Ask a fintech founder about licensing and you’ll usually hear one of two things: “we’ll get an AFSL when we raise our Series A” or “we don’t need one — we’re a software company”. Both answers can be catastrophically wrong. Carrying on a financial services business in Australia without an Australian Financial Services Licence is a criminal offence, and ASIC’s recent enforcement run — capped by the Full Federal Court’s decision against the operator of the Qoin token and the $14 million in penalties that followed in January 2026 — shows the regulator is willing to litigate the perimeter against startups, not just banks. The good news: the Corporations Act 2001 (Cth) offers several legitimate ways to launch without your own licence. The bad news: each has sharp edges, and the most popular one — becoming an authorised representative of someone else’s licence — just got significantly narrower.
The Trigger: Section 911A
Section 911A is blunt: a person who carries on a financial services business in Australia must hold an AFSL covering the services they provide, unless an exemption applies. You provide a financial service if, broadly, you give financial product advice, deal in a financial product (issuing it, or arranging for others to acquire or dispose of it), make a market, operate a registered scheme, or provide custodial or depository services.
The reach comes from the definition of “financial product”, which extends well beyond shares and funds. The trap for fintechs is the non-cash payment facility — an arrangement through which payments are made other than by physical delivery of cash. Wallets, stored-value products, payment apps and buy-buttons can all qualify. It was a non-cash payment facility, not a security, that brought the Qoin wallet inside the regime. And under the Digital Assets Framework legislation passed in April 2026 — which commences in April 2027, with a further transition period for existing operators — digital asset platforms and tokenised custody providers will be pulled inside the same perimeter.
Two misconceptions are worth killing early:
- “We only serve wholesale clients, so we don’t need a licence.” Wrong. Serving only wholesale, sophisticated or professional investors changes which authorisations you need and strips away retail-facing obligations (disclosure documents, design and distribution obligations, dispute resolution membership) — but the section 911A obligation applies to wholesale-only businesses too.
- “We’re just the technology layer.” Sometimes true, often not. A pure software vendor selling tools to licensees is generally outside the regime; a platform that arranges for users to acquire financial products, or whose interface strays into advice, is squarely inside it. The line is functional, not aesthetic — it turns on what your product actually does, not what your marketing says.
Note also what the AFSL regime doesn’t cover: consumer lending. Credit activities sit under the National Consumer Credit Protection Act 2009 (Cth) and require an Australian Credit Licence — a parallel regime with its own analysis. Plenty of fintechs need both; some lenders need only an ACL and no AFSL at all.
When You Genuinely Don’t Need One
Before assuming you need a licence, test whether you’re outside the perimeter or inside an exemption:
- Your product isn’t a financial product. Some payment-adjacent products are expressly excluded or relieved — gift facilities and certain loyalty schemes among them — and ASIC has longstanding relief for various low-value non-cash payment facilities. This is the cheapest possible compliance outcome, but it needs to be confirmed against the exclusions and relief instruments, not assumed.
- Mere referrals. Passing a customer to a licensee, with disclosure of any commission and without advising on the product, can fall within the referrer exemptions in the Corporations Regulations. The exemption is narrow: the moment your funnel ranks, recommends or pre-qualifies, you’re likely dealing or advising.
- The enhanced regulatory sandbox. The ERS, established under the Corporations (FinTech Sandbox Australian Financial Services Licence Exemption) Regulations 2020, lets an eligible fintech test specified services for up to 24 months without a licence, after notifying ASIC and satisfying an innovation test and a net public benefit test. The caps are real — including a $10,000 limit on the value of certain products issued to an individual retail client and a $5 million aggregate client exposure cap — and derivatives and margin lending are excluded. ASIC’s INFO 248 sets out the mechanics. The sandbox is a runway, not a business model: 24 months passes quickly, there’s no extension, and your exit plan is either a licence, an authorisation or a pivot.
The Authorised Representative Route
The workhorse exemption for early-stage fintechs is section 911A(2)(a): you don’t need your own licence if you provide the service as a representative of an AFSL holder. Under section 916A, a licensee gives written notice authorising you — including a company, as a corporate authorised representative (CAR) — to provide specified financial services on its behalf. With the licensee’s consent, a CAR can sub-authorise individuals under section 916B. The licensee must notify ASIC of the appointment within 30 business days, and the authorisation appears on ASIC’s public register.
The commercial logic is straightforward. A licensee-for-hire charges a monthly fee and takes on supervision; in exchange you launch in weeks rather than the many months an AFSL application takes, without recruiting the responsible managers or holding the financial resources ASIC requires of licensees. Because the licensee is generally responsible to clients for your conduct under sections 917A–917E, a competent principal will insist on real oversight: compliance sign-off on marketing, product approval, audit rights, professional indemnity insurance and reporting. That oversight isn’t friction to negotiate away. It’s the legal substance of the arrangement — and after Qoin, it’s existential.
Know the route’s structural limits before you commit:
- You inherit the licence you’re renting. You can only provide services within your principal’s authorisations — if your roadmap outgrows their licence, you’re renegotiating or moving.
- Cross-endorsement is restricted. Acting for two licensees generally requires each licensee’s consent to the other’s appointment, which principals are often reluctant to give.
- Your regulatory identity isn’t yours. Enterprise partners, banks and investors will diligence your principal as well as you — and a principal’s licence problems become your distribution problems overnight.
What the Qoin Decision Changed
For years, parts of the market treated the AR route as a general-purpose licensing workaround: find a friendly licensee, get appointed, and issue your own product under their umbrella. In ASIC v BPS Financial Pty Ltd [2025] FCAFC 74, the Full Federal Court shut that model down. BPS had built and issued the Qoin wallet — a non-cash payment facility — and relied on an authorised representative appointment from an unrelated licensee that had no substantive involvement in the product. The Court held the exemption has an essential representative capacity requirement: an authorisation only protects services you genuinely provide on behalf of the licensee. Where you are, in substance, issuing your own product for your own benefit — what the litigation memorably described as “AFSL provisioning” — the exemption fails, and every issue of the product is unlicensed conduct.
The consequences of getting this wrong are severe. Unlicensed conduct is a criminal offence — for individuals, up to five years’ imprisonment — and a civil penalty provision, with corporate maximums calculated under the standard formula: the greater of $18.2 million (50,000 penalty units at the $364 unit value applying from 1 July 2026), three times the benefit obtained, or 10% of annual turnover capped at $910 million. Contracts made in the course of unlicensed business can also be unenforceable against your customers, and “we were appointed as an AR” is no answer if the appointment didn’t match the substance.
The practical rule after Qoin: the AR route works for distributing, advising on or arranging a licensee’s products, or operating inside a genuinely integrated arrangement where the licensee stands behind the product as issuer. It does not work as a wrapper for issuing your own product with a licensee’s name on the paperwork. If you’re the issuer, plan for your own licence — or structure the product so the licensee truly issues it.
A Licensing Playbook for Fintech Founders
- Map the perimeter before you build. Characterise every product feature against the financial service definitions — advice, dealing, market making, custody — and check the credit regime separately. Deferred settlement, stored value and auto-invest features are where “software companies” become financial services businesses.
- Choose the route deliberately. Exclusion or relief if you can get it; sandbox if you’re testing; AR if you’re distributing someone else’s product; your own AFSL if you’re the issuer or the economics demand control. Write down the reasoning — investors will ask, and so may ASIC.
- Diligence your principal like a co-founder. Their authorisations must cover your roadmap, not just your MVP; their compliance failures and licence conditions become yours in practice.
- Make the representative relationship real. Licensee involvement in product governance, approvals and supervision isn’t overhead — it’s what keeps the exemption available after Qoin.
- Start the AFSL application earlier than feels necessary. Between responsible managers, financial requirements and ASIC’s assessment timeframes, a realistic budget is six to twelve months. If your sandbox window or AR arrangement is your bridge, build the licence timeline backwards from its expiry.
- Revisit the analysis at every pivot. Licensing is a snapshot of what your product does today. New features — a wallet, a yield product, a token — can move you across the perimeter without anyone noticing until diligence, or ASIC, does.
The Bottom Line
The AFSL regime is not a Series B problem, and it’s not optional for wholesale-only or “tech layer” businesses that in substance provide financial services. But nor does every fintech need a licence on day one: the exclusions, the sandbox and the authorised representative route exist precisely so that new entrants can launch lawfully. The discipline is matching the route to the substance of what you do. The Qoin litigation is the cautionary tale — a product built first, a licensing story bolted on afterwards, and a Full Court finding that the story didn’t survive contact with the statute. Do the analysis before you ship, and the licensing strategy becomes a fundraising asset instead of the finding that stalls your round.
This article is general information only, not legal advice — whether your product is a financial product, and which licensing route fits, turns on the specific features of your business. Viridian Lawyers advises Australian fintech founders and investors on financial services licensing, authorised representative arrangements and capital raising. If you’re launching near the perimeter, get in touch before it ships.
