How to Get a Crypto License in Australia: The ASIC Application, DAP and TCP Authorisations and the 7 October 2027 Deadline

The short version: Australia has no stand-alone crypto licence. From 8 Apr 2027, issuing a digital asset platform (DAP) or a tokenised custody platform (TCP) becomes a financial service, so the operator needs an Australian financial services (AFS) licence from ASIC with the new DAP or TCP authorisations (Act No. 38, 2026; ASIC CP 392). Applications go through the ASIC Regulatory Portal and are assessed under Regulatory Guide 1 (RG 1). ASIC says licence applications open on 8 Apr 2027, and firms already operating must apply by 7 Oct 2027 to keep trading while ASIC decides (CP 392, Table 1 and para. 45). This article covers the application itself. Who needs a licence, the small-platform exemption and the transition rules are in our licensing guide. The Act and ASIC's roadmap are in our Act explainer.

A summary of the Act, ASIC regulatory guides, the CP 392 consultation and AUSTRAC pages linked in each paragraph. Not legal advice. VASP Tracker is an independent project, not affiliated with ASIC, AUSTRAC or the Treasury. Several items below are ASIC proposals that may change before ASIC finalises them; we mark them as such.

What Is Final and What Is Still a Proposal

The legal framework is final: the Corporations Amendment (Digital Assets Framework) Act 2026 received Royal Assent on 8 Apr 2026 and inserts the DAP and TCP provisions into the Corporations Act (Act). The application machinery is also in place, because a DAP or TCP licence is an ordinary AFS licence with extra authorisations. The general process in RG 1, issued in June 2025, already applies to every AFS applicant (RG 1).

What is not final is the crypto-specific layer. On 15 Oct 2026 ASIC released CP 392 with a draft regulatory guide for DAPs and TCPs (labelled “RG 000” in the draft), draft asset-holding and transactional and settlement standards, and a draft financial requirements instrument (ASIC CP 392). ASIC proposes to (CP 392, proposal A1):

• publish one new regulatory guide for DAPs and TCPs, including how to apply for a licence;
• set the financial requirements in a new appendix to RG 166;
• make minor updates to RG 1 for the new authorisations, the application process and the application form; and
• keep INFO 225 as guidance on when digital assets are financial products.

ASIC's timetable is: comments due 27 Nov 2026; ASIC settles its guidance and instruments between November 2026 and March 2027, possibly with further consultation; final instruments and guidance published in March 2027; the Act commences and applications open on 8 Apr 2027; and the transition window for existing firms closes on 7 Oct 2027 (CP 392, Table 1). In practice, the final rulebook should be public about a month before applications open, so firms will have to prepare much of their file against the drafts.

Step 1: Work Out Which Authorisations You Need

RG 1 is blunt about why this step matters. Applying for authorisations you do not need raises your fees and levies and slows the assessment, and ASIC can cancel a licence if you do not provide a financial service under it within six months of the grant (s915B) (RG 1.47). Draft RG 000 tells applicants to identify four things before they apply (draft RG 000.87):

• whether they will issue a DAP or a TCP;
• which DAP business model or models they will use;
• any other financial services they will provide in relation to the platform; and
• any services relating to underlying assets that are themselves financial products.

The draft proposes five “issue” authorisations, one per business model, and an operator using more than one model may need more than one (draft RG 000, Table 4):

• Custody-only DAP: the operator holds tokens for clients and records their interests, but does not execute, match or settle trades. Ancillary uses such as staking or lending are allowed if safekeeping stays the primary function.
• DAP as agent: the operator takes client orders and executes them through another platform, venue or liquidity source, like a broker.
• DAP as principal: the operator is the buyer or seller in each trade, may price from its own inventory and make markets. This includes matched principal trading.
• DAP as trading venue provider: the operator runs the venue where buyers and sellers interact, without being a counterparty.
• TCP: the operator holds an underlying asset and issues a token that gives rights to it, including a right to redeem or take delivery.

On top of these, the draft lists further authorisations that may be needed: dealing by using a DAP or TCP on behalf of another person, arranging for another person to deal in a DAP or TCP, and general or personal advice about a DAP or TCP (draft RG 000, Table 5). A DAP authorisation does not cover services relating to underlying assets that are financial products. A platform that also trades, for example, tokenised securities needs the normal dealing, market-making or advice authorisation for those products. However, the draft says it does not need the custodial or depository service authorisation for digital assets that are financial products (draft RG 000.92–94). ASIC also flags that some platforms will have to consider the markets licensing and clearing and settlement facility regimes (CP 392, proposal A3(b)).

The Portal's own choices are more granular than the old paper form. Applicants can limit some authorisations to retail or wholesale clients, limit advice to general advice, and select dealing, arranging or both (ASIC INFO 294). These choices drive both the questions you are asked and the fee.

Step 2: Write a Business Description ASIC Can Assess

RG 1 asks for a description that covers (RG 1.36):

• the services and products you will offer, and your sources of income and their proportions;
• growth forecasts;
• whether your clients are retail or wholesale;
• how you will distribute and deliver your services;
• which operations sit in Australia and which overseas, and how they are supervised; and
• what you outsource.

ASIC recommends diagrams of the business model, the group structure and the flow of money (RG 1.37). For a platform, the asset flow matters as much as the money flow. The draft standards turn on how client tokens are held, and ASIC is consulting on periodic reporting of the wallets and addresses that hold client assets (CP 392, paras. 79–83).

ASIC's FAQs say that the time an assessment takes depends on the quality of the information, ASIC's analysis of the business and the market you propose to operate in. They also ask applicants to be “open and transparent” (INFO 294). The platform-specific obligations the description has to support are set by the Act. They include platform rules with transparent and non-discriminatory client eligibility criteria and a disclosed settlement method (new s912BG), compliance with the asset-holding and transactional and settlement standards (s912BB), and a DAP/TCP Guide for retail clients (s1020AN) (Act; draft RG 000.104–105).

Step 3: Nominate Responsible Managers and Gather People Proofs

ASIC assesses organisational competence (s912A(1)(e)) through the knowledge and skills of the responsible managers you nominate, under RG 105 (RG 105). Draft RG 000 says DAP and TCP responsible managers should have three things (draft RG 000.96–99):

• experience relevant to the products and services;
• an understanding of the technology used; and
• an understanding of AFS licensee obligations.

For RG 105's Option 5, which looks at relevant experience over the past 10 years, ASIC may count regulated or unregulated experience. Depending on the authorisations sought, that can include:

• operating a platform;
• custody;
• dealing in securities;
• market making or derivatives;
• operating a financial market in Australia or overseas; and
• managing the technology.

The application has to explain how the managers collectively cover every service applied for. In CP 392, ASIC asks for feedback on “challenges reported in meeting” the responsible manager requirements, which suggests this is a known pressure point for crypto applicants (CP 392, A5Q5).

RG 1 sets out the general rules (RG 1.172–186):

• There is no cap on the number of responsible managers. A small business may have one, but ASIC generally expects at least two.
• If the licensee depends heavily on one person, ASIC will usually name them in a “key person” condition, with notification and replacement duties if they leave.
• An overseas qualification is generally accepted only if it is comparable to an Australian one. A comparability assessment by International Education Online can take up to three months.

Separately, ASIC must have no reason to believe that the applicant's fit and proper people (for a company, its officers and natural-person controllers) or its responsible managers are not fit and proper (s913BA) (RG 1.134–149). Each person needs “People Proofs” no more than 12 months old: a national criminal history check, plus overseas criminal history and bankruptcy checks for every country where they lived for more than 12 months in the last 10 years, and a signed Statement of Personal Information (RG 1.149). Documents must be in English or come with a certified translation (RG 1.150). People Proofs are now the only proof documents. ASIC has dropped the old “core” and “non-core” proofs and collects fit and proper information inside the application (INFO 294). For groups, ASIC may accept a certification for officers of intermediate controllers, or evidence of an equivalent fit and proper regime abroad for an ultimate controller's people (RG 1.151–155).

Collecting overseas police and bankruptcy checks for a multinational board takes time, and every check must still be less than 12 months old when you file. Start the collection close enough to the filing date that nothing expires.

Step 4: Show the Financial Resources (Draft Figures)

Every AFS licensee must have adequate financial resources (s912A(1)(d)). Under RG 166, the requirements are made up of base-level requirements, a surplus liquid funds (SLF) requirement where the licensee holds client money or property, and an adjusted SLF requirement where it transacts with clients as principal (RG 1.206–211; RG 166). ASIC does not ask for financial statements with the application. They are requested at the “requirements stage” if ASIC is minded to approve, and a final licence is granted only once ASIC is satisfied the resources are there (INFO 294; RG 1.212).

For DAPs and TCPs, CP 392 proposes the following. These are consultation figures, not final rules (CP 392, Section D, proposals D1–D3 and Table 7):

• All DAP/TCP licensees (D1): solvency and positive net assets. If they hold more than $100,000 of client money, $50,000 in SLF. If they transact with clients as principal, an adjusted SLF of $50,000 plus 5% of adjusted liabilities between $1 million and $100 million plus 0.5% of adjusted liabilities above $100 million. These would be imposed by licence conditions.
• Operators (D2): quarterly cash flow projections covering at least the next 12 months, and audit reports that attest to compliance with the cash needs and NTA requirements. These mirror the rules for IDPS operators.
• Operators, net tangible assets (D3): one of three models, with CPI-indexed thresholds. In all three, an operator that meets the third-party custody conditions holds at least $200,000, 0.5% of average underlying assets held (up to $7 million), or 10% of average revenue, as set out in Table 7. Otherwise:
  • Model 1: the greater of $14 million or 10% of average revenue.
  • Model 2: the greater of $7 million or 10% of average revenue if the operator never holds an underlying asset that is a financial product, otherwise $14 million or 10%.
  • Model 3: the greatest of $2 million, 0.5% of assets (up to $14 million) or 10% of revenue, plus $500,000 for an agent, $750,000 for a neutral trading venue or $1 million for a principal.

The requirements would be set in a draft ASIC Corporations (Financial Requirements for Digital Asset Platforms and Tokenised Custody Platforms) Instrument 2027/XX, attached to CP 392. ASIC notes the draft will change after consultation. The gap between the models matters most for self-custodying operators: the same business could face a $2 million or a $14 million floor depending on which model ASIC chooses. Firms should model all three until March 2027.

Step 5: Document Compliance, Risk and Client Protection

ASIC must not grant a licence if it has reason to believe the applicant is likely to breach its obligations, and you must be able to comply from the day the licence is granted (s913B(1)(b), reg 7.6.03(g)) (RG 1.188–189). During the assessment, ASIC may ask about (RG 1.190):

• how you maintain competence;
• your compliance arrangements;
• how you train, supervise and monitor representatives;
• financial, human and IT resources;
• dispute resolution;
• risk management;
• compensation and insurance; and
• product research and representatives' benefits.

RG 1 adds expectations on IT security and disaster recovery, and says outsourcing does not shift responsibility (s769B). Both points are directly relevant for platforms that rely on third-party custody or cloud infrastructure (RG 1.214–218). Draft RG 000 includes a catalogue of the obligations that apply to DAP and TCP licensees, mapping each to its legal source and to ASIC guidance such as RG 104, RG 105 and RG 166. ASIC says the catalogue is not exhaustive (draft RG 000.100–103).

If you will serve retail clients, RG 1 points you to internal dispute resolution (RG 271), membership of the Australian Financial Complaints Authority (AFCA) and compensation arrangements, normally professional indemnity insurance under RG 126 (RG 1.41–43). You do not need AFCA membership or PI cover before you apply, but ASIC will ask for them in its requirements letter before granting a final licence. RG 1 warns that PI cover can take weeks to arrange (RG 1.235–241; INFO 294). After the grant, you must appoint an ASIC-registered auditor within one month (s990B(1)) (RG 1.219).

Step 6: Lodge Through the ASIC Regulatory Portal and Pay

Since 16 June 2025, new AFS licence applications and variations can be lodged only through the ASIC Regulatory Portal (ASIC; INFO 294). INFO 294 sets out how the Portal works:

• The questions are generated from the authorisations you select.
• Documents are uploaded inside the transaction, with no 10 MB limit and no separate upload system.
• Drafts can be saved and resumed until you submit.
• Once submitted, answers cannot be changed. False or misleading statements to ASIC are a criminal offence.
• Paper lodgement takes considerably longer and costs more. ASIC counts inability to apply online when it assesses whether you have adequate technological resources.

ASIC publishes the full set of possible questions as a “Record of Transaction” on its AFS Licensing Kit page (INFO 294).

The fee is paid on lodgement. The Portal calculates it from your selections and issues a remittance advice, and fees are GST-free and paid by BPAY or cheque (INFO 294). ASIC's fee schedule, effective 1 July 2026, lists these online fees for a body corporate (ASIC INFO 30; ASIC form page):

• Retail clients, low complexity products (FSL1E): $3,721
• Retail clients, high complexity products (FSL1G): $7,537
• Wholesale clients, low complexity products (FSL1N): $2,233
• Wholesale clients, high complexity products (FSL1P): $5,025
• Varying the conditions of a body corporate's licence online: $2,470

We did not find an ASIC statement on which complexity band the new DAP and TCP authorisations will fall into. The Portal will calculate it. Annual industry funding levies are a separate cost, and RG 1 notes they rise with unnecessary authorisations. The fee is not refunded if you withdraw after ASIC accepts the application, or if the application is deemed withdrawn (INFO 294).

Step 7: Assessment, Requirements Letter and Grant

After lodgement, the application goes to an ASIC licensing analyst. ASIC takes a risk-based approach and contacts the applicant for more information. If an applicant does not answer a formal written notice in time, the law deems the application withdrawn, with no appeal and no refund (INFO 294). If ASIC grants the licence in principle, it sends a “requirements letter” with a draft licence showing the proposed authorisations and conditions. Outstanding items, typically PI insurance and AFCA membership, must be completed within the stated time, and you must confirm there has been no material change before the final licence is issued.

The licence comes with the standard conditions in PF 209 and may carry tailored conditions for your business (INFO 294; RG 1.193). Before ASIC can refuse a licence, the applicant has a right to be heard by an ASIC delegate, and a refusal can be taken to the Administrative Review Tribunal (INFO 294).

How long it takes. ASIC's guidance points applicants to its service charter rather than to a statutory decision period like the UK's 6-month clock (INFO 294). The charter target is to decide 70% of complete AFS licence applications or variations within 150 days and 90% within 240 days. ASIC adds that applications “will take longer if they raise complex or new policy issues” (ASIC service charter). DAP and TCP applications are new policy by definition, and there is no published track record for them yet.

What 27 November 2026, 8 April 2027 and 7 October 2027 Mean for Applicants

• 27 Nov 2026: CP 392 comments close. This is the last scheduled chance to shape the NTA model, the responsible manager guidance and the variation process before ASIC finalises them. Comments go to ASIC's Fintech Team at [email protected] (CP 392). ASIC asks existing operators to estimate the time and cost of each proposal, and specific numbers carry more weight than general objections.
• March 2027: final rules. ASIC plans to publish the final guide, standards and financial requirements instrument, along with the updated RG 1 authorisations and form (CP 392, Table 1 and proposal A1). Freeze the business description, the responsible manager plan and the capital plan against the final text.
• 8 Apr 2027: applications open. “Applications for DAP and TCP authorisations commence on 8 April 2027” (CP 392, para. 45). Firms that already hold an AFS licence will usually apply for a variation rather than a new licence. ASIC says firms licensed after INFO 225 will likely need a variation to issue a DAP or TCP, and it plans separate, temporary guidance on variations for the April–October 2027 window (CP 392, para. 40 and proposal A3(c)).
• 7 Oct 2027: transition window closes. “If you apply by the deadline, you can continue operating while ASIC assesses your application” (CP 392, para. 45). The statutory mechanics, and what happens to firms that miss it, are covered in our licensing guide, linked above.

Lining these dates up against ASIC's charter target is sobering. A complete application lodged in October 2027 that lands in the 150-day band would be decided around March 2028, and one in the 240-day band around June 2028. That is our arithmetic, not an ASIC forecast. Filing early shortens the period spent operating on transitional protection, and a well-prepared file is the only part of the timing an applicant controls.

How AUSTRAC Registration Fits In

ASIC licensing does not replace anti-money-laundering registration. AUSTRAC says you must be registered with it before providing virtual asset services in Australia, and that doing so without registration is illegal (AUSTRAC). We found nothing in the Act or ASIC's materials that exempts AFS licensees from this. A platform will therefore deal with two regulators and two separate files:

• Process. Enrol, then register through AUSTRAC Online. AUSTRAC may take up to 90 days to assess, and the clock resets when it asks for more information. The outcome is approval, approval with conditions, or refusal (AUSTRAC).
• Test. AUSTRAC asks whether registration could pose a significant money laundering, terrorism financing or other serious crime risk. It looks at AML/CTF readiness and resourcing, the experience of key personnel, any criminal charges or convictions, and compliance history, including that of beneficial owners (same source).
• Upkeep. Registration lasts three years, and you can apply to renew from 90 days before expiry. Changes to beneficial owners, key personnel, countries of operation or foreign licences must be reported within 14 days (same source).
• The 2026 reforms. Registered digital currency exchange providers became registered virtual asset service providers automatically on 31 March 2026 (AML/CTF Transitional Rules 2026, s. 6). Providers of newly regulated virtual asset services had until 29 July 2026 to apply, and could keep operating until AUSTRAC decided (AUSTRAC; Transitional Rules, ss. 13–14). Existing registrants must update their details with the newly required information before their next renewal (AUSTRAC).

The two files overlap, for example on key personnel, ownership and wallet information. ASIC notes that AUSTRAC already collects wallet information at registration and says it will weigh the overall regulatory burden before adding its own wallet reporting (CP 392, para. 83). Keep the people, ownership and wallet data consistent across both applications. Our register check shows which major platforms are on AUSTRAC's register today, and the register tool lets you search by name.

Australia Next to the UK and MiCA

All three regimes fold crypto into existing financial services licensing rather than creating a separate crypto licence. The differences are in the clock and the reach:

• UK. Firms need an FCA Part 4A permission under FSMA, applied for through FCA Connect. The application window for existing firms runs to 28 February 2027, and the regime starts on 25 October 2027. The FCA has a statutory 6-month decision deadline for complete applications. Application fees are £2,820 to £28,150, and the minimum capital is £75,000 to £750,000 depending on the activity (our UK guide).
• EU. MiCA gives a CASP one authorisation that can be passported to every member state. The authority has fixed periods of 25 working days to check completeness and 40 working days to decide, and minimum capital is €50,000 to €150,000 (our MiCA guide).
• Australia. An AFS licence with DAP or TCP authorisations is a national licence with no passport. ASIC works to service charter targets of 150 and 240 days rather than a fixed decision period. Application fees of $2,233 to $7,537 for a body corporate are low by comparison. The proposed NTA floors, however, run as high as $14 million for self-custodying operators, far above the UK and EU minimums (CP 392, draft). Australia also sequences the process differently from the UK: its window opens on the day the law commences, not before.

Practical Checklist Before You File

1. Map each product to a draft RG 000 business model (custody-only, agent, principal, venue, TCP), and list the extra dealing, arranging, advice and underlying-asset authorisations it needs.
2. Check whether any token you list is a financial product (INFO 225) and whether markets licensing or clearing and settlement rules could apply.
3. Draft the business description to RG 1.36 standard, with diagrams of entities, money flows and token custody.
4. Nominate at least two responsible managers who together cover every authorisation, and record their Option 5 experience under RG 105.
5. Order People Proofs (criminal history, bankruptcy and Statements of Personal Information for each country lived in) so they are under 12 months old at filing.
6. Model capital under all three proposed NTA models, plus SLF and adjusted SLF if you hold client money or trade as principal.
7. Prepare platform rules, the DAP/TCP Guide, custody and settlement procedures, IDR, compliance, risk and outsourcing policies.
8. Line up AFCA membership and PI insurance quotes for the requirements stage.
9. Register on the ASIC Regulatory Portal and budget for the fee ($2,233 to $7,537 for a new body corporate licence, $2,470 for a variation).
10. Comment on CP 392 by 27 Nov 2026, read the final rules in March 2027, and lodge from 8 Apr 2027, well before 7 Oct 2027.
11. Keep the AUSTRAC registration current and consistent with the ASIC file.

Checked against legislation.gov.au, asic.gov.au and austrac.gov.au on 2 Nov 2026. Not published, so not estimated here: which fee complexity band DAP and TCP authorisations fall into; the final NTA model; the variation guidance for existing licensees; and any ASIC processing statistics for DAP or TCP applications.