In an exciting start to Blockchain Week, the Australian Government has released its Consultation Paper on new licensing and custody requirements for the crypto assets industry. This is the first set of reforms proposed by the Government in response to the three major reviews into Australia's payment system framework conducted last year.

The Consultation Paper proposes:

• a new licensing regime for ‘crypto asset secondary providers’ (CASSPrs) as well as two alternative options to regulate the crypto industry; and
• additional obligations on CASSPrs who are custodians of crypto assets on behalf of retail consumers.

Submissions on the Consultation Paper are due by 27 May 2022.

Crypto assets and CASSPrs

As a starting point, the government proposes that a single broad definition of 'crypto asset' be introduced into all of Australia’s existing regulatory frameworks. At the same time, the Consultation Paper lists a number of different types of tokens and crypto assets and seeks feedback about how those assets should be categorised – see below regarding token mapping for further details.

The Government proposes to adopt ASIC’s description of crypto assets. That is, ‘a digital representation of value or contractual rights that can be transferred, stored or traded electronically, and whose ownership is determined or substantially affected by cryptographic proof’.

ASIC’s definition does not exclude crypto assets that are financial products. We assume the final definition that is adopted will exclude crypto assets that constitute financial products – otherwise it would create a duplication of licensing regimes (i.e. both this new CASSPr regime and the existing AFS licensing regime would apply).

We welcome this proposal for a single definition across regulatory regimes. It will help to provide consistency and clarity on how crypto assets are understood and treated by different regulatory regimes. However, it is imperative that the new definition is flexible enough to keep pace with future innovations within the crypto world.

The Government also proposes to adopt the term ‘crypto asset secondary providers’ (CASSPrs) to capture a wide range of secondary providers who provide retail consumers with access to non-financial product crypto assets. This term will capture participants who operate digital currency and crypto asset exchanges and markets or provide custodial, broking and dealing services. It also includes any person who provides ‘financial services’ relating to an issue or sale of crypto assets. It is not clear how this could apply, or who this could apply to, given the definition of financial services only ever applies to ‘financial products’.

The application of the proposed regime to CASSPrs extends the scope of the proposed new licensing regime beyond ‘digital currency exchanges’ referred to in the Government’s initial response in December 2021. This expanded scope is, however, consistent with how the existing Australia financial services (AFS) licensing regime applies to distributors and other service providers involved with delivering access to financial products to customers.

Proposed new regulatory framework

The Government proposes to introduce a new licensing regime for CASSPrs that is similar to, but separate from, the AFS licensing regime. The new regime will be administered by ASIC. There will be one type of type for all CASSPrs regardless of the service they provide. The Government has commented that decentralised platforms and protocols will not need to be licensed under the proposed regime.

The Government has said the proposed regime has been designed to be fit for purpose, technology neutral and risk focussed. It aims to create a predictable, consistent, simple and light touch framework that avoids undue restrictions, with the ability to recognise the unique nature of crypto assets and harness the power of the private sector.

The new regime will apply to any person that falls within the definition of a CASSPr, which as mentioned above captures a broad range of industry participants. However, the issuing of crypto assets does not fall within the category of ‘CASSPrs’ and will therefore not be regulated under the proposed new regime unless issuers are also providing a regulated service. This reflects the Government’s recognition of the need to distinguish between issuers of crypto assets and the service providers who facilitate consumer access to them. This means that issuers of crypto assets will only be regulated if the crypo assets are financial products – in which case they will require an AFS licence (subject to licensing exemptions).

It will be interesting to see where and how the new CASSPr regime will fit in and interact with the existing financial services regulatory regime. Recent media reports suggest a new 'Digital Services Act' may be introduced to protect consumers and allow Australia to regulate the potential and promise of blockchain technology. Whatever the form, it will be important that the new regime does not add further complexity – particularly in light of the ongoing inquiry by the Australian Law Reform Commission into the simplification of the legislative framework for financial services regulation.

The key obligations under the new CASSPr licensing regime

The proposed new CASSPr licensing regime will include:

• minimum standards and obligations similar to those that apply under the AFS licensing regime – for example, the general AFS licensee obligations in s912A of the Corporations Act (including the duty to act efficiently, honestly and fairly) and the fit and proper requirement;
• a prohibition on hawking or pressure selling crypto assets;
• empowering ASIC to grant relief from some or all of the obligations on a case-by-case basis; and
• similar supervisory and enforcement mechanisms to the AFS licensing regime, including information gathering powers, civil and criminal penalty provisions.

Although the proposed obligations imposed for CASSPr licensees are modelled on the AFS regime, the CASSPr regime will introduce new obligations such as:

• comply with ‘all relevant Australian laws’ (and not just financial services laws);
• principles-based custody obligations for holding of crypto assets on behalf of retail consumers;
• a requirement to be regularly audited by independent auditors – it is not clear whether this is intended to be limited to a financial audit or to go beyond that and into a general compliance audit;
• comply with AML/CTF provisions (breach of which can be grounds for licence cancellation);
• take reasonable steps to ensure that the crypto assets it provides access to are not falsely described or misrepresented; and
• take steps to prevent scams on their platform.

There is no proposal for CASSPrs to comply with other disclosure or conduct obligations similar to those which apply to AFS licensees – for example, requirement to give a Financial Services Guide and to report significant breaches.

Alternative regulatory frameworks

The Government has also sought feedback on two alternative options to the CASSPr licensing framework:

• regulate CASSPrs under the existing AFS licensing regime; or
• self-regulation by the crypto industry.

Alternative Option 1 is to regulate CASSPrs under the existing AFS licensing regime by doing the following:

• include crypto assets as a financial product;
• tailor the existing AFS licensing regime to 'achieve the appropriate outcomes' for crypto assets;
• empower the Government or ASIC to exempt or 'carve out' particular crypto assets;
• require CASSPrs that provide a 'trading venue' to hold a market licence;
• require brokers that forward clients' orders to a third-party exchange for execution to hold an AFS licence and comply with the associated obligations; and
• tailor the AFS licensing regime differently according to the products and service provided.

This proposed option has the benefit of working within the existing licensing system but seems to involve more complexity by trying to retrofit crypto innovation into laws that were introduced many years before the invention and proliferation of blockchain and crypto assets. Accordingly, as the Government points out, there is a risk this option may face issues of delays in assessing and exempting categories of crypto assets that do not require regulation and/or should not be subject to all of the obligations that apply under the AFS licensing regime.

Further, some CASSPrs would be subject to much higher financial requirements (for instance under the market licence) on top of meeting the requirements of compliance with numerous parts of the regime.

Alternative option 2 is self-regulation by the crypto industry which would involve:

• industry developing a code of conduct for crypto asset services to impose standards regarding consumer protection, levels of insurance and technical standards – there is a question whether the code would need to be approved by a regulator;
• industry having responsibility to set minimum standards and expectations by for crypto custodians; and
• continuation of the existing AML/CTF regulatory regime.

The Government has identified that current voluntary codes of conduct such as the 'Global Digital Finance Principles for Token Trading Platforms' and Blockchain Australia's code of conduct would be useful 'starting points' for this approach if adopted.

The Government also noted the similarity of this approach with the current regulatory framework in the US and UK where, apart from regulation under the AML/CTF regime, crypto assets are not specifically regulated unless they are securities or financial products.

Proposed crypto asset custody regime

In line with Recommendation 2 of the Senate Committee report, the Government has proposed to impose obligations on CASSPrs who hold custody (either themselves or via third parties) of crypto assets on behalf of consumers. This includes the obligation to (among other things):

• maintain minimum financial requirements including capital requirements;
• ensure that the custodian of private keys has the requisite expertise and infrastructure;
• generate and store private keys in a way that minimises the risk of loss and unauthorised access;
• adopt signing approaches that minimise 'single point of failure' risk;
• have robust cyber and physical security practices;
• independently verify cybersecurity practices;
• processes for redress and compensation in the event that crypto assets held in custody are lost; and
• have the appropriate competencies to assess a third-party custodian's compliance requirements.

It is proposed that CASSPrs that have the direct relationship with the consumer will be liable for the safekeeping of all crypto asset private keys in its care, even if the storage of the private keys are outsourced to a third-party custodian.

The Government is also seeking feedback on whether it should mandate specific domestic location requirements for custodians or whether an alternative option should be adopted which would involve industry taking responsibility for maintaining minimum standards and expectations that are used by crypto custodians.

Early views on token mapping

In accordance with Recommendation 3 of the Senate Committee report, the Government will undertake a token mapping exercise to identify relevant characteristics of digital assets in Australia. While this exercise is to be completed by the end of 2022, the Government has provided a preliminary non-exhaustive list of crypto asset categories and has sought feedback about whether these categories should be classified as crypto assets, financial products or other product services or asset types.

Other regulatory developments regarding crypto and payments

The Government has also released the terms of reference for a review by the Board of Taxation into the appropriate policy framework for taxation of digital transaction assets such as crypto. This review is due to be completed by 31 December 2022.

The Government has also indicated it will release terms of reference relating to a request for advice from the Council of Financial Regulators on potential policy responses to address the issue of de-banking for financial technology firms, digital currency exchanges and remittance providers. This advice is due to be completed by the end of June 2022.

Submissions

As mentioned, submissions on Treasury’s Consultation are due by 27 May 2022 which can be sent to [email protected]. Please let us know if you would like us to assist you to make a submission.

Links to key material

Crypto asset secondary service providers: Licensing and custody requirements | Treasury.gov.au