Australia's Crypto Licensing Deadline Has Passed: What Firms Must Do Now
Australia's digital asset sector is now operating under three concurrent regulatory obligations, and the grace period on one of them is gone. ASIC's no-action position, which shielded unlicensed firms from enforcement while they prepared their Australian Financial Services Licence (AFSL) applications, expired on 1 October 2026. Any firm still operating in-scope digital asset services without meeting the no-action conditions is now exposed to civil and criminal penalties, including fines that can reach 10% of annual turnover. That exposure sits alongside a separate AML/CTF overhaul that took effect in March 2026, and a third track, the Corporations Amendment (Digital Assets Framework) Act 2026, that comes into force on 9 April 2027. For accounting firms, auditors, and CFOs serving Australian crypto businesses, understanding how these three tracks interact, and where firms are most likely to slip up, is now a practical necessity. Robust crypto accounting software and compliance workflows are no longer optional hygiene; they are the evidentiary foundation regulators will scrutinise.
Track One: ASIC's INFO 225 and the End of No-Action Relief
ASIC's Information Sheet 225 (INFO 225) has been the primary interpretive guide for how existing financial services law applies to digital assets since it was first published in 2017 in response to initial coin offerings. ASIC updated the guidance following a December 2024 consultation paper, with the revised version released in December 2025. The core message is that many digital asset arrangements already carry rights that qualify them as financial products under the Corporations Act 2001, regardless of what an issuer calls them.
What qualifies as a financial product under INFO 225
The guidance identifies a range of arrangements that are likely to constitute financial products. These include certain stablecoins, wrapped tokens, tokenized securities, staking arrangements, and custodial wallets that let users make payments to third parties (treated as non-cash payment facilities under the guidance's Example 17). Any business that deals in, advises on, makes a market in, or provides custody of these products generally needs an AFSL. The obligation extends to offshore businesses that promote or provide these services to Australian users. Platforms may also require a market licence or a clearing and settlement facility licence depending on their activity. Some relief exists, including an ASIC class relief instrument for distributors of eligible stablecoins and wrapped tokens, but this relief is narrow and condition-dependent.
How the no-action position worked, and why it is now spent
To support an orderly transition after the December 2025 clarification, ASIC adopted a no-action position: it would not take action for unlicensed conduct where a firm had lodged an AFSL application or variation by a specified deadline. The original deadline was 30 June 2026. ASIC extended it to 30 September 2026 to accommodate industry transition difficulties. As of 2 September 2026, ASIC had recorded more than 100 applications from businesses seeking authorisations to provide financial services relating to digital assets, a figure that itself signals how broad the in-scope population is. From 1 October 2026 onward, firms that failed to lodge an application, or that continued operating outside the scope of any application they did lodge, receive no forbearance. Enforcement exposure is immediate and real.
Track Two: The Corporations Amendment (Digital Assets Framework) Act 2026
The Corporations Amendment (Digital Assets Framework) Act 2026 introduces something materially new: a statutory obligation to hold an AFSL for operating a digital asset platform even where the tokens involved are not themselves financial products. This changes the compliance calculus significantly. Under INFO 225, the question is whether a specific token or arrangement is a financial product. Under the new Act, from 9 April 2027, the question is whether the platform itself falls within the defined categories, and the categories are drawn broadly.
Digital Asset Platforms and Tokenized Custody Platforms
The Act creates two new regulated financial product categories. A Digital Asset Platform (DAP) is a facility under which the operator holds digital tokens on behalf of clients and records client interests in an account. This definition captures most cryptocurrency exchanges, brokers, custodians, and other intermediaries that hold crypto assets for clients. A Tokenized Custody Platform (TCP) is a facility under which the operator holds real-world assets, such as commodities or securities, and issues a digital token representing the client's right to redeem or take delivery of the underlying asset. Tokenized gold products, tokenized securities, and similar instruments fall here.
Obligations, carve-outs, and ASIC's standards roadmap
Licensed DAP and TCP operators will be required to maintain platform rules covering client eligibility, settlement processes, fees, asset availability, and how assets are deposited, redeemed, and delivered. The Act includes a de minimis exemption for low-volume, small-scale platforms and specific carve-outs for public digital token infrastructure and certain custodial staking arrangements, but these are targeted and not a general escape route for mid-sized operators.
The detailed, binding standards will be set by ASIC through legislative instrument rather than the Act itself. ASIC has published a roadmap that begins with stakeholder roundtables and consultation on guidance, and progresses through licence applications to full supervision. The forthcoming consultation is expected to cover how licensees must safeguard, record, and use client assets (including holding client money in trust), and financial requirements modelled on Regulatory Guide 166, covering minimum capital adequacy metrics, liquidity thresholds, net tangible asset floors, and audit obligations for both DAP and TCP licensees. ASIC is also consulting on standard licence conditions, a streamlined variation process for recently licensed firms, and whether additional navigation aids are needed for the sector.
For accounting professionals, the audit and financial requirements under this track are particularly significant. Capital adequacy testing, NTA floors, and liquidity thresholds will need to be computed and evidenced on an ongoing basis, and auditors will need to be satisfied that the underlying records, produced by whatever digital asset accounting software the firm uses, are accurate and auditable.
Track Three: AUSTRAC AML/CTF Reforms
The Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 took effect on 31 March 2026, and it rewires the AML/CTF framework for virtual assets from the ground up. Virtual asset exchanges were first brought within AUSTRAC's perimeter in 2018, but coverage was limited to exchanges between digital currency and fiat. These reforms go much further.
What the new definitions cover
The legislation replaces the term "digital currency" with "virtual asset" and replaces "digital currency exchange provider" with a broader category of regulated entity. The new definition covers digital representations of value that function as a medium of exchange, store of economic value, unit of account, or investment. Central bank digital currencies, in-game currencies, and loyalty points are excluded.
The services now regulated under AUSTRAC's expanded regime include: exchanges between virtual assets and Australian dollars or foreign currency (already regulated before the reforms); exchanges between different types of virtual assets, including facilitating peer-to-peer trades on a platform; holding or administering virtual assets or the private keys that control them on behalf of customers, including under multi-signature arrangements; transferring virtual assets on behalf of customers (with Travel Rule obligations attached); and providing financial services connected with the issuance or sale of a virtual asset where the business actively participates, for example through underwriting, market-making, or placement.
The staggered transition timetable
Unlike a single transition window, AUSTRAC's rules defer specific obligations to different dates running from 2026 to 2029. Customer due diligence, record-keeping, and other obligations for newly regulated services, including items 46A, 50B, 50C, and transfers, each carry their own compliance deadlines. Firms that have correctly registered under the earlier regime are not automatically compliant under the new one; they need to map each new service category against the applicable transition date and build the required controls before that date arrives.
A critical point: AML/CTF obligations apply wherever a service has a geographical link to Australia, for instance where it is provided through a permanent establishment in Australia. Offshore operators serving Australian clients cannot assume the obligations do not reach them.
For a broader view of how AML enforcement is reshaping crypto compliance obligations globally, see our coverage of how AML enforcement is reshaping crypto compliance obligations globally.
Why Three Tracks Running in Parallel Creates Specific Compliance Risk
The structural risk here is asymmetry. A firm can be fully registered with AUSTRAC, have lodged an AFSL application under INFO 225, and still be entirely unprepared for the DAP/TCP licensing requirements under the 2026 Act. Equally, a firm that obtained an AFSL years ago for a traditional financial product may not have mapped its digital asset activities against the INFO 225 guidance and could be operating in-scope services outside its authorisation scope without realising it.
Practical implications for accounting firms and auditors
Audit teams engaged by crypto-adjacent clients need to verify that the client's scope of authorisation under any existing AFSL actually covers the digital asset activities being conducted, not just the legacy financial services the licence was originally issued for. Licence scope mismatches are an obvious enforcement target for ASIC following the no-action expiry.
Financial statements for the period ending after 1 October 2026 will need to reflect the regulatory status of the business accurately. If a firm was operating without a licence after the no-action period ended and before obtaining authorisation, the accounting treatment for potential penalty exposure, and for any costs associated with licence applications and remediation, will need to be considered. Provisions, contingent liabilities, and going concern disclosures are all potentially in play depending on the facts.
CFOs at digital asset businesses should also be reviewing their existing crypto bookkeeping software and record-keeping infrastructure against what ASIC's forthcoming DAP/TCP standards are expected to require: trust account segregation of client money, auditable client asset records, and ongoing capital adequacy computation. If current systems cannot produce these outputs cleanly, remediation needs to start now rather than when ASIC finalises the standards.
Implications for compliance and AML functions
The AUSTRAC reforms introduce Travel Rule obligations for virtual asset transfers, alongside the expanded CDD and record-keeping requirements. These obligations interact with the AML programme a registered entity is already required to maintain, but they are not automatically satisfied by an existing programme built for the pre-reform perimeter. Compliance teams should be conducting a gap analysis against each newly regulated service category and each applicable transition date.
Blockchain analytics tooling and transaction monitoring frameworks also need to be calibrated to the broader asset coverage, since the new "virtual asset" definition sweeps in asset types that were not previously within scope. For context on what this means in practice for monitoring functions, see our piece on what blockchain analytics now means for AML monitoring teams.
Accounting and Tax Treatment: Key Considerations
The regulatory changes carry direct accounting and tax consequences that practitioners need to anticipate.
Licence application costs and intangible asset recognition
AFSL application costs and any associated legal and advisory fees are likely to be expensed as incurred under AASB 138, unless they form part of a broader internally generated intangible that meets the recognition criteria. Firms should not capitalise licence application fees speculatively. Where a licence is granted, any associated capitalised costs should be assessed against the useful life of the authorisation.
Provisions for regulatory exposure
For any firm that continued operating in-scope services after 1 October 2026 without satisfying the no-action conditions, AASB 137 requires a provision where an outflow of resources is probable and can be reliably estimated. The 10% of annual turnover penalty ceiling cited in ASIC's guidance is the outer limit of exposure, not a certain liability, but legal advice on the probable range will be needed to set any provision appropriately. Auditors should press management on whether this risk has been identified and quantified.
Tax treatment of compliance costs
Expenditure on AML/CTF programme build-out, legal advice on licence applications, and ongoing compliance infrastructure is generally deductible under section 8-1 of the Income Tax Assessment Act 1997 to the extent it is incurred in gaining or producing assessable income and is not capital in nature. The line between deductible operational compliance costs and capital expenditure on regulatory infrastructure can be fact-specific, and practitioners should document the basis for each classification.
Frequently Asked Questions
The ASIC no-action period ended on 1 October 2026. What does that mean for a firm that missed the deadline?
Any firm that was operating in-scope digital asset services without having lodged an AFSL application or variation by 30 September 2026 is now exposed to enforcement action for unlicensed conduct under the Corporations Act 2001. ASIC's guidance describes the consequences as civil and criminal penalties, with fines potentially reaching 10% of annual turnover. The firm should take immediate legal advice and consider whether to cease in-scope activities until authorisation is obtained.
Does the Digital Assets Framework Act replace the INFO 225 obligations, or do both apply?
Both apply, and they operate on different logic. INFO 225 addresses whether a specific digital asset or arrangement is a financial product under existing law. The Corporations Amendment (Digital Assets Framework) Act 2026, which takes effect from 9 April 2027, requires an AFSL to operate a DAP or TCP even where the underlying tokens are not financial products. A firm needs to assess its position under each track separately.
Our firm is registered with AUSTRAC under the pre-2026 regime. Does that cover the new expanded obligations?
Not automatically. The AML/CTF reforms effective from 31 March 2026 expanded the definition of regulated services significantly. Registration under the earlier regime for fiat-to-crypto exchange does not extend to the newly regulated service categories such as virtual-to-virtual exchange, custody of private keys, or virtual asset transfers. Each newly regulated service carries its own transition deadline, and firms need to map their activities against the expanded service list and update their AML/CTF programmes accordingly.
Are offshore firms providing services to Australian users subject to these rules?
Yes, for both tracks. ASIC's INFO 225 guidance applies to offshore businesses that promote or provide in-scope digital asset services to people in Australia. The AUSTRAC AML/CTF obligations apply wherever there is a geographical link to Australia, including where a service is provided through a permanent establishment in Australia. Offshore firms should not assume Australian regulatory obligations stop at the border.
What records and systems will auditors need to assess for the DAP/TCP licensing regime?
ASIC has signalled that forthcoming standards, modelled on Regulatory Guide 166, will require licensees to demonstrate capital adequacy, liquidity management, and net tangible asset maintenance, alongside segregation and trust accounting for client money. Auditors will need to assess whether the firm's digital asset accounting software and record-keeping infrastructure can produce the underlying data needed to evidence compliance with these requirements. Early engagement with clients on system readiness is advisable well ahead of the April 2027 commencement date.
Source: TRM Labs