Regulating the crypto asset ecosystem Explaining Treasurys proposed licensing and custody regime

The Consultation Paper proposes that CASSPrs must obtain a licence where they:

• provide retail customers access to non-financial product crypto assets (e.g. brokers, dealers or operators of markets for crypto assets);
• provide safekeeping of all crypto assets on behalf of a customer; and
• are captured by the Financial Action Task Force's definition of a Virtual Asset Service Provider for anti-money laundering and counter terrorism financing purposes (noting this definition forms the basis of the definition of CASSPr).

The proposed licensing regime does not, however, apply to decentralised platforms or protocols, including, for example, decentralised exchanges upon which transactions occur between traders without the need for a secondary service provider to provide custodial or other management services. Despite this, in practice it is likely that many entities will provide retail clients with access to both a decentralised protocol and other crypto-related services which are otherwise caught by the regime, and may therefore still require a CASSPr licence.

It remains unclear whether CASSPrs that provide services for all non-financial product crypto assets will be caught by the regime or if particular types of crypto assets will be included or excluded. Treasury welcomes submissions from industry on this point.

The proposed licensing regime for CASSPrs is to be separate from the AFSL regime and the Australian markets licensing regime. In this regard, the policy proposal intends, as far as practicable, to ensure that providers are not subject to multiple regulatory regimes.

Having said this, in our experience, many, if not most, CASSPrs already hold an AFSL or otherwise have an affiliate with an AFSL, meaning that there is likely to be some duplicate regulation.

Moreover, to the extent that an entity provides a service relating to a crypto asset which meets the definition of a financial product and also provides a service relating to a crypto asset that does not meet this definition, it appears that these persons would be required to hold both an AFSL and a CASSPr licence. This is on the basis that these regimes separately apply to different types of products and would therefore be subject to different levels of regulatory oversight.

In order to comply with the proposed licensing regime, CASSPrs must adhere to a number of core obligations. These include that CASSPr licencees must:

• do all things necessary to ensure that the services covered by the licence are provided efficiently, honestly and fairly; and any market for crypto assets is operated in a fair, transparent and orderly manner;
• maintain adequate technological, and financial resources to provide services and manage risks;
• have adequate dispute resolution arrangements in place (both internal and external);
• ensure directors and key persons responsible for operations are fit and proper persons and are clearly identified;
• maintain minimum financial requirements including capital requirements, noting that these requirements would be specified by ASIC and would depend on the types of services provided, as well as the volume of transactions;
• comply with client money obligations;
• comply with all relevant Australian laws, including the AML/CTF Act (a breach of the latter being grounds for a licence cancellation);
• take reasonable steps to ensure that the crypto assets it provides access to are 'true to label' (e.g. not falsely described or otherwise misrepresented in a way that is intended to mislead);
• respond in a timely manner to ensure scams are not sold through their platform;
• not hawk specific crypto assets, that is not offer, or request or invite a consumer to ask for, specific crypto assets in the course of unsolicited contact;
• be subject to regular auditing by independent auditors; and
• maintain adequate custody arrangements (see more information on this below).

Relevantly, a number of these obligations are akin to those which apply to AFSL holders and go towards ensuring minimum standards of conduct and operational resilience.

Treasury has separately proposed two alternative options for licensing CASSPrs:

1. that all crypto assets could be brought into the existing financial services regime by defining crypto assets as financial products under section 764A of the Corporations Act and tailoring the AFSL regime to achieve appropriate outcomes for crypto assets; and
2. a self-regulation model under which industry would develop a code of conduct for crypto asset services that is approved by a regulator and meets minimum regulatory policy goals.

The Consultation Paper also introduces mandatory minimum, principles-based custody obligations for private-keys that are held or stored by CASSPrs on behalf of consumers. This proposal responds to the risks faced by consumers in relying upon CASSPrs to maintain custody of their holdings and, if adopted, will increase consumer confidence in providers of custody services.

Specifically, CASSPrs who maintain custody (either themselves or via third parties) of crypto assets on behalf of consumers will be required to:

• hold assets on trust for the consumer;
• ensure that a consumers' assets are appropriately segregated;
• maintain minimum financial requirements including capital requirements;
• ensure that the custodian of private keys has the requisite expertise and infrastructure;
• generate and store private keys used to access the consumer's crypto assets in a way that minimises risk of loss an unauthorised access;
• adopt signing approaches that minimise 'single point of failure' risk;
• maintain robust cyber and physical security practices;
• ensure independent verification of cybersecurity practices;
• establish processes for redress and compensation in the event that crypto assets held in custody are lost; and
• where applicable, properly assess third-party custodians compliance with the above requirements and ensure that third-party custodians have robust systems and practices for the receipt, validation, review, reporting and execution of instructions from the CASSPr.

These obligations will be applied in a manner that is proportionate to the nature, scale and complexity of each custodian's operations.

Treasury is seeking advice on whether additional obligations or standards would be necessary, including whether the regime should impose domestic location requirements for custodians.

Treasury has also put forward an alternative proposal for the custody requirements under which the crypto asset custodian industry would work collaboratively to create and maintain minimum standards and expectations.

 The proposed licensing regime will be administered by ASIC. More work will be needed to define the scope and application of these obligations, as this will in turn determine the powers that ASIC requires (e.g. to grant or cancel licences).

The Consultation Paper suggests that the obligations are intended to be applied in a flexible manner with the aim of ensuring that industry participants behave with honesty, fairness, integrity and competence. ASIC would be empowered to grant relief from some or all the obligations if warranted, on a case-by-case basis to ensure the regime remains agile and adaptable.

It is also intended that regulatory guidance will be published to provide additional clarity about the application of obligations. The regime would also likely rely on similar supervisory and enforcement mechanisms to the AFSL regime, including compulsory information gathering powers, civil and criminal penalty provisions.

 The Consultation Paper confirms that AUSTRAC will remain the AML/CTF supervisor for CASSPrs that provide designated services under the AML/CTF Act. Consideration will be given to how the existing AUSTRAC registration requirements may be integrated with the proposed new regulatory model in order to achieve regulatory efficiencies and minimise duplication.

It should be noted that the need to register under the AML/CTF Act presently applies only to digital currency exchanges that exchange fiat to crypto and vice versa (i.e. not crypto to crypto). It is unclear whether, and if so the extent to which, the AML/CTF Act will be amended to align with the broader definition for "CASSPr" in the Consultation Paper.

In any case, to the extent that a self-regulation model were to be adopted with respect to the broader licensing proposals or otherwise with respect to the custody obligations only, the obligations under the AML/CTF Act would continue to apply given that self-regulation cannot be extended for AML/CTF purposes.