Crypto asset platform licensing: the 2026 reforms explained

Australia is moving crypto asset platforms inside the existing financial services licensing system. In short: if your business holds or deals in crypto on behalf of customers, you will generally need an Australian Financial Services Licence (AFSL) from ASIC. ASIC's sector-wide no-action position required firms to apply by 30 June 2026, a date that has now passed. Rather than create a standalone crypto licence, the Government has chosen to treat digital asset platforms as financial services providers under the Corporations Act, through the Corporations Amendment (Digital Assets Framework) Act 2026, which was made on 8 April 2026.

This explainer sets out who is captured, what the new licensing categories are, the timing, and the practical steps platforms should take. It is a neutral reference, not advice — confirm your specific position against the primary sources cited.

What the 2026 reforms require

The reforms have two moving parts.

First, ASIC's interpretation of existing law: ASIC's updated Information Sheet 225, *Digital assets: financial products and services*, sets out when a digital asset or related service is already a financial product or financial service under the Corporations Act. On ASIC's current view, that can include stablecoins, wrapped tokens, tokenised securities and certain digital asset wallet and custody arrangements. Where a product is a financial product, dealing in it, advising on it, or providing custody generally requires an AFSL today — the reforms clarify and enforce this rather than invent it.

Second, the new statutory framework: the Corporations Amendment (Digital Assets Framework) Act 2026 (Act No. 38 of 2026) creates two new categories of regulated platform and brings their operators squarely within the AFSL regime. The substance is that crypto platforms become subject to the same core obligations as brokers and fund managers — safeguarding client assets, clear and standardised disclosure, prohibitions on misleading conduct, and access to dispute resolution and compensation arrangements.

You can review the full obligation profile under crypto asset platform licensing and the related crypto asset secondary service provider licensing.

Who the new licensing applies to

The licensing net is drawn around businesses that hold or control crypto on behalf of customers, or otherwise deal in crypto that is a financial product. In practice this captures:

• Centralised crypto exchanges that take custody of customer assets;
• Custody and wallet providers that hold private keys or assets for clients;
• Brokers and intermediaries that buy, sell or arrange transactions in digital asset financial products;
• Operators issuing or facilitating tokenised real-world assets.

Some activity may fall outside the regime, and purely non-custodial software may not be captured in the same way. Whether an exemption applies depends on the enacted legislation and ASIC guidance, so confirm it with ASIC rather than assuming it.

A useful working test: if customers must trust you to hold or move their assets, assume you are in scope until you have advice confirming otherwise. For the broader picture of how fintech, payments and crypto obligations interlock, see the fintech, payments and crypto topic hub.

The two new regulated platform categories

The framework introduces two defined platform types:

Operators of both must obtain an AFSL with the relevant authorisations. Bringing tokenised real-world assets into the same perimeter is significant: it signals that the regime is asset-agnostic and focused on the *function* of holding and dealing, not on the underlying technology.

Key dates: the 30 June 2026 no-action deadline and April 2027 commencement

ASIC granted a sector-wide no-action letter, issued with its updated INFO 225, enabling providers to consider the guidance and, where applicable, apply for a new or varied licence until 30 June 2026. ASIC's notice, Deadline looms for digital asset businesses to apply for a licence, states: "Firms who need a licence or a variation to their existing authorisations, but do not apply by 30 June 2026, risk being in breach of financial services laws. Unlicensed conduct carries serious civil and criminal penalties under law, including significant fines that could reach up to 10% of annual turnover." Businesses needing an Australian Market Licence or Clearing and Settlement facility licence were required to notify ASIC in writing of their intention to apply and hold a pre-meeting with ASIC by the same date.

That date has passed. A business that needed a licence or variation and did not apply by 30 June 2026 is outside the no-action position and should take advice and engage ASIC promptly.

Separately, the Digital Assets Framework Act commences 12 months after Royal Assent (per the Parliamentary Library Bills Digest). ASIC describes the new laws as bringing digital asset platforms and tokenised custody platforms under the financial services licensing regime "from April 2027".

AUSTRAC AML/CTF runs in parallel

AFSL licensing does not replace anti-money-laundering obligations. Crypto businesses remain regulated by AUSTRAC, and the AML/CTF regime has itself been reformed.

Key points:

• Businesses providing virtual asset services must be registered with AUSTRAC and meet AML/CTF program, customer due diligence and reporting obligations.
• The 2024 AML/CTF amendments expanded the perimeter from the older "digital currency exchange" concept to a broader set of virtual asset services. AUSTRAC states that businesses providing certain virtual asset services "beyond currently regulated digital to fiat currency exchange services" have been regulated from 1 July 2026 (AUSTRAC).

So a typical exchange will face two distinct regulators: ASIC for financial-services licensing and conduct, and AUSTRAC for AML/CTF. See the AML/CTF hub for the financial-crime obligations in more detail.

What platforms should do now

A pragmatic sequence:

1. Map your products and services against ASIC's INFO 225 to identify which involve financial products.
2. Form a licensing view — do you need a new AFSL, a variation to an existing licence, or can you rely on an authorised representative arrangement?
3. If you did not apply by 30 June 2026, take advice and engage ASIC now, because you are outside the no-action position.
4. Build the AFSL substance: responsible managers, organisational competence, financial resources, custody and key-management controls, breach reporting, and a dispute-resolution pathway.
5. Confirm AUSTRAC registration and program are current under the expanded virtual-asset definitions.
6. Document your reasoning — keep a written record of why each product is or is not a financial product, since ASIC may test it.

Common pitfalls

• Assuming AUSTRAC registration is enough. It is not — AML/CTF compliance and AFS licensing are separate obligations.
• Treating "non-custodial" as a blanket exemption. Scope turns on the substance of what you do, not the label.
• Missing the application date. The no-action position protected only those who *applied* by 30 June 2026, not those who merely intended to.
• Under-resourcing custody controls. Safeguarding client assets is central to the regime, and weak key management is a foreseeable enforcement focus.

The direction of travel is clear: Australia is regulating crypto platforms as financial services. The no-action window has closed, and the platform categories under the Digital Assets Framework Act take effect from April 2027.