ASIC’s temporary forbearance for crypto firms has ended, leaving unlicensed businesses exposed in Australia

Australia’s corporate markets regulator has brought a long running period of regulatory tolerance for digital asset firms to a close, with the so called no action position expiring on September 30, 2026. The change means businesses offering in scope crypto products or services without either an Australian Financial Services licence or a qualifying authorised representative arrangement are exposed to enforcement action from October 1.

What changed and why it matters now

Since late 2025 ASIC issued Information Sheet 225 to explain how existing financial services law applies to digital assets. To give the industry time to adapt, the regulator said it would not take enforcement action against firms that met transitional conditions, effectively creating a temporary safe harbour. That period was extended more than once, most recently to the end of September 2026.

With the extension now ended, the legal position has reverted to the default under the Corporations Act. Where a digital asset or product meets the definition of a financial product, the provider must hold a valid Australian Financial Services licence, operate through an authorised representative, or otherwise be operating within an express exemption. ASIC can pursue civil or criminal remedies for unlicensed conduct, and firms may also face consumer protection and disclosure obligations they previously avoided.

Regulatory context: parallel AML rules and a new licensing framework

The change sits alongside a separate, already active, tightening of anti money laundering and counter terrorism financing rules that AUSTRAC implemented earlier in 2026. AUSTRAC expanded reporting and customer due diligence requirements for virtual asset service providers, bringing crypto exchanges, over the counter dealers, and some other services into stricter AML oversight.

At the same time, Parliament has enacted the Corporations Amendment that creates a Digital Asset Framework and a new licensing architecture for Digital Asset Platforms and Tokenised Custody Platforms. That framework received Royal Assent in April 2026 but will not commence until April 9, 2027, leaving an implementation gap of several months during which existing law and ASIC guidance govern market conduct.

Practical effects for firms and customers

Compliance and policy advisers told industry audiences that firms which did not lodge licence applications, or secure authorised representative arrangements by the end of September, now face a materially different enforcement environment. ASIC has made clear it expects firms to either secure an AFS licence where required or to structure operations so they fall outside the financial product regime.

For customers, the end of the no action period increases the legal clarity around the obligations platforms must meet, including dispute resolution and disclosure standards. But it also raises short term operational risk. Smaller providers that decide to stop servicing Australian customers rather than meet licensing and AML requirements could restrict consumer access, while others may be the subject of regulatory inquiries or court action if they continue operating without meeting the law.

Industry response and the compliance pathway

Market participants and compliance firms have accelerated licence filings since INFO 225 first took effect. Regulators reported receiving multiple applications during 2026, and industry analysts say an influx of applications is likely to continue as firms weigh the cost of licensing against the business case for remaining in the Australian market.

Options for firms include applying for a full Australian Financial Services licence, operating through an authorised representative who already holds the necessary permissions, or reengineering products so they do not meet the existing legal definitions of a financial product. Each route has different timeframes and costs, and none eliminates the separate AML obligations imposed by AUSTRAC.

Why the gap until the new regime starts matters

The period between the end of ASIC’s no action position and the commencement of the Digital Asset Framework on April 9, 2027 is a critical window. It concentrates enforcement risk into a time when new, bespoke rules for digital asset platforms are not yet in force. Regulators have signalled they will use established authorities to address unlawful conduct rather than wait for the new statute to commence.

That approach has two consequences. First, firms that believed they could defer compliance until the bespoke licensing regime arrives must now treat the Corporations Act and current ASIC guidance as the binding standard. Second, compliance costs and legal uncertainty will likely incentivise a shakeout among smaller operators, with some exiting the market and others consolidating under licensed intermediaries.

What to watch next

Over the coming months watch for three developments. One, the pace and outcome of licence applications will show whether the local industry can scale to meet Australian standards. Two, AUSTRAC enforcement activity or targeted supervisory campaigns could shift the allocation of market share, particularly for cash to crypto over the counter and crypto ATM operators. Three, preparatory rulemaking and ASIC guidance on how to interpret INFO 225 in particular product contexts will determine whether borderline offerings are brought into the licensed regime or can continue with minor product changes.

For consumers and institutional users, the immediate effect should be clearer lines of accountability, but the transition may reduce the number of available platforms in the short term. Firms that plan to serve Australians should urgently confirm their licensing pathway and ensure AML systems are operational, because the window for informal regulatory forbearance has closed.