Design and Distribution Obligations for Fintech Startups: How ASIC's Target Market Determinations Apply to Financial Product Issuers

Most fintech founders file the design and distribution obligations under “big bank compliance” — something for the product committees of the majors, not a ten-person startup. ASIC sees it differently. Its first-ever penalty for failing to make a target market determination wasn’t against a bank: it was against Bit Trade, the operator of the Kraken crypto exchange in Australia, which was ordered to pay $8 million after offering a “margin extension” product to over 1,100 Australian customers without a TMD. Bit Trade held no credit licence and the product wasn’t regulated consumer credit — and that was exactly the problem. The design and distribution obligations (DDO) in Part 7.8A of the Corporations Act 2001 (Cth) reach further than the licensing perimeter, and they’ve applied since 5 October 2021.

Does DDO Apply to Your Product?

The regime applies to financial products offered to retail clients. Broadly, a product is caught if it needs a product disclosure statement under Part 7.9, needs a disclosure document under Chapter 6D (with a key carve-out below), or is a financial product under the ASIC Act — a definition that, unlike the AFSL regime, includes credit facilities generally. That last limb is the fintech trap. It picks up consumer credit, BNPL-style products, and — as Bit Trade discovered — credit extended by a product that was never designed as a loan at all. The Federal Court found Bit Trade’s margin extension was a credit facility whenever it was repayable in a national currency, so a TMD was required before it was offered, licence or no licence.

The main exclusions matter too, because they tell you what isn’t caught:

• Fully paid ordinary shares — so a seed round of ordinary shares generally doesn’t need a TMD. But the exclusion is exactly that narrow: it doesn’t extend to preference shares, convertible notes or SAFEs, nor to ordinary shares the company intends to convert into preference shares within 12 months of issue — and anti-hawking and disclosure rules still apply;
• Securities offered under an employee share scheme — provided the offer is one that’s eligible to be made under the ESS regime in Division 1A of Part 7.12;
• MySuper products and margin lending facilities, which have their own regimes.

And because DDO only protects retail clients, a product distributed exclusively to wholesale, sophisticated or professional investors sits outside the regime — but the classification has to be right, and it has to hold up in practice, not just in your terms of use.

The Target Market Determination

If your product is caught, section 994B requires the issuer to make a TMD before any “retail product distribution conduct” occurs — before the product is offered, sold or advertised to retail clients. Distributing without one is a civil penalty contravention (section 994D), and it’s a per-customer analysis: Bit Trade contravened every time the product was made available.

A TMD is a public-facing document, but it is not marketing copy. Under section 994B it must:

• describe the class of consumers who make up the target market — by reference to their likely objectives, financial situation and needs, not just demographics;
• specify distribution conditions — the channels and restrictions that make it likely the product reaches that market;
• set review triggers — events suggesting the TMD is no longer appropriate (complaint spikes, unexpected loss rates, high cancellation rates);
• set review periods and the reporting periods for distributor complaint data.

The overarching standard is that the TMD must be such that the product, distributed as the TMD contemplates, would likely be consistent with the likely objectives, financial situation and needs of the target market. ASIC’s guidance in Regulatory Guide 274 makes clear this is a product governance exercise: the target market should fall out of your product design data, and a target market defined so broadly that anyone fits (“consumers seeking flexible payment options”) is exactly what ASIC’s stop orders have targeted.

The Obligations Don’t Stop at Launch

Making the TMD is the start, not the end:

• Reasonable steps (section 994E). Issuers and distributors must take reasonable steps that will, or are reasonably likely to, result in distribution being consistent with the TMD. This is where Firstmac was penalised $8 million: it cross-sold an investment product to hundreds of existing term deposit customers without reasonable steps to keep distribution inside the target market.
• Review triggers have teeth (section 994C). When a review trigger occurs — or you otherwise become aware the TMD is no longer appropriate — distribution must stop until the TMD is reviewed. American Express paid $8 million in penalties after high cancellation rates on co-branded credit cards should have told it the TMDs needed review, and it kept distributing anyway.
• Records and reporting (sections 994F–994G). Distributors must keep distribution records, report complaints to the issuer, and notify the issuer of significant dealings inconsistent with the TMD within 10 business days. Issuers must notify ASIC of significant dealings inconsistent with the TMD, also within 10 business days of becoming aware.

ASIC also holds an administrative weapon it uses far more often than court action: stop orders under Part 7.8A, which can halt distribution immediately where a TMD is missing or deficient. ASIC has issued dozens, and small issuers with template TMDs — often bought as a compliance document rather than built from product design — feature heavily. Beyond stop orders, contraventions attract civil penalties calculated under the Corporations Act formula — for companies, the greater of $18.2 million (50,000 penalty units at the $364 unit value applying from 1 July 2026), three times the benefit obtained, or 10% of annual turnover capped at $910 million. The three $8 million outcomes above are the early data points, not the ceiling.

A Practical Playbook for Fintech Founders

1. Map your products against the perimeter before launch. Ask “does anything we offer involve credit, even incidentally?” — deferred settlement, fee financing, negative balances and margin features can all be credit facilities. This analysis belongs alongside your AFSL/ACL licensing analysis, not after it.
2. If you’re wholesale-only, prove it. Gate onboarding with real wholesale client verification, not a checkbox.
3. Write the TMD from product data. Who is the product genuinely built for, and who would be harmed by it? Define the negative target market honestly.
4. Hard-code your distribution conditions. This is the startup advantage: unlike a bank branch network, your onboarding funnel is software. Knock-out questions, eligibility screens and channel restrictions can be enforced in code — which makes “reasonable steps” demonstrable.
5. Wire up your review triggers. A trigger you don’t monitor is worse than none: it proves you knew what mattered and didn’t watch it. Dashboard your complaint rates, cancellation rates and distributor reports against the TMD’s stated triggers.
6. Paper your distribution partnerships. If others distribute your product — brokers, platforms, referral partners — your agreements need to deliver the data flows sections 994F and 994G assume, in both directions.

The Bottom Line

DDO is product regulation, not disclosure regulation: it regulates who you sell to and how, not just what you tell them. For fintechs the two lessons from the first wave of enforcement are blunt. First, the perimeter is wider than the licensing regime — a product can need a TMD even when it needs no licence, as the crypto sector has already learned the hard way. Second, ASIC is enforcing against issuers of all sizes, and the cheap failure mode — a template TMD nobody reads and triggers nobody monitors — is the one its stop orders are built to catch. Design the target market into the product, and the compliance document writes itself; bolt it on afterwards, and you’re one complaint spike away from a stop order on your core revenue line.

This article is general information only, not legal advice — whether DDO applies, and what your TMD must say, turns on the specific features of your product and distribution model. Viridian Lawyers advises Australian fintech founders and investors on financial services regulation, product structuring and capital raising. If you’re launching a product that might touch the perimeter, get in touch before it ships.