.svg)
In March 2022, the Australian Treasury announced the publication of its consultation paper titled “Crypto-Asset Secondary Service Providers: Licensing and Custody Requirements”. The consultation paper proposes a regime governing the licensing of crypto-asset secondary service providers and certain requirements for custodians of crypto-assets in the country.
This regulatory analysis will delve into the background of the consultation, as well as the key provisions and requirements of the proposed regime. It will then assess the possibility of opting for alternative requirements proposed by the government, in addition to the potential implications of these regulatory changes for providers and the wider crypto-asset ecosystem.
Background
Up to this point, crypto-asset secondary service providers (CASSPrs) and crypto-assets in Australia have not been subject to a dedicated regulatory framework. However, using the term “decentralisation” can be somewhat misleading when it comes to domestic rules applicable to crypto-assets. In this respect, it is important to point out that CASSPrs do not operate in a complete absence of regulatory oversight. As will be discussed below, various activities involving crypto-assets are governed by a wide range of strict requirements under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, the Competition and Consumer Act 2010 and the Corporations Act 2001.
In its consultation paper, the Australian Treasury explains that the reasons underlying its motivation to carry out the consultation are related to the significant growth of the crypto industry. In doing so, the Treasury relies on data provided by the Financial Stability Board (FSB), an international authority which was established by the G20 for the purpose of monitoring the global financial environment and which also counts Australia among its member states. In its report “Assessment of Risks to Financial Stability from Crypto-Assets” from February 2022, the FSB points out that the global crypto-asset market had grown 3.5 times in 2021, reaching a value of US$2.6trn by the end of 2021.
As the consultation paper outlines, the proposed CASSPrs regime will operate independently from the general Australian regime applicable to financial products. This decision was addressed in greater detail at Australian Blockchain Week on March 21, 2022 by Senator Jane Hume, the Australian minister for superannuation, financial services and the digital economy. Hume justified the need for separate regimes applicable to financial products and CASSPrs because the government considered that “crypto-assets do not require the government to assure trust in the same way that financial products do”, due to the larger degrees of transparency and precision, as well as the perceived lower risk of social harms associated with crypto-assets.
Despite the accuracy and precision of crypto-assets, Hume also explained that the need for government action is motivated by the need for trust when entities and individuals are dealing with an intermediary or a third-party custodian. Therefore, the Treasury’s ultimate goal in carrying out a consultation is to ensure that the trust in Australian CASSPrs is not threatened and that the assets held by Australian entities and citizens are safe and secure.
In addition, the Treasury’s paper cites potential risks to consumers as another reason for introducing a special regime for CASSPrs. It lists the collapse of Australian cryptocurrency exchange myCryptoWallet as an example of an exchange inflicting damage to consumers’ interests. In spring 2021, myCryptoWallet failed to provide its users access to their funds and to the exchange, which eventually led to the liquidation of the exchange. The paper clarifies that the crypto industry and interested parties have also been calling for regulatory action in the aftermath of myCryptoWallet’s collapse, with the hope that regulatory clarity would assist consumers with achieving an understanding as to which providers are reliable and meet minimum pre-determined regulatory standards.
The proposed measures laid out in the consultation paper form part of the Australian Digital Economy Strategy, which aims to secure a top-ten position among all digital economies worldwide by year 2030. According to the strategy that forms part of the country’s 2021-22 budget, this objective was to be achieved through the provision of strategic investment initially amounting to A$1.2bn; this investment was further boosted in the 2022-23 budget. The Australian government also aims to attain the goals contained in the strategy document by placing additional emphasis on key areas of importance, including encouraging the growth of emerging technologies such as crypto-assets.
Main requirements introduced
The consultation paper first maps out the domestic crypto ecosystem in Australia, drawing a distinction between primary and secondary services involving crypto-assets. The paper provides definitions and sets out key requirements for CASSPrs, which aim to lay the foundation not only for the CASSPrs regime but for future regulatory initiatives as well.
Key definitions
The consultation paper introduces a working definition of “CASSPrs”: “Any natural or legal person who, as a business, conducts one or more of the following activities or operations for or on behalf of another natural or legal person:
i. exchange between crypto-assets and fiat currencies;
ii. exchange between one or more forms of crypto-assets;
iii. transfer of crypto-assets;
iv. safekeeping and/or administration of virtual assets or instruments enabling control over
crypto-assets; and
v. participation in and provision of financial services related to an issuer’s offer and/or sale of a crypto-asset.”
This definition extends beyond “digital currency exchanges” as a more obvious example of a secondary service provider. This is due to the government’s intention to increase trust across a wider range of intermediaries and other CASSPrs, including brokers and custodians of crypto-assets.
In addition, the Treasury intends to apply the same definition of “crypto-assets” across all regulatory regimes. It currently adopts the definition introduced by the Australian Securities and Investments Commission (ASIC) in its “Consultation paper No. 343: Crypto-assets as underlying assets for ETPs and other investment products”. Specifically, ASIC defines a “crypto-asset” to mean: “[…] a digital representation of value or contractual rights that can be transferred, stored or traded electronically, and whose ownership is either determined or otherwise substantially affected by a cryptographic proof.”
Depending on the outcome of the consultation, the Treasury may opt for different forms of these definitions.
Licensing regime for CASSPrs
The Treasury’s consultation paper introduces licensing requirements for CASSPrs. In terms of the scope of application, the licensing regime will capture the business activities of CASSPrs that:
- Provide access to non-financial product crypto-assets for consumers in the retail space.
- Provide safekeeping, custody or storage services of all crypto-assets to consumers.
- Fall within the definition of “virtual asset service providers” adopted by the Financial Action Task Force (FATF) due to issues pertaining to anti-money laundering and counter-terrorism financing (AML/CTF).
For additional clarity, in October 2021, FATF included a definition of “virtual asset service providers” in its Updated Guidance for a Risk-Based Approach: Virtual Assets and Virtual Asset Service Providers: “[…] any natural or legal person who […] as a business conducts one or more of the following activities or operations for or on behalf of another natural or legal person:
i. Exchange between virtual assets and fiat currencies;
ii. Exchange between one or more forms of virtual assets;
iii. Transfer of virtual assets; and
iv. Safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets;
v. Participation in and provision of financial services related to an issuer’s offer and/or sale of a virtual asset.”
Based on the scope of application mentioned above, it appears that exchanges and operators of crypto-markets, as well as brokers and dealers in Australia, will need a licence under the new regime if it is passed as proposed.
As a result of the requirement that potential licensees should also provide “safekeeping, custody, or storage services”, there may be providers that fall outside the regime, such as decentralised networks and exchanges which provide non-custodial services and whose users engage in peer-to-peer transactions.
Proposed set of CASSPrs obligations
The consultation paper outlines 13 primary obligations applicable to CASSPrs.
Out of these 13 obligations, seven are identical to the requirements under the general Australian financial services (AFS) regime. This list comprises requirements such as: providing services in an efficient, honest and fair manner; ensuring the adequacy of the entity’s financial and technological resilience; and having adequate internal and external dispute resolution procedures in place.
To achieve compliance with the remaining six obligations, licensees should:
- Take reasonable steps to ensure that the crypto-assets they provide access to are not improperly described or misrepresented.
- React in a well-timed manner when requested to verify that scams are not sold on their platform.
- Not hawk specific crypto-assets.
- Be subject to regular audits conducted by independent parties.
- Ensure compliance with applicable AML/CTF provisions.
- Maintain adequate custody arrangements.
The paper also introduces 11 mandatory obligations and standards with respect to custody procedures. These requirements are particularly important for CASSPrs that hold customers’ private keys or outsource these services to third parties. Their aim is to ensure that crypto-assets custodians meet customers’ reasonable expectations in terms of safety, data security and access to their assets.
Administration of regime and pre-existing obligations
The Treasury’s consultation paper stipulates that the CASSPrs regime will be placed under ASIC’s oversight. It also sheds light on the application of the pre-existing obligations of CASSPrs specified above.
First, it is proposed that entities should remain compliant with the country’s general AML/CTF legislation under the auspices of the Australian Transaction Reports and Analysis Centre (AUSTRAC), Australia’s government agency responsible for the detection and investigation of criminal offences in the financial services industry.
Specifically, should the present regime remain unaltered, all pre-existing and new licensees will most likely still have to ensure that they are registered with AUSTRAC’s digital currency exchange register. However, the government needs to provide additional clarity on these registrations. Currently, the scope of AUSTRAC’s supervision over digital currency exchange providers extends to:
- Businesses and individuals exchanging domestic and foreign currencies for cryptocurrencies.
- Businesses and individuals exchanging cryptocurrencies for domestic and foreign currencies.
As mentioned above, the definition of CASSPrs proposed by the government applies to a wider range of entities, including exchanges that provide crypto-to-crypto trading services, taken in addition to other types of intermediaries, all of which are currently excluded from the scope of AUSTRAC’s supervision. The remaining intermediaries and custodians would still need to be covered by the general AML regime, but this leaves a temporary regulatory gap in the application of AUSTRAC’s regime specifically to CASSPrs.
For the purpose of ensuring that the same standards and definitions apply in a comprehensive and consistent manner throughout all legislation, it is possible that the remaining intermediaries will need to be addressed separately in other legislative initiatives and consultations in the near future. This could be the case with regard to platforms dealing with particular subsets of crypto-assets; for example, this may be implied by the consultation paper’s enquiry about the status of non-fungible token (NFT) marketplaces.
Furthermore, the paper confirms that all crypto-assets will continue to be considered financial products for the purposes of the Corporations Act 2001, as long as they provide services to consumers relating to: making a financial investment; managing financial risks; and/or completing digital (non-cash) payments. If certain business activities fall within this definition, they need to comply with advertising standards specifically applicable to financial products. In stating its position on the classification of crypto-assets as financial products, the government also relies upon ASIC’s information sheet INFO 225, which provides more comprehensive practical guidance regarding the application of the Corporations Act.
Potential adoption of alternative regime for CASSPrs
Two proposals for regimes are outlined in the consultation paper, one of which could be an alternative to the CASSPrs regime described above.
The first option would seek to bring CASSPrs under the umbrella of the general financial services regime. CASSPrs would, therefore, need to obtain an Australian financial services (AFS) licence. The government will then assess every crypto-asset class on its own on a case-by-case basis to determine the nature of applicable obligations. However, as the paper expressly states, this could lead to significant delays and constrained innovation for certain licensees. For this reason, it is less likely that this proposal would garner a lot of support from the industry and other interested parties.
The second option suggests that the crypto-asset industry regulates itself while simultaneously remaining subject to external supervision by AUSTRAC with respect to their AML/CTF commitments. Essentially, this would require the adoption of a code of conduct by CASSPrs.
The Treasury specifically compares this self-regulatory approach to the lack of centralised crypto-asset regulations in the US. However, with respect to the US, it is worth pointing out that, in a speech on April 4, 2022, Gary Gensler, the chairman of the US Securities and Exchange Commission (SEC), announced that the agency plans to regulate crypto-asset exchanges. The SEC compared the role of crypto-exchanges to the important functions of traditional exchanges; therefore, crypto-exchanges would require a similarly high level of protections for investors. As VIXIO reported in May 2022, the SEC will also double the size of its crypto-enforcement unit to enable the efficient enforcement of the planned measures. This overseas development is significant to the extent that it may affect Australia’s own regulation plans and the attitudes within an industry of a truly global nature.
Furthermore, another factor that may influence the government’s decision to introduce the proposed self-regulation alternative is its long-standing approach to self-regulation, which is clearly mapped out in “Industry Self-Regulation in Consumer Markets”, a report from August 2000 prepared by the Australian government’s Taskforce on Industry Self-regulation. In its report, the taskforce recommended that a mature industry would potentially be better-positioned to effectively self-regulate due to the fact that “industry participants are more likely to have sufficient resources and be more committed while any ‘shakeout’ of rogue traders may already have occurred”. The crypto-assets industry may be growing, but the origins of the first cryptocurrency, Bitcoin, and the first crypto-exchange only date back to 2008, which is why the sector may be considered insufficiently mature. By analogy, there are other industries gaining popularity, such as the buy now, pay later (BNPL) sector, which are also less mature and have formed part of recent regulatory efforts and discussions on the effectiveness of self-regulation in Australia; this issue was also recently explored in a BNPL regulatory analysis by VIXIO.
Implications
If adopted, the proposed regime for CASSPrs would bring both benefits and disadvantages for secondary service providers and the wider crypto-industry.
The potential benefits for both CASSPrs and investors is higher consumer confidence in crypto-assets, which, in turn, may encourage innovation and competition. By their nature, cryptocurrencies are known for their price volatility, which is why investing in crypto-assets is a highly speculative undertaking. Recent developments, such as the downfall of stablecoin Terra at the beginning of May 2022, have contributed to concerns regarding the potentially declining market integrity and consumer confidence. In this respect, ensuring the trust component in crypto-assets, as emphasised by the Australian Treasury, may partially prevent users from shying away from platforms and all businesses associated with crypto-assets.
On the other hand, stricter regulations could stifle innovation. Introducing regulations in the crypto industry, with its lack of links to central authorities, may deprive the market of this much-valued decentralisation feature. As collateral damage, this may limit the appeal of services provided by CASSPrs. Further, among the multiple questions submitted in its consultation paper, the Treasury queries the need for domestic location requirements for providers of crypto-asset custody services. It is unclear what this may mean in practice; however, unlike physical assets, another advantage of crypto-assets lies in their ability to be held across various locations due to the distributed ledger technology (DLT) applied in the transactional process. Therefore, introducing any particular location requirements would indicate that further restrictions are being imposed on decentralisation, which may not be a positive development for interested parties.
In addition, there will likely be more compliance costs for CASSPrs that need to be brought under the purview of the new CASSPrs regime and ASIC’s supervision. In the consultation paper, the Treasury has signalled to the market that it intends to avoid duplication across the general AFS licensing and the CASSPrs licensing regimes. Nevertheless, the new CASSPrs licensing requirements will need to be introduced with due diligence and added care exercised by both regulators and secondary service providers; otherwise, any lack of clarity and delayed reactions can result in duplication and undesired costs.
Further, the Treasury’s paper flags the need for the proposed regulation to remain technology-neutral. This seems to protect the interests of CASSPrs, as the government will focus on the particular asset class and adjust any potential rules accordingly.
One of the suggested obligations of CASSPrs is to “maintain adequate technological and financial resources to provide services and manage risks, including by complying with the custody standards proposed in this consultation paper”. As a result, crypto-asset custodians could be subject to even more stringent technology-related requirements concerning their infrastructure, their cybersecurity systems, which are also to be put through independent verification processes, as well as their mechanisms for storing consumers’ private keys. Depending on the entity in question, this obligation could lead to one-off compliance costs or even structural changes. At the same time, the paper also highlights the lawmakers’ intention to refrain from “restricting custodians to specific technology”, which is why it may be too early to estimate the precise regulatory impact on providers’ costs.
Next steps
Neither of the alternative regimes proposed by the Treasury is likely to be adopted. It is, therefore, essential that all parties affected by the proposed CASSPrs regime estimate their own position and re-evaluate their internal procedures in light of the general CASSPrs licensing and custody rules.
The Treasury’s consultation closed on May 27, 2022. In its consultation paper, the Australian Treasury points out that it intends to use the results of this consultation to inform its future work on tokens: “[…] a token mapping process will be completed as a separate piece of work and finalised by the end of year.”
At the moment, there is no clear and unified classification of tokens in the country, which will be tackled in a separate consultation later in 2022. To avoid surprises and remain prepared at all times, potentially affected entities should keep informed of the details of all upcoming rules and requirements.
Conclusion
Key suggestions undergoing review by the Treasury include the introduction of uniform definitions of “crypto-asset secondary service providers” and “crypto-assets”, as well as specific licensing requirements for CASSPrs. The proposed new regime for CASSPrs and crypto-asset custodians will not function in isolation, as pre-existing obligations such as the current applicable AML/CTF rules will not cease to apply.
It seems unlikely that the Australian government will adopt an alternative CASSPrs regime, due to constrained innovation and fewer investor protections. The government-proposed CASSPrs regime, on the other hand, may increase consumer confidence and trust. The downside of such a regime, however, is the perceived threats to decentralisation and undesirable compliance costs.
Introducing regulations to an industry that is as highly innovative as the crypto-assets sector requires flexibility and open-mindedness by all industry participants and regulators, as well as a high degree of regulatory courage. However, the Australian Treasury seems determined to do so in light of what it perceives to be stability threats posed by the lack of CASSPrs regulations. This indicates the end of a regulatory expedition limited to the physical assets realm and — in the words of Senator Hume — marks the “opening of the virtual frontier”.
