Digital Assets Framework Act 2026 Explained | ComplyEdge

Australia has finally passed its first comprehensive crypto law, and it barely mentions crypto.

That is not a criticism. It is the single most important thing to understand about the Corporations Amendment (Digital Assets Framework) Act 2026, and it is the thing almost every headline got wrong. The Act does not regulate Bitcoin. It does not regulate tokens. It does not declare digital assets to be financial products and march them all into the Corporations Act. What it regulates is the layer everyone actually loses money through: the middlemen who hold digital assets on behalf of other people.

Which, when you think about every major crypto collapse of the past decade, is the most quietly sensible piece of drafting you will read this year. People rarely lose their savings because a blockchain failed. They lose them because the business standing between them and the blockchain failed, or helped itself.

In my fifteen plus years across Big Four advisory and major banks, I have watched plenty of new regimes arrive. The pattern is always the same: the headlines cover the passage, the deadlines get misreported, and the businesses caught at the edges find out last. So this is the decode. What the framework actually captures, who is caught without realising it, the four dates that matter, and the trap sitting in the gap between two regulators.

---

What the Digital Assets Framework Act actually does

The Act creates two new categories of financial product under the Corporations Act, and both of them describe a service, not an asset.

A Digital Asset Platform (DAP) is a facility where an operator holds digital tokens for other people. Think exchanges, custody providers, and any arrangement where the operator holds client tokens as trustee, bailee or under a contract requiring them to act on the client's instructions.

A Tokenised Custody Platform (TCP) is the newer idea: a facility where an operator holds real assets, anything other than money, and issues a digital token for each one, with the token carrying the right to redeem or direct delivery of the underlying asset. Tokenised gold, tokenised property interests, tokenised anything.

Operate either, and you will need an Australian Financial Services Licence, the same licence regime that governs brokers, fund managers and custodians, plus a set of platform-specific obligations layered on top: ASIC-made standards for holding client assets and settling transactions, platform rules that have contractual effect between you and your clients, and a plain-language platform guide for retail customers.

Here is the decode that matters. The trigger is the holding, not the coin. A straightforward spot transaction where a customer buys a token and controls it themselves will often sit outside the regime entirely. The moment your business model involves holding what belongs to your clients, you have walked inside it. The question is no longer whether a token is a financial product. The question is what role your platform plays, and for many operators that question was answered the day they designed their business.

"Australia's first comprehensive crypto law regulates the holder, not the coin. Nobody loses their savings because a blockchain failed. They lose them because the business standing between them and the blockchain failed, or helped itself."

---

Who is caught by the new crypto licensing rules, including the ones who don't know it yet

The obvious captures are the crypto exchanges and custody providers. They have been watching this Bill for two years, and most are already moving.

The less obvious captures are where I expect the pain to land. Fintechs holding tokens for customers as a side feature of something else. Businesses building tokenisation plays over real-world assets who have been thinking of themselves as tech companies rather than financial services providers. Platforms whose white-label or outsourced arrangements mean somebody in the chain is holding client assets, and nobody has asked which entity wears the licensing obligation.

If your business touches digital assets and your instinct just now was "surely not us," I would treat that instinct as a prompt rather than an answer. It is the same sentence I heard from newly captured businesses all through the AML/CTF reform, and it aged poorly every time.

There are exemptions, and they are worth knowing precisely. The regime provides relief for genuinely small operations, including where total transactions across an operator's platforms stay under $10 million over 12 months, and where holdings per customer stay under $5,000. There are also carve-outs for businesses that merely advise on or arrange access to a platform in the ordinary course of business. If you sit under those thresholds, breathe out, then keep reading, because the other regulator does not use thresholds.

---

The four dates that matter, decoded

This is where most of the coverage has made a mess, so here is the timeline stripped to what each date actually means.

Date	What it actually means
Right now	The Act is law but not yet in force. ASIC's position is that many digital asset arrangements are already financial products under existing law, a view the High Court reinforced this year in the Block Earner matter. The bridge is ASIC's no-action position, which shields businesses demonstrably moving toward licensing.
30 Sep 2026	The date that matters this year. ASIC's no-action position, originally expiring 30 June, was extended on 25 June 2026. To stay inside the shield, a digital asset business generally needs to lodge its AFSL application or variation by this date, or be properly positioned under an authorised representative or intermediary arrangement, and meet the conditions, including having operated in Australia on or before 31 December 2025 and holding AFCA membership where retail clients are involved. Crypto lending and earn products, most non-stablecoin payment facilities, and most derivatives sit outside the relief.
9 Apr 2027	The DAF Act commences. DAPs and TCPs formally become financial products and the new regime switches on.
The six months after	A transition period runs from commencement, during which an existing operator that has applied for a licence or variation can keep operating while ASIC processes the application.

And now the sting almost nobody has noticed. ASIC has flagged that businesses licensed under the current INFO 225 pathway will, in many cases, still need to add DAP and TCP authorisations to their licence once the new regime commences. Read that again. The licence you obtain this year may need varying next year. This is a two-stage compliance journey being widely reported as a single deadline, and businesses that budget for one application are going to be surprised by the second.

---

The dual-regulator trap: AUSTRAC is not ASIC

Here is the part of the decode I care most about, because it is where I am already watching businesses get it wrong.

Since 31 March this year, digital asset businesses have also been dealing with AUSTRAC's expanded regime, which replaced the old digital currency exchange registration with the broader virtual asset service provider framework under the reformed AML/CTF Act. That regime is about financial crime: registration, a compliance program, customer due diligence, suspicious matter reporting.

The ASIC regime is about something entirely different: how you conduct the business. Governance, disclosure, custody standards, client asset protection, acting efficiently, honestly and fairly.

Two regulators, two regimes, one business. And the trap is a single sentence. Satisfying one does nothing for the other. AUSTRAC registration does not license you with ASIC. An AFSL does not discharge a single AML/CTF obligation. I have already had conversations this year with operators who genuinely believed their AUSTRAC registration was "the licence," and who were planning their year around a compliance obligation they had already met while ignoring one they had not started.

If you take one line from this article to your board, make it that one. And if AI tools sit anywhere in your compliance stack, the governance expectations we covered in our analysis of the APRA and ASIC letters on AI apply to digital asset businesses with particular force, because you are now squarely inside the regulated population those letters were written for.

---

What licensed life will actually feel like

For operators who cross into the regime, the honest picture is this: the days of crypto as a lightly supervised adjacent industry are ending, and what replaces them is ordinary financial services life. Capital and financial requirements. Custody and asset segregation standards set by ASIC. Platform rules that bind you contractually. Disclosure documents a retail client can actually read. Responsible managers whose names sit on the licence. Boards that own the risk.

If that sounds heavy, it is worth saying what sits on the other side of the scale. Licensing is the thing that lets superannuation funds, banks and institutional money finally engage with this sector without their own compliance teams breaking out in hives. The operators who treat the next eleven weeks as a licensing sprint and the next eighteen months as a governance build are not just avoiding penalties. They are building the exact credential their competitors will be missing when the institutional money starts choosing counterparties.

The ones who treat it as paperwork will discover what every other regulated industry already knows. The licence is the easy part. Operating like a licensee is the job.

---

The decode, on one hand

1. The law regulates the holder, not the coin. If you hold client digital assets, assume you are in scope until properly advised otherwise.
2. The date that matters this year is 30 September 2026, not April 2027.
3. The licence you get now may still need DAP or TCP authorisations added later. Budget for two stages.
4. AUSTRAC and ASIC are separate regimes. Passing one exam does not sit the other.
5. Small-operator exemptions exist under the ASIC regime. The AML/CTF regime does not care about your size.

A business that can answer all five in writing is ahead of most of the sector. A business that cannot has a very fixable problem, and the fix starts with knowing exactly where you stand. Our Regulatory Health Review is the entry-point diagnostic for exactly this: one structured look across both regimes, your custody arrangements and your obligations, delivered in plain English. For digital asset businesses that need the compliance function owned and kept current month to month, from AML/CTF program to licensing readiness, that is what our Managed Compliance Partner retainer was built for.

---

Frequently asked questions

What is the Digital Assets Framework Act 2026?

The Corporations Amendment (Digital Assets Framework) Act 2026 passed Parliament on 1 April 2026 and received Royal Assent on 8 April 2026. It amends the Corporations Act to create two new categories of financial product, Digital Asset Platforms and Tokenised Custody Platforms, bringing their operators into the Australian Financial Services Licence regime. It commences on 9 April 2027.

Does the Act make all crypto a financial product in Australia?

No. The framework is activity-based. It regulates platforms and custody arrangements where an operator holds digital assets for clients, rather than treating tokens themselves as a standalone regulated asset class. Direct self-custody spot transactions will often fall outside the regime, though existing financial product definitions can still apply to particular arrangements.

What is the difference between a DAP and a TCP?

A Digital Asset Platform holds digital tokens on behalf of clients, such as an exchange or custody service. A Tokenised Custody Platform holds real-world assets and issues a digital token for each one, carrying the right to redeem or direct delivery of that asset.

What is the 30 September 2026 crypto licensing deadline?

It is the expiry of ASIC's extended no-action position, announced on 25 June 2026. Digital asset businesses providing financial services generally need to lodge an AFSL application or variation by that date, or be positioned under an authorised representative or intermediary arrangement, and meet the relief conditions, to remain shielded from enforcement while transitioning. The relief excludes crypto lending and earn products, most non-stablecoin payment facilities, and most derivatives. Verify the current position at asic.gov.au.

Are there exemptions for small digital asset businesses?

Yes, under the ASIC regime, including where total transactions across an operator's platforms do not exceed $10 million over 12 months, or holdings remain under $5,000 per customer, along with carve-outs for advice-only and arranging-only services in the ordinary course of business. These exemptions do not affect AML/CTF obligations, which apply regardless of size.

Does AUSTRAC registration mean my crypto business is licensed?

No. AUSTRAC's virtual asset service provider regime addresses financial crime obligations under the AML/CTF Act. ASIC's licensing regime addresses how the business is conducted under the Corporations Act. They are separate, and each must be satisfied on its own terms.

When does the new digital asset regime actually start?

The Act commences on 9 April 2027, followed by a six-month transition period during which existing operators that have lodged a licence application or variation can continue operating while ASIC processes it. ASIC has indicated that entities licensed under the current pathway may still need DAP and TCP authorisations added once the regime commences.

Who can help my digital asset business get compliant?

ComplyEdge works directly with digital asset businesses, fintechs and platform operators across Australia on both regimes, from AUSTRAC VASP registration and AML/CTF programs through to ASIC licensing readiness and governance builds. Our Regulatory Health Review is the entry-point diagnostic. The Managed Compliance Partner retainer is the ongoing solution for businesses that need an embedded compliance function.

---

About the Author

Tarun Mago, JD is the Director and Principal Consultant of ComplyEdge Pty Ltd, a boutique risk and compliance advisory firm based at Barangaroo, Sydney. He works with digital asset businesses, financial services licensees, real estate principals and SME directors across Australia on regulatory frameworks, AML/CTF programs, and embedded compliance retainers.

For more analysis like this, subscribe to Comply or Explain, our LinkedIn newsletter, where Edition 22 carries the companion decode of this framework, and our earlier analysis covers what APRA and ASIC told the financial system about AI governance.

This article is general information only and does not constitute legal advice or financial advice. Positions described reflect the Corporations Amendment (Digital Assets Framework) Act 2026 (Cth), ASIC's extended class no-action position for digital asset businesses announced 25 June 2026, and AUSTRAC's virtual asset service provider framework as at the date of publication. ASIC standards and guidance under the new regime remain under consultation and settings may change. Verify current requirements with ASIC and AUSTRAC, and seek advice specific to your circumstances. ComplyEdge® is a registered trademark of ComplyEdge Pty Ltd (IP Australia, Class 45).