Digital Asset Platform Licence in Australia: ASIC CP 392 and the 2027 Regime Explained

What the new digital asset platform regime is

The Corporations Amendment (Digital Assets Framework) Act 2026 (Act No. 38 of 2026) passed Parliament on 1 April 2026, received Royal Assent on 8 April 2026 and commences on 8 April 2027. It creates two new financial products and brings their operators into Australian financial services (AFS) licensing, the licence ASIC grants to anyone carrying on a financial services business in Australia.

• Digital asset platform (DAP): a facility under which an operator possesses digital tokens for or on behalf of clients, for example as trustee or bailee. A centralised crypto exchange or custodial wallet is the typical case, and the platform may also offer trading, settlement and staking.
• Tokenised custody platform (TCP): a facility under which an operator holds an asset other than money, such as gold, and issues one digital token for each asset that gives the holder the right to redeem it.

A digital token is an electronic record that a person can factually control: transfer it, stop others transferring it, and show they can do both. The Act does not make every digital asset a financial product; that question is still decided under existing law, with ASIC's Information Sheet 225 (INFO 225) as its guidance. What changes is that the platform itself becomes a financial product, so its operator needs a licence even where the tokens on it are not financial products.

Payment stablecoins sit outside this regime. They will be regulated as tokenised stored value facilities under the Government's payments reforms, on which Treasury consulted on draft legislation in March and April 2026.

ASIC CP 392: what is out for consultation

ASIC published Consultation Paper 392, Digital asset law reform implementation: Proposed standards and guidance (CP 392), on 15 October 2026 with media release 26-245MR. Comments close at 5pm AEDT on 27 November 2026 and are sent to [email protected]. The package has four attachments:

1. draft Regulatory Guide 000 Digital asset platforms and tokenised custody platforms (draft RG 000), covering scope, licensing and operator obligations;
2. draft asset-holding standards for DAPs and TCPs, made under section 912BE of the Corporations Act;
3. draft transactional and settlement standards for DAPs, made under section 912BF;
4. draft financial requirements for DAP and TCP operators.

ASIC describes the drafts as preliminary and says the final instruments may change considerably. Its principle is "same activity, same risk, same regulatory outcome": the standards draw on the rules for custodians, investor directed portfolio services and market operators, adapted to how tokens are held and traded. Some exemptions depend on regulations the Government is preparing in parallel. The capital model, the limits on principal trading and wallet reporting will shape operating costs, and ASIC has asked firms for evidence of the cost of each proposal.

Who needs an AFS licence with the new authorisations

If a facility is a DAP or TCP and no exemption applies, the operator must hold an AFS licence that authorises it to issue that type of platform. Draft RG 000 sets one issue authorisation per business model, and a platform running more than one model may need more than one.

Related services and routes

Using a DAP or TCP on behalf of clients, arranging for others to use one, and giving general or personal advice about one each need their own authorisation. If a token on the platform is itself a financial product, such as a tokenised security, dealing in it or advising on it needs that product's authorisation too. An operator cannot issue a DAP or TCP as a corporate authorised representative of another licensee, and the authorised intermediary exemption does not apply, except for related bodies corporate under the anticipated regulations.

Exemptions

• Low-value DAP. No licence is needed to issue the platform if no financial products are held on any platform of the operator's closely related group, transactions over the last 12 months total no more than A$10 million, each client's holdings stay within A$5,000 by entry value whenever a token is added, and a notice has been lodged with ASIC. Draft RG 000 says these tests rise over time with inflation.
• Limited advice and arranging. A business that only tells people a platform exists or arranges for them to use one, as a minor part of its ordinary business.
• Anticipated regulations. Sub-custodians of an authorised operator, overseas providers serving clients outside Australia through an authorised operator, overseas related bodies corporate of an Australian licensee, and nominee companies.

Our Australia AFS licence page sets out the general licensing process that the new authorisations sit within.

The platform and custody standards

Operators must comply with the standards ASIC makes, and civil penalties apply to breaches. ASIC treats compliance with the transactional and settlement standards as a core obligation for breach reporting.

Asset-holding standards (DAPs and TCPs)

• Client assets held on trust, or under another legally effective arrangement that protects clients if the operator becomes insolvent; client money under the Corporations Act client money rules or otherwise on trust.
• Records of which assets belong to which client, segregation, and reconciliation each business day unless ordinary practice for that asset is less frequent.
• Holding arrangements disclosed before the first deposit, including the position in an insolvency.
• Verified client instructions, redemption rights honoured and controls against unauthorised transfers.
• No lending, staking or other use of client assets without disclosure and the client's express authorisation.
• Wallet addresses recorded for at least seven years and reported to ASIC within 10 business days after each quarter end, without private keys or seed phrases.
• A unique, published identifier for each class of token held.
• Due diligence, monitoring and a written agreement for any third-party custodian, with the operator still responsible.

ASIC proposes not to require client assets to be held in Australia, and will instead expect the location of custody to be disclosed as a material feature of the product.

Transactional and settlement standards (DAPs)

These apply to DAPs that execute or settle trades, not to custody-only platforms, and scale with the business model:

• seven years of records of client instructions and timestamped trading messages;
• a policy for admitting tokens and removing those that cease to be suitable;
• no shelf space fees for favouring one token over another;
• for order-matching platforms, no trading as principal, except for tied brokers, tied dealers, agents and platforms that are counterparty to every trade;
• best execution and at least two liquidity sources where client orders are executed elsewhere;
• free, real-time pre-trade and post-trade data where orders are matched, and public disclosure of fees and market makers;
• market misconduct controls, with notice to ASIC when a client is removed for suspected misconduct.

Financial requirements and net tangible assets

Every licensee providing services in relation to DAPs or TCPs, including advisers, would be solvent with positive net assets. A licensee holding more than A$100,000 of client money would hold A$50,000 in surplus liquid funds, and one trading with clients as principal would hold adjusted surplus liquid funds scaled to its liabilities.

Operators would also prepare a 12-month cash flow projection, approved by the directors at least once a quarter, with an annual auditor's report on the cash and NTA requirements. Net tangible assets (NTA) are, broadly, assets less liabilities, leaving out intangible items such as goodwill. ASIC is consulting on three NTA models for operators that hold client assets themselves:

Under all three models, an operator whose qualifying third-party custodian holds all client assets would hold the greatest of A$200,000, 0.5% of the average value of client assets capped at A$7 million, and 10% of average revenue, supported by assurance and audit reports showing the custodian holds the NTA the operator would otherwise need. Cash or cash equivalents must be at least the greater of A$200,000 and half the NTA requirement, and fixed amounts would be indexed to inflation each year.

ASIC compares these with minimum capital of roughly A$80,000 to A$5.4 million for platforms in the UK, the EU, Singapore and Hong Kong, noting that NTA can be met with a wider range of liquid assets than the equity capital those regimes require.

Disclosure, platform rules and general obligations

A DAP or TCP operator gives retail clients a DAP/TCP Guide in place of a Product Disclosure Statement, which ASIC proposes to allow electronically. It also publishes platform rules, which form a contract with its clients, and keeps a voting policy for rights attached to tokens it holds. A token that is itself a financial product may still need its own Product Disclosure Statement.

Operators are full AFS licensees: they provide services efficiently, honestly and fairly, manage conflicts, hold adequate resources and risk systems, and report breaches. For retail clients they also need internal dispute resolution, membership of the Australian Financial Complaints Authority (AFCA), compensation arrangements, usually professional indemnity insurance, and the design and distribution obligations.

Responsible managers

ASIC judges competence through the nominated responsible managers, the senior people whose experience supports the licence. It expects experience relevant to the services, and an understanding of the technology and of AFS obligations. Under the experience-based option in RG 105, it may count experience over the past 10 years from regulated or unregulated activity, including operating a platform, custody, dealing, market making or managing the technology.

AUSTRAC registration alongside the AFS licence

The AFS licence and AUSTRAC registration are separate requirements. AUSTRAC, Australia's anti-money laundering regulator, keeps the Virtual Asset Service Provider Register under Part 6A of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act). Providing a registrable virtual asset service without registration is an offence carrying up to 2 years' imprisonment or 500 penalty units, with higher penalties for repeat conduct. The AML/CTF Act reforms, most of which commenced on 31 March 2026, replaced the former digital currency exchange category with this wider virtual asset framework and extended the travel rule to virtual asset transfers.

A digital asset platform therefore runs two regimes side by side: AUSTRAC registration and an AML/CTF programme for money laundering and terrorism financing risk, and the AFS licence for conduct, custody and financial resources. CP 392 notes that AUSTRAC already collects wallet information from virtual asset service providers at registration, and ASIC says it will weigh that overlap before deciding on quarterly wallet reporting.

Our AUSTRAC registration page covers enrolment, the virtual asset service provider application and the AML/CTF programme AUSTRAC expects.

Timeline: the dates that matter

Firms already operating: INFO 225 and the transition

Many digital assets are already financial products under existing law, and ASIC's position that the definitions are broad and technology neutral has been confirmed in the High Court (media release 26-124MR). ASIC updated INFO 225 in October 2025 and gave the sector a no-action position, extended in June 2026 to 30 September 2026, so that firms had time to apply. That position has ended. ASIC has recorded over 140 applications from digital asset businesses, including more than 110 received in response to INFO 225 between October 2025 and 30 September 2026.

For these firms the 2027 regime adds to an existing licence rather than starting a new one. ASIC proposes to streamline licensing for existing AFS licensees, and for businesses that applied for an authorisation in response to INFO 225, when they add DAP or TCP authorisations. It will issue separate guidance on these variations for the April to October 2027 transition, and is considering publishing a list of firms that apply by 7 October 2027 so that clients can see who may continue operating.

The transition itself is set by the Act. A platform operating on 8 April 2027 has six months, to 7 October 2027, to apply for a new licence or a variation. If it applies in time, it can keep operating until ASIC decides the application. If it does not apply, the new requirements apply to it immediately after the six-month period.

What an overseas exchange serving Australians must do

An offshore exchange needs an AFS licence if it carries on a financial services business in Australia, which under section 911D of the Corporations Act includes conduct intended, or likely, to induce people in Australia to use its services. ASIC's RG 121 gives examples: advertising to Australians or contacting them directly to win their business is likely to need a licence, while a website not targeted at Australia, with a jurisdictional disclaimer and little impact on Australian investors, may not. An exchange that markets to and onboards Australian retail clients should plan for an AFS licence with the DAP authorisations it needs.

1. Choose the licensed entity. A foreign entity that holds an AFS licence without being registered as a foreign company under the Corporations Act must keep a local agent authorised to accept service of process and notices.
2. Decide where client assets sit. ASIC proposes not to require custody in Australia, so a group custodian overseas can be used if the arrangement is legally effective, protects clients in an insolvency and is disclosed. ASIC is asking whether the Australian operator should have emergency access to keys if an overseas parent becomes insolvent.
3. Use the overseas exemptions only where they fit. They cover services to clients outside Australia and certain related-company arrangements; they do not replace a licence for serving Australians directly.
4. Appoint responsible managers who know the platform and Australian obligations.
5. Register with AUSTRAC where the AML/CTF Act's geographical link applies: services provided through a permanent establishment in Australia, or by an Australian resident or the subsidiary of an Australian company through an overseas branch. An exchange operating through an Australian entity and office meets that test.
6. Plan the financial resources under each NTA model until ASIC chooses one.

Groups already licensed elsewhere can adapt much of the custody, governance and AML material prepared for a Hong Kong VATP licence or a Dubai VARA licence, because ASIC has designed its standards to align with comparable overseas regimes. Our guide to Hong Kong payment and crypto licences sets out the SFC's requirements.

How long it takes and how to plan

ASIC aims to decide 70% of complete AFS licence applications within 150 days (about 5 months) and 90% within 240 days (about 8 months), and says applications that raise new policy issues take longer. It has not published a separate target for DAP and TCP authorisations. The firm plans AFS licence applications at 5 to 8 months.

Applications for DAP and TCP authorisations cannot be lodged before 8 April 2027, so the months until then are for building the controls the standards require: custody arrangements, reconciliation, wallet records, trading controls and the financial model. For a platform already operating, the date that matters is 7 October 2027. An application lodged early in the window, with the standards already working in operations, gives ASIC a complete file and leaves time to answer its questions while the business continues to trade.

Readiness checklist

How Buckingham Capital Consulting supports digital asset platforms

The firm maps the business model to the DAP and TCP authorisations, builds custody, reconciliation, wallet reporting and trading controls against the draft standards, models NTA under all three options, and prepares the AFS application or variation, the DAP/TCP Guide, the platform rules and the AUSTRAC registration. Its crypto licensing practice also prepares CP 392 submissions and runs Australian applications alongside licences in other markets.

Frequently asked questions

References

1. ASIC media release 26-245MR: ASIC consults on implementation of new digital asset laws, 15 October 2026
2. ASIC CP 392: Digital asset law reform implementation, proposed standards and guidance
3. ASIC CP 392 consultation paper (PDF), October 2026
4. ASIC Attachment 1 to CP 392: draft Regulatory Guide 000, digital asset platforms and tokenised custody platforms (PDF)
5. Corporations Amendment (Digital Assets Framework) Act 2026, Act No. 38 of 2026 (Federal Register of Legislation)
6. ASIC: no-action position for digital asset businesses extended to 30 September 2026
7. ASIC Regulatory Guide 121: Doing financial services business in Australia (PDF)
8. Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Federal Register of Legislation)

Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or [email protected].

This article is general information, not legal advice. Requirements change, and the regulator’s own publications take precedence.