Buy a licensed company 
VASPs live data and insights 
Learn about crypto safety 
Read the latest research 
DCE vs. AFSL: Which Australian License Does Your Exchange Actually Need?
In the past, exchange-running in Australia was a lot more straightforward. You would register with AUSTRAC, do KYC, and basically keep your house clean. But that has changed, especially in 2026. The Corporations Amendment (Digital Assets Framework) Bill 2025 creates a fork every platform has to pick from. One path is DCE (AUSTRAC), the other is AFSL (ASIC). Picking the wrong one can lead to an enforcement problem, with penalties up to $16.5m or 10% of annual turnover. The only way to get this right is to map your actual product, custody, and flows to how AUSTRAC and ASIC see them.
AUSTRAC DCE Registration
DCE registration stays the entry ticket for anyone exchanging digital currency for AUD or other digital assets. This fits platforms that do simple on-ramp/off-ramp. Users buy BTC for AUD, sell BTC back to AUD, and you’re not running custody-heavy features or packaged yield.
AUSTRAC cares about AML/CTF (a lot). That means an AML/CTF program that matches your risk, transaction monitoring that works, KYC that stands up under review, and a compliance officer who can actually run this.
Two things make 2026 expensive even if you “only” sit in AUSTRAC land:
- the operational cost of running the AML program properly
- the Travel Rule (data-sharing obligations for transfers, regardless of value)
AUSTRAC doesn’t charge a registration fee in the way people assume. The bill shows up in headcount, tooling, and process.
The AFSL Trigger
The moment your platform moves beyond plain buy/sell, you start walking into AFSL territory. If your platform “possesses” a client’s tokens, ASIC treats you like a custody operator. Possession here means factual control, the practical ability to move a client’s tokens, or block them from moving those tokens.
| Service feature | Regulatory path | Key reason |
| Pure fiat-to-crypto exchange | AUSTRAC DCE | On-ramp/off-ramp only |
| Custodial wallets (over $5k per user) | ASIC AFSL | You control client assets |
| Managed staking / staking-as-a-service | ASIC AFSL | Treated like an investment facility |
| Wrapped tokens | ASIC AFSL | Usually treated as derivatives |
| OTC desk for wholesale clients | AUSTRAC + AFSL | Often triggers dealing or market-making permissions |
The Low-Value Exemption
“Under $5k per customer and under $10m per year, you’re fine” or at least that’s what everyone hears recently. That exemption exists, but it’s not passive. It’s not a “stay under the line and forget about it” situation.
ASIC expects you to formally notify them if you intend to rely on it. Silence while offering custodial services, even under thresholds, still puts you in breach territory.
On another note, “financialized” features can override the comfort people think they have. Lending-style earn, structured yield, packaged staking, these are the kinds of functions that pull you into higher-risk treatment even when volume looks small.
Staking and Wrapped Tokens
Most small exchanges trip AFSL because they bolt on staking.
A common pattern looks like this:
- users can stake through the platform
- the platform pools funds to hit protocol minimums
- the platform controls validators, reward routing, and distribution logic
ASIC tends to treat that as a managed structure, closer to an investment facility than a pure technical interface.
Staking stays cleaner when it’s truly non-custodial. Users keep unilateral control of keys. The platform behaves like an interface, rather than an operator holding the assets.
Wrapped tokens are another compliance magnet. Tokens that reference an underlying asset on another chain often land in derivative-like treatment. Custodial bridging and synthetic exposure are hard to frame as “just exchange,” because the product is fundamentally a referenced claim. If these features sit at the center of your business, it is no longer AUSTRAC-only.
Professional Indemnity Insurance
Founders fixate on NTA and licensing timelines. Insurance quietly becomes the blocker. AFSL holders dealing with retail clients need adequate compensation arrangements under the Corporations Act. In practice, PI cover becomes part of the AFSL survival kit.
For example, a business doing around $2m in retail revenue often ends up needing around $2m cover for any one claim.
Many traditional insurers still treat crypto as high-risk and avoid it. If you cannot secure PI, you can end up with a license you cannot keep. ASIC has acknowledged the broader “de-risking” problem, including insurance. Relief can exist when equivalent consumer protections are demonstrably in place, but it’s not automatic. It’s case-by-case, paperwork-heavy, and you need a strong story.
The No-Action Window, If You’re Already Live
If you’re operating now and you realise you need an AFSL, the deadline is 30 June 2026. Lodge by then and ASIC’s “Class No-Action” position can protect you while the application is processed, assuming you commenced services before 31 December 2025.
If you miss the June deadline, you either shut down regulated activity immediately or accept enforcement risk.
Tax: Your License Choice Can Shift Your Tax Outcome
Company tax is usually 25% or 30%. To qualify for the 25% base rate, aggregated turnover needs to stay under $50m and no more than 80% of income can be passive.
Platforms that lean heavily into custodial staking fees or lending-style income can end up stacking passive-style revenue. If that dominates, it can push you into the higher 30% bracket. This catches teams by surprise because the product decision creates the tax profile.
Where Coincub Fits
Coincub helps with the local setup pieces regulators care about, resident director support, compliance officer capability, and the organisational competence angle that ASIC and AUSTRAC both test. If you’re applying fresh or buying an AUSTRAC-registered entity, the service model still has to match the 2026 perimeter, otherwise the paperwork turns into a liability.
Frequently Asked Questions (FAQ)
What is the difference between AUSTRAC DCE registration and an AFSL?
AUSTRAC DCE registration covers AML/CTF obligations for exchanging digital assets. An AFSL is required when a platform holds client assets, provides custodial services, or operates a regulated digital asset platform under ASIC rules.
Do all crypto exchanges in Australia need an AFSL in 2026?
No. Exchanges that only provide fiat-to-crypto or crypto-to-fiat buy and sell services without custody can operate with AUSTRAC registration only. Custodial or investment-style features usually trigger AFSL.
When does a crypto exchange cross from DCE into AFSL territory?
The trigger is factual control over client assets. If the platform can move tokens, restrict withdrawals, or pool assets, ASIC is likely to require an AFSL.
What are the $5,000 and $10 million thresholds everyone talks about?
If a platform holds more than $5,000 per customer or facilitates more than $10 million in transactions over a rolling 12 months, AFSL obligations are triggered unless a valid exemption applies.
Can a platform rely on the low-value exemption and avoid an AFSL?
Possibly, but it is not automatic. Platforms must notify ASIC and stay within scope. Offering custodial or financialized features can override the exemption even at low volumes.
Does offering staking force an exchange to get an AFSL?
Often, yes. Custodial or pooled staking where the platform controls validators, rewards, or distribution is typically treated as a regulated investment-style service.
Are wrapped tokens regulated differently from spot crypto trading?
Yes. Wrapped tokens that reference an underlying asset are often treated as derivative-like products, which usually brings the platform into AFSL scope.
Can an exchange operate while applying for an AFSL?
Existing platforms that lodge an application by 30 June 2026 may rely on ASIC’s no-action position. New platforms usually need approval before offering regulated services.
What happens if an exchange operates under the wrong license?
ASIC can impose penalties up to the greater of AUD $16.5M or 10% of annual turnover. AUSTRAC can suspend or cancel registration for AML breaches.
Is AUSTRAC registration alone enough to get banking access?
Sometimes for basic operations, but banks increasingly expect AFSL coverage or a clear AFSL roadmap before offering full operational or client money accounts.
