New Licensing and Custody Obligations for Crypto Asset Secondary Service Providers

Summarise with: ChatGPT Claude Perplexity Microsoft Copilot

---

Table of Contents

• What is a CASSPr?
• Consultation Paper Summary
• Existing Regulatory Framework
• Challenges and Gaps in the Law
• Proposed Changes
• Regulatory Objectives of Proposed Changes
• Early Thoughts
• Key Takeaways
• Frequently Asked Questions

The Federal Government recently released a consultation paper (Consultation Paper), setting out the Government’s proposed approach to licensing and regulating crypto asset secondary service providers (CASSPrs). This article unpacks the Consultation Paper, examines proposed concepts such as the CASSPr and definitions, and concludes with our early thoughts on the proposed legislative framework.

What is a CASSPr?

The proposed definition of CASSPrs would include service providers who give consumers and businesses access to crypto assets, including:

1. custody and storage services –  where software and hardware are used to store and handle private keys; 
2. exchange, brokerage and dealing services – facilitating access to crypto assets; and
3. operating a market – facilitating the peer-to-peer exchange of crypto assets.

Consultation Paper Summary

The Consultation Paper covers the following: 

1. general overview of the crypto asset ecosystem in Australia;
2. the existing regulatory framework, and the actual and perceived regulatory gaps;
3. the proposed new licensing regime for CASSPrs;
4. proposed mandatory custody obligations to safeguard private keys held by CASSPrs; and
5. the Federal Government’s current categorisation of crypto assets.

Existing Regulatory Framework

The existing regulatory framework is a combination of legislation, including the following:

• the Corporations Act 2001 (Cth) (Corporations Act);
• the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth); and
• the Competition and Consumer Act 2010 (Cth), which includes the Australian Consumer Law.

Crypto Assets

The key question is whether a crypto asset is a ‘financial product’ under the Corporations Act or the Australian Securities and Investments Commission Act 2001 (ASIC Act). In summary, we generally consider a crypto asset a financial product if it lets a person:

• make a financial investment: if a person contributes money (or money’s value) as consideration to someone to generate a financial return where the contributor does not have day-to-day control over the contribution’s use. e.g. investing in a company in exchange for company shares; 
• ​​manage financial risk: if a person manages the financial consequences of particular circumstances happening or avoids or limits the financial consequences of fluctuations in (or value of) receipts or costs. e.g. insurance contracts;
• make a non-cash payment (NCP): a person makes an NCP if they make a payment or cause a payment to be made otherwise than through the physical delivery of Australian or foreign currency. e.g. online payments technology. 

Furthermore, if a crypto asset satisfies the definition of a ‘financial product’, it will be governed by a range of disclosure obligations and market manipulation restrictions ASIC Act.

The Ultimate Guide for Startup Founders

The LegalVision Startup Manual provides guidance on a number of common challenges faced by startup founders including structuring, raising capital, building a team, dealing with customers and suppliers, and protecting intellectual property.

The guide includes 10 case studies featuring Australia’s top VC fund partners and leading Australian startups.

Download Now

Crypto Asset Secondary Service Providers (CASSPrs)

For the following:

• custody and storage services CASSPrs: in circumstances where crypto assets are either (1) scheme property or (2) financial products, custody and storage providers must comply with the minimum safekeeping requirements under the Corporations Act; and
• exchange, brokerage and dealing services CASSPrs: where service providers facilitate fiat currency to crypto assets, they generally must register as a digital currency exchange (also referred to as DCEs) with AUSTRAC to meet anti-money laundering and counter-terrorism funding (AML/CTF) obligations which include Know Your Customer (KYC) requirements. 

Challenges and Gaps in the Law

The Government has recognised the following challenges and gaps within the existing regulatory framework: 

1. Is it a ‘financial product’? The difficulty in determining whether or not crypto assets fall within the definition of a financial product and which laws apply because of their variety of features and rights and increasingly novel use cases;
2. Consumer risk: Consumers are exposed to high risk when making investments in crypto assets, and the current framework does not provide adequate consumer protection in the event of cybersecurity, operational or financial failures of service providers;
3. Misperception of regulation: Consumers may assume that crypto assets and services are subject to regulatory oversight comparable to businesses that provide financial services; and
4. Prevention of crime and fraud: Current AML/CTF laws relevant to CASSPrs do not apply a fit and proper person or good character tests, which may strengthen community protection against criminal activity.

Proposed Changes

Principles and Scope of Proposed Regime

The Consultation Paper identifies the need to introduce a licensing regime to cover certain CASSPrs who provide retail customers access to crypto assets that are not financial products. However, this regime would not apply to:

• decentralised platforms and protocols; or
• crypto assets that are financial products, as they will need to comply with the financial services regime. 

In addition to this regime, obligations under the Australian Consumer Law and AML/CTF laws will continue to apply.

Licensing Regime for CASSPrs

The Consultation Paper discusses a licensing regime where there would be one type of licence for CASSPrs. However, obligations can vary depending on the services offered. The proposed obligations include the following. To:

1. provide efficient, honest and fair services;
2. maintain adequate technological and financial resources to manage risks and provide services; 
3. have adequate dispute resolution arrangements in place (internal and external);
4. ensure directors and key persons responsible for operations are clearly identified fit and proper persons; 
5. maintain minimum financial requirements, such as capital requirements; 
6. comply with client money obligations; 
7. comply with all relevant Australian laws; 
8. take reasonable steps to ensure that the crypto assets it provides access to are “true to label” (i.e. not misleading or deceptive);
9. respond promptly to ensure scams are not sold through their platform;
10. not hawk specific crypto assets;  
11. be regularly audited by independent auditors; 
12. comply with AML.CTF obligations; and
13. maintain adequate custody arrangements (see Custody Obligations below).

The Consultation Paper also considers two alternative approaches to this licensing regime:

1. including crypto assets into the existing financial services regime; and
2. self-regulating, where the industry will develop a voluntary code of conduct. However, in this scenario, AML/CTF Laws will still apply. 

Custody Obligations 

CASSPrs who have a direct relationship with the customer and provide custody services for crypto assets (whether or not the custody services are outsourced) will be subject to the following obligations:

1. holding assets on trust for the consumer; 
2. ensuring that consumer assets are appropriately segregated; 
3. maintaining minimum financial requirements, such as capital requirements; 
4. ensuring that the private key custodian has the requisite expertise and infrastructure; 
5. generating and storing private keys to access a consumer’s crypto assets in a way that minimises the risk of loss and unauthorised access; 
6. adopting signing approaches that minimise ‘single point of failure’ risk; 
7. robust cyber and physical security practices; 
8. independent verification of cybersecurity practices; 
9. adequate processes for redress and compensation if crypto assets held in custody are lost; 
10. when a third-party custodian is used, that CASSPrs have the appropriate competencies to assess the custodian’s compliance with requirements; and
11. ensuring any third-party custodians have robust systems and practices for the receipt, validation, review, reporting and execution of instructions from the CASSPr.

Regulatory Objectives of Proposed Changes

The primary reasons behind these proposed regulatory changes are the following. To:

• protect consumers and increase consumer confidence in dealing with CASSPrs; and
• progress towards regulatory certainty, which promotes innovation and competition.

To achieve this, the Federal Government has identified the following objectives for the proposed regulatory regime. To:

1. ensure that regulation is fit for purpose, technology-neutral and risk-focused 
2. create a predictable, light touch, consistent and simple legal framework; 
3. avoid undue restrictions; 
4. recognise the unique nature of crypto assets; and 
5. harness the power of the private sector

Early Thoughts

The Consultation Paper demonstrates the Federal Government’s willingness to address key risks to consumers and work collaboratively with the industry.

This certainly challenges the general sentiment held by some in the industry that regulation slows innovation. 

Furthermore, it is essential to address the existing regulatory gaps in the crypto asset industry. Overall, the Federal Government’s proposed licensing regime will achieve this. However, the regime needs to be simple and not overly demanding to ensure that startups can participate as CASSPrs. 

Concerning the custody obligations of CASSPrs, it seems as though a regulated industry code of conduct will provide enough flexibility and fitness for purpose to allow startups and other businesses to participate as CASSPrs in the crypto asset industry. 

Key Takeaways

The Consultation Paper is a major development for the future of CASSPrs, and an exciting step for the future of the industry. LegalVision will be submitting feedback in response to the Consultation Paper. If you would like to understand how the obligations in the Consultation Paper will apply to you, our experienced fintech lawyers can assist as part of our LegalVision membership. For a low monthly fee, you will have unlimited access to lawyers to answer your questions and draft and review your documents. Call us today on 1300 544 755 or visit our membership page.

Robert Chen contributed to this article. Robert is a lawyer in LegalVision’s Corporate and Commercial Team specialising in Commercial and Construction Law.

Frequently Asked Questions