Australia regulates crypto businesses through two parallel regimes. AUSTRAC handles AML obligations and requires VASP registration. ASIC issues the Australian Financial Services License under the Corporations Act to businesses dealing in financial products. The Corporations Amendment (Digital Assets Framework) Act 2026 received Royal Assent on April 8, 2026 and brought digital asset platforms and tokenized custody platforms into the financial products category. ASIC's no-action position, extended on June 25, 2026, gives businesses until September 30, 2026 to apply for an AFSL or make equivalent arrangements. The question is not which regime to choose. Platforms that handle tokens classified as financial products may fall under both, and compliance with one regime does not satisfy the other.
Two Regimes, Two Regulators
AUSTRAC is responsible for the Anti-Money Laundering and Counter-Terrorism Financing Act 2006. Its remit includes customer identification, transaction monitoring, and suspicious matter reporting. The digital currency exchange category ended on March 31, 2026, replaced by the broader VASP registration framework that captures virtual asset transfers, custody, and related services. The AUSTRAC Registration Requirements article addresses the registration process and ongoing obligations in detail, while the AUSTRAC VASP registration service covers application support.
ASIC enforces the Corporations Act 2001. An AFSL is required when a business provides financial services in relation to financial products. Whether a particular digital asset qualifies as a financial product depends on its features. ASIC's updated INFO 225 guidance, published on October 29, 2025, explains how stablecoins, wrapped tokens, tokenized securities, and certain digital asset wallet arrangements may fall within existing financial product definitions, depending on their structure and features.
A crypto exchange that lists tokens falling within the financial products definition needs both a VASP registration with AUSTRAC and an AFSL from ASIC. AUSTRAC registration does not substitute for an ASIC license, and an AFSL does not satisfy AML obligations.
What the Digital Assets Framework Act Changed
The Corporations Amendment (Digital Assets Framework) Act 2026 passed both houses of Parliament on April 1, 2026 and received Royal Assent on April 8, 2026, with a commencement date of April 9, 2027. It introduces two new categories of financial products under the Corporations Act: Digital Asset Platforms (DAPs) and Tokenized Custody Platforms (TCPs). A DAP captures arrangements where an operator holds digital tokens on behalf of clients, including as trustee, bailee, or under contractual arrangements. A TCP captures facilities where an operator holds non-monetary assets and issues a single digital token for each asset, granting the holder a redemption or delivery right.
Operators of both platform types must hold an AFSL once the Act commences. The regime imposes requirements for segregating client assets, restricting the reuse of collateral, disclosing risks, and establishing internal dispute resolution procedures. Retail clients must receive a platform guide covering the platform's risks, fee structure, client rights, and complaints process.
| VASP Registration | AFSL | |
|---|---|---|
| Regulator | AUSTRAC | ASIC |
| Governing law | AML/CTF Act 2006 | Corporations Act 2001 |
| What it covers | Anti-money laundering, counter-terrorism financing, transaction reporting | Financial products and services, client protection, market conduct |
| Who is captured | Operators providing virtual asset services (exchange, transfer, custody) | Operators dealing in, advising on, or providing financial services related to financial products |
| Key deadline | March 31, 2026 (VASP framework commenced); July 1, 2026 (AML/CTF obligations for new VASP services) | September 30, 2026 (no-action position expires); April 9, 2027 (DAF Act commences) |
| Non-compliance consequences | Criminal penalties under AML/CTF Act, deregistration, enforceable undertakings | Civil penalties up to the greater of $16.5 million, three times the benefit obtained, or 10% of annual turnover; criminal penalties including imprisonment |
When You Need an AFSL
Whether a platform needs an AFSL depends on the assets it handles, not on how the platform describes itself. ASIC's updated INFO 225 guidance, published on October 29, 2025 alongside media release 25-250MR, explains how stablecoins, wrapped tokens, tokenized securities, and certain digital asset wallet arrangements may fall within existing financial product definitions. Because the classification turns on the structure and specific features of each product, a platform must evaluate its listings individually to determine which ASIC authorizations are needed.
This token-by-token assessment is the most labor-intensive part of AFSL preparation for digital asset businesses. A platform listing twenty tokens may find that some are financial products requiring specific authorizations while others fall outside the regime entirely. The scope of the AFSL application depends on what that review produces.
An alternative to holding a standalone AFSL is becoming an authorized representative of an existing licensee. This route is faster to set up, and ASIC's extended no-action position now explicitly includes authorized representative and intermediary authorization arrangements. The limitation is that the authorized representative can only provide the services permitted under the agreement with the licensee, and the licensee retains supervisory responsibility.
The No-Action Deadline: 30 September 2026
ASIC originally set a no-action position expiring on June 30, 2026, giving businesses time to assess the updated INFO 225 guidance and prepare license applications. On June 25, 2026, ASIC extended the deadline by three months to September 30, 2026 and expanded its scope to include firms operating under authorized representative or intermediary authorization arrangements.
By September 30, 2026, a digital asset business providing financial services must have taken at least one of the following steps: lodged an AFSL application or an application to vary an existing license, entered into an authorized representative arrangement with an existing AFSL holder, or entered into an intermediary authorization arrangement with an existing AFSL holder.
Firms that do not take qualifying steps by that date risk breaching financial services law. Section 911A of the Corporations Act requires anyone carrying on a financial services business to hold an AFSL unless an exemption applies. Civil penalties for corporations can reach the greater of 50,000 penalty units (approximately A$16.5 million at current rates), three times the benefit obtained or detriment avoided, or 10% of annual turnover, capped at 2.5 million penalty units. Criminal penalties, including imprisonment of up to five years for individuals, also apply.
The no-action position does not cover all activities. Crypto lending and earn products, most digital asset payment facilities outside eligible stablecoins, and derivatives beyond wrapped tokens remain outside the scope of the relief. Regardless of the no-action position, ASIC retains the ability to pursue enforcement where serious consumer harm or systemic misconduct is involved.
Who Falls Outside the Regime
The Act includes a low-value exemption for smaller platforms. A DAP is not required to hold an AFSL if the platform holds less than A5,000 percustomerandfacilitateslessthanA10 million in transaction value across a rolling twelve-month period. Platforms that stay below both thresholds face reduced regulatory obligations, though they may still need to comply with other provisions of the Corporations Act depending on their activities.
Separately, ASIC finalized class relief for secondary distributors of eligible stablecoins and wrapped tokens through Instrument 2025/867, issued on December 9, 2025. The instrument exempts qualifying distributors from holding a separate AFSL, market license, or clearing and settlement facility license when dealing with eligible products. To qualify, the issuer of the stablecoin or wrapped token must hold an AFSL or have lodged an application by the relevant deadline. The instrument repeals automatically on January 1, 2029.
AFSL Requirements for Digital Asset Platforms
Financial resource requirements follow ASIC's Regulatory Guide 166 and account for the risks associated with custody and client asset handling. Platforms holding client assets face higher net tangible asset thresholds and may need to demonstrate additional liquidity buffers. The exact financial requirement depends on the authorized activities and the volume of client assets under management.
ASIC evaluates the competence and experience of responsible managers who oversee the licensed services. Each responsible manager must demonstrate relevant qualifications and a track record in the financial services activities the platform intends to offer. AUSTRAC has simultaneously tightened compliance officer requirements under the reformed AML/CTF regime from March 2026, so digital asset businesses face elevated personnel standards from both regulators in the same period.
The organizational requirements include an Australian legal entity (typically a Pty Ltd company), at least one Australian-resident director, documented compliance procedures, a dispute resolution mechanism (including AFCA membership for retail services), and segregated custody of client assets. ASIC processes AFSL applications through its Regulatory Portal, with a target of deciding 70% of complete applications within 150 days. In practice, complex applications involving digital asset authorizations may take five to eight months. Legal costs for preparing and supporting an AFSL application for a digital asset platform start from €40,000, depending on the number of authorizations sought and the complexity of the token assessment.
If you are working out whether your platform needs an AFSL, a VASP registration, or both, schedule a call with the Equilex licensing team to assess your tokens, authorizations, and application route.
What Happens Between Now and 2027
ASIC published its 18-month implementation roadmap on April 20, 2026. The DAF Act commences on April 9, 2027, at which point the DAP and TCP categories become live financial product classifications. From April to October 2027, operators can lodge AFSL applications or variations covering the new DAP and TCP authorizations and continue operating under regulatory relief while ASIC reviews those applications. Between now and commencement, ASIC plans to consult on operational standards for asset holding, transactional and settlement functions, and the content of DAP and TCP platform guides.
Preparation should happen well before the application window opens. Documenting governance structures, appointing responsible managers, building compliance frameworks, and assessing each listed token against the financial product criteria all take months. ASIC had received approximately 30 license applications from digital asset businesses by June 2026, before applications for the new DAP and TCP authorizations opened.
How VASP and AFSL Fit Together
For a typical crypto exchange operating in Australia, VASP registration with AUSTRAC addresses AML and counter-terrorism financing obligations, while the AFSL from ASIC covers financial services involving products within ASIC's remit. The timelines and documentary requirements differ, but preparation overlaps in areas such as governance, risk management, and key personnel appointments. Businesses entering the Australian market should therefore prepare the AUSTRAC and ASIC workstreams in parallel.
The AUSTRAC Registration Requirements article explains the registration stream in more detail. For a comparison of Australia's framework with other jurisdictions, see Best Countries to Get a Crypto License in 2026. The Crypto Licensing hub covers additional registration and licensing routes.
FAQ
Do I need both a VASP registration and an AFSL?
Many crypto platforms need both. AUSTRAC registration satisfies anti-money laundering obligations, while an AFSL from ASIC is required for financial services involving financial products. If a token or arrangement falls within a financial product definition under existing law or the forthcoming DAF Act, both regimes may apply. Neither authorization substitutes for the other.
What replaced the DCE registration in Australia?
The digital currency exchange category ended on March 31, 2026, when the broader virtual asset service provider framework took its place. Existing DCE registrants transitioned without filing a new application, though they were required to update their details and meet the wider obligations that came with the change.
What is the September 30, 2026 deadline?
ASIC's no-action position, originally set for June 30, 2026 and extended on June 25, 2026, gives digital asset businesses until September 30, 2026 to lodge an AFSL application, apply to vary an existing license, or enter into an authorized representative arrangement. Firms that have not taken qualifying steps by that date risk enforcement for carrying on unlicensed financial services.
Which digital assets count as financial products?
ASIC's updated INFO 225 explains how stablecoins, wrapped tokens, tokenized securities, and certain digital asset wallet arrangements may fall within existing financial product definitions. Classification depends on the structure, rights, and specific features of each product, so platforms must assess their listings individually to determine which authorizations their license needs to cover.
Can I operate under someone else's AFSL?
Yes. Becoming an authorized representative of an existing licensee is a recognized route and typically moves faster than applying for a standalone license. The trade-off is scope: you can only provide the services your agreement with the licensee permits, and the licensee retains supervisory responsibility over how you provide them.
