On 1 April 2026, Australia passed its first comprehensive legislation regulating digital asset platforms. The Corporations Amendment (Digital Assets Framework) Bill 2025 cleared both houses of Parliament, bringing crypto exchanges and custody providers into the Australian Financial Services Licence (AFSL) regime for the first time. If you are building a crypto or Web3 startup in Australia, this legislation will likely reshape how you operate, raise capital, and engage with institutional counterparties.
Here is what founders need to know.
What the Legislation Does
The Bill amends the Corporations Act 2001 (Cth) and the Australian Securities and Investments Commission Act 2001 (Cth) to create two new categories of regulated financial product:
Digital Asset Platforms (DAPs) — facilities where an operator possesses digital tokens on behalf of clients and records client interests via an account or similar mechanism. This captures most centralised exchanges, brokers, custodians, and some wallet providers where the operator has custody or control of user tokens.
Tokenised Custody Platforms (TCPs) — facilities where an operator identifies real-world underlying assets, creates a corresponding digital token for each, and holds the underlying asset on trust for the person who possesses that token. Think tokenised securities, tokenised commodities, or tokenised real estate.
Both DAPs and TCPs are now classified as financial products under the Corporations Act. Operators must obtain an AFSL from ASIC and comply with the same core obligations that apply to brokers, fund managers, and other financial services providers — including client asset safeguarding, standardised disclosure requirements, prohibitions on misleading conduct, and membership of an external dispute resolution scheme.
Importantly, the legislation does not attempt to regulate all crypto or all blockchain activity. It targets the intermediaries in the middle — the businesses that hold, manage, or control digital assets on behalf of customers. The policy rationale, informed by the collapses of FTX and Celsius (both of which had Australian customers), is that custody creates fiduciary responsibilities regardless of the technological medium.
Who Gets Caught
The scope is broader than many founders expect. If your business model involves any of the following, you should assume you are within the regulatory perimeter:
- Operating a centralised exchange that holds customer tokens
- Providing custodial wallet services, including institutional custody
- Acting as a broker or intermediary that acquires and holds tokens on behalf of clients
- Issuing tokenised representations of real-world assets where you hold the underlying asset on trust
The legislation includes a low value exemption and an incidental activity exemption, which may provide relief for smaller or peripheral operators. However, the boundaries of these exemptions are yet to be tested, and ASIC has broad powers to issue guidance (and enforcement action) as the regime matures.
One area of particular uncertainty is the treatment of DeFi protocols and software developers. The Bill targets intermediary-operated facilities, which suggests that truly decentralised protocols — where no single operator holds custody — may fall outside the regime. But as practitioners have noted, the legislation is drafted broadly enough that businesses providing software applications used in decentralised finance, or infrastructure providers in the ecosystem, could be caught depending on the degree of control they exercise over user assets.
If you are operating in this space, the prudent approach is to obtain specific legal advice rather than assuming you are exempt.
The Timeline
The compliance timeline has three phases:
- Royal Assent — the Bill received Royal Assent following passage on 1 April 2026.
- Commencement — the substantive provisions commence 12 months after Royal Assent, currently expected around April 2027.
- Transition period — existing operators have a further 6 months from commencement to apply for an AFSL (or a variation to an existing AFSL) covering their DAP or TCP activities.
That gives existing businesses approximately 18 months from now to achieve compliance. For a new startup that has not yet launched, the calculation is different — you will need to factor AFSL application timing into your go-to-market strategy from the outset.
AFSL applications are not fast. ASIC’s standard processing times for new licence applications can run to six months or more, and applications involving novel business models (which most crypto businesses involve) tend to take longer. If you plan to be operational by the time the transition period expires, the time to start preparing your application is now.
What Compliance Looks Like
Holding an AFSL is not just about having a licence number. It comes with ongoing obligations that many early-stage crypto startups have not previously had to consider:
- Organisational competence requirements — you will need to demonstrate that your responsible managers have appropriate qualifications and experience to oversee a financial services business.
- Financial resource requirements — ASIC imposes minimum net tangible asset requirements on AFSL holders. The specific requirements for DAP and TCP operators will be set out in regulations, but expect them to be meaningful.
- Client money and asset segregation — you must hold client assets separately from your own. This is the core consumer protection that the regime is designed to enforce, directly addressing the commingling risks that caused losses in overseas platform failures.
- Disclosure obligations — you will need to provide clients with product disclosure statements (PDS) or similar documents, tailored to the specific risks of digital asset products.
- Dispute resolution — membership of the Australian Financial Complaints Authority (AFCA) or an equivalent external dispute resolution scheme.
- Risk management and compliance — documented compliance arrangements, a compliance plan, and adequate risk management systems.
- Record keeping and reporting — the same standard of books and records that applies to any financial services licensee.
For startups accustomed to operating with minimal regulatory overhead, this represents a significant uplift. The cost of obtaining and maintaining an AFSL — legal fees, compliance staff, systems, and capital — is material. Early-stage founders should be modelling these costs in their financial plans and discussing them with investors.
AML/CTF Obligations
The Digital Assets Framework operates alongside, not instead of, Australia’s anti-money laundering regime. AUSTRAC registration as a Digital Currency Exchange (DCE) provider remains a separate requirement under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth).
Additionally, AUSTRAC has confirmed that AML/CTF obligations for newly regulated virtual asset services under the expanded framework will commence from 1 July 2026, with a registration deadline of 29 July 2026 for those services. If your startup provides virtual asset services that were previously unregulated, this deadline is even closer than the AFSL transition period.
What This Means for Fundraising
For crypto and Web3 founders raising capital, the new framework changes the conversation with investors in two important ways.
First, regulatory clarity is broadly positive for fundraising. Institutional investors and venture capital funds have been hesitant to deploy capital into Australian digital asset businesses precisely because of the regulatory uncertainty. A clear licensing framework — even one that imposes significant compliance costs — gives investors confidence that the businesses they back will not face an existential regulatory risk down the line. Research from the Digital Finance Cooperative Research Centre estimates that Australia could generate up to A$24 billion annually from tokenised markets and digital assets under a well-regulated framework.
Second, compliance costs become a line item in your financial model. Investors will want to see that you have budgeted for AFSL application costs, ongoing compliance staffing, and the capital reserves required to maintain the licence. A founder who understands the regulatory landscape and has planned for it signals maturity. A founder who has not thought about it signals risk.
Practical Steps for Founders
If you are building in the crypto or Web3 space in Australia, here is what you should be doing now:
- Map your activities against the new categories. Determine whether your platform operates (or will operate) as a DAP or TCP, and whether any exemptions apply.
- Get legal advice on your AFSL strategy. Decide whether you need a new AFSL, a variation to an existing licence, or whether you can structure your operations to fall outside the regime.
- Start preparing your compliance framework. Responsible manager appointments, compliance plans, risk management systems, and client asset segregation arrangements all take time to design and implement.
- Budget for it. AFSL application costs, ongoing compliance, and capital requirements should be in your financial model and your investor deck.
- Watch for ASIC guidance. ASIC will issue regulatory guides and information sheets as the commencement date approaches. These will provide critical detail on how the regime will operate in practice.
The Digital Assets Framework represents the most significant change to Australia’s financial services regulatory architecture in the digital asset space. For startups that plan ahead, it creates a credible regulatory environment that should attract institutional capital and mainstream adoption. For those that do not, the 18-month compliance window will arrive faster than expected.
If you need help navigating the new framework or preparing your AFSL application, get in touch.
