Varying Your AFSL in NSW & Australia: A Guide to the New ASIC Portal

Introduction

For fintech founders and compliance officers, expanding your operations may require a variation to the conditions of your Australian Financial Services Licence (AFSL). In May 2025, the Australian Securities and Investments Commission (ASIC) introduced a new Regulatory Portal, and by 16 June 2025, new AFSL variation and notification transactions were moved from eLicensing to this Regulatory Portal. Varying an AFSL is not just a clerical task; it is a strategic re-pitch to the regulator under the Corporations Act 2001 (Cth). Licensees must clearly demonstrate they maintain the organisational competence and compliance arrangements to support any new financial product or service.

This article explains the AFSL variation application process for Australian businesses and distinguishes an authorisation or licence-condition variation from a prescribed change notification. It covers how to use the digital workflow, the difference between a full variation and a notification, and the separate obligations that may apply where a responsible manager named in a key person condition ceases their role.

Interactive Tool: See If You Need an AFSL Variation & Notification

The 2025 Portal Pivot & Why Your AFSL Variation is a Re-Pitch

Moving AFSL Transactions into the ASIC Regulatory Portal

In mid-2025, the ASIC implemented a fundamental change in how financial service providers manage their licensing. It moved new AFSL variation, cancellation and change-notification transactions to the ASIC Regulatory Portal. Before that date, applicants generally used Form FS03 for variations and Form FS20 for change notifications through eLicensing.

The old methods have been replaced by the ASIC Regulatory Portal, which operates as a digital-first platform. Key changes from this transition include:

• End of numbered forms: Applications are now completed as online “transactions” within the portal, rather than through the former eLicensing workflow.
• Direct document uploads: ASIC no longer provides a MOVEit address for AFSL proof documents, and portal uploads are no longer subject to the former 10 MB file limitation.
• Structured data entry: ASIC collects information through structured transaction fields and no longer distinguishes between “core” and “non-core” proofs.

Ultimately, this move to a centralised digital system was designed to streamline interactions with the regulator. However, it requires a new approach to preparing and lodging applications.

Treating Your Licence Variation as a Strategic Re-Pitch to ASIC

The introduction of the ASIC Regulatory Portal means a variation to your AFSL is more than just an administrative update. Instead, it should be viewed as a complete re-pitch of your business to the regulator. Furthermore, the portal’s digital workflow is designed to be dynamic, adjusting the questions you need to answer based on your real-time inputs.

This intelligent system connects previously separate datasets, allowing algorithms to flag inconsistencies in your application instantly. Consequently, a discrepancy that might have been missed or queried weeks later by a human analyst can now halt your application at the initial digital stage. For this reason, every variation is an opportunity for ASIC to conduct a fresh assessment of your entire operation, ranging from your organisational competence to your financial stability.

Variation vs. Notification: A Decision Matrix

When to Lodge a Full AFSL Variation

A full AFSL variation is required where your proposed activity requires a change to the authorisations or other conditions of your licence. The relevant application is made under Section 914A(2)(b) of the Corporations Act 2001 (Cth). The test is not whether the change is commercially significant; it is whether the existing AFSL conditions cover the proposed activity.

Common triggers that necessitate a full variation include:

• Adding new financial products or services: If your business intends to provide a financial service or deal in a financial product not covered by its existing authorisation conditions, it should apply to vary those conditions under Section 914A(2)(b) before carrying on that activity. Section 911A(1) of the Corporations Act 2001 (Cth) requires the licensee to hold an AFSL covering the financial services business it carries on.
• Changing your client base: Moving from wholesale-only clients to retail clients may require a variation if the existing AFSL authorisation conditions are limited to wholesale clients. This move introduces a higher level of consumer protection obligations, and ASIC will need to assess your capacity to meet them. The expansion can also engage retail-client obligations, including dispute-resolution obligations under Section 912A, and compensation-arrangement obligations under Section 912B.
• Altering how you handle client money: If you plan to change the way you hold client funds or assets, a variation may be needed if the proposed model adds a financial service not covered by the existing licence conditions. This includes a custodial or depository service within Section 766E of the Corporations Act 2001 (Cth). However, a change in internal procedures alone does not automatically require an AFSL variation. Further, if the licensee receives client money in connection with a financial service, Section 981B may impose separate client-money obligations.

When a Simple Notification is Enough

Not every business change requires a full variation application. For minor administrative updates that do not alter the authorisations or conditions of your AFSL, a simple notification through the ASIC Regulatory Portal is enough. These updates are designed to keep ASIC’s records current.

A portal notification is appropriate for changes such as:

• Updating your business details: This may include changes to information required to be recorded on the register, where the change falls within Reg 7.6.05 of the Corporations Regulations 2001 (Cth).
• Updating Responsible Manager details: A change to a responsible manager is generally notified under Reg 7.6.04(1)(b) and Reg 7.6.05(1)(g) within 10 business days. This is in addition to any separate requirement under a key person condition on the AFSL.
• Amending compensation or dispute resolution details: Minor updates to your compensation arrangements, such as a new professional indemnity insurance policy, can be lodged via a notification.

Navigating the Digital Workflow to Vary Your AFSL

Preparing Your Documentation & Initiating the Transaction

Before you begin your application in the ASIC Regulatory Portal, it is important to conduct a pre-flight check. This initial step helps prevent access issues that can delay your submission, and involves ensuring that:

• your user permissions are correct; and
• your Australian Financial Services AFSL registrations are up to date and properly linked within the portal.

Once you are ready, you can initiate the “Vary AFSL” transaction. The portal will require you to select the type of variation you are making, such as changing your authorisations or amending licence conditions. Make these selections with precision, as the portal’s dynamic questionnaire generates new evidence questions based on your inputs. A carefully considered choice at this stage can minimise unnecessary back-and-forth requisitions from the ASIC.

Uploading Tailored Proofs & Settling Invoices

As you move through the digital workflow, the portal will prompt you to attach specific documentation requested by the dynamic questionnaire. ASIC no longer distinguishes between “core” and “non-core” proofs, and supporting documents are described as People Proofs. However, People Proofs are not necessarily required for every person at the point of lodgement; ASIC may request them for only a subset of fit and proper people during assessment. This process replaces the old MOVEit system and its 10MB file limitation, allowing for a more integrated submission.

After you submit the application, the portal digitally generates an invoice for the required fee. ASIC will not assign your application to an analyst for assessment until this invoice has been paid, and the funds have cleared. You can pay the application fee by BPAY or cheque. Promptly settling this invoice is a critical step to ensure your variation enters the assessment queue without delay.

ASIC may request information or material under Section 914B(3) of the Corporations Act 2001 (Cth). A failure to provide requested information within the period specified by ASIC can result in the application being taken to have been withdrawn under Section 914B(6).

Avoiding the Key Person 5-Day Trap & Lessons for Responsible Managers

Understanding the High-Stakes Five-Day Notification Rule

An AFSL may include a key person condition, which ASIC generally imposes when a licensee is heavily dependent on the competence of one or two specific responsible managers. If a person named under this condition leaves your business or ceases their duties, your compliance arrangements are immediately at risk.

AFS licensees are typically required to notify ASIC in writing within five business days of the date the key person ceases their role, depending on the wording of the actual AFSL condition, as imposed or varied under Section 914A of the Corporations Act 2001 (Cth). There is no general provision in the Corporations Act 2001 (Cth) that imposes a five-business-day notification rule whenever any responsible manager leaves.

Your notification to ASIC must include:

• the date the key person stopped being an officer or performing their duties;
• details of any new responsible manager appointed to replace the key person; and
• if no replacement has been appointed, detailed reasons why.

Case Study: Focused Financial Advice Pty Ltd Licence Suspension

The consequences of failing to comply with a key person condition are not theoretical. In ASIC Media Release 25-293MR, the regulator detailed the suspension of the AFSL held by Focused Financial Advice Pty Ltd.

The company’s key person and responsible manager had ceased their roles, but the licensee failed to notify ASIC within five business days as required by its licence conditions. The business continued to provide financial services for more than two years without a key person in place.

The breach was only identified after ASIC made direct enquiries. Ultimately, this failure led ASIC to suspend the company’s AFSL, providing a clear example of the serious regulatory action that can result from not adhering to key person conditions.

Updating Fit and Proper Information & People Proofs

Automating Fit & Proper Assessments with Digital Background Checks

ASIC must be satisfied, in accordance with Section 913BA of the Corporations Act 2001 (Cth), that the relevant people are fit and proper in the circumstances prescribed by that section. The ASIC Regulatory Portal automates significant parts of the “Fit and Proper Person” assessment for your AFSL variation. This digital process involves real-time cross-referencing of a nominee’s details against police and bankruptcy registries. As a result, the system is designed to flag discrepancies or expired documents instantly.

This automation increases the need for accuracy when providing information for any new responsible manager or officer. Key aspects of the digital background check process include:

• Direct data validation: The portal can verify information against national databases, leaving no room for error.
• Streamlined document submission: You must upload all required “People Proofs,” such as a national criminal history check, directly into the portal.
• Reduced applicant burden: ASIC has removed the need for applicants to provide Australian bankruptcy certificates for fit and proper persons, as the regulator now handles these checks internally.

Because the system has zero tolerance for misclassified or outdated documents, you must ensure every piece of information articulating a nominee’s competence is flawless before submission.

Refreshing Your Business Description & Financials

A variation application is a re-pitch of your business to the regulator, meaning your core proofs must reflect your new operational reality. Your business description and financial-resources evidence should explain how the proposed authorisations can be supported in practice. This includes the operating model, responsible-manager capability, financial resources and risk management relevant to the expanded activities.

This description must also demonstrate that your compliance framework can scale to meet new challenges, such as changing client demographics or the complex legal requirements of the 2026 AML/CTF reforms.

While ASIC now requests financial statements at the “requirements stage” rather than upfront, you must have them prepared.

The NSW Advantage & Localised Support for Sydney Fintechs

Navigating Unique Local Pressures in the Sydney Tech Ecosystem

Operating a financial services business in Sydney can present commercial pressures associated with fundraising, product expansion and hiring. However, this need for speed cannot come at the expense of a sound regulatory strategy. Fintech founders in Sydney must navigate complex pivots and expansions without compromising their compliance arrangements, a common area where legal advice for startups is essential.

Investors may assess whether the business has identified the licensing consequences of its growth plan. The relevant objective is not a “bulletproof” compliance strategy, but an approach that is aligned with applicable licensing obligations and appropriate to the nature, scale, and complexity of the business.

Leveraging Fractional General Counsel for Proactive Risk Management

For scaling Sydney businesses, a Fractional General Counsel model provides on-demand access to high-level institutional knowledge and legal strategy. This approach is designed to match the operational speed that the tech industry demands, without the significant overhead of hiring a full-time general counsel.

This model focuses on proactive risk management, helping founders navigate key challenges, including:

• the realities of ASIC enforcement; and
• the expectations of local investors.

Ultimately, by having a legal partner who understands the Sydney ecosystem, a business can ensure its compliance framework acts as a strategic asset for growth rather than a roadblock.

Conclusion

The shift to the ASIC Regulatory Portal has transformed the AFSL variation process into a strategic re-pitch, requiring businesses to navigate a new digital workflow and provide robust digital proof. Successfully managing this landscape means understanding the critical difference between a variation and a notification and avoiding high-stakes pitfalls like the five-day key person notification trap.

Navigating these changes requires a clear strategy to ensure your compliance framework supports your growth. Contact Click Legal’s AFSL lawyers for a fixed-fee variation audit to gain operational certainty and ensure your business is ready to scale smoothly.

Frequently Asked Questions