Crypto firms lost their safety net ten months before the new rules start

Australia now has a digital assets law. The Corporations Amendment (Digital Assets Framework) Bill 2025 cleared both houses on 1 April and received royal assent on 8 April 2026. It covers two kinds of business: exchanges where you trade crypto, and firms that hold it on your behalf. Rather than write a separate rulebook, it puts both under the same licence banks, brokers and fund managers already need — an Australian financial services licence, issued by the corporate regulator, ASIC.

That design choice deserves the credit it got. A bespoke regime would have needed its own definitions, its own case law and its own decade of argument. Slotting platforms into the existing licence means the obligations arrive pre-argued: governance, disclosure, custody standards, client protection. Treasury has put the prize at around twenty-four billion dollars a year in productivity and cost savings.

The framework commences on 9 April 2027.

The date that already passed

Here is what almost nobody wrote about at the time. The corporate regulator, ASIC, had issued what is called a no-action position. That is a formal statement from a regulator that it will not prosecute firms while the law is being sorted out. It expired on 30 June 2026. To rely on it, a business needed to have been operating in Australia on or before 31 December 2025 and to have lodged a complete licence application by that June deadline.

The expiry of the relief and the commencement of the Act are two separate events, ten months apart. Between them, digital asset businesses are not in a grace period. They are subject to the licensing law as it already stood.

For ten months, the sector is governed by precisely the regime the new Act was written to replace, minus the relief that made it survivable.

That older regime is the one the industry spent years calling regulation by enforcement. The regulator took the view that some crypto assets were already financial products under existing law. Firms were left to work out which ones. The Act exists because that was unsatisfactory. It does not apply yet.

Why the sequencing is the story

Around four hundred platforms were reported to be operating into the June deadline. Firms that lodged in time can operate while their applications are processed. Firms that did not are exposed under current law, not future law — and current law is the ambiguous version.

This puts ASIC in an awkward position of its own making. It has spent a decade being criticised for enforcing an unclear perimeter. It now has ten months in which the only tool available is enforcing that same unclear perimeter, against a population it has just told to get licensed under a different regime that has not started.

The alternative was available and obvious: align the expiry of relief with commencement of the Act. Leaving them unaligned was a choice. The cost falls on the smallest operators, who can least afford ten months of legal limbo and are the most likely to simply stop.

The counter-case

Two decent objections. The first is that the gap is deliberate and useful. A firm unwilling to lodge an application by June 2026 was probably never going to clear the licensing bar in 2027 either. Pulling the deadline forward surfaces that early rather than late. On that reading the sequencing is a filter, not an oversight.

The second is that nothing has actually gone wrong. Relief has expired before without a wave of enforcement. The regulator has shown willingness to make allowances where the boundary is genuinely unclear. And one with a new licensing regime arriving in April has little reason to spend the interim litigating the old one.

There is also a fair point that money-laundering rules apply regardless. Crypto firms have long had to register with AUSTRAC, the agency that tracks suspicious transactions. That was never a substitute for a licence, and a licence was never a substitute for it. So the floor did not drop to nothing in June.

What would settle it

Enforcement activity between now and April 2027. If the regulator brings no action against platforms that lodged and simply waits for commencement, the gap was paperwork. If it acts under the old provisions during a window created by its own deadline, the sequencing was a real cost — and the lesson for the next framework is that relief should expire when the replacement starts, not eleven months earlier.