Australia's ASIC Proposes Capital and Custody Rules for Crypto Platforms
What the Digital Assets Framework Act Created
Before CP 392 can be understood, it helps to know what the Act actually does. The legislation expanded Australia's existing financial services licensing regime to cover digital asset platforms (DAPs), bringing them under the same Corporations Act umbrella that governs traditional brokers and market operators. Platforms that exchange, facilitate trading in, or hold digital assets on behalf of clients will need an Australian Financial Services Licence with DAP-specific authorisations.
ASIC's implementation roadmap runs from the Act's passage in April 2026 through to the go-live date in April 2027. CP 392 is the first substantive consultation under that roadmap, covering the three areas where the regulator has most discretion: capital adequacy, custody of client assets, and conflicts of interest in trading.
Three Capital Models on the Table
The most commercially significant part of CP 392 is the capital section. ASIC is not proposing a single requirement. Instead, it has put three alternative models to the industry and is seeking feedback on which best balances investor protection with proportionality across businesses of different sizes.
The Highest-Threshold Option
One model would require operators that do not have qualifying third-party custody arrangements to hold net tangible assets of at least AUD 14 million (approximately USD 9.7 million at the time of the consultation) or 10% of average revenue, whichever figure is greater. The structure of that test is deliberate: the revenue-linked floor means that as a platform grows, its capital requirement grows with it.
Proportionality and Custody Concessions
All three models include concessions for platforms that use qualifying third-party custody. The logic is that robust external custody reduces the risk that a platform failure leaves clients unable to recover assets. ASIC has indicated it will scrutinise what "qualifying" means in practice, particularly given that much of Australia's digital asset infrastructure is held offshore. The Digital Economy Council of Australia noted it will work with members to examine the proportionality of each model across different business sizes, a signal that smaller operators are already concerned about the fixed-floor element.
What This Means for Finance Teams
CFOs and finance directors at platforms currently operating under no formal capital regime should treat the highest proposed threshold as the planning baseline until ASIC finalises its position. Net tangible assets is an accounting concept with specific meaning under Australian standards: goodwill, intangibles and deferred tax assets generally do not count. Firms will need to model their balance sheets against each of the three proposed tests and assess which custody structures might qualify for relief. Digital asset accounting software capable of producing real-time NTA calculations will become a compliance tool rather than a back-office convenience.
Custody: Offshore Allowed, but With Emergency Access Questions
CP 392 does not mandate domestic custody. ASIC has explicitly recognised the global nature of digital asset markets and the practical reality that most Australian platforms rely on offshore infrastructure for key storage. That decision drew praise from industry groups, but the regulator has attached a significant question to it: should Australian operators be required to have emergency access to private keys if an overseas parent or related company fails?
The Private Key Access Problem
This is not a theoretical concern. Several high-profile platform collapses in other jurisdictions demonstrated that when an offshore entity enters insolvency, client assets held in wallets controlled by that entity can become locked in protracted cross-border legal proceedings. ASIC's question essentially asks whether Australian licence holders should be contractually or technically positioned to recover client assets independently of their overseas group. Liam Hennessy, a partner at Thomsons Lawyers, noted that the offshore custody proposal reflects the Australian market's structural reliance on international infrastructure, a dynamic that ASIC cannot easily change by regulation but can at least mitigate through access requirements.
Quarterly Wallet Reporting
Regardless of where assets are held, all operators would have to report custody wallet structures and addresses to ASIC on a quarterly basis and retain relevant records for seven years. For audit teams, this creates a new category of regulatory evidence: wallet address disclosures that must be accurate, timely and reconcilable to client balances. The seven-year retention period aligns with standard document retention under Australian tax law, but the wallet-level granularity is new. Firms advising DAPs will need to review client record-keeping policies before the April 2027 go-live. For context on how similar quarterly and annual reporting obligations have reshaped compliance workflows in other jurisdictions, the approach taken after South Korea's AML licensing enforcement offers a useful reference point.
Conflicts of Interest: Principal Trading Restrictions
The third major pillar of CP 392 addresses how platforms trade. ASIC proposes restrictions on DAPs trading for their own account on their own platforms and on accepting benefits that could lead them to favour particular tokens. These are targeted at structural conflicts that regulators in multiple jurisdictions have identified as a root cause of retail investor harm.
Order-Matching Platforms and Affiliated Market Makers
The most technically complex restriction concerns order-matching DAPs. Under the proposal, a platform that brings client orders together through an order book or matched principal model could not itself trade as principal on that same platform. Related bodies corporate would face the same prohibition. There are model-specific exceptions, and Hennessy flagged that groups relying on an affiliated market maker should examine those exceptions first before assuming their existing structure is non-compliant. The practical effect is that some current business models will need restructuring. Platforms that earn revenue from both market-making and order matching may need to separate those functions into distinct legal entities or choose one activity.
Token Listing Incentives
The restriction on accepting benefits to favour particular tokens targets pay-to-list arrangements. While the proposal's full detail will emerge after consultation closes, the direction is clear: DAPs will need documented, defensible token listing criteria, and any commercial arrangements with token issuers will come under scrutiny. Compliance teams should begin reviewing existing commercial agreements for provisions that could be characterised as listing incentives.
Licensing Timeline and Transition Provisions
The sequencing matters for planning purposes. ASIC intends to publish final standards and guidance in March 2027. The Act takes effect on 8 April 2027. Operators already in the market at that date have until 7 October 2027 to submit a licence application and can continue operating while ASIC assesses it. That six-month transition window is meaningful but not unlimited: a platform that misses the 7 October 2027 deadline loses the right to operate during assessment.
Key Dates at a Glance
| Date | Milestone |
|---|---|
| 15 October 2026 | CP 392 consultation opens |
| 27 November 2026 | Consultation feedback deadline |
| March 2027 | ASIC publishes final standards and guidance |
| 8 April 2027 | Digital Assets Framework Act takes effect |
| 7 October 2027 | Deadline for existing operators to apply for a DAP licence |
Accounting and Audit Implications for Firms
CP 392 is a licensing consultation, but its downstream effects on financial reporting and audit work are substantial. Three areas stand out.
Balance Sheet Restructuring
The net tangible asset tests under all three capital models will require platforms to carry clearly identified, liquid capital. Accounting teams will need to classify assets carefully, particularly any crypto holdings on the platform's own balance sheet, to determine whether they qualify as tangible assets under Australian Accounting Standards. The interaction between AASB standards and the proposed NTA definitions is not yet settled and will likely be a focus of submissions during the consultation period.
Custody Reconciliation as an Audit Procedure
The quarterly wallet reporting obligation creates a new reconciliation cycle. Auditors of DAP clients will need to tie reported wallet addresses and balances to the platform's client liability ledger as part of their year-end procedures. The seven-year record retention requirement means that audit trails going back to the first year of operation under the new regime must be preserved, a point worth raising in engagement letters signed before April 2027. Firms investing in crypto bookkeeping software with automated wallet reconciliation features will be better positioned to meet these obligations than those relying on manual processes.
Going-Concern Considerations
For auditors of smaller DAPs that cannot comfortably meet the proposed capital thresholds, going-concern assessments from April 2027 onwards will need to address regulatory capital adequacy explicitly. OKX Australia's CEO noted publicly that the proposed standards will challenge operators who have delayed compliance investment. That kind of market consolidation signal is relevant context for any auditor evaluating whether a client platform has a realistic path to licensure. The regulatory environment in Australia is part of a broader global pattern; the ASIC proposals on crypto-settled CFDs published earlier this year show the same direction of travel toward investor protection and operational resilience.
Industry Response and What to Watch
The initial industry reaction has been cautiously supportive. The Digital Economy Council of Australia described CP 392 as an important milestone after years of engagement on regulatory reform, while noting it will scrutinise the proportionality of the capital models closely. OKX Australia's CEO argued the standards would reward early compliance investors and consolidate the market, a view consistent with the pattern seen in other jurisdictions that have introduced formal crypto licensing. The consultation closes on 27 November 2026. Submissions are publicly available on the ASIC website, making them a useful source of market intelligence for advisers and auditors seeking to understand how platforms are planning to respond.
Frequently Asked Questions
When does the Digital Assets Framework Act take effect?
The Act takes effect on 8 April 2027. Existing operators have until 7 October 2027 to apply for a DAP licence and can continue operating while ASIC assesses their application.
What is the highest proposed capital requirement under CP 392?
One of the three proposed models would require platforms without qualifying third-party custody to hold net tangible assets of at least AUD 14 million or 10% of average revenue, whichever is the greater amount.
Does ASIC require crypto assets to be held domestically?
No. CP 392 does not mandate domestic custody. ASIC proposes allowing offshore custody but is consulting on whether Australian operators should have emergency access to private keys if an overseas parent or related entity fails.
What are the new reporting obligations for crypto platforms?
Platforms would need to report custody wallet structures and addresses to ASIC on a quarterly basis and retain relevant records for seven years.
How do the principal trading restrictions affect platform business models?
Order-matching platforms could not trade as principal on their own platforms under the proposal, and related group companies face the same restriction. Groups using affiliated market makers should review the model-specific exceptions in CP 392 before restructuring.
Source: Cointelegraph
]]>