How should the licensing and preparation requirements for this business be confirmed?
Where an entity provides another specified financial service in Table 1 in connection with an offer or sale of virtual assets, 50C may apply. This can include accepting orders and funds, buying from the issuer for distribution, underwriting, market-making or placement. The business need not ordinarily describe itself as VASP, and even a one-off service may be covered. An isolated issuance or incidental payment processing unrelated to participation in an offer does not automatically trigger this. Official scope: https://www.austrac.gov.au/new-austrac/designated-services-newly-regulated-entities/virtual-asset-designated-services
RGYS provides support with organising materials, assessing pathways and coordinating with professionals; we are not a licensing or approval authority. Approval, registration status and operating restrictions are subject to official decisions and the actual licence.
Business scope and applicable boundaries
Where an entity provides another specified financial service in Table 1 in connection with an offer or sale of virtual assets, 50C may apply. This can include accepting orders and funds, buying from the issuer for distribution, underwriting, market-making or placement. The business need not ordinarily describe itself as VASP, and even a one-off service may be covered. An isolated issuance or incidental payment processing unrelated to participation in an offer does not automatically trigger this. Official scope: https://www.austrac.gov.au/new-austrac/designated-services-newly-regulated-entities/virtual-asset-designated-services
Application eligibility and required information
First classify the token rights and fundraising arrangements, then identify the specific Table 1 services, issuer, customers, subscription funds, distribution and delivery pathways. Prepare issuer due diligence, sales contracts, use of funds and refund mechanisms. The benefit is traceable management of fundraising proceeds and delivery; this does not amount to approval of ICO or endorsement of the investment.
Requirements for shareholders, directors and compliance personnel
Directors, ultimate controllers and key sales or fundraising personnel must undergo due diligence. The AML management lead must meet residency and fitness requirements for the Australian service location. If underwriting, dealing or advice relates to existing securities, derivatives or schemes, the relevant AFSL responsible managers and compliance roles are also required; staffing alone with VASP personnel is not sufficient.
Capital and financial resource requirements
AUSTRAC registration has no uniform minimum share capital or NTA amount for 50C; the business and AML resources must be demonstrated. Underwriting commitments, refund liabilities, client subscription funds and own capital are calculated separately; current financial product activities are subject to the existing AFSL financial conditions, while any future platform activities must be assessed against the final DAP/TCP requirements.
Registered address and actual operating arrangements
Disclose the operating locations for issuance, placement and services, Australian connections and the addresses of overseas issuers. Customer contracts must clearly identify the actual service provider, subscription account and responsibility for delivering assets, and must not use an overseas issuer’s name to conceal Australian business activities.
Application and business preparation process
- Review token rights, use of funds and sales arrangements, and determine whether it is an existing financial product.
- Map the other Table 1 services underpinning 50C, and check the delivery steps under 50A, 50B and 29.
- Prepare issuer and purchaser CDD, subscription fund monitoring, placement and refund documents.
- Complete applicable AUSTRAC registration and current financial services authorisation; do not wait until 2027 to remedy unlicensed securities business.
- Operate within the actual scope of registration and authorisation, and retain evidence of subscriptions, allocations, funds and delivery.
Time required and review uncertainty
The main obligations under new section 50C AML took effect on 2026-07-01; new AUSTRAC registrations may take 90 days, with the period recalculated if further information is requested. Existing AFSL requirements apply now; the general ASIC complete-application targets are 70% within 150 days and 90% within 240 days. Approval by the proposed commercial offering date is not guaranteed.
Changes to shareholders or directors, acquisitions and transfers
Reassess if the issuer, token rights, sales regions, underwriting model, entity receiving subscription funds or controller changes; changes affecting registration particulars must be notified within 14 days. Before an acquisition, investigate complaints about the offering, undelivered assets, refunds, promotional statements and potential financial product breaches.
Ongoing compliance, renewal and maintenance
Reconcile subscription funds, token allocations and refunds transaction by transaction; conduct ongoing issuer and customer risk checks, SMR and applicable transfer-information obligations. Existing financial product disclosure and marketing rules apply separately; custody records, annual compliance reports and renewals must not be omitted because the offering has ended.
Frequently Asked Questions
Was DCE renamed to VASP only in April 2026?
No. AUSTRAC transitional rules confirm that the former DCE was automatically registered as VASP on 31 March 2026, with the online service migration and information update window running from 31 March to 29 July. The scope of VASP is broader than the former fiat-currency digital currency exchange regime, so it cannot be said that this is merely a name change with exactly the same business scope.
Does the digital asset framework legislation commence on 8 April 2027 or 9 April?
The commencement table in section 2 of the formal Act, the ASIC notice dated 15 October 2026, and CP392 adopt 8 April 2027. ASIC’s earlier roadmap and September reminder stated 9 April; this article notes the discrepancy and follows the formal Act and updated consultation guidance. The Act received Royal Assent on 8 April 2026 and, as at the verification date, had not yet commenced.
Does having VASP registration now mean that AFSL is not required?
This is not how it should be understood. VASP is only AUSTRAC registration; if a token or arrangement is already a financial product, the relevant financial services may already require AFSL or another licence. The 2027 DAP/TCP framework will also create new platform-level permissions and is not automatically replaced by VASP.
When is the 2027 DAP/TCP application deadline, and can a business operate while awaiting a decision?
ASIC CP392 expressly states that applications open on 8 April 2027, and existing relevant platforms must apply or vary their arrangements by 7 October 2027. Those that meet the new law's transitional provisions and apply in time may continue operating while their application is assessed under ASIC, but must continue to comply with the laws already applicable to them; an acknowledgement of receipt is not approval.
Is it true that the minimum registered capital is AUD 1?
AUD 1 can be an example of a share structure; it is not a uniform statutory capital threshold for VASP. The AUSTRAC guidelines do not set a uniform minimum share capital or NTA amount, but they consider compliance resources and operational capability. There are several NTA models in the future DAP/TCP financial draft; NTA is not nominal share capital either, and client assets cannot be treated as operating capital.
Does CP392 require DAP/TCP to hold AUD 14 million as a uniform minimum?
As at 5 November 2026, there is no such uniform requirement in force. CP392 consulted on three options, alongside a qualifying full third-party custody concession, scenarios involving underlying assets that are not financial products, and activity add-ons. None of the options has been finalised; 14 million must not be used without reference to the model and business conditions.
Can a new VASP applicant start operating first and then wait 90 days for approval?
As a general rule, no. New applicants must obtain registration approval before providing registrable services. The historical transitional arrangements for services added in 2026 apply only to entities that meet the conditions and submitted their applications on time; the July window has already passed. 90 days is a review period that AUSTRAC may use, and the period restarts when further information is required. It is not automatic permission to operate.
Is it sufficient to submit only the passports of shareholders holding more than 10%?
Not sufficient. Disclose and substantiate actual ownership, ultimate beneficial owners, controllers and key personnel in accordance with the AUSTRAC forms, taking account of multi-tier groups, board control and related entities. A bank’s additional information checklist cannot replace regulatory application requirements.
Must we appoint an Australian director and an Australian AML officer?
Where an Australian Pty Ltd is used, at least one director must ordinarily reside in Australia. The AML responsible person is a separate role; where a permanent establishment in Australia provides the designated services, that person must be an Australian resident and must be part of management, fit and proper, and have the necessary authority and resources. The role may be outsourced, but the appointment cannot be nominal. The AFSL responsible manager is separately used to demonstrate organisational competence.
Must every electronic transfer or crypto transaction of AUD 10,000 be reported to TTR?
No. TTR applies to physical cash of A$10,000 or more, or its equivalent, actually received or paid, with a report due within 10 business days after the transaction date. Electronic transfers and virtual assets do not trigger it solely because of their value; suspicious activity may still require an SMR, and suspected cash structuring to avoid the threshold requires particular scrutiny.
After the 2026 reforms, must annual compliance reports still be submitted between January and March?
Current AUSTRAC rules have moved to a financial-year basis. The next period covers 1 July 2026 to 30 June 2027, with submission due between 1 July and 30 September 2027. The annual report by the AML officer to the governing body is a separate obligation.
Can a legacy DCE company immediately add custody or derivatives?
No. Check registration status, actual services, conditions and historical compliance. New custody services require updated service and AML risk design; derivatives may already require AFSL. An asset acquisition does not transfer a licence; a share acquisition retains the entity and its potential liabilities. Notifications to AUSTRAC and ASIC must be completed separately.
Does VASP registration guarantee bank account opening and the right to operate globally?
No guarantee is given. Banks assess risk independently, and overseas markets are subject to local licensing and marketing rules. A public register can verify only the entity’s registration status; it is not government endorsement of an investment, a guarantee of token security or FATF certification.
Can outsourcing all custody avoid DAP authorisation and mean only A$200,000 needs to be prepared?
Not necessarily. The new law attributes an agent’s holding of assets to the operator, and an outsourced platform may still constitute DAP. 200,000 is only one of the lower-limit items in the calculation of the CP392 third-party custody relief; it must also be compared with the asset and revenue ratios, and the guarantee, audit and full-custody conditions must be met. It remains a draft at present.
Official sources and verification notes
Information verified: 5 November 2026. Business classifications do not replace legal definitions; use the latest versions of official webpages and legislation where they are updated.
- User's original guide, extracted in full but not as evidence of current law
- Formal Act: Corporations Amendment (Digital Assets Framework) Act 2026, No.38, full text on Royal Assent, commencement, platform definition and transitional provisions
- ATO publishes the enacted legislation in PDF; the commencement table specifies 8 April 2027
- Australian parliamentary bill record: passed on 1 April 2026 and received Royal Assent on 8 April
- AUSTRAC AML/CTF Transitional Rules 2026: automatic migration to VASP, CDD, reporting and independent assessment arrangements
- AUSTRAC online migration from DCE to VASP, QRG, window from 31 March to 29 July
- AUSTRAC Virtual asset designated services, five service categories and exclusions
- AUSTRAC VASP and remittance registration: recalculation of the 90-day period upon submission of further information, changes and three-year renewal
- AUSTRAC Preparing for our registration forms: business, personnel and supporting documents
- AUSTRAC AML/CTF compliance officer: residence, management, fitness and notification
- ASIC 26-245MR, 15 October 2026 digital assets implementation consultation, adopting 8 April
- ASIC CP392 consultation page, attachments and consultation status
- ASIC CP392 main text, paragraph 45: opening on 8 April and deadline of 7 October; Table 7: three capital models
- CP392 Attachment 1: proposed DAP/TCP guidance, issuance permissions by model and responsible managers
- CP392 Attachment 4: draft financial standards, revised 20 October 2026, three alternative NTA models
- ASIC earlier roadmap, which used 9 April; this should be distinguished from the enacted legislation and October material
- ASIC current INFO225 no-action deadline reminder: application conditions for 30 September 2026
- ASIC service charter, general AFSL complete applications: 150-day 70% and 240-day 90% targets
- ASIC company directors, secretaries and residency requirements
- ASIC company shareholders and share rules
- ABRS: New directors must apply personally for Director ID and observe the pre-appointment timeframe
- ASIC Rules on company addresses and consent to occupy premises
- AUSTRAC TTR thresholds, definition of cash and 10-business-day time limit
- AUSTRAC SMR reasonable suspicion, reporting time limits and tipping off
- AUSTRAC annual compliance reporting has changed to a financial-year basis; the next period runs from July 2026 to June 2027
- ASIC AFSL 30-business-day notice of change of control
- ASIC general AFSL information changes: 10 business days and website notification
- ASIC company annual review, fees and solvency resolutions
- ATO GST registration threshold and calculation, excluding input-taxed supplies
- ATO digital currency exchanges: GST differences between transaction-facilitation services and direct buying and selling
- AUSTRAC VASP public register and reminder about withdrawal of inactive registrations
- AUSTRAC Record keeping overview: records of CDD, transactions and AML plans, seven-year retention period and privacy requirements
Notes on corrections to historical information in this guide
The source treats DCE and VASP as the same scope under a new name. Instead, distinguish the historical exchange of fiat currency for digital currency from the expanded scope of designated virtual asset services in 2026. It is not correct to say that crypto-to-crypto exchange was comprehensively covered automatically by the original DCE in 2018.
The source says VASP takes effect from April 2026. Instead, the original DCE automatically transitioned by law to VASP on 31 March 2026. The online migration and enrolment-information update window runs until 29 July 2026; automatic continuation and updating information are separate matters.
The official Digital Assets Framework Act 2026 is Act No. 38 and received Royal Assent on 8 April 2026. The commencement table in the official Act and ASIC's October materials specify 8 April 2027; earlier materials from ASIC state 9 April. The discrepancy has been recorded, and the former date is taken as authoritative.
DAP/TCP’s new law has not commenced as at 5 November 2026. CP392 specifies that applications open on 8 April 2027, with existing platforms to apply or vary by 7 October; the general transition ends on 8 October. Do not promote future authorisation as approval already granted.
CP392’s asset, transaction settlement, responsible manager and three NTA financial proposals remain under consultation. Attachment 4 incorporates the 20 October revised version. AUD 14 million, AUD 7 million, AUD 2 million or AUD 200,000 must not be described as a uniform minimum share capital already in force.
Remove claims that VASP has a statutory minimum capital of AUD 1 or that 100 shares by default constitutes compliance. Distinguish company share capital, cash, regulatory NTA and client assets. AUSTRAC has no uniform amount set but requires actual resource capability.
The deferral of the main virtual asset obligations to 1 July 2026 does not apply to 50A; the historical continue-to-operate rule for timely applications made by 29 July 2026 cannot be applied to new applicants now.
AFSL and market or clearing and settlement obligations for existing financial products may already apply in 2026; the deadline for a INFO225 no-action application is 30 September 2026. Current compliance cannot be deferred by relying on a future DAP framework.
The source’s annual compliance reporting period of 2 January to 31 March is out of date. Change it to the financial year: the next period runs from 1 July 2026 to 30 June 2027, with submission from 1 July to 30 September 2027.
The source’s statement that all transactions over AUD 10,000 must be reported to TTR is inaccurate. Correct this to actual cash of at least the equivalent of AUD 10,000, reported within 10 business days after the transaction. Electronic transfers and crypto-only transfers are not triggered solely by their amount.
Supplement: SMR terrorism financing reports are due within 24 hours; other reports are generally due within 3 business days, subject to the reasonable suspicion test. IFTI, IVTS and reports concerning unverified self-hosted wallets have different transitional arrangements; do not say that all virtual asset transfers are currently reported to IFTI.
Do not present passports, police certificates and electronic signatures for every shareholder holding at least 10% as a fixed statutory checklist for every case; instead, assess the entity structure, entire control chain, key personnel and official requests for further information.
The local-director requirement for an Australian Pty Ltd is separate from the Australian-residency condition for the AML responsible person at an Australian service location; the AFSL responsible manager is a third role. In addition, each director must apply personally for a Director ID before appointment, and an external appointee must not be a nominee only.
Correct generalisations that all financial institutions require an AFSL, all lending requires an AFSL, all VASP must have AFCA and buy PI insurance for clients, and all must be audited; assess by product, retail service, exemption and actual licence conditions.
The source’s overall timeframe of 4—6 months, account-opening timeframe of 2—4 weeks and AUD 10,000–30,000 are not official fixed commitments or government fees. AUSTRAC’s 90-day period restarts when supplementary information is submitted. The general ASIC targets distinguish between 70% of complete applications within 150 days and 90% within 240 days.
Supplement: an acquisition is not a transfer of a licence; distinguish the different notification deadlines: AUSTRAC 14 days, 30 business days for a change of control under AFSL, 10 business days for general AFSL information, and 28 days for most company information.
The three-year validity period and renewal 90 days before expiry apply to VASP registration; they must not be applied as a three-year licence replacement cycle for AFSL. Entities that do not operate for an extended period risk withdrawal or cancellation.
Correct the misdescription of Westpac as the Bank of Western Australia; remove guarantees of bank account opening, lists of brands said to be already registered, claims of globally recognised certification and international rankings of prestige. Unverified commercial comparisons must not be presented as facts.
GST registration is not automatic on company establishment; it depends on GST turnover and the nature of the services. Fees for facilitating transactions and directly buying or selling digital currency may receive different GST treatment.
The service is to draft the entity’s risk assessment, AML/CTF policies and procedures; it is not to draft the national anti-money laundering regulations. Attribution does not constitute an endorsement or certification by ASIC or AUSTRAC, or a statement that a programme has been approved.
YOUR CONSULTATION PARTNER
Drew Tang （Mr Tang / Drew）
Business Manager · Rengangyongsheng (Hong Kong) Limited
Speak with Mr TangThis article was prepared by Rengangyongsheng (Hong Kong) Limited, with business explanations provided by Drew Tang ( Mr Tang) Business Manager. It is general information and does not replace advice on an individual matter from an Australian lawyer, tax adviser or regulator.