Australia is preparing to end a major regulatory grace period for cryptocurrency businesses, with firms covered by existing financial-services licensing requirements facing potential enforcement action from October 1 if they have not taken the required steps by September 30.
The Australian Securities and Investments Commission issued a final warning that businesses relying on its sector-wide digital-asset no-action position have until September 30 to apply for, or seek a variation to, an Australian Financial Services licence.
Companies requiring an Australian Market Licence or Clearing and Settlement facility licence must instead notify ASIC in writing of their intention to apply and hold a pre-application meeting by the same deadline.
From October 1, firms that require authorization but have not satisfied those conditions risk operating in breach of Australian financial-services law.
Fines Can Reach 10% of Annual Turnover
ASIC has made clear that the September 30 deadline is not simply administrative.
Unlicensed financial-services activity can attract both civil and criminal penalties, with potential fines reaching 10% of annual turnover. The regulator says more than 45 licence applications have already been submitted by digital-asset businesses seeking relevant authorizations.
The deadline originally stood at June 30 but was extended by three months after ASIC acknowledged difficulties businesses faced transitioning into the licensing framework.
ASIC also expanded its temporary protection to businesses operating under, or entering into, authorized-representative and intermediary-authorization arrangements with existing licence holders.
The requirements stem from ASIC’s updated Information Sheet 225, issued in October 2025, which clarified how Australia‘s existing technology-neutral financial-product definitions apply to crypto.
Products potentially captured include certain stablecoins, wrapped tokens, tokenized securities and digital-asset wallets. Whether a particular business requires an AFS licence depends on the legal characteristics of the products and services it provides rather than simply whether it handles cryptocurrency.
That distinction is important: October 1 does not introduce a blanket new licensing requirement covering every Australian crypto company.
Broader Crypto Licensing Regime Arrives in 2027
Australia is simultaneously preparing a much wider regulatory framework. The Corporations Amendment (Digital Assets Framework) Act 2026 passed Parliament on April 1, received Royal Assent on April 8 and is scheduled to commence on April 9, 2027. It will bring digital-asset platforms and tokenized custody platforms more comprehensively within Australia’s financial-services regime.
Many businesses obtaining licences under the current INFO 225 framework will subsequently need to add authorizations covering digital-asset platforms or tokenized custody once the new regime begins.
Crypto companies also face separate obligations under Australia’s anti-money-laundering regulator, AUSTRAC.
AUSTRAC now maintains a public register of virtual-asset service providers and says businesses providing regulated virtual-asset services must be registered. The regulator has already cancelled, suspended or refused renewal for 45 remittance and virtual-asset businesses over the past year as supervision intensifies.
ASIC has likewise demonstrated that unlicensed crypto activity can result in substantial penalties. Earlier this year, the Federal Court ordered BPS Financial to pay A$14 million over its Qoin Wallet, including A$2 million specifically for unlicensed conduct and A$12 million for misleading representations.
September 30 therefore represents a concrete enforcement threshold rather than the launch of Australia’s entire new crypto regime.
For affected firms, the immediate requirement is straightforward: submit the appropriate licence application or variation — or satisfy the relevant alternative authorization conditions — before ASIC’s temporary protection disappears. From October 1, companies that should be licensed but have failed to act can no longer rely on the regulator’s sector-wide promise not to pursue them.