Custodial wallet / SaaS in Australia
Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).
Custodial SaaS is conditionally permitted in Australia with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Mandatory enrolment with AUSTRAC within 28 days of commencing designated services (au.aml.enrol-or-register-overview-httpswwwaustracgovaunew-austracenrol-or-register8-fix-1776276114635-1)
- Mandatory VASP registration with AUSTRAC (registration follows enrolment) — applies to digital currency custodians holding keys on behalf of users as a designated service (au.aml.specific-dcevasp-enrolment-and-registration-fix-1776276114635-2, au.aml.specific-dcevasp-enrolment-and-registration-fix-1776276114635-3)
- Existing DCEs must transition to VASP registration between 31 March 2026 and 29 July 2026 (au.aml.specific-dcevasp-enrolment-and-registration-fix-1776276114635-1)
- Mandatory AML/CTF program covering KYC, transaction monitoring, suspicious activity reporting (SUSTR), designated compliance officer, and record-keeping (au.licensing.amlkyc-mandatory-amlctf-program-for, au.aml.reporting-entities-must-develop-and)
- Customer due diligence obligations under the AML/CTF Act 2006 (au.licensing.legislation-anti-money-laundering-and-counter-terrorism-financing-act-20, au.aml.reporting-entities-must-develop-and)
- Suspicious matter reporting (SUSTR) to AUSTRAC
- The SaaS operator (custodian) bears primary AML obligations as the reporting entity; white-label clients may have additional responsibilities depending on whether they also provide designated services (au.aml.reporting-entities-must-develop-and)
Key Restrictions
- Must be a registered Australian company with an ABN (au.licensing.local-presence-must-be-a)
- Fit-and-proper directors/owners with clean backgrounds required (au.licensing.local-presence-must-be-a)
- AFSL required if custodied digital assets are classified as 'financial products' by ASIC — applies to tokenized assets and certain stablecoins (au.licensing.custody-providers-require-an-afsl, au.licensing.custody)
- If AFSL is required, client asset segregation, disclosure, and custody standards apply under the Corporations Act 2001 (au.licensing.other-afsl-obligations-client-asset, au.licensing.legislation-corporations-act-2001)
- No standalone crypto custody license exists yet; framework reform (CASP-style) expected 2025-2026 (au.licensing.vasp, au.licensing.custody)
- Debanking risk — Senate inquiry 2023 identified debanking of crypto firms as a major issue (au.licensing.exchange)
Key Risks
- Regulatory ambiguity on when custodied assets constitute 'financial products' — ASIC assesses case-by-case, creating classification risk for custodial wallet providers (au.licensing.asic-info-sheet-225-digital, au.licensing.custody-providers-require-an-afsl)
- Severe enforcement penalties for non-compliance — fines up to AUD 210,000 for corporations and potential criminal charges (au.enforcement.non-compliance-penalties-are-severe-failing)
- Transition period risk: new VASP registration framework takes effect 2026; providers must navigate the DCE-to-VASP migration correctly or risk regulatory gaps (au.aml.specific-dcevasp-enrolment-and-registration-fix-1776276114635-1, au.aml.specific-dcevasp-enrolment-and-registration-fix-1776276114635-3)
- Upcoming CASP-style licensing (2025-2026) may impose new capital, custody, and insurance requirements not yet in force — operators face evolving compliance costs (au.licensing.vasp)
- Debanking and limited access to banking services for crypto firms (au.licensing.exchange)
- White-label client liability ambiguity — unclear whether the SaaS provider's AML program fully covers the white-label client's obligations, or whether the client needs separate AUSTRAC enrolment
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
AUSTRAC is the AML/CTF regulator; since 31 March 2026 it registers virtual asset service providers, replacing digital currency exchange registration (AML/CTF Amendment Act 2024, No. 110, Schedule 6).
ASIC regulates digital assets that are financial products under the Corporations Act and ASIC Act, including licensing, disclosure and design and distribution obligations; its guidance is INFO 225 (updated October 2025).
The Anti-Money Laundering and Counter-Terrorism Financing Act 2006 governs crypto AML/CTF; from 31 March 2026 its digital currency exchange registration was replaced by virtual asset service provider registration (AML/CTF Amendment Act 2024, No. 110, Schedule 6).
The Corporations Act 2001 governs digital assets that are financial products, requiring AFS licensing, product disclosure and design and distribution obligations (ASIC INFO 225); the Digital Assets Framework Act 2026 (No. 38) amends it to add digital asset platforms and tokenised custody platforms from April 2027.
Virtual asset service providers register with AUSTRAC from 31 March 2026 (AML/CTF Amendment Act 2024, No. 110) and need an AFS licence for financial products; the crypto reform is enacted as the Digital Assets Framework Act 2026 (No. 38), commencing in April 2027.
Providing custody of digital assets that are financial products currently requires an AFS licence covering custodial or depository services (RG 133, RG 166); the Digital Assets Framework Act 2026 (No. 38) adds tokenised custody platforms as a new financial product (s 761GD) from April 2027.
Exchanges register with AUSTRAC for AML/CTF (virtual asset service provider registration from 31 March 2026) and need an AFS licence for financial products; ASIC enforces design and distribution obligations, with Bit Trade (Kraken) ordered to pay $8 million in December 2024 for issuing a margin product without a target market determination.
AUSTRAC administers the Anti-Money Laundering and Counter-Terrorism Financing Act 2006; since 31 March 2026 its regime covers virtual asset service providers, which must be registered on the Virtual Asset Service Provider Register (s 76B, inserted by Act No. 110, 2024).
Every reporting entity, including virtual asset service providers from 31 March 2026, must be entered on AUSTRAC's Reporting Entities Roll (AML/CTF Act s 51A as amended by Act No. 110, 2024).
Virtual asset service providers must both enrol on the Reporting Entities Roll (AML/CTF Act s 51A) and be registered on the Virtual Asset Service Provider Register (s 76B) under the AML/CTF Act as amended by Act No. 110, 2024 from 31 March 2026.
Holding digital assets that are financial products for clients is a custodial or depository service requiring an AFS licence, while a self-custody or self-hosted wallet product is unlikely to be one (ASIC INFO 225); ASIC extended omnibus-account relief to such digital assets in December 2025.
AFS licensees in the digital asset sector must meet ASIC's base-level financial requirements in Regulatory Guide 166, with tailored requirements by authorisation; custodial providers must also meet a net tangible assets requirement, at least 50% of it held in cash or cash equivalents (INFO 225).
From 31 March 2026 the AML/CTF Amendment Act 2024 (No. 110, 2024) replaced AML/CTF programs with 'AML/CTF policies' (s 26F) and requires every reporting entity, including virtual asset service providers, to designate an AML/CTF compliance officer (s 26J).
Local Presence: Must be a registered Australian company with an ABN; fit-and-proper directors/owners with clean backgrounds; robust governance, IT security, and risk controls.
AFS licensees offering digital asset products must also meet disclosure (PDS and FSG), design and distribution, internal and external dispute resolution and compensation requirements, and custodians must keep client assets separate from their own (ASIC INFO 225, RG 133).
AUSTRAC Registration: Submit online via AUSTRAC portal with business details, AML/CTF program, ownership structure, and compliance evidence. Approval typically 4-6 weeks if complete.
AFS licence applications, including for digital asset businesses, are lodged through ASIC's Regulatory Portal, where an application can be saved as a draft and resumed before lodgement.
ASIC Info Sheet 225 (Digital Assets): https://asic.gov.au/regulatory-resources/digital-transformation/digital-assets-financial-products-and-services/
DCEs registered as reporting entities must transition to VASP registration by updating enrolment details between 31 March 2026 and 29 July 2026 to continue providing services. AUSTRAC QRG: Transitioning from DCE to VASP
VASPs must both enrol and register with AUSTRAC before providing virtual asset services; registration approval is required except under transitional rules for applications before 29 July 2026. AUSTRAC: Register as remittance or VASP
Providers of newly regulated virtual asset services must enrol and apply for registration by 29 July 2026; transitional rules allow continued services until AUSTRAC decides on pending applications. AUSTRAC: Register as remittance or VASP
Businesses must enrol with AUSTRAC before providing designated services; daily penalties may accrue after 28 days of operating without enrolment.
Under the AML/CTF Act 2006 as amended by Act No. 110 of 2024, reporting entities must undertake an ML/TF risk assessment and maintain AML/CTF policies (ss 26C, 26F), conduct initial, ongoing and enhanced customer due diligence (ss 28, 30, 32), report suspicious matters to AUSTRAC (s 41) and keep records (Part 10).
A person who commences to provide a designated service and is not on the Reporting Entities Roll must apply to AUSTRAC for enrolment no later than 28 days after commencing; each day of delay is a separate contravention of a civil penalty provision (AML/CTF Act 2006 s 51B(1), (2C), (3)).
Registration is an additional requirement for higher-risk designated services (remittance and virtual asset services) and involves more detailed application and closer AUSTRAC scrutiny
Digital currency exchange providers have had to register with AUSTRAC since 3 April 2018 (AML/CTF Amendment Act 2017, No. 130); since 31 March 2026 providers of registrable virtual asset services must be registered virtual asset service providers (AML/CTF Act 2006 s 76A, as amended by Act No. 110 of 2024), and ASIC licensing applies separately where a digital asset is a financial product (INFO 225).
Providing a registrable virtual asset service without AUSTRAC registration is a strict-liability offence punishable by 2 years imprisonment or 500 penalty units, rising to 7 years or 2,000 penalty units for repeat conduct (AML/CTF Act 2006 s 76A); failing to enrol is a civil penalty contravention for each day (s 51B).
ASIC-obtained court penalties against crypto firms include $14 million against BPS Financial over its Qoin Wallet (Federal Court, ASIC 26-008MR, 27 January 2026) and $8 million against Kraken operator Bit Trade for design-and-distribution breaches (ASIC 24-274MR, 12 December 2024).
AUSTRAC's actions affected the most entities, signaling broad sector crackdown.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — custodial wallet/SaaS providers may operate in Australia but must enrol and register with AUSTRAC as a VASP (mandatory from 2026), and likely require an AFSL from ASIC if custodied assets are classified as financial products, with a local Australian entity and fit-and-proper requirements.
Questions this verdict aims to answer
- What custody license / qualified-custodian status applies?
- What segregation, insurance, and proof-of-reserves rules apply?
- What AML obligations attach to the SaaS vs the white-label client?