As crypto adoption increases, the role of custodians—businesses that hold and safeguard crypto assets on behalf of clients—has come under increased regulatory scrutiny. In Australia, the current rules for crypto custody remain limited, but proposed reforms aim to establish a more robust framework. This article outlines the current situation, the regulatory gaps, and what to expect from future reforms.

The Current Landscape: Limited Regulation

At present, there are no specific domestic laws in Australia that directly govern how crypto assets should be held or safeguarded by custodians, unless the assets are considered financial products under the Corporations Act.

If a business only provides custody for crypto assets that are not classified as financial products (such as many utility tokens or certain cryptocurrencies), they are not subject to licensing by ASIC and are only indirectly affected by general AML/CTF obligations, if at all.

AUSTRAC’s Role in Custodial Oversight

AUSTRAC, the Australian Transaction Reports and Analysis Centre, currently plays a limited role in supervising custodians unless they also conduct activities involving the exchange of crypto for fiat. However, in its submission to the Treasury, AUSTRAC strongly advocates for a new licensing framework that will explicitly cover custodial services as part of a broader definition of Virtual Asset Service Providers (VASPs).

AUSTRAC’s recommendations include:

• Requiring fit and proper person checks for all directors and key personnel of custodians.
• Ensuring custodians comply with AML/CTF obligations as a condition of licensing.
• Extending these requirements to third-party custodians used by licensed entities.
  
  

International Standards and FATF Compliance

Globally, the Financial Action Task Force (FATF) considers custody of crypto assets to be a core VASP activity. Australia, as a FATF member, is expected to regulate this activity in order to maintain compliance and avoid reputational and economic consequences.

Failure to introduce appropriate regulation for custodians may lead to:

• De-banking of crypto custodians by financial institutions.
• Australian custodians being classified as high-risk counterparties internationally.
• Barriers to global financial system access.
  
  

Domestic Location and Jurisdiction Issues

Currently, there is no requirement for custodians to hold client assets within Australia. This poses enforcement and asset recovery challenges, especially in cases involving proceeds of crime or insolvency.

AUSTRAC has proposed that:

• Custodians should only use third-party custodians located in jurisdictions that maintain adequate AML/CTF standards.
• A domestic location requirement could enhance legal clarity and enforcement, though it remains a policy decision outside AUSTRAC’s scope.
  
  

What the Proposed Licensing Framework May Include

According to Treasury’s consultation and AUSTRAC’s input, the proposed framework for custodians may include:

• Mandatory licensing for custody providers, regardless of whether the crypto asset is a financial product.
• Strict fit and proper person requirements for those in control.
• Application of AML/CTF rules to custodial services.
• Oversight of any subcontracted or third-party custody arrangements.
  
  

This framework is likely to be part of a unified licensing regime that includes trading platforms, token issuers, and custodians.

Looking Ahead: What Custodians Should Do Now

In anticipation of these changes, crypto custodians operating in or serving the Australian market should:

• Evaluate their internal AML/CTF programs and prepare to enhance them.
• Conduct early due diligence on third-party custody providers, including jurisdictional risk assessments.
• Implement strong governance and operational standards, including incident response, access control, and segregation of client assets.
• Stay updated on Treasury consultations and upcoming legislative changes.
  
  

Conclusion

Custody is one of the most sensitive areas in the crypto asset ecosystem. While Australia has not yet imposed dedicated custody rules, significant reforms are underway. Businesses providing custodial services for crypto assets must prepare to transition from a lightly regulated environment to one governed by robust licensing, AML/CTF obligations, and oversight. Aligning with global standards will not only ensure legal compliance but also enhance credibility with financial institutions and clients.