Australia: Conduct, Safeguarding & Promotions

Conduct, Safeguarding & Financial Promotions

The conduct and safeguarding layer of the Australian payments-reform cycle is as active as the licensing layer, with three distinct developments converging in the 2026–2027 window.

The most operationally immediate is the safeguarding requirement introduced under the Payments Systems Modernisation reforms. Non-bank PSPs will be required to segregate payment-related customer money in a trust account held with an Australian ADI. A mandatory, revised ePayments Code will be introduced via a new rule-making power. The trust-account requirement is analytically significant beyond its face value as a consumer-protection measure: it creates a structural dependency of non-bank PSPs on ADIs. To satisfy a statutory safeguarding obligation, a non-bank PSP must maintain or establish a banking relationship with an ADI. In a market where de-risking dynamics have historically constrained non-bank PSPs' access to banking services, this requirement could function as an indirect market-access barrier for smaller or higher-risk entrants. This dynamic will be tested as the licensing reforms come into force and as the RBA's ESA access review (W12) progresses.

The digital-asset conduct framework is advancing on a parallel track. The Corporations Amendment (Digital Assets Framework) Act 2025 received royal assent in April 2026 and is scheduled to commence on 8 April 2027. The Act embeds digital-asset licensing concepts within the AFSL framework, meaning that entities providing financial services in relation to digital assets will need to hold or vary an AFSL from that date. ASIC's transitional no-action position for unlicensed digital-asset financial-product services required that an AFSL application or variation be lodged by 30 June 2026 to remain operative. This deadline has passed or is passing at the time of this cycle; entities that did not lodge by that date are no longer covered by the no-action position and face enforcement exposure.

The AML/CTF dimension of the digital-asset conduct framework is provided by AUSTRAC's FATF-aligned virtual-asset service provider regime, which commenced on 31 March 2026. The regime requires AUSTRAC registration and an AML/CTF programme for virtual-asset and value-transfer designated services. This finding was surfaced via the W1b licensing lens rather than through a direct Sentinel W11 feed, which was not available for Australia this cycle. The AML/CFT surface for Australian virtual-asset operators should therefore be understood as potentially broader than what this cycle's coverage reflects; a cross-monitor flag has been raised to the Financial Intelligence Monitor. Financial-promotion enforcement — specifically ASIC-specific actions on surcharging or BNPL promotion — was not directly queried this cycle and represents a standing gap.

The bank versus non-bank distinction runs through all three developments. The safeguarding trust-account requirement applies to non-bank PSPs, not to ADIs, which are already subject to prudential requirements that address customer-money protection. The digital-asset AFSL and AUSTRAC VASP registration requirements apply to non-bank entities operating in the digital-asset space; ADIs providing digital-asset services will engage with these frameworks differently, typically through existing AFSL and AML/CTF programme structures.

Outlook

The 30 June 2026 ASIC no-action deadline is the most immediate conduct-layer milestone. The Digital Assets Framework Act commences 8 April 2027, giving entities that have lodged AFSL applications a transition window to obtain authorisation before the Act is in force. The safeguarding trust-account requirement will come into force as part of the Tranche 1 licensing package, timing contingent on Parliament. The AUSTRAC VASP regime is already live. The combination of these four developments means that non-bank PSPs operating in or adjacent to the digital-asset space face a compressed multi-front compliance timeline across 2026 and 2027.