Introduction

Globally, it has been a frenetic and exciting time for digital assets and the pace is continuing in Australia. On 15 October 2026, ASIC released its highly anticipated Consultation Paper 392 (CP 392). It sets out ASIC’s proposed operating rules for digital asset platforms (DAPs), which hold digital tokens for clients, and tokenised custody platforms (TCPs), which issue tokens representing assets held for clients, under the Corporations Amendment (Digital Assets Framework) Act 2026 (DAF Act), which commences on 8 April 2027.¹

This briefing by our specialists focuses on what is new and what it means in practice. It covers trading and execution models, custody models and wallet reporting, capital, licensing and transition, tokenised markets and other proposals, including staking and stablecoins. We also map the practical implications and next steps, including disclosure, licence applications and the PPSA.

ASIC’s draft regulatory guide and draft instruments are preliminary, and we will cover them separately. Thomsons has the markets' leading and largest financial services regulatory team dedicated to digital assets. Thomsons assisted ASIC with draft standards.

In brief

Trading models will be tested – It is critical to understand trading & execution models in granular detail. Under ASIC’s proposal, an order matching DAP (one that brings client orders together, by order book or by matched principal trading) could not trade as principal on its own platform, and its related bodies corporate could not trade as principal through it. There are model-specific exceptions. Groups that rely on an affiliated market maker should look at this first.

Offshore custody is allowed, with conditions - The test is whether client assets are legally protected if something fails, with some new regulatory safeguards in place. Control of the keys is not enough. The operator stays responsible for every custodian and sub-custodian, so where those entities are based becomes a risk / strategic design feature.

ASIC wants the addresses, not the keys - Operators would report wallet structures and addresses each quarter and keep seven years of records. This is partly to respond to an intrinsic feature of the Australian digital assets market, as global economies of scale and  competition mean that digital assets – and most of the value of the product the customer is engaging with – is usually held offshore i.e. in custody arrangements / orderbooks.

Custody choices will drive capital - ASIC is consulting on three alternative formulas for net tangible assets (NTA), the capital buffer an operator must hold, linked to fixed amounts, revenue and, for Model 3, assets and activities. Qualifying outsourced custody could cut the requirement substantially. The conditions are (unsurprisingly, given the point we've made above on where assets are held) demanding.

Tokenised markets get a clearer path - Qualifying public blockchain infrastructure sits outside market and clearing and settlement (CS) facility regulation. The securities and settlement running across it do not. This is big news for those building private, permissioned architecture for tokenised securities trading.

ASIC's stated aim is “same activity, same risk, same regulation/regulatory outcome”, and the proposed standards borrow heavily from existing custody, investor directed portfolio service (IDPS) and market rules.² Submissions close on 27 November 2026. ASIC is targeting March 2027 for its final rules.³

Trading and execution models

The proposed trading standards turn on how each client order is executed. CP 392 describes five models:

• trading venues (order book or request for quote, where clients ask for prices);
• order matching (order book, or matched principal where the operator sits between matched buyers and sellers);
• agency (which has the structural issue of needing to obtain liquidity in financial products, usually, from an organisation with an AFSL or operating under an exemption);
• tied brokers (which route every order to one related venue, often an offshore exchange run by the parent.  In essence, local subsidiaries of the global giants); and
• principal to all orders (the operator faces every client trade).⁴

Some businesses will fit more than one box. For example, an exchange with a broking or OTC desk may sit in several.

Principal trading and affiliated liquidity

ASIC proposes that order matching DAPs could not trade as principal on their own or a related body corporate’s DAP. They would also have to stop related bodies corporate trading as principal through their own DAP. ASIC carves out tied brokers, tied dealers, agents and certain principal-to-all arrangements, so this is not a general ban on principal dealing of course.⁵

Where a group market maker trades on the order book, we expect groups to separate entities, pull back affiliated liquidity or bring the arrangement within a tightly drawn exception. The Act requires the standards to make operators enter into, monitor and enforce written arrangements with liquidity providers. It also prevents the standards from stopping offshore liquidity sourcing.⁶

For order books, ASIC adds rights to request assistance and to intervene without limitation. For all DAPs, it proposes monitoring liquidity providers and publishing who they are.⁷ This is implicitly responding to the centralisation of custody and orderbooks in global digital asset markets.

Best execution

ASIC proposes best execution duties for agent and matched principal DAPs where client orders are executed on another DAP or trading venue. The duties include reasonable steps to obtain the best outcome, sequential execution of comparable orders and access to at least two adequate liquidity sources.

Tied brokers and dealers, and principal-to-all models, would be excepted if they clearly disclose how they operate.⁸ Two sources i.e. from a liquidity provider do not guarantee best price, and brokers should record how each source was assessed.  Parallels can be drawn from a separate market, potentially, here e.g. the mortgage broker's 'best interests duty' which ASIC has focused on recently.

Matched principal, markets and CS facilities

Many global exchanges serve Australians through a local entity that faces clients as principal and hedges each trade on the group’s offshore order book. That is generally dealing or 'matched principal' market making under an Australian financial services licence (AFSL).

Running a facility where third parties’ offers meet is operating a market, which generally needs a market licence. Operating a facility for the clearing or settlement of transactions may constitute operating a CS facility, requiring a separate licence unless an exclusion or exemption applies.

The Act requires the trading standards to allow offshore liquidity sourcing, so the line between these models now matters more and has been a key focus area for the market in the preceding year.⁹ The key questions are who faces the client, how prices are formed, whether local clients interact with the offshore order book, and who settles. Figure 1 sets out the differences.

Figure 1. Matched principal market making compared with market and CS facility licensing.

A matched principal model has to hold up in operation, not only in the documents. If a firm says it deals as principal, its systems and records should show it. Clients should trade with the firm at the firm’s price, and that should be well understood by them. Client assets and money should move to and from the firm, not the offshore venue. The firm should carry the risk on each leg, including where a hedge fails or is delayed, and should run its own pricing, hedging, limits and reconciliations. Where client orders in fact pass straight through to an offshore order book, clients see its depth, or the venue settles with clients directly, the arrangement may look more like access to a market than principal dealing.

Firms should test their asset and cash flows, controls, market risk management and reconciliations against the model they describe, and keep evidence that the two match.  It is a detailed forensic exercise, and legal structuring alone does not address it.

Data, settlement and scope

DAPs subject to the transactional and settlement standards would keep seven years of client instructions and timestamped trading messages. Order book DAPs would publish pre-trade data (bids and offers) free and in real time. Order matching DAPs would do the same for post-trade data (completed trades), publish their settlement terms and make other trading information available free as soon as reasonably practicable.¹⁰ An operator that suspends or terminates a client for suspected misconduct would notify ASIC.¹¹ Many venues may need to upgrade systems and audit trails.

Token admission controls would apply to all DAPs, whether or not the tokens are financial products. Operators could not accept financial or non-financial benefits to preference one admitted token over others, in admission, removal, trading or marketing.¹² The transactional standards would generally exclude custody-only DAPs, most TCP operations, and transactions in tokenised tangible property or non-financial-product derivatives. The client instructions standard still reaches TCPs.¹³

Custody models

Legal holding is not key control

Underlying assets would be held on trust, under the client money and property rules in Pt 7.8, or under another arrangement. If it is not a trust, the arrangement would need to be legally effective, protect client rights (including by any registration) and give reasonably effective protection in an insolvency. The effect of any foreign law would have to be assessed. Bailment, where the operator holds assets it does not own and must return them, is ASIC’s example (though potentially difficult in practice), and the Act itself refers to an operator acting as trustee or bailee.¹⁴

Control of a pooled wallet shows a platform can move the tokens. It does not show which client owns which tokens if the platform fails. ASIC deals with legal protection separately, and adds client-level records, reconciliation and fixing shortfalls in pooled holdings.¹⁵ Omnibus wallets, which pool many clients’ tokens in one address, remain workable, noting the Act ensure the standards could not prohibit a single wallet where internal accounts identify each client’s tokens.¹⁶ A blockchain address does not, on its own, establish beneficial ownership though.

Money that is not an underlying asset gets less flexibility. It would be held under Div 2 of Pt 7.8 where that applies, and otherwise on trust through an appropriate account or facility under an arrangement governed by Australian law. ASIC acknowledges debanking risk (banks refusing or closing accounts for digital asset businesses) and is considering guidance on mixed and unidentified money, but proposes no broad Pt 7.8 i.e. client monies relief.¹⁷ We expect it to be a focus of submissions.

ASIC wants the addresses, not the keys

Wallet reporting is the most novel supervisory tool in the paper. Operators would record wallet structures, addresses and reconciliation data, report them quarterly, notify material changes and keep the records for at least seven years. ASIC is explicit that it does not want private keys, seed phrases, authentication credentials or anything else capable of authorising a transfer. It is still consulting on whether reporting could be limited to storage addresses, where assets are kept, rather than client deposit addresses.¹⁸ The result is a map of where assets sit, and it is not an audit of client balances.

Much of the digital asset value held for Australians sits with offshore groups, and the FTX collapse in 2022 showed how hard client assets are to trace once a group fails. Quarterly address data gives ASIC a starting point without taking custody risk onto itself. ASIC also notes that AUSTRAC already collects wallet information on registration, and says it will weigh the overall burden before proceeding.¹⁹

In practice, we sense platforms and custodians will need a defensible address inventory across hot and cold wallets, omnibus structures, chains, layer 2 networks (built on top of a main blockchain) and sub-custodians. Someone should own reporting and change control. Each token class needs its own identifier, so ETH, ERC-20 ETH and ETH on a layer 2 are counted separately.²⁰

Offshore custody, onshore accountability

ASIC does not propose any domestic custody requirement, and intends to develop guidance on disclosing custody location and cross-border risks.²¹ Responsibility does not move with the assets. The operator would remain responsible for custodians and sub-custodians, with due diligence, monitoring and written agreements. Under the Act, an agent’s conduct is attributed to the operator, even where the agent acted fraudulently.²²

ASIC only asks whether emergency local key access is needed, and notes that it could create operational complexity and risk for local responsible managers. It has largely kept the flexibility of the current custody regime, in accordance with RG 133. For groups, the real question is who can process a lawful withdrawal if an offshore parent fails.

Capital, licensing and transition

Capital

ASIC is consulting on three alternative NTA formulas, on top of solvency, liquidity and quarterly cash flow requirements.²³ Each formula links the minimum to fixed amounts and revenue, and Model 3 also draws on assets and activities. Thresholds would be indexed to CPI. ASIC has not chosen a model.²⁴

NTA is the buffer the Australian licensee must hold in its own right. ASIC says it is there to meet operating costs, keep owners invested in compliant operation, and fund an orderly wind-down if the operator fails.²⁵ The models build on the IDPS requirements, because ASIC treats custody as the core activity of a DAP or TCP.

Model 1 mirrors IDPS operators. Model 2 gives a lower base to platforms that hold only non-financial-product assets. Model 3 is meant to scale with smaller platforms.²⁶ Table 7 reads as follows.

Qualifying outsourced custody could cut an operator’s NTA substantially. The custodian must hold all the underlying assets, and give written assurance and, subject to limited exceptions, audit reports that it holds the NTA the operator would otherwise need.²⁷ Outsourcing alone will not qualify. Even so, banks and established custodians could become core infrastructure for platforms, and smaller platforms may prefer to buy custody than fund it.

The definitions are material as well. NTA can be met with liquid tangible assets, but at least half must be cash or cash equivalents. All guarantees count as liabilities, and trustee indemnity and set-off receivables against clients are excluded from assets. ASIC accepts its minimums look higher than overseas DAP capital (roughly AU$80,000 to AU$5.4 million). It points out that those regimes are prudential, scale up quickly and must be met with narrower forms of capital.²⁸

Who needs authorisation?

Under the Act, DAPs and TCPs are financial products unless they are managed investment schemes. Operating, dealing in or advising on them will need an AFSL authorising that service, unless an exemption applies.²⁹ Some firms that obtained or varied licences after INFO 225 (ASIC’s existing digital asset guidance) will almost certainly need a further variation.³⁰

The Act contains two exemptions. One covers low value DAPs ($10 million in transactions a year, $5,000 per client, no financial products held, and notice to ASIC). The other covers incidental referral and arranging.³¹ There are further exemptions, including for overseas issuers and clients. Those are not in the Act and depend on regulations still to be made.³²

Dates and transition

ASIC’s own description is narrow. Existing DAP and TCP operators that apply for a new or varied licence by 7 October 2027 may keep operating while ASIC assesses the application.³³ It is a variation on the INFO 225 relief, which was well received by the market.

Anyone who applies in that period stays outside the regime until the day after ASIC decides. Those who do not apply are caught from 8 October 2027.³⁴

Tokenised markets: the ledger is not the market

ASIC says its guidance on public blockchain infrastructure and wrapped tokens (tokens issued against an asset held elsewhere, often on another blockchain) is meant to help financial firms, market operators and CS facilities tokenise financial markets.³⁵

Infrastructure and venue

ASIC says a facility cannot be both a DAP financial product and a financial market or CS facility.³⁶ This essentially matches the Act, which says a facility within the DAP definition can be a market or CS facility, and to that extent it is not a financial product. Each facility needs its own characterisation. Tokenising a bond or share does not change the regime for that security.³⁷

Qualifying public digital token infrastructure (PDTI) is not a financial product, market or CS facility under the Act. ASIC’s proposed guidance that digital assets issued in relation to PDTI are not financial products depends on regulations still to be made.

Promises made and obligations settled through it keep their own character.³⁸ Infrastructure that only select persons can validate does not qualify, and ASIC suggests KYC limits on validators may fail the test.³⁹

Fascinatingly, and helpfully for the local market to keep pace with its global peers, that opens a route for public blockchains to carry tokenised securities. Most institutional tokenisation projects to date have used permissioned networks, where only approved participants can validate. Those need separate analysis, although they are not automatically markets either.

A tokenised bond is still a bond

Holding assets under a DAP or TCP is not a custodial or depository service. A custodian that tokenises client holdings may therefore be issuing a TCP, and need a new authorisation. ASIC expects some custodians to move into the regime.⁴⁰

Nor is a TCP a licence to fractionalise. The Act requires a single token for each underlying asset, which precludes some asset classes. A TCP stays outside the managed investment scheme regime only if, among other conditions, all its assets are of one class and each token divides only as far as the asset can be physically delivered in parts.⁴¹ A gold holding can be split into deliverable parts. A painting cannot!

Settlement

As we read it, ASIC’s settlement proposal is a conduct and disclosure standard for order matching DAPs. It is not a settlement regime for exchanges or CS facilities. Platform rules must disclose the settlement method, any use of external liquidity and who bears the risk.⁴² For exchanges and banks, the harder questions remain open: who transfers title, when the cash and securities obligations discharge, and which register is authoritative.

International context

The bigger prize is moving the security and the cash together. The RBA’s Project Acacia tested 20 use cases settled with stablecoins, tokenised deposits, a pilot wholesale central bank digital currency and exchange settlement account (ESA) balances held at the RBA.⁴³ Overseas, DTC (the US central securities depository) received SEC staff no-action relief in December 2025 for a tokenisation service for DTC-custodied securities.⁴⁴ HM Treasury chose HSBC Orion for its Digital Gilt Instrument pilot.⁴⁵ Hong Kong settled the HKD tranche of its September 2026 digital green bond issue with tokenised deposits.⁴⁶

Other proposals

Staking - ASIC proposes INFO 225 guidance that custodial staking (the platform staking client tokens to earn network rewards) through a DAP or TCP is not a separate financial product. Under the Act, that exclusion depends on the issuer holding an AFSL to issue the platform. We also think staking client tokens is likely to be a use of client assets under the asset-holding standards.⁴⁷

Wrapped tokens - The redemption right of a wrapped token is disregarded when determining whether it is a financial product. Its classification instead depends on its other rights and features, including rights associated with the underlying asset.⁴⁸

Stablecoins - ASIC accepts that some stablecoins may count as cash equivalents for NTA. It proposes that no AFS licensee could count one issued, possessed or held by the licensee, an associated entity, or a person controlled by or under common control with either, although business use is unaffected. An otherwise eligible stablecoin would also need to be held by an independent third-party custodian to count. Tokenised stored value facilities (broadly, payment stablecoins) are a matter for the separate payments reforms.⁴⁹

Practical implications and next steps

Submissions close on 27 November 2026, and evidence matters most on principal trading, NTA, client money and wallet reporting scope.⁵² Please contact us if you would like any assistance in preparing a submission to ASIC.

References

1. CP 392, pp 2, 4–6.
2. CP 392, pp 9 [16]–[17], 27–28 [63]–[64], 38 [95] and 50 [126]–[127].
3. CP 392, pp 4–5; DAF Act s 2. Statutory references are to the Corporations Act as amended by the DAF Act.
4. CP 392, p 35 [90]; Corporations Act s 912BF.
5. CP 392, p 40 (Table 4, C3.3 and C3.4).
6. Corporations Act s 912BF(3)(c)–(d).
7. CP 392, pp 36 [92] and 42 (Table 5, C4.3).
8. CP 392, pp 37–38 (Table 3, C2.6) and C2Q5.
9. Corporations Act ss 767A, 768A and 912BF(3)(c).
10. CP 392, pp 35 [89], 37 (Table 3, C2.1, C2.4 and C2.5) and 42–43 (Table 5, C4.4 to C4.6).
11. CP 392, p 45 (Table 6, C5.2).
12. CP 392, pp 39–40 (Table 4, C3.1 and C3.5).
13. CP 392, pp 35 [89], 37 (C2.2), 39 [98] and 46 (C6).
14. CP 392, pp 25–26 (Table 2, B1.4 and B1.5) and 30 [71]–[72]; Corporations Act s 761GC(1)(b).
15. CP 392, p 26 (Table 2, B1.4 and B1.6).
16. Corporations Act s 912BE(2)(e).
17. CP 392, pp 25 (B1.2) and 30–31 (B4, B4Q3 and [73]–[77]).
18. CP 392, pp 27 (B1.10) and 31–32 (B5, B5Q3, [81] and [83]).
19. CP 392, p 32 [78]–[83].
20. CP 392, p 27 (Table 2, B1.11).
21. CP 392, pp 28–29 (B2, B2Q2, [67]–[69]).
22. CP 392, p 27 (B1.12); Corporations Act s 761GE(2)–(3).
23. CP 392, pp 48–49 (D1 and D2).
24. CP 392, pp 50–52 (D3, D3Q2 and Table 7).
25. CP 392, p 52 [128].
26. CP 392, p 53 [129] and [131].
27. CP 392, p 53 [130].
28. CP 392, p 54 [134] and [136]–[138].
29. Corporations Act s 764A(1)(la)–(lb); CP 392, pp 16 [39] and 17 [41].
30. CP 392, p 17 [40] and A3Q3.
31. Corporations Act s 911A(2)(ja)–(jb).
32. CP 392, p 16 [38].
33. CP 392, pp 6 and 18 [45].
34. Corporations Act ss 1730–1732, inserted by DAF Act Sch 1 item 98.
35. CP 392, p 59 [144].
36. CP 392, p 16 [37].
37. CP 392, p 18 [42].
38. CP 392, p 58 (Table 9).
39. CP 392, p 58 (Table 9); Corporations Act s 9E(2)–(3).
40. Corporations Act s 766E(3)(cb)–(cc); CP 392, p 28 [65].
41. Corporations Act s 761GD(1)(b) and s 9 (definition of managed investment scheme, para (md)).
42. Corporations Act s 912BG(1)(c)–(d).
43. RBA and Digital Finance CRC, Project Acacia final report (21 May 2026).
44. DTCC, “Paving the Way to Tokenized DTC-Custodied Assets” (11 December 2025).
45. FinTech Futures (16 February 2026).
46. HKMA press release (29 September 2026).
47. Corporations Act ss 9F and 765A(1)(pa); CP 392, pp 26 (B1.9) and 59 (Table 9).
48. CP 392, p 58 (Table 9); Corporations Act s 765E(3).
49. CP 392, pp 7 [7] and 60–61.
50. CP 392, pp 20 [53], 25 (B1.3) and 29 [68]; Corporations Act s 912BG(1).
51. CP 392, pp 17 [40], 19 (A5Q5) and 33 [85]; Corporations Act ss 912BB and 912D(3)(a).
52. This briefing is based on CP 392 and the enacted DAF Act (No. 38 of 2026). It has not reviewed the preliminary draft standards or draft RG 000, which are separately downloadable. ASIC says they are attached for illustrative purposes only and may change considerably (CP 392, p 2, Note 2). Proposed relief and anticipated regulations are also provisional. The key consultation questions are C3Q1 and C3Q4 (principal trading), D3Q2 and D3Q4 (NTA), B4Q3 (client money) and B5Q3 (wallet reporting).