The crypto clock has run out. Here is who is now exposed

ASIC's grace period for digital asset businesses ended on 30 September. Firms that applied for a licence in time are now in the queue. Those that did not risk heavy penalties, well before Australia's new crypto law begins.

Australia's crypto businesses have passed their first real regulatory deadline. The Australian Securities and Investments Commission (ASIC) gave digital asset firms until 30 September 2026 to apply for, or vary, an Australian Financial Services (AFS) licence. That window has now closed.

The deadline is easy to confuse with Australia's new crypto law, which does not commence until 9 April 2027. It comes from something older. In October 2025, ASIC updated its guidance, known as Information Sheet 225 (INFO 225), to set out its view that many digital assets already count as financial products under existing law, including stablecoins and wrapped tokens.

"Many widely traded digital assets are financial products under current law," ASIC commissioner Alan Kirkland said at the time, meaning many providers required a licence. ASIC gave the industry a temporary reprieve, a sector-wide no-action position, promising not to take action against firms while they got their paperwork in order. It originally ran to 30 June 2026 and was extended to 30 September 2026.

The regulator was blunt about what happens next. "From 1 October, firms that need a licence or variation to their existing authorisation but have not met the conditions of ASIC's no-action position risk breaching financial services law and could face civil and criminal penalties," ASIC said in a final warning on 2 September 2026. It said those penalties could include fines of up to 10 per cent of annual turnover.

Dozens of firms moved in time. ASIC had recorded more than 45 licence applications from digital asset businesses by early September 2026, up from about 30 in late June 2026, according to ASIC figures reported by The Industry Spread. Firms needing a market or clearing licence had a separate step: they had to notify ASIC in writing and hold a pre-application meeting by the same date.

What does this mean for someone who holds crypto? For most users, nothing changes overnight. Lodging an application does not mean a firm has been licensed, and assessment will take time. The practical difference is that a platform offering products ASIC regards as financial products, such as stablecoins, should now be able to show it holds a licence or has applied for one.

The bigger change is still to come. From April 2027, the new Digital Assets Framework will require most exchanges and custodians that hold customer tokens to be licensed as well, with a six-month transition. The September deadline was the first filter before the full rulebook arrives in 2027.

This deadline separates the crypto firms preparing for regulation from those hoping to avoid it. We expect ASIC to make an early example of at least one business that kept operating without applying, most likely an offshore platform serving Australians, because enforcement is the only way to give the deadline teeth. For users, the sensible step is simple: ask your platform whether it holds an AFS licence or has applied for one. A platform that cannot give a clear answer is telling you something.