standards (segregation, MPC/HSM controls, reconciliation), and a DAP/TCP Guide that users can actually read.
- Align with AUSTRAC and plan for APRA touchpoints if stablecoin exposure is material (stored‑value facility implications).
- Prepare for penalties as a control design input, not a footnote—governance that survives audit, board‑level oversight, and breach reporting muscle memory.
The bigger picture
Australia has chosen to integrate crypto market plumbing into its existing financial law rather than mint a parallel universe. That makes courts happier, banks calmer, and investors less likely to wake up to “suspended withdrawals” on a Monday. It also says something cultural: the experiment is over; the infrastructure is graduating. The next headlines won’t be about draft bills. They’ll be about who earned a licence—and who quietly powered down.
