DeFi protocol frontend in Australia
Operates a web frontend or aggregator that interacts with permissionless smart contracts on behalf of users. May or may not screen users / restrict regions.
DeFi frontend is conditionally permitted in Australia with a local entity, subject to AML obligations and medium licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- Medium
- Last updated
- 2026-07-13
AML Obligations
- Enrol with AUSTRAC as a reporting entity within 28 days of commencing designated services (au.aml.enrol-or-register-overview-httpswwwaustracgovaunew-austracenrol-or-register8-fix-1776276114635-1)
- Register as a Virtual Asset Service Provider (VASP) with AUSTRAC — mandatory before providing virtual asset services, with transitional rules for applications before 29 July 2026 (au.aml.specific-dcevasp-enrolment-and-registration-fix-1776276114635-2)
- Develop and maintain an AML/CTF program tailored to the business, including KYC, transaction monitoring, suspicious activity reporting, record-keeping, and a designated compliance officer (au.licensing.amlkyc-mandatory-amlctf-program-for)
- Report suspicious transactions to AUSTRAC (au.aml.reporting-entities-must-develop-and)
- Conduct customer due diligence (CDD) on all users (au.aml.reporting-entities-must-develop-and)
- Maintain required records as per AML/CTF Act obligations (au.aml.reporting-entities-must-develop-and)
- Existing DCEs must transition to VASP registration between 31 March 2026 and 29 July 2026 (au.aml.specific-dcevasp-enrolment-and-registration-fix-1776276114635-1)
- If the frontend facilitates activities that involve financial products (e.g., derivatives, tokenized securities, or yield-bearing instruments classified as financial products), AFSL obligations and additional AML/KYC requirements may apply (au.licensing.exchange)
Key Restrictions
- Must be registered as an Australian company with an ABN (au.licensing.local-presence-must-be-a)
- Directors and owners must be fit-and-proper with clean backgrounds (au.licensing.local-presence-must-be-a)
- If the frontend charges fees that are tied to facilitating financial-product transactions (e.g., derivative-like tokens, tokenized securities), an AFSL from ASIC may be required (au.licensing.vasp; au.licensing.exchange)
- Geofencing of US persons may be required if the frontend offers financial products not compliant with US securities law (inferred from general cross-border risk)
- If the frontend does not provide custody or trading of financial products and only routes to permissionless protocols, only VASP registration with AUSTRAC is needed — no AFSL
- Fee-taking per se does not automatically trigger AFSL; classification depends on whether fees are received for a 'financial product' advice, dealing, or service (au.licensing.asic-info-sheet-225-digital)
- Tranche 2 AML/CTF reforms (from 1 July 2026) may expand obligations for lawyers, accountants and other professionals involved in the frontend's operations (au.aml.for-tranche-2-entities-newly)
Key Risks
- Regulatory ambiguity: ASIC may reclassify certain DeFi protocol tokens or yield products as financial products, retroactively triggering AFSL requirements (au.licensing.asic-info-sheet-225-digital)
- Enforcement risk: AUSTRAC has taken broad enforcement action against crypto firms including DCEs; failure to enrol/register carries fines up to AUD 210,000 and potential criminal charges (au.enforcement.non-compliance-penalties-are-severe-failing)
- Debanking risk: Crypto firms face systemic debanking in Australia — Senate inquiry 2023 noted this is a major operational hurdle (au.licensing.exchange)
- CASP reform risk: Comprehensive reform proposed (CASP-style authorization expected 2025-2026) may introduce new licensing obligations for DeFi frontends currently outside scope (au.licensing.vasp)
- Transition risk: Current DCE-registered entities must transition to VASP registration by mid-2026, creating a compliance timeline crunch (au.aml.specific-dcevasp-enrolment-and-registration-fix-1776276114635-1)
- If the frontend charges fees for facilitating financial products without an AFSL, risk of ASIC enforcement action and investor lawsuits (au.licensing.exchange)
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
AUSTRAC is the AML/CTF regulator; since 31 March 2026 it registers virtual asset service providers, replacing digital currency exchange registration (AML/CTF Amendment Act 2024, No. 110, Schedule 6).
ASIC regulates digital assets that are financial products under the Corporations Act and ASIC Act, including licensing, disclosure and design and distribution obligations; its guidance is INFO 225 (updated October 2025).
Virtual asset service providers register with AUSTRAC from 31 March 2026 (AML/CTF Amendment Act 2024, No. 110) and need an AFS licence for financial products; the crypto reform is enacted as the Digital Assets Framework Act 2026 (No. 38), commencing in April 2027.
Exchanges register with AUSTRAC for AML/CTF (virtual asset service provider registration from 31 March 2026) and need an AFS licence for financial products; ASIC enforces design and distribution obligations, with Bit Trade (Kraken) ordered to pay $8 million in December 2024 for issuing a margin product without a target market determination.
From 31 March 2026 the AML/CTF Amendment Act 2024 (No. 110, 2024) replaced AML/CTF programs with 'AML/CTF policies' (s 26F) and requires every reporting entity, including virtual asset service providers, to designate an AML/CTF compliance officer (s 26J).
Local Presence: Must be a registered Australian company with an ABN; fit-and-proper directors/owners with clean backgrounds; robust governance, IT security, and risk controls.
ASIC Info Sheet 225 (Digital Assets): https://asic.gov.au/regulatory-resources/digital-transformation/digital-assets-financial-products-and-services/
AUSTRAC Registration: Submit online via AUSTRAC portal with business details, AML/CTF program, ownership structure, and compliance evidence. Approval typically 4-6 weeks if complete.
AUSTRAC AML/CTF Registration: https://www.austrac.gov.au/businesses/obligations/digital-currency-exchange-providers
Virtual asset service providers, which replaced digital currency exchange providers on 31 March 2026, must enrol with AUSTRAC as reporting entities (AML/CTF Act 2006 s 51B); registrable virtual asset services are virtual asset safekeeping, exchange, transfer, and services connected with the offer or sale of a virtual asset (s 5; s 6 table 1 items 29, 30, 46A, 50A-50C).
DCEs registered as reporting entities must transition to VASP registration by updating enrolment details between 31 March 2026 and 29 July 2026 to continue providing services. AUSTRAC QRG: Transitioning from DCE to VASP
VASPs must both enrol and register with AUSTRAC before providing virtual asset services; registration approval is required except under transitional rules for applications before 29 July 2026. AUSTRAC: Register as remittance or VASP
Businesses must enrol with AUSTRAC before providing designated services; daily penalties may accrue after 28 days of operating without enrolment.
Providers of registrable remittance services and registrable virtual asset services must both enrol with AUSTRAC (AML/CTF Act 2006 s 51B) and be registered, on the Remittance Sector Register (s 74) or the Virtual Asset Service Provider Register (s 76A), as amended by Act No. 110 of 2024.
Under the AML/CTF Act 2006 as amended by Act No. 110 of 2024, reporting entities must undertake an ML/TF risk assessment and maintain AML/CTF policies (ss 26C, 26F), conduct initial, ongoing and enhanced customer due diligence (ss 28, 30, 32), report suspicious matters to AUSTRAC (s 41) and keep records (Part 10).
Persons who began providing the newly designated real estate, professional services or precious-metals dealing services (AML/CTF Act s 6 table 2 item 2, tables 5 and 6) before 1 July 2026 had until 29 July 2026 to apply to enrol with AUSTRAC (Act No. 110 of 2024, Sch 3 Pt 4 item 12).
Providing a registrable virtual asset service without AUSTRAC registration is a strict-liability offence punishable by 2 years imprisonment or 500 penalty units, rising to 7 years or 2,000 penalty units for repeat conduct (AML/CTF Act 2006 s 76A); failing to enrol is a civil penalty contravention for each day (s 51B).
ASIC-obtained court penalties against crypto firms include $14 million against BPS Financial over its Qoin Wallet (Federal Court, ASIC 26-008MR, 27 January 2026) and $8 million against Kraken operator Bit Trade for design-and-distribution breaches (ASIC 24-274MR, 12 December 2024).
AUSTRAC's actions affected the most entities, signaling broad sector crackdown.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — A DeFi protocol frontend serving Australian users must enrol and register as a VASP with AUSTRAC (AML/CTF obligations apply, including KYC, transaction monitoring, and a compliance program) and must be a locally incorporated company with an ABN; if the frontend charges fees for facilitating activities involving financial products (e.g., derivatives, tokenized securities), an additional AFSL from ASIC is required, with higher capital and compliance burden.
Questions this verdict aims to answer
- Is operating the frontend a regulated activity even if the protocol is decentralized?
- What geofencing or KYC obligations apply?
- Does fee-taking change classification?