Does Your Fintech Need an AFSL & What Are Your AFSL Obligations?

Introduction

A fintech business does not need an Australian Financial Services Licence (AFSL) simply because it operates in financial technology. Whether an AFSL is required depends on what the business does, whether its products are financial products, and whether it provides regulated financial services.

Determining whether your fintech requires an AFSL involves three main questions: whether the business deals with a financial product, whether it provides a financial service, and whether it carries on that financial services business in Australia. In this article, we explain when a fintech may need an AFSL, which business models commonly trigger licensing requirements, and the key ongoing obligations that apply once licensed.

Interactive Tool: Check If Your Fintech Business Needs an AFSL

When Does a Fintech Need an AFSL?

What Is a Financial Product?

Under Section 911A(1) of the Corporations Act 2001 (Cth) (Corporations Act), a person carrying on a financial services business in Australia must hold an AFSL covering those services and products, unless an exemption applies. Section 763A(1) broadly defines a financial product as a facility through which a person:

• makes a financial investment;
• manages financial risk; or
• makes non-cash payments.

Section 764A also identifies specific financial products, including securities, interests in managed investment schemes, derivatives, insurance products, superannuation products, certain deposit products, foreign exchange contracts and margin lending facilities.

For fintechs, the important point is that the technology used to deliver the product does not determine its regulatory classification. The rights, obligations, and functionality of the product must be considered.

Payment products may also fall within the regime. Sections 763A and 763D recognise facilities used to make non-cash payments as financial products, subject to applicable exclusions.

What Counts as Providing a Financial Service?

The next question is what the fintech actually does in relation to the financial product. Under Section 766A(1) of the Corporations Act (Cth), providing a financial service includes activities such as:

• providing financial product advice;
• dealing in a financial product;
• making a market for a financial product;
• operating certain registered managed investment schemes; and
• providing custodial or depository services.

A fintech does not necessarily need to execute a transaction itself to be dealing. Under Section 766C(2), arranging for another person to acquire, issue, vary or dispose of a financial product can itself constitute dealing.

Financial product advice can also arise through digital interfaces. Section 766B(1) covers recommendations or statements of opinion intended, or reasonably regarded as intended, to influence a person’s decision about a financial product or class of financial products.

As a result, an algorithm, questionnaire, comparison tool or recommendation engine may require closer analysis if it influences how users choose or deal with financial products.

When Is a Fintech Carrying on a Financial Services Business in Australia?

Section 911A(1) applies where a person carries on a financial services business in Australia.

An offshore fintech is not automatically outside the Australian licensing regime. Under Section 911D of theCorporations Act (Cth), a financial services business is taken to be carried on in Australia where the business engages in conduct intended, or likely, to induce people in Australia to use its financial services.

An overseas fintech offering its app or platform to Australian customers should therefore consider whether its activities bring it within the AFSL regime.

Fintech Business Models That Commonly Require an AFSL

Investment & Trading Platforms

A platform allowing users to acquire or dispose of shares, derivatives, or other financial products may be dealing in financial products under Section 766C of the Corporations Act (Cth).

This can include arranging for another entity to execute transactions, meaning a fintech does not necessarily avoid licensing simply because trades are ultimately completed by a separate broker.

If the platform also makes recommendations or provides opinions designed to influence investment decisions, financial product advice under Section 766B may also be involved.

Robo-Advisers & Automated Investment Tools

Robo-advice platforms use algorithms and customer information to generate investment recommendations.

Section 766B of the Corporations Act (Cth) does not require financial product advice to come from a human adviser. A recommendation generated automatically may still constitute financial product advice.

Whether the advice is personal or general advice also matters. Under Section 766B(3), advice is personal advice where the provider has considered one or more of the client’s objectives, financial situation or needs, or where a reasonable person might expect those matters to have been considered.

Fintechs collecting detailed customer information before producing automated recommendations should therefore assess the advice classification before launch.

Payment Platforms & Digital Wallets

Some digital wallets and payment platforms may involve a non-cash payment facility and therefore a financial product. The analysis depends on factors such as:

• what rights users have against the provider;
• whether value is stored or transferred;
• how payments are made;
• whether a statutory or regulatory exclusion applies; and
• what services the fintech provides in relation to the facility.

A payments business should therefore not assume that it falls outside the AFSL regime simply because its primary purpose is facilitating transactions rather than investments.

Digital Asset & Crypto Platforms

Digital assets require a product-by-product analysis. The Australian Securities and Investments Commission‘s (ASIC) Information Sheet 225 explains that businesses should assess the rights and benefits attached to a digital asset to determine whether it is a financial product. Where it is, activities such as dealing, financial product advice, market making and custody may constitute financial services.

ASIC’s current sector-wide no-action position for eligible digital asset businesses transitioning to relevant licensing or authorisation arrangements has been extended to 30 September 2026. This is an ASIC enforcement position and does not replace the underlying licensing requirements in the Corporations Act (Cth).

The Corporations Amendment (Digital Assets Framework) Act 2026 (Cth) will also introduce a new framework under the Corporations Act (Cth) for digital asset platforms and tokenised custody platforms from 2027. Digital asset fintechs should therefore distinguish between their current AFSL obligations and the forthcoming regime.

Custody & Asset-Holding Platforms

Section 766A of the Corporations Act (Cth) includes providing a custodial or depository service within the definition of a financial service.

Custody issues can arise where a fintech or related entity holds financial products or relevant rights on behalf of customers. The analysis should focus on who legally controls and holds the assets rather than simply how the arrangement is described commercially.

When Can a Fintech Operate Without Its Own AFSL?

Operating as an Authorised Representative

Not every fintech providing regulated services needs to hold its own AFSL. A common alternative is to operate as an authorised representative of an existing AFSL holder.

Under Section 916A of the Corporations Act (Cth), an AFSL holder can give another person written authority to provide specified financial services on its behalf. However, the authority can only cover services within the principal licensee’s AFSL authorisations.

An authorised representative arrangement therefore does not provide blanket permission for all of a fintech’s activities. The business must remain within the scope of both the representative authority and the principal’s AFSL.

Using a Licensed Intermediary

Section 911A(2)(b) of the Corporations Act (Cth) provides an intermediary authorisation exemption for certain product issuers.

Broadly, an unlicensed product provider may be able to issue, vary or dispose of a financial product under an arrangement where an AFSL holder or its authorised representative makes the relevant offers and arranges the transaction.

The exemption is subject to specific statutory conditions, so the structure must be reviewed carefully rather than assuming that involvement of an AFSL holder automatically removes the licensing requirement.

Technology Providers That Do Not Provide Financial Services

A fintech supplying software, APIs, data infrastructure or other technology to a financial services business may not itself provide a financial service.

There is not necessarily a standalone “technology exemption”. Instead, the question is whether the technology provider’s activities fall within the financial services listed in Section 766A of the Corporations Act (Cth).

The position can change if the fintech begins directly participating in customer onboarding, arranging transactions, making recommendations or controlling customer assets.

What AFSL Authorisations Does Your Fintech Need?

Holding an AFSL does not allow a fintech to provide every financial service. The licence must cover the particular:

• financial services being provided;
• classes of financial products involved; and
• retail and/or wholesale clients served.

For example, an authorisation to provide general financial product advice does not automatically allow a fintech to provide personal advice. Similarly, an advice authorisation does not necessarily permit dealing or arranging transactions.

Fintechs should therefore review their licence authorisations before launching materially new products or functionality.

What Are Your Ongoing AFSL Obligations?

Providing Financial Services Efficiently, Honestly & Fairly

Section 912A(1)(a) of the Corporations Act (Cth) requires an AFSL holder to do all things necessary to ensure the financial services covered by its licence are provided efficiently, honestly and fairly.

For fintechs, this can extend across onboarding, platform operations, transactions, customer communications, complaints, and remediation. Automating these processes does not remove the licensee’s responsibility for how the services are provided.

Managing Conflicts of Interest

Section 912A(1)(aa) of the Corporations Act (Cth) requires adequate arrangements for managing conflicts of interest arising in connection with the financial services business.

For fintechs, conflicts may arise from:

• referral payments or commissions;
• preferential placement of products;
• commercial relationships with product issuers;
• proprietary products appearing on comparison platforms; or
• incentives affecting how products are presented to users.

ASIC’s Regulatory Guide 181 provides regulatory guidance on managing these conflicts, while the legal obligation itself arises from Section 912A(1)(aa).

Maintaining Adequate Resources

Section 912A(1)(d) of the Corporations Act (Cth) requires most AFSL holders to maintain adequate financial, technological and human resources to provide their licensed services and carry out supervisory arrangements.

The express reference to technological resources is particularly relevant to fintechs. Systems, staffing and financial resources should remain appropriate as transaction volumes, customer numbers and product complexity increase.

Maintaining Organisational Competence

Section 912A(1)(e) of the Corporations Act (Cth) requires an AFSL holder to maintain the competence needed to provide its licensed financial services. Section 912A(1)(f) also requires representatives to be adequately trained and competent.

ASIC assesses organisational competence partly through responsible managers and the knowledge and experience relied upon by the licensee.

A fintech moving into new financial products or services should therefore consider whether its existing competence arrangements remain appropriate.

Supervising Representatives

Under Section 912A(1)(ca) of the Corporations Act (Cth), an AFSL holder must take reasonable steps to ensure its representatives comply with the financial services laws.

Outsourcing functions or appointing representatives therefore does not remove the licensee’s compliance responsibilities. Appropriate monitoring, escalation and oversight arrangements remain necessary.

Maintaining Adequate Risk Management Systems

Section 912A(1)(h) of the Corporations Act (Cth) requires most AFSL holders to maintain adequate risk management systems.

For fintech businesses, relevant risks may include:

• technology failures;
• errors in automated processes;
• fraud or unauthorised transactions;
• third-party provider failures;
• customer harm;
• cyber incidents; and
• operating outside AFSL authorisations.

The legislation does not prescribe one universal framework. What is adequate depends on the nature, scale and complexity of the business.

Complaints, AFCA & Compensation Arrangements

Additional obligations apply where financial services are provided to retail clients. Under Sections 912A(1)(g) and 912A(2) of the Corporations Act (Cth), relevant licensees must have:

• an internal dispute resolution procedure meeting applicable ASIC standards; and
• membership of the Australian Financial Complaints Authority (AFCA).

Section 912B also requires licensees providing financial services to retail clients to maintain arrangements for compensating clients for relevant loss or damage in accordance with the statutory requirements.

Breach Identification & Reporting

AFSL holders also need processes for identifying potential reportable situations.

Section 912D of the Corporations Act (Cth) defines reportable situations, including certain significant breaches or likely significant breaches of core obligations, extended investigations, gross negligence and serious fraud.

Where there are reasonable grounds to believe a reportable situation has arisen, Section 912DAA requires a report to ASIC. Under Section 912DAA(3), it must generally be lodged within 30 days after the licensee first knows, or is reckless whether, there are reasonable grounds to believe the situation has arisen.

For fintechs, technology incidents should therefore be assessed for both operational and potential regulatory consequences.

Additional Obligations for Fintechs Serving Retail Clients

Serving retail clients can materially increase a fintech’s obligations. In addition to dispute resolution and compensation requirements, Section 941A of the Corporations Act (Cth) generally requires an AFSL holder providing financial services to a retail client to provide a Financial Services Guide, subject to statutory exceptions.

Depending on the products and services involved, obligations relating to financial product disclosure, advice, and product distribution may also apply.

Importantly, serving only wholesale clients does not automatically remove the need for an AFSL. Section 911A(1) is not limited to retail financial services.

AFSL Compliance Risks for Fintech Businesses

Launching New Features Without Reviewing AFSL Authorisations

A fintech can hold an AFSL and still operate outside its licence if new functionality is not covered by its existing authorisations.

New recommendation engines, transaction functionality, payment services or custody arrangements should therefore trigger a regulatory review before launch.

Assuming Technology Falls Outside Financial Services Regulation

Software, automation, AI, or blockchain does not itself determine whether an activity is regulated.

The statutory tests focus on the actual financial product and service involved. A technology-enabled activity may still constitute advice, dealing, arranging or custody.

Relying Too Broadly on Another Entity’s AFSL

Working with an AFSL holder does not automatically cover every activity undertaken by a fintech.

An authorised representative can only provide the financial services specified in its authority and covered by the principal’s AFSL. Similarly, statutory intermediary exemptions only apply where their specific conditions are satisfied.

Failing to Integrate Compliance Into Product Systems

For fintechs, compliance should be embedded into operational workflows rather than existing only in policies.

Relevant controls may need to be reflected in:

• customer onboarding;
• transaction processes;
• disclosure delivery;
• complaints handling;
• monitoring;
• incident escalation; and
• breach reporting.

When Should Your Fintech Review Its AFSL Position?

A fintech should consider reviewing its licensing position when it:

• launches a new financial product or service;
• adds investment recommendations or comparison functionality;
• changes an algorithm affecting customer recommendations;
• starts arranging or executing transactions;
• begins holding customer assets;
• introduces new wallet or payment functionality;
• expands into digital assets;
• moves from wholesale to retail customers;
• changes an authorised representative or distribution arrangement; or
• enters the Australian market from overseas.

These changes can affect both whether an AFSL is required and whether existing AFSL authorisations remain sufficient, so fintechs may benefit from advice from AFSL lawyers on licensing and authorisation reviews.

Conclusion

Whether a fintech needs an AFSL depends on the legal substance of its products and activities—not simply on whether it identifies as a technology business.

Under Section 911A of the Corporations Act (Cth), a business carrying on a financial services business in Australia must generally hold an AFSL covering those services, unless an exemption applies. Fintechs should therefore map their products, services, and customer interactions against the financial services framework before launch and whenever their business model changes.

Once licensed, ongoing compliance is equally important. Click Legal’s AFSL lawyers for fintech businesses can help fintech businesses assess AFSL requirements, scope licence authorisations, review authorised representative or intermediary structures, and establish compliance arrangements appropriate to the nature and scale of the business.

Frequently Asked Questions