If you are a fintech business operating in Australia, it is essential to understand the financial regulatory landscape that governs your products and services. This article provides an overview of the financial regulatory landscape in Australia. It breaks down the key regulatory bodies, activities that trigger licensing requirements and regulated activities relevant to fintech businesses. It also explores various regulatory resources that might be available for your fintech business.
Key Regulatory Bodies
The table below sets out the key regulatory bodies in the fintech space in Australia and their respective roles.
| Regulatory Bodies | Responsibilities |
| ASIC | • regulates financial services, consumer credit, and authorised financial markets • licenses and monitors businesses engaged in these activities |
| APRA | • independent dispute resolution body that considers consumer complaints about financial products and services • primarily resolves retail consumer disputes but has the discretion to hear complaints from wholesale clients. |
| AUSTRAC | • prevents criminal abuse of the financial system • regulates most financial services and lending businesses, including fintech ADIs, lenders, stored value providers, remittance providers, product issuers, foreign exchange dealers and digital currency exchanges • requires regulated entities to have anti-money laundering or counter-terrorism financing programs and to comply with reporting obligations |
| RBA | • maintains the overall stability of the Australian financial system • regulates payment systems, ensuring their safety and robustness |
| ACCC | • enforces competition and consumer laws for all businesses |
| AFCA | • independent disputes resolution body that considers consumer complaints about financial products and services • primarily resolves retail consumer disputes but has the discretion to hear complaints from wholesale clients. |
Activities That Trigger Licensing Requirements
The table below sets out certain fintech activities that will trigger licensing requirements in Australia. Note that your fintech business may fall under more than one category of activities.
| Activity | Licensing Requirement |
| Financial Services | Fintech businesses carrying on a financial services business in Australia must have an Australian Financial Services License (AFSL) unless an exemption applies. “Financial services” include: • providing advice on a financial product; • dealing in a financial product; • making a market for a financial product; providing custodial, depository or trustee services; providing crowd-sourced funding services; and • operating a registered scheme under the Corporations Act 2001 (Cth). “Financial product” is a facility through which a person makes a financial investment, manages financial risk or makes non-cash payments. This broad definition includes: • shares; • options; • securities; • debentures; • bonds; • units in unit trusts; • interests in a managed investment scheme; • margin lending products; • non-cash payment facilities; and • bank deposit accounts. |
| Credit Activities | Fintech businesses engaging in credit activities in Australia must have an Australian Credit License (ACL) unless an exemption applies. “Credit activities” include: • providing credit under a credit contract or consumer lease; • benefiting from mortgages or guarantees relating to a credit contract; • exercising rights or performing obligations of a credit provider or lessor (either as the credit provider or lessor or on behalf of another person who is the credit provider or lessor); • suggesting or assisting with a particular credit contract or consumer lease; and • acting as an intermediary between a credit provider and a consumer (for a credit contract) or between a lessor and a consumer (for a consumer lease). |
| APRA-Regulated Entities | Fintech businesses carrying on banking, insurance or superannuation businesses must be licensed by APRA and meet prudential standards. |
Regulated Activities
The table below sets out regulations for various fintech activities in Australia. Note that your fintech business may fall under more than one category of activities.
| Activity | Overview of Regulations |
| Consumer Lending | There are no legislative restrictions on trading loans. However, as of the date of this article, there is only a limited secondary market in Australia. Trading consumer loans requires assignees of the loans to hold an ACL unless exempted. |
| Buy Now, Pay Later (BNPL) | In May 2023, the government announced that BNPL service providers will need an ACL and comply with the obligations of an ACL holder unless exempted. ASIC will continue to develop regulations on this. |
| Consumer Data Rights (CDR) promotes consumer data access and control. Open banking allows customers to share data with accredited third parties. | There are no legislative restrictions on trading loans. However, as of the date of this article, there is only a limited secondary market in Australia. Trading consumer loans requires assignees of the loans to hold an ACL, unless exempted. |
| Managed Investment Schemes (MIS) | A MIS has the following features: • people contribute money or money’s worth as consideration to acquire interests in benefits produced by the scheme (whether the rights are actual, prospective or contingent and whether they are enforceable or not); • any of the contributions are to be pooled, or used in a common enterprise, to produce financial benefits or benefits consisting of rights or interests in property for the members who hold interests in the scheme (whether as contributors to the scheme or as people who have acquired interests from holders); and • the members do not have day-to-day control over the operation of the scheme (whether or not they have the right to be consulted or to give directions). Responsible entities, managers and fund operators of an MIS need an AFSL unless an exception applies. Registered MISs are also subject to additional obligations under the Corporations Act 2001 (Cth). If interests in the MIS are offered to retail investors, the scheme must be registered with ASIC and have a constitution and compliance plan meeting various requirements. You will need to prepare a Target Market Determination and a Product Disclosure Statement (similar to a prospectus). ASIC Information Sheet INFO 213 provides further guidance. |
| Corporate Collective Investment Vehicle (CCIV) | The CCIV regime commenced on 1 July 2022. A CCIV is a type of company limited by shares that is an investment vehicle. A CCIV regime is similar to a MIS but has additional features such as the ability to operate ‘sub-funds’. ASIC Information Sheet INFO 213 provides further guidance. |
| Peer-to-Peer and Marketplace Lending | There is no specific regulation for these activities. However, the structure of these activities may cause the activities in question to fall under other regulations. ASIC Regulatory Guide RG 209 and ASIC Information Sheet INFO 213 provide further guidance. |
| Crowd-sourced Funding (CSF) | There are reduced regulatory requirements for public offers of shares. Providers of CSF services need an AFSL unless an exemption applies. ASIC Regulatory Guides RG 261 and RG 262 provide further guidance. |
| Invoice Trading | ASIC Corporations (Factoring Arrangements) Instrument 2017/794 relieves debt factoring arrangements from needing an AFSL. |
| Payment Services | APRA, ASIC and RBA are all responsible for regulating purchase payment facility (PPF) providers. PPFs that are widely available and redeemable upon demand into Australian currency are considered to carry on a banking business and require authorisation from APRA. If PPFs are not widely available or redeemable for Australian currency, they may be authorised or exempted by the RBA. Payment services businesses may also voluntarily subscribe to be bound by the ePayment Code administered by ASIC. |
| Open Banking | Consumer Data Rights (CDR) promotes consumer data access and control. Open banking allows customers to share data with accredited third parties. |
| Insurance Products | Generally, insurance issuing businesses need an AFSL, unless exempted, and to be authorised by APRA. Non-insurance businesses that only sell or market insurance products generally need an AFSL unless an exemption applies. |
| Credit References | Only credit reporting agencies are allowed to collect and provide credit information under the Privacy Act 1988 (Cth). |
| Data collection | Where a fintech business is regulated under AUSTRAC, a credit reporting body or has revenue of at least $3 million, it must comply with the Privacy Act 1988 (Cth). These businesses must have a privacy policy that complies with the Australian Privacy Principles. |
Regulatory Resources
The table below sets out various regulatory resources that might be available for your fintech business.
| Resource | Description |
| Fintech Sandbox | ASIC operates a regulatory sandbox allowing fintech businesses to test small-scale financial services or credit activities as pilot projects without needing an AFSL or ACL. Eligibility criteria apply, including the pilot project centring around new and innovative products with a public benefit. |
| ASIC Innovation Hub | ASIC’s innovation hub aids startups and fintech businesses in the process of obtaining or operating under an AFSL or ACL for less than 12 months. It focuses on ground-breaking innovations that benefit investors and consumers. |
| Regulator Engagement | ASIC and AUSTRAC offer guidance and host meetups with the industry to discuss financial innovation initiatives. AUSTRAC’s RegTech Engagement program assists reporting entities with AML/CTF obligations. |
| AUSTRAC Innovation Hub | AUSTRAC/s Fintel Alliance Innovation Hub addresses money laundering/terrorist financing issues and evaluates the impact of emerging technologies like blockchain and cryptocurrency. |
| AUSTRADE | AUSTRADE supports fintech businesses in exporting their services internationally. |
| International Assistance | Australia has MOUs with global regulators, including Canada, Kenya, Singapore, the UK, and the US, to help fintech businesses expand across borders. |
This fact sheet outlines the changes to data and privacy protection in 2023.
Key Takeaways
Understanding the financial regulatory landscape is crucial for fintech businesses to operate legally and successfully in Australia. You need to be aware of who the key regulatory bodies are and what activities will trigger licensing requirements. You must also identify what your fintech business is and what regulations will generally apply. Should the need arise, consider using the regulatory assistance available to fintech businesses.
If you need assistance with your financial regulatory needs, our experienced fintech lawyers can assist as part of our LegalVision membership. For a low monthly fee, you will have unlimited access to lawyers to answer your questions and draft and review your documents. Call us today on 1300 544 755 or visit our membership page.
We appreciate your feedback – your submission has been successfully received.
