ASIC digital asset licensing deadline: What changes on 1 October 2026?

Since October 2025, the Australian Securities and Investments Commission (ASIC) has said publicly that it would not take action against firms operating without a licence while they worked towards obtaining one. From 1 October 2026, that ends. Firms that require a licence and have not met ASIC’s conditions risk breaching financial services law, and may face significant civil and criminal penalties. The penalty that applies will depend on the nature of the contravention and the circumstances.

What makes this month unusual is that no new law is taking effect. The reprieve has not changed legal obligations, it only changed how ASIC would enforce them.

What the law requires

Under the Corporations Act, a business offering a ‘financial product’ to Australians needs an Australian Financial Services (AFS) licence. A financial product is, broadly, an arrangement through which someone makes a financial investment, manages a financial risk, or makes payments.

That definition was written well before cryptocurrency (crypto) existed, but it does not mention any particular technology. It looks at what an arrangement does, rather than what it is built on.

This is why the answer differs from business to business. A crypto token on its own is often not a financial product. Building a service around it can be a different matter. Holding tokens on behalf of customers, promising a return on them, or running a venue where people trade them can each bring the arrangement inside the definition.

Who does this affect?

While it could be read as a story about crypto exchanges, in practice, the perimeter is wider and some of the most exposed businesses do not think of themselves as digital asset firms at all. Three situations come up regularly:

• Brokers adding digital asset settlement: Allowing clients to settle trades in digital assets changes what the business does, even where the underlying service looks unchanged
• Firms launching digital asset products: Where a new product gives customers exposure to digital assets or pays a return on them, the key question from the courts remains - what is the customer actually receiving in exchange?
• Existing licensees whose activities have moved: This is the situation most often overlooked. Holding an AFS licence does not mean holding the right authorisations. A licence covers specified products and activities, and a business that has moved into digital assets since it was granted may need a variation rather than a new application.

Highlighting the final situation, the litigation that brought this to a head involved a business offering a product without holding a licence at all. For established firms, the exposure is more likely that a licence exists, but it does not extend to what the business has since started offering.

How we got here

Whether digital asset businesses fall inside that definition has been contested.

In 2025, the Full Federal Court (Court) considered a product where customers deposited crypto with a business in exchange for a set rate of return. The Court found it was not a financial product. That decision was appealed and, in June 2026, the High Court reached a different conclusion on the basis that customers handing over their crypto in exchange for a promised return were making a financial investment.

The case concerned a single product that had been withdrawn some years earlier, so it does not follow that every digital asset offering is a financial product. It demonstrates that the existing definition can reach new products without Parliament rewriting it.

In October 2025, ASIC updated Information Sheet 225, its published guidance on how it reads the existing law as applied to digital assets. Guidance is not law, and it created no new obligations. It set out ASIC's view, which is why the question became pressing for many firms that had assumed they were outside the rules.

Alongside the guidance, ASIC issued a class no-action position. That is, a public statement that ASIC will not pursue firms in defined circumstances in this case, while they moved towards licensing. It does not change the law, and it speaks only to ASIC's own conduct.

The original cut-off was 30 June 2026. In June, ASIC extended it to 30 September 2026 and expanded it to cover firms operating under another company's licence, either as an authorised representative or through an intermediary arrangement. ASIC described the extension as a pragmatic response to the sector's transition difficulties, and has recorded more than 45 licence applications since the guidance was updated.

Two gates, not one

Much of the confusion comes from treating this month's deadline and the new digital assets law as a single event, however they are separate laws, and they ask different questions.

This month's deadline sits under the law as it already stands. Whether it applies to a business depends on whether they already fall within the existing definition of a financial product, which is assessed product by product, not across the sector.

The Digital Assets Framework Act is new law. It received Royal Assent in April 2026, and takes effect on 9 April 2027. It adds two named categories to the Corporations Act:

• Digital asset platforms, broadly meaning businesses that hold crypto on behalf of customers. An exchange or a custody service would typically fall here
• Tokenised custody platforms, broadly meaning businesses that hold a conventional asset and issue a digital token representing it.

Once the law takes effect, running one of these platforms requires a licence because the legislation names the activity, rather than relying on existing definitions being interpreted to apply. The Digital Assets Framework Act carries its own definitions and exclusions, so it still depends on what a business actually does.

The important point is that the second regime adds to the first rather than replacing it. ASIC has indicated that many existing authorisations will still be required once the new framework starts. A firm getting licensed this month is not getting a head start on April 2027, it is rather meeting a separate requirement that continues to apply.

	30 September 2026	9 October 2027
Law in effect	The Corporations Act as it already stands	The DAF Act, which adds new provisions to it
The question it raises	Does what you already offer fall within the existing definition of a financial product?	Do your activities amount to running a digital asset platform or a tokenised custody platform?
What is required	An AFS licence application or variation, or another arrangement the ‘no-action’ position contemplates	An application for the new platform authorisations, in addition to any licence already required
If nothing is lodged	ASIC's ‘no-action’ position stops applying, and the underlying licensing requirements continue to operate	The platform cannot be operated until a licence is held

 

Both deadlines may apply to the same business or only one of them. Which is the case depends on the specific activities, products and operating model of the firm.

What to consider

As the deadline draws near, businesses should consider four key questions to determine their current and future obligations:

• Does what you already offer meet the existing definition of a financial product? This decides whether the 30 September 2026 deadline applies to you at all. The recent case law is a reminder the answer is not always the intuitive one
• If it does meet the definition, lodging isn't the end of it. The conditions attached to ASIC's position must still be met, and the position only ever spoke to ASIC's own conduct
• Will you be running a digital asset platform or tokenised custody platform from April 2027? The new obligations catch firms by name rather than by argument and doesn't displace any licence you already needed.
• Do you have a view on the standards? Asset-holding, settlement and financial requirements get settled in the roadmap consultations. ASIC has said its guidance will be principles-based rather than exhaustive, so waiting to see what lands is a weaker position than putting your view in.

Beyond the application

Attention naturally concentrates on the application itself, but a licence is the start of an ongoing relationship with a regulator rather than the end of a project. Firms in scope, or likely to come into scope in 2027, should be considering:

• Governance and board oversight: Clear accountability at board and executive level for regulatory obligations, with reporting that lets that oversight be exercised
• Compliance framework readiness: Policies, procedures and compliance programs that reflect the obligations a licence carries day to day, not just those needed to get the application over the line
• Responsible managers: Licensees must nominate individuals whose knowledge and experience demonstrate the business can competently do what it is licensed to do. Firms should know who those people are and be able to evidence it
• Custody and safeguarding: ASIC's forthcoming standards will deal directly with how client assets are held, keeping them separate from the company's own, checking regularly that records match what is actually held, ensuring customers can withdraw, and overseeing any third party involved
• Financial resources: Licensees must hold minimum levels of cash and assets on an ongoing basis, so a business needs to know what applies to it and be able to keep meeting it
• Risk and control environment: Controls that are designed, implemented and working, with evidence that they are.

The distinction that matters is between frameworks that exist and frameworks that are embedded, approved, put into practice, understood across the business and capable of being demonstrated to a regulator. If it is not documented, it is not done. Regulators increasingly expect organisations not only to hold frameworks and controls, but to show that they work and form part of day-to-day activity.

What comes next

ASIC published an implementation roadmap in April 2026, which remains the most useful document for anyone planning past this month. Consultation on standards and guidance comes first, then a regulatory guide explaining how the new law works and who needs a licence under it, then applications are expected to open from around April 2027. The roadmap was issued before the no-action position was extended, so it refers to a June expiry.

The new law takes effect on 9 April 2027, followed by a transition period. Businesses that apply in that window are expected to be able to keep operating while ASIC assesses their applications. From 9 October 2027, the regime is fully in force.

ASIC will consult on how client assets must be held, how trades must be executed and settled, and how much capital firms must hold, drawing on its existing custody and financial resource guidance rather than starting from scratch. It has also indicated that its guidance will be principles-based, meaning it will set expectations rather than prescribe detailed rules, and will not address every issue. Firms with a view on how the standards should work are better placed contributing during consultation than waiting to see what emerges.

How Australia compares internationally

Regulatory change of this kind prompts some firms to ask whether another jurisdiction would be easier. Two things are worth weighing first.

Relocating does not move the obligation. ASIC's guidance is explicit that an offshore or decentralised structure does not mean Australian obligations can be ignored.  Australian law applies where a digital asset is promoted or sold, or services are provided in relation to it, in Australia including from offshore.  A business that moves its entity but keeps its Australian customers has changed its address, not its licensing position.

The jurisdictions most often raised have not proved lighter either. The European Union gave firms operating before 30 December 2024 a transitional period under the Markets in Crypto-Assets Regulation, broadly the accommodation Australia is making now, but that window has closed. Member states set their own lengths, from six to 18 months, and the outer limit of 1 July 2026 has passed, leaving no transitional cover anywhere in the European Union.

Singapore has a more direct approach. Its digital token service provider regime, in force since June 2025, targets businesses that operate from Singapore while serving only overseas customers. The Monetary Authority of Singapore states the bar is high and that licences will generally not be granted because it cannot effectively supervise activity carried on elsewhere. Firms already serving Singapore customers are unaffected. Singapore has, in effect, closed the door on the arrangement a relocation strategy would depend on.

It is important to clarify that Australia should not be viewed as the softer option. ASIC has noted that the Australian definition of a financial product is often broader than comparable concepts in other jurisdictions, meaning that obligations are not necessarily lighter and are difficult to avoid where Australian customers or activities remain in scope.

Why it matters for the sector

Well-designed regulation is beneficial for digital assets. Clear frameworks support investor confidence, market integrity and the long-term credibility of the industry, and the maturity that comes with them is what allows larger institutions to participate rather than something that holds the sector back.

Firms weighing their position should question beyond what the new regime will look like in April 2027 to focus on whether the governance, risk and compliance foundations are in place to operate under it.

How BDO can help

BDO supports organisations across the regulatory journey, from assessing licensing readiness and strengthening governance and compliance frameworks through to uplifting control environments and preparing for both current and future licensing requirements. Contact our team if you need support with your organisation’s framework.

Disclaimer: This article is general information only and does not constitute legal, financial or professional advice. It reflects the regulatory position as at 10 September 2026 in an area that continues to develop. Whether particular obligations apply to a business depends on its own circumstances, activities and operating model, and readers should obtain their own advice before acting on any matter discussed.