Click Legal

Common AFSL Variation Triggers: A Detailed Guide for AFS Licensees

Hannah Deuk — Wed, 02 Sep 2026 06:51:34 +0000

Introduction

An Australian Financial Services Licence (AFSL) can become too narrow without a fundamental change to the business. A new advice model, financial product, retail offering, fund structure or platform feature may introduce financial services that fall outside the authorisations or conditions on the existing licence.

The key question is therefore whether the proposed activity still fits within the precise scope of the current AFSL. In this article, we explain the most common AFSL variation triggers and the less obvious business changes that should prompt a licence-scope review.

Interactive Tool: See If Your Business Changes Need an AFSL Variation

AFSL Variation Trigger Checker

Quickly check if your business changes require an AFSL variation under the Corporations Act.

Are you planning to offer a new financial service or expand into a new product class?

Will you be changing your client type (e.g., from wholesale to retail clients)?

Are you changing your business model or adding new regulated activities (e.g., market making, custodial services, claims handling)?

Are there any key person or express licence conditions that may be affected by recent or planned changes?

⚠️ Likely AFSL Variation Required

Your planned changes are likely to trigger a need for an AFSL variation.

Under Section 914A(2)(b) and Section 914A(6) and Section 914A(7) of the Corporations Act 2001 (Cth), expanding into new financial services, product classes, client types, or changing key person conditions generally requires ASIC approval before you proceed. Operating outside your current licence authorisations can result in serious compliance breaches.

We recommend seeking legal advice before implementing these changes.

Section 914A(2)(b) of the Corporations Act 2001 (Cth)
Section 914A(6) of the Corporations Act 2001 (Cth)
Section 914A(7) of the Corporations Act 2001 (Cth)

Speak to an AFSL lawyer about your variation

⚖️ Review Your Licence Conditions

Your changes may not automatically require a variation, but a detailed review of your AFSL conditions is strongly advised.

Some changes, such as internal business restructures or adding authorised representatives, may only require ASIC notification. However, if the underlying activities or client types are affected, a variation could still be necessary. Always compare your proposed activities against the precise wording and conditions of your current AFSL.

Section 914A(2)(b) of the Corporations Act 2001 (Cth)
Section 766A(1) of the Corporations Act 2001 (Cth)

Get AFSL legal advice before proceeding

✅ No Immediate Variation Required

Your answers suggest no immediate AFSL variation is required.

However, you must continue to monitor your business for any future changes that could affect your licence scope. Regularly reviewing your AFSL conditions and compliance framework is best practice. If in doubt, seek legal advice to confirm your position.

Section 914A(2)(b) of the Corporations Act 2001 (Cth)

Request an AFSL compliance review from our lawyers

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

The Core AFSL Variation Trigger

Under Section 914A(6) of the Corporations Act 2001 (Cth) ('Corporations Act'), the Australian Securities and Investments Commission (ASIC) must ensure an AFSL is subject to a condition specifying the financial services or classes of financial services the licensee is authorised to provide. Under Section 914A(7), those services may be specified by reference to particular financial products or classes of products.

Under Section 914A(2)(b), ASIC may impose, vary or revoke licence conditions on application by the licensee. ASIC describes the practical trigger similarly: if a business changes so that its AFSL needs to cover additional financial services or products, it needs to apply for a variation.

A new product, client segment or commercial change does not therefore automatically require a variation. The issue is whether the proposed activity remains within the existing licence authorisations and conditions.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Changes to Financial Services and Client Scope

Adding a New Type of Financial Service

One of the clearest variation triggers is moving into a new financial service that is not already authorised. Under Section 766A(1) of the Corporations Act, financial services include:

providing financial product advice;
dealing in financial products;
making a market;
operating a registered managed investment scheme;
operating the business and conducting the affairs of a CCIV;
providing custodial or depository services;
providing crowd-funding services;
providing claims handling and settling services; and
providing a superannuation trustee service.

An authorisation to provide one financial service does not automatically authorise another. For example, authority to provide financial product advice does not itself authorise issuing or otherwise dealing in the relevant product.

A variation review is therefore appropriate whenever the business moves into a different regulated function.

Expanding From General to Personal Advice

A change in the advice model can create a variation trigger even where the financial product does not change.

Under Section 766B of the Corporations Act, financial product advice is personal advice where the provider has considered—or a reasonable person might expect the provider to have considered—one or more of the client's objectives, financial situation or needs. Financial product advice that is not personal advice is general advice.

ASIC's Regulatory Guide (RG) 244 confirms that advice authorisation is restricted to general advice only. A licensee subject to that restriction will therefore need broader authority before providing personal advice.

This can arise unintentionally where a digital advice journey, adviser conversation or client questionnaire becomes increasingly personalised. The substance of the service should therefore be assessed rather than relying on its existing label.

Expanding Dealing Activities

Changes to a licensee's role in transactions can also move it outside its existing dealing authority.

Under Section 766C(1) of the Corporations Act, dealing can include applying for or acquiring, issuing, underwriting, varying or disposing of a financial product. Under Section 766C(2), arranging for another person to engage in relevant dealing conduct is also itself dealing, subject to the qualifications in that section.

The licensing framework nevertheless allows applicants to select different dealing activities, including whether they will deal directly or arrange for another person to deal, together with relevant dealing subtypes. Potential variation triggers can therefore include moving from:

arranging transactions to dealing directly;
distribution into issuing a financial product;
acquiring or disposing on behalf of clients into underwriting; or
an otherwise limited dealing authority into a broader transaction role.

The actual wording of the licence remains critical: some AFSLs already contain sufficiently broad dealing authority, while others are expressly restricted.

Moving From Wholesale to Retail Clients

A change in client type can also trigger a variation. AFSL authorisations may be restricted to wholesale clients only, and the legal framework permits relevant authorisations to be selected for retail clients, wholesale clients or both.

A wholesale-only licensee that proposes to provide the relevant financial services to retail clients may therefore require a variation before doing so.

Moving into retail can also engage additional obligations concerning disclosure, dispute resolution, compensation arrangements, advice conduct and product governance. The licence and broader compliance framework should therefore be reviewed before marketing or onboarding begins.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Changes to Financial Products and Fund Structures

Adding a New Financial Product Class

An AFSL may authorise a financial service only in relation to specified financial products. For example, a licensee may be authorised to advise on or deal in securities and managed investment scheme interests but not derivatives, foreign exchange contracts or non-cash payment facilities.

As noted above, Section 914A(7) of the Corporations Act permits licence conditions to define authorised services by reference to particular financial products or classes. Moving into a product class outside the existing AFSL is therefore a common variation trigger.

This can arise when a business expands into:

derivatives or foreign exchange contracts;
interests in managed investment schemes;
non-cash payment facilities;
regulated emissions units; or
digital assets that are financial products under the existing Chapter 7 framework.

However, a new commercial product does not necessarily require a new AFSL product authorisation. For example, that an unrestricted derivatives authorisation may already cover derivatives over regulated emissions units, while a general custodial or depository authorisation applies across financial product types.

The correct analysis is therefore to compare the proposed product with the precise scope and restrictions of the existing AFSL.

Becoming the Responsible Entity of a Registered Scheme

Under Section 601FA of the Corporations Act, the responsible entity of a registered managed investment scheme must be a public company holding an AFSL authorising it to operate a managed investment scheme.

ASIC's licensing framework permits registered-scheme operating authorisations to be limited to a named scheme or to schemes of a particular asset kind. An existing licensee may therefore need a variation where it:

becomes a responsible entity for the first time;
proposes to operate a scheme outside its existing named-scheme or asset-kind authority; or
requires additional dealing or advice authorisations for activities associated with the scheme.

Importantly, ASIC states in RG 1.59(d) that a responsible entity will generally not need a separate custodial or depository authorisation merely to hold scheme property because of the exception in Section 766E(3)(b). Separate custody activities outside that exception require their own analysis.

The proposed fund structure and associated services should therefore be mapped against the AFSL before launch or appointment as responsible entity.

Becoming the Corporate Director of a CCIV

Operating a Corporate Collective Investment Vehicle (CCIV) has a separate AFSL requirement. Under Section 1224F of the Corporations Act, the corporate director of a CCIV must be a public company holding an AFSL authorising it to operate the business and conduct the affairs of the CCIV.

Therefore, an existing AFS licensee must apply to vary its licence to obtain the required CCIV authorisation before it can be appointed as corporate director. An existing managed investment scheme authorisation does not, by itself, establish that the separate CCIV authority is held.

Expanding Restricted Authorisations

A variation may also be necessary even where the relevant financial service and broad product class already appear on the licence. ASIC's current application framework permits, for example, derivatives and foreign exchange advice and dealing authorisations to be restricted to hedging purposes only.

Other restrictions may limit a licensee to:

particular named managed investment schemes;
particular client categories;
specific dealing activities; or
another expressly limited service or product authority.

The complete licence conditions should therefore be reviewed rather than relying only on the high-level financial service or product description.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Specialist Business Model Changes

A variation review should also occur where new functionality changes the regulatory role performed by an existing business.

Examples include:

a platform beginning to hold financial products for clients, potentially introducing custodial or depository services under Section 766E of the Corporations Act;
an insurance business or service provider beginning regulated claims handling and settling activities under Section 766G;
a distributor beginning to quote buy and sell prices in circumstances potentially amounting to market making under Section 766D; or
a technology platform adding a payment or investment feature that constitutes a new financial product or financial service.

These changes can be overlooked because the business views them as new "features" rather than changes to its regulated activities. The licence analysis should focus on what the business will actually do after implementation.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Changes to Existing Licence Conditions

Key Person Conditions

Not every variation arises from a new financial service or product. ASIC may impose a key person condition where a licensee materially depends on one or more responsible managers for its organisational competence.

Where a responsible manager named in that condition leaves, ASIC's RG 1.177 states that the licensee must apply to vary its AFSL. The example accompanying RG 1.177 requires the variation application within five business days of the key person ceasing to be an officer or perform duties for the licensee.

This should be distinguished from an ordinary responsible-manager change. ASIC currently requires changes to responsible managers to be notified within 10 business days. Where the departing responsible manager is also a named key person, the responsible-manager notification and licence-condition variation both need to be addressed.

Other Express Licence Restrictions

An AFSL may contain other conditions specific to the licensee.

Where a proposed business model is inconsistent with an express condition, the licensee may need to seek its variation or removal under Section 914A(2)(b) of the Corporations Act rather than simply changing its internal arrangements.

This is another reason to review the complete licence, not just its headline authorisations, before implementing a material business change.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Corporate and Administrative Changes: Notification or Variation?

Some corporate or administrative events do not themselves require an AFSL authorisation variation but can reveal a separate licence-scope issue. Examples include:

acquiring or integrating another financial services business;
changing control of the AFSL holder;
appointing or removing a responsible manager;
appointing an authorised representative; or
changing business details.

These events may be dealt with through separate ASIC notification or approval processes. However, the underlying business change may independently require a licence variation.

For example, acquiring another business does not itself expand an AFSL. If the combined business will provide financial services, products or services to client categories outside the existing licence, that expansion must be considered separately.

Similarly, an authorised representative cannot be authorised by the licensee to provide financial services outside the scope permitted by the licensee's own AFSL.

The corporate event and the licence-scope question should therefore be analysed separately.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Common AFSL Variation Trigger Mistakes

The most significant mistakes generally involve assuming an AFSL is broader than its actual conditions. Common examples include:

treating a new product as covered because it resembles an existing one;
overlooking distinctions between advice, different dealing activities, market making and custody;
providing personal advice under a general-advice-only authority;
servicing retail clients under wholesale-only authorisations;
overlooking hedging-only, named-scheme or other express restrictions; and
launching a new activity because a variation application has already been lodged.

A pending variation application does not itself expand the AFSL. Until ASIC varies the relevant conditions, the licensee must continue operating within its existing authority.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

AFSL Variation Trigger Review

Before approving a new product, service or business model, an AFS licensee should ask:

Financial service: Is the business providing the same financial service as before?
Financial product: Does the existing licence cover the relevant product or product class?
Activity scope: Has the advice, dealing or other regulated function changed?
Client type: Will the activity involve retail clients where the existing authority is restricted?
Licence conditions: Do any key person, hedging, scheme-specific or other conditions restrict the proposed activity?
Organisational competence: Do the licensee's responsible managers collectively have appropriate competence for the expanded authorisations?

ASIC's variation process also requires the applicant to identify the additional authorisations sought and provide information supporting its capacity to provide the relevant financial services or products. Organisational competence must continue to cover the services authorised by the licence.

Existing licensees can use Click Legal's free AFSL Compliance Checklist when reviewing whether their licence scope and compliance framework remain aligned with their business.

For a broader overview of the obligations supporting AFSL authorisations, see Click Legal's AFSL Compliance Guide – Core Obligations for AFS Licensees.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Conclusion

The most common AFSL variation triggers arise when a licensee moves beyond the financial services, financial products, client types or restrictions already covered by its licence conditions. New advice models, transaction roles, retail clients, product classes, fund structures and specialist services can all change the licensing position.

The best time to identify a trigger is during product or business planning. Comparing the proposed operating model with the actual AFSL before launch can establish whether the change is already covered or whether ASIC approval is required first; if you need help with that assessment, contact Click Legal for AFSL compliance services and a pre-launch licence-scope review.

Frequently Asked Questions

Does launching a new product always require an AFSL variation?

No. A variation is required only where the financial services or products associated with the offering fall outside the existing AFSL conditions. A new commercial product may already fall within existing authorisations.

Does moving from general advice to personal advice require a variation?

It can. If the existing AFSL is restricted to general advice, broader authority is required before the licensee provides personal advice.

Does adding retail clients require an AFSL variation?

Where the relevant authorisation is restricted to wholesale clients, generally yes. Moving into retail clients can also introduce additional disclosure and other retail-client obligations.

Does adding a new financial product class require a variation?

Generally, where the existing AFSL does not cover that product class. The precise licence wording should still be checked because some authorisations are broad enough to cover additional products.

Does becoming a responsible entity require a variation?

As explained above, Section 601FA requires the responsible entity to hold an AFSL authorising it to operate a managed investment scheme. Whether an existing licensee needs a variation depends on whether its current operating authority already covers the proposed scheme.

Does becoming a CCIV corporate director require an AFSL variation?

Yes, unless the existing AFSL already contains the required CCIV authority (see discussion of Section 1224F above).

Does adding a responsible manager require an AFSL variation?

Not ordinarily. Responsible-manager changes are generally notified separately, but a variation is also required where the change affects a key person condition on the licence.

Does acquiring another financial services business automatically require a variation?

No. The acquisition itself is not the variation trigger. A variation may be required if the combined business will provide financial services, products, or services to client categories outside the existing AFSL.

Can a licensee start a new activity after lodging its variation application?

Not merely because the application has been lodged. The licensee must remain within its existing AFSL conditions until the required variation takes effect.

AFSL Variation, ASIC Notification or New Licence: Which One is Right for You?

Hannah Deuk — Wed, 02 Sep 2026 06:45:53 +0000

Introduction

An Australian Financial Services Licence (AFSL) needs to remain aligned with the business operating under it. Adding a financial product, expanding into retail clients, changing responsible managers, bringing in a new controller or restructuring into another company can all affect the licensing position—but they do not require the same regulatory response.

Depending on the change, the business may need to vary its existing AFSL conditions, notify the Australian Securities and Investments Commission (ASIC), or obtain a new AFSL for a different legal entity. In some cases, more than one pathway applies at the same time. In this article, we explain the distinction and how AFS licensees should assess material business changes before implementing them.

Interactive Tool: Check If Your Business Change Needs a Variation, Notification, or New Licence

AFSL Change Pathway Checker

Unsure if you need to vary your AFSL, notify ASIC, or apply for a new licence? Answer a few questions to identify your next regulatory step.

What is the main change your business is planning?

Will the same legal entity remain the AFSL holder after the change?

Is there a key person condition or change in control involved?

✅ AFSL Variation Required

You will need to apply to ASIC to vary your AFSL before providing the new service or product.

Under Section 914A(2)(b) of the Corporations Act 2001 (Cth), licensees must apply for a variation if they wish to expand their authorisations. ASIC will assess your organisational competence, responsible managers, and compliance systems as part of the process.

Tip: Do not commence the new activity until the variation is approved.

Legal References

Section 914A(2)(b) of the Corporations Act 2001 (Cth)
Section 914A(6)-(7) of the Corporations Act 2001 (Cth)
Section 914B of the Corporations Act 2001 (Cth)

Speak to a lawyer about your AFSL variation

⚠️ ASIC Notification Required

You must notify ASIC of changes to responsible managers, controllers, or authorised representatives within the statutory timeframes.

For responsible managers and licence details, notification must be lodged within 10 business days (Regulation 7.6.04(1)(b) of the Corporations Regulations 2001 (Cth)). For changes in control, both Section 912DA (30 business days) and Regulation 7.6.04(1)(i) (10 business days) may apply.

Note: Notification does not expand your licence authority.

Legal References

Regulation 7.6.04(1)(b) of the Corporations Regulations 2001 (Cth)
Section 912DA of the Corporations Act 2001 (Cth)
Regulation 7.6.04(1)(i) of the Corporations Regulations 2001 (Cth)
Section 916F of the Corporations Act 2001 (Cth)

Get legal advice on ASIC notifications

❌ New AFSL Application Required

A new AFSL is required if a different legal entity will carry on the financial services business.

Under Section 911A(1) and Sections 913A–913BB of the Corporations Act 2001 (Cth), each person or entity must hold its own AFSL unless an exemption applies. Transferring business activities to another company without a new AFSL is a breach of the law.

Legal References

Section 911A(1) of the Corporations Act 2001 (Cth)
Sections 913A–913BB of the Corporations Act 2001 (Cth)
Section 913B(1) of the Corporations Act 2001 (Cth)

Get legal advice on new AFSL applications

⚖️ No Variation Required (Ongoing Compliance)

If your new product or service is already fully covered by your existing AFSL authorisations, a variation is not required. However, you must ensure ongoing compliance with all licence conditions and obligations under Section 912A of the Corporations Act 2001 (Cth).

Tip: Review your compliance framework regularly, especially after any business change.

Legal References

Section 912A of the Corporations Act 2001 (Cth)

Get AFSL compliance advice from a lawyer

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Comparing AFSL Variation, Notification, and New Licence

The starting point is to identify what is changing and which legal entity will provide the financial services.

An AFSL variation is generally required where an existing licensee needs its licence conditions changed—for example, to add financial services, financial product classes or retail authorisations not already covered.

An ASIC notification generally applies where the underlying licence authority remains adequate but ASIC must be told about a prescribed change, such as a responsible manager, controller, authorised representative or registered licence detail.

A new AFSL will generally be required where a different person will carry on the financial services business and that person does not have another lawful licensing basis, such as an authorised representative arrangement or exemption.

The critical distinction is that notification does not expand licence authority. Telling ASIC that the business has changed does not authorise a financial service that falls outside the existing AFSL.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Understanding AFSL Variations

Changes to AFSL Authorisations and Conditions

Under Section 914A(6) of the Corporations Act 2001 (Cth) (‘Corporations Act‘), every AFSL must contain a condition specifying the financial services or classes of financial services the licensee is authorised to provide. Under Section 914A(7), those services may be specified by reference to particular financial products or classes of products.

In terms of Section 914A(2)(b), the licensee can apply for ASIC to impose, vary or revoke licence conditions. This is the statutory mechanism ordinarily used where a licensee wants to expand or change its AFSL authorisations.

A variation may therefore be required where the licensee proposes to:

add financial product advice where its existing authority only covers dealing;
add another financial product class;
move beyond a wholesale-only licence into relevant retail authorisations;
add custodial or depository services;
add or change managed investment scheme authorisations; or
provide another financial service outside its existing licence conditions.

If the proposed service is already fully covered by the AFSL, a variation is not required merely because the licensee launches a new commercial product.

Other Licence Condition Changes

Variations are not limited to financial service and product authorisations.

A common example is the key person condition. As per ASIC’s Regulatory Guide (RG) 105, if the licence identifies a particular responsible manager as a key person and that individual leaves, notifying ASIC of the responsible manager change does not remove the licence condition. In that situation, the licensee is required to first notify the responsible manager change and then apply to vary the AFSL to change or remove the key person condition. A single business event can therefore require both notification and variation.

For completeness, Section 915A of the Corporations Act deals separately with ASIC varying an AFSL to reflect a change in the licensee’s name. It should not be treated as the primary statutory basis for applications to add licence authorisations.

ASIC’s Assessment of a Variation

Under Section 914B of the Corporations Act, ASIC can refuse a variation application where the fit and proper person requirement in Section 913BA is not satisfied in relation to the licence as proposed to be varied. ASIC can also request specified information, audit reports or statements during the assessment.

Separately, ASIC’s RG 1 explains the evidence ASIC expects when assessing a variation. Where new authorisations are sought, this may require additional information about responsible manager competence and the systems supporting the expanded business.

The practical point is that a variation is not simply an administrative update. Where the business expands materially, ASIC may test whether the existing licensing framework can support the new activities.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

What are ASIC Notifications

Licence Details and Responsible Managers

Under Regulation 7.6.04(1)(b) of the Corporations Regulations 2001 (Cth) (‘Corporations Regulations‘), an AFSL is subject to a condition requiring changes to matters recorded on the AFS licensee register to be lodged with ASIC within 10 business days.

ASIC applies this 10-business-day notification process to matters including licence details and changes involving responsible managers.

There is an important legal distinction regarding responsible managers. Section 912A(1)(e) of the Corporations Act requires an AFS licensee to maintain competence to provide the financial services covered by its licence. The Corporations Act does not itself establish “responsible manager” as a separate statutory office. Rather, ASIC uses responsible managers through its RG 105 to assess how the licensee satisfies that statutory competence obligation.

A responsible manager change therefore requires more than updating a name. The licensee should ensure its remaining and replacement responsible managers collectively continue to cover all relevant services and products.

Changes in Control

A share sale or acquisition affecting the AFSL holder can trigger separate change-of-control requirements.

Under Section 912DA of the Corporations Act, if an entity starts or stops controlling an AFS licensee, the licensee must notify ASIC within 30 business days after the control change occurs. Non-compliance with Section 912DA(1) is a strict liability offence.

There is also a shorter licence condition in Regulation 7.6.04(1)(i) of the Corporations Regulations requiring the licensee, once it becomes aware of a change in control, to notify ASIC within 10 business days. Both provisions remain in the regulatory framework.

Practically, a licensee should therefore work to the shorter deadline once aware of the change, while ensuring the Section 912DA 30-business-day statutory deadline is also met.

“Control” is broader than a simple majority shareholding. Under Section 910B, it can include control over voting rights, board composition or the outcome of decisions concerning the licensee’s financial and operating policies.

A change in ownership does not automatically require a new AFSL if the same legal entity remains the licensee. However, controllers and relevant officers are included within the Section 913BA fit and proper person test, and ASIC can suspend or cancel a licence under Section 915C(1)(b) if that test is no longer satisfied.

Authorised Representative Changes

Authorised representative appointments are generally notification matters rather than AFSL variations.

Under Section 916F of the Corporations Act, the licensee must notify ASIC about relevant authorised representative appointments and changes. Regulation 7.6.04AA of the Corporations Regulations modifies the statutory notification periods so that the relevant period is generally 30 business days.

However, the authorised representative can only be authorised for financial services that the underlying AFSL covers. An appointment cannot be used to expand the licensee’s own authorisations.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Filing a New AFSL Application

Moving the Business to Another Legal Entity

A new licence issue commonly arises during corporate restructures. Under Section 911A(1) of the Corporations Act, the person carrying on a financial services business in Australia must generally hold an AFSL covering those services unless a relevant exemption applies.

An AFSL is granted to the particular applicant under Sections 913A and 913B. The fact that another company in the same group holds an AFSL does not itself authorise a separate entity to carry on the financial services business.

For example, if Company A currently holds the AFSL but a restructure moves the client contracts and regulated activities into Company B, Company B needs its own lawful licensing basis before carrying on those services. That may involve:

obtaining its own AFSL;
becoming an appropriately authorised representative; or
relying on another valid statutory exemption.

By contrast, if the shares in Company A are sold but Company A continues to provide the financial services, the issue is generally one of change in control, not an automatic requirement for a replacement AFSL.

ASIC’s Assessment of a New Licence

A new AFSL application is governed by Sections 913A–913BB of the Corporations Act.

Under Section 913B(1), ASIC must not grant the licence unless, among other things, the application complies with Section 913A, ASIC has no reason to believe the applicant is likely to contravene the obligations that would apply under Section 912A, and the Section 913BA fit and proper person test is satisfied.

This is generally a broader assessment than a targeted variation application because ASIC is assessing a new person’s suitability to hold the licence, rather than changing specified conditions on an existing licence.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Common Business Changes and the Appropriate Pathway

In practical terms:

New service outside existing AFSL scope: variation before providing the service.
New product already within existing authorisations: potentially no variation, but ongoing compliance implications should still be assessed.
Move from wholesale-only to relevant retail services: usually variation plus implementation of applicable retail-client obligations.
Responsible manager change: notification; also vary the AFSL if a key person condition is affected.
New controller but same licensed entity: change-of-control notification, not automatically a new AFSL.
Financial services business moved to another group company: new licence or another valid licensing pathway for that entity.
New authorised representative: notification, provided the existing AFSL already covers the services.

The correct answer can therefore involve more than one regulatory action, so it may be wise to speak with AFSL lawyers before proceeding.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Common AFSL Change Management Mistakes

The most common problems arise when the commercial change happens before the licensing analysis.

These include:

treating every change as a notification;
assuming notifying ASIC expands the licence;
commencing a new regulated service while a variation application is pending;
assuming an AFSL automatically follows a business into another group company;
overlooking a key person condition after a responsible manager leaves;
applying only the 30-business-day change-of-control deadline and overlooking the shorter licence condition;
appointing an authorised representative for services outside the underlying AFSL; and
failing to reassess organisational competence when new authorisations are added.

Where a licensee has already operated outside its existing AFSL, another issue may arise. If the conduct constitutes a reportable situation within Sections 912D and 912DAA of the Corporations Act may separately require a report to ASIC. Lodging a variation application does not retrospectively authorise the earlier conduct.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

AFSL Change Management Process

Before implementing a material business change, AFS licensees should:

Identify the operating legal entity. Confirm which entity will actually contract with clients and provide the regulated financial services.
Map the activity against the current AFSL. Check the financial service, financial product class, client type and any special licence conditions.
Identify separate notifications. Consider responsible managers, controllers, authorised representatives and register details independently.
Review organisational competence and compliance systems. New authorisations may require additional responsible manager coverage, resources, disclosure, risk controls or supervisory arrangements.
Complete any necessary approval before commencing the activity. A pending variation or new AFSL application does not itself authorise the proposed service.

Existing licensees can use Click Legal’s free AFSL Compliance Checklist when reviewing whether their licence and compliance framework remain aligned with the business.

For a broader review of ongoing licence obligations, see Click Legal’s free AFSL Compliance Guide – Core Obligations for AFS Licensees.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Conclusion

Whether a business change requires an AFSL variation, ASIC notification or new licence depends primarily on what is changing, which entity will provide the financial services and whether the existing licence already covers those activities.

Notification tells ASIC about a prescribed change but does not expand licence authority. A variation changes the conditions of an existing AFSL. A new licence—or another lawful licensing pathway—is needed where a different person will carry on the financial services business. Working through those questions before a launch, acquisition, or restructure can prevent the business from inadvertently operating outside its authority. Contact Click Legal’s AFSL lawyers for licensing and compliance advice.

Frequently Asked Questions

Does every new financial product require an AFSL variation?

No. If the existing AFSL already covers the relevant financial service, product class and client type, a variation may not be necessary. The licensee should still assess whether the product changes its competence, resources or other ongoing obligations.

Can a licensee provide a new service while its AFSL variation is pending?

Not if the existing AFSL does not already authorise that service and no other lawful exemption applies. Lodging the variation application does not itself expand the licence.

Does changing a responsible manager require an AFSL variation?

Usually the responsible manager change is a notification matter. A variation may also be required if the person is named in a key person licence condition.

Is a responsible manager a statutory office under the Corporations Act?

No. The statutory obligation is the organisational competence requirement in Section 912A(1)(e) of the Corporations Act. ASIC uses responsible managers under RG 105 as its framework for assessing how a licensee demonstrates that competence.

Does a change in ownership require a new AFSL?

Not automatically. If the same legal entity remains the licensee, the change generally triggers the change-of-control requirements rather than replacing the existing AFSL.

What is the deadline for notifying ASIC of a change in control?

Section 912DA of the Corporations Act requires notification within 30 business days after the control change occurs. A separate licence condition in Regulation 7.6.04(1)(i) of the Corporations Regulations requires notification within 10 business days after the licensee becomes aware of the change, so the shorter timeframe should also be accounted for.

Can an AFSL be moved to another company in the same corporate group?

A related company is not authorised merely because another group entity holds the AFSL. If it will carry on the financial services business, it needs its own appropriate licensing basis.

Does appointing an authorised representative require an AFSL variation?

Generally not if the existing AFSL already covers the relevant services. The appointment must instead satisfy the authorised representative regime and ASIC notification requirements.

Where are AFSL variations and key notifications lodged?

ASIC currently uses the ASIC Regulatory Portal for AFSL variation applications and key licensee changes, including responsible manager and change-of-control notifications.

Non-Cash Payment (NCP) Facilities: A Complete AFSL Guide for Australian Fintech & Payment Platforms

Hannah Deuk — Wed, 02 Sep 2026 06:40:53 +0000

Introduction

Digital wallets, payment apps, remittance platforms, stablecoin products and embedded payment features can all bring a fintech within Australia’s financial services licensing regime. The key question is not the technology being used, but whether the arrangement allows a person to make payments without physically delivering cash.

Where a payment arrangement is a non-cash payment (NCP) facility, providing financial services in relation to it can require an Australian Financial Services Licence (AFSL), unless an exclusion or specific relief applies. In this article, we explain how NCP facilities are regulated, which fintech models are commonly affected, the main exclusions and ASIC relief available, and what payment businesses should review before launching or changing a product.

Interactive Tool: Check If Your Payment Product Needs a Financial Services Licence

Non-Cash Payment (NCP) Facility Regulatory Checker

Quickly assess if your fintech or payment platform may be regulated as a Non-Cash Payment (NCP) facility under Australian law.

Step 1 of 3

Does your product or platform allow users to make payments without physically delivering cash (including digital wallets, payment apps, or crypto)?

Step 2 of 3

Can users make payments to more than one merchant, user, or third party using your product?

Step 3 of 3

Does your product meet ALL of the following: (a) No user can hold more than $1,000 at any time; (b) Total value across all users does not exceed $10 million; (c) The facility is not part of another financial product?

✅ Not an NCP Facility

Based on your answers, your product does not appear to be a Non-Cash Payment (NCP) facility under Section 763D of the Corporations Act 2001 (Cth). However, you should review your business model with a legal professional before launching, as regulatory positions can change.

Citation: Section 763D of the Corporations Act 2001 (Cth)

Speak to a Lawyer about your product structure

⚖️ Single-Payee Exclusion May Apply

Your product may be excluded from NCP regulation if it only allows payments to a single payee, under Section 763D(2)(a)(i) of the Corporations Act 2001 (Cth). Carefully review your legal structure, as adding more payees or merchants can remove this exclusion.

Citation: Section 763D(2)(a)(i) of the Corporations Act 2001 (Cth)

Get Legal Advice on NCP exclusions

⚖️ Low-Value NCP Facility Relief May Apply

Your product may qualify for ASIC’s low-value NCP facility relief under Section 10 of ASIC Corporations (Non-cash Payment Facilities) Instrument 2026/167. This provides reduced licensing and disclosure obligations, but you must strictly comply with all conditions or risk losing relief.

Citation: Section 10 of ASIC Corporations (Non-cash Payment Facilities) Instrument 2026/167

Speak to a Lawyer about ASIC relief conditions

❌ AFSL Likely Required

Your product is likely regulated as a Non-Cash Payment (NCP) facility and will generally require an Australian Financial Services Licence (AFSL) under Section 911A(1) of the Corporations Act 2001 (Cth), unless a specific exclusion or ASIC relief applies. Operating without an AFSL can result in severe penalties. See ASIC v BPS Financial Pty Ltd [2024] FCA 457.

Citations: Section 911A(1) of the Corporations Act 2001 (Cth) | ASIC v BPS Financial Pty Ltd [2024] FCA 457

Speak to a Lawyer about AFSL requirements

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

NCP Facility Framework

Statutory Definition

Under Section 762C of the Corporations Act 2001 (Cth) (‘Corporations Act‘), a “facility” can include intangible property, an arrangement, or a combination of the two.

Section 763A(1)(c) then provides that a facility through which, or through the acquisition of which, a person makes non-cash payments is a financial product, subject to the statutory exclusions.

A person “makes non-cash payments” under Section 763D(1) where they make, or cause to be made, a payment otherwise than through the physical delivery of Australian or foreign currency notes or coins. The Act itself gives examples including direct debit facilities, cheques, purchased payment facilities and travellers’ cheques.

The definition is intentionally broad. It can potentially capture modern payment mechanisms even where the underlying technology looks very different from a traditional card or banking product.

Payment Arrangement, Not Just Technology

The distinction between the regulated facility and the technology supporting it was central to ASIC v BPS Financial Pty Ltd [2024] FCA 457 (‘BPS Financial‘).

The Federal Court found that the BPS Financial arrangement was an NCP facility. The regulated product was the arrangement allowing users to make payments using Qoin—not simply the blockchain infrastructure on which those transactions depended. The client guide adopts the same arrangement-versus-technology distinction.

ASIC’s current digital asset guidance similarly explains that custodial or non-custodial digital wallets may constitute NCP facilities where users can use them to make payments to third parties. ASIC also considers that certain stablecoins are likely to be NCP facilities, depending on their terms and features.

The practical implication is that calling a product “software”, a “wallet” or a “crypto platform” does not determine its regulatory status. The actual rights, payment functionality and contractual arrangement need to be analysed.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Fintech and Payment Models That May Be NCP Facilities

Digital Wallets and Stored-Value Products

A wallet that allows customers to hold value and then use it to pay multiple merchants or other users is a common example of an NCP facility.

Potential examples include:

standalone digital wallets;
stored-value accounts;
prepaid or reloadable payment products;
marketplace wallets; and
embedded wallets within larger apps.

Stored value is not, by itself, the statutory test. The critical issue is whether the facility enables the user to make non-cash payments and whether an exclusion or relief applies.

Remittance, P2P and Payment Features

Payment functionality can also arise within platforms whose primary business is not described as a wallet. For example, regulatory analysis may be required where a platform lets users:

transfer funds to other users;
pay multiple merchants;
make international payments;
pay bills through the platform; or
maintain a balance that can later be spent.

A remittance or payment-processing business is not automatically an NCP issuer merely because it participates in a payment flow. Its precise role in the arrangement matters when assessing whether a fintech needs an AFSL.

This is particularly important for “super apps”. A social, commerce, or marketplace platform may have largely unregulated functionality but adding a wallet or peer-to-peer payment feature that independently attracts Chapter 7 regulation.

Crypto Wallets and Stablecoins

Digital asset payment arrangements require the same functional analysis. Following BPS Financial, a crypto wallet that creates an arrangement through which users can make payments to third parties can be an NCP facility. ASIC’s current guidance also states that digital assets themselves may sometimes constitute NCP facilities where they are designed and used as a store of value and means of payment.

The analysis therefore needs to distinguish between:

the wallet or account arrangement;
the underlying digital asset;
the blockchain or technical infrastructure; and
the particular financial services provided by the operator.

A single product ecosystem may contain more than one potentially regulated component.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

AFSL Requirements for NCP Facility Providers

Providing Financial Services in Relation to an NCP Facility

An NCP facility being a financial product does not mean every person who touches the payment transaction automatically requires an AFSL.

Under Section 766A of the Corporations Act, a person provides a financial service where, among other things, they provide financial product advice or deal in a financial product. Section 766C deals with what constitutes dealing, which can include issuing a financial product.

If a business carries on a financial services business in Australia, Section 911A(1) generally requires it to hold an AFSL covering the relevant financial services unless an exemption applies, so fintech and payment businesses should seek advice from Click Legal’s AFSL lawyers for fintech and payment businesses.

For a fintech, the licensing analysis should therefore identify:

the financial product;
who issues or otherwise deals in it;
whether any advice is being provided;
whether those activities constitute a financial services business; and
whether an exclusion, ASIC relief or another licensing pathway applies.

Obligations After Licensing

Where an AFSL is required, obtaining the licence is only the beginning. The general licensee obligations in Section 912A of the Corporations Act can require appropriate compliance systems, competence, resources, risk management and representative supervision, depending on the business and applicable statutory qualifications.

Retail-facing NCP products may also engage disclosure and conduct requirements under Parts 7.7 and 7.9 of the Corporations Act, unless specific relief applies.

For a broader overview of those obligations, see Click Legal’s free AFSL Compliance Guide – Core Obligations for AFS Licensees.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Key NCP Exclusions and ASIC Relief

The Single-Payee Exclusion

One of the most important statutory exclusions appears in Section 763D(2)(a)(i) of the Corporations Act. A payment is not treated as a NCP for Chapter 7 purposes where it is made through a facility under which there is only one person to whom payments can be made.

This can be important for closed-loop facilities. For example, an app through which stored value can only be used to purchase goods from the one business operating the facility may fall outside the NCP definition.

By contrast, if the same balance can be spent with multiple independent marketplace sellers, the single-payee exclusion may no longer be available.

Whether separate stores, related entities or marketplace participants amount to one or multiple payees depends on the legal structure rather than simply the branding of the platform.

Low-Value NCP Facility Relief

ASIC provides conditional relief for low-value NCP facilities under Section 10 of ASIC Corporations (Non-cash Payment Facilities) Instrument 2026/167 (‘ASIC Instrument 2026/167‘).

A “low value non-cash payment facility” must satisfy all the following:

no person may hold more than $1,000 available under facilities of the same class issued by that issuer at any time;
the total amount available across all facilities of that class must not exceed $10 million at any time; and
the facility must not be a component of another financial product.

Section 10 provides relief from specified licensing, conduct and disclosure obligations, including Section 911A(1) of the Corporations Act.

However, the relief is conditional. For retail clients, relevant conditions include clear disclosure of terms, fees, expiry, and procedures for unauthorised or mistaken transactions, access to balance and recent transaction information, and an internal dispute resolution process. Failure to satisfy applicable conditions can cause the exemptions to cease applying.

Low-value relief therefore means reduced regulatory requirements, not the absence of compliance obligations.

Loyalty, Gift and Road-Toll Facilities

The ASIC Instrument 2026/167 also retains specific relief for several lower-risk facilities.

For example:

Section 7 declares qualifying loyalty schemes not to be financial products for Chapter 7;
Section 8 excludes facilities used only for road-toll payments; and
Section 11 provides specified relief for qualifying non-reloadable gift facilities.

Each category has its own definition and conditions. A business should therefore test the precise product against the instrument rather than assume that anything described commercially as a “gift card” or “loyalty scheme” is automatically exempt.

Credit Facilities and BNPL Products

Credit facilities are dealt with separately.

Under Section 765A(1)(h) of the Corporations Act, certain credit facilities are excluded from the Chapter 7 financial product definition. The exclusion also extends to an NCP facility where payments using that facility are all debited to a qualifying credit facility. This can be relevant to BNPL and other credit-based payment models.

However, the exclusion is highly sensitive to product design. If a credit platform later adds a wallet into which users can deposit their own funds and spend them with multiple parties, that wallet may require a separate NCP analysis even if the credit component remains outside Chapter 7.

Separate Australian consumer credit licensing and conduct requirements may also apply to the credit product.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Current Law and Upcoming Payments Licensing Reforms

The framework described above is the current Chapter 7 regime. ASIC Instrument 2026/167 preserves the existing NCP relief until April 2031, subject to ASIC revisiting it when broader payments reforms take effect.

Separately, Treasury is developing a modernised licensing framework for payment service providers. The proposed regime would use the AFSL framework for specified payment functions and introduce graduated obligations, including for stored-value facilities and payment stablecoins.

As at August 2026, those payment-service-provider reforms remain at the draft legislation and consultation stage and should not be treated as the current operative licensing regime.

Fintechs should therefore comply with the existing Corporations Act framework while monitoring the proposed transition separately.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Common NCP Compliance Mistakes

Common problems arise when businesses analyse the technology or commercial label rather than the underlying legal arrangement. Examples include:

assuming a wallet is unregulated because it uses blockchain technology;
assuming every payment processor is automatically—or never—an NCP provider;
relying on the single-payee exclusion after adding third-pary merchants;
relying on low-value relief without monitoring the $1,000 and $10 million thresholds;
overlooking the conditions attached to ASIC relief;
adding wallet functionality to an otherwise excluded credit product without reassessing the AFSL position;
launching new payment features without checking the scope of an existing AFSL; and
assuming a future payment-services reform removes the need to comply with current law.

The regulatory analysis should be repeated whenever the payment flow, permitted payees, stored-value functionality or commercial structure materially changes.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Practical Steps for Fintech and Payment Platforms

Before launching or materially changing a payment product:

Map the payment flow. Identify who provides funds, where value is held, who can receive payments and what contractual arrangement enables the payment.
Identify the financial product. Apply Sections 762C, 763A and 763D of the Corporations Act to the facility itself rather than only the underlying technology.
Test all exclusions and relief. Review the single-payee exclusion, credit facility exclusion and current ASIC Instrument 2026/167.
Map the financial services. Determine who issues, deals in or advises on the product and whether an AFSL covering those activities is required.
Review the position before product changes. A new wallet, merchant network, P2P feature or stored-value component can materially alter the regulatory analysis.

Existing licensees can also use Click Legal’s free AFSL Compliance Checklist to review whether their licence scope and compliance systems remain aligned with their current services.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Conclusion

NCP regulation is broad because it focuses on the facility through which payments are made, rather than a particular technology. Digital wallets, stored-value products, crypto payment arrangements and embedded payment features can therefore fall within the same Chapter 7 framework as more traditional payment products.

For fintechs, the safest approach is to analyse the payment architecture before launch and revisit it whenever functionality changes. An exclusion or ASIC relief may remove the need for an AFSL in some cases, but those pathways are fact-specific and often conditional, so contact Click Legal’s AFSL lawyers for advice on fintech licensing and exemptions before relying on them.

Frequently Asked Questions

What is a non-cash payment facility?

As explained in the statutory framework above, an NCP facility is defined under Sections 762C, 763A and 763D of the Corporations Act as a facility through which a person can make payments without physically delivering currency notes or coins.

Does every digital wallet require an AFSL?

No. Whether an AFSL is required depends on the wallet’s legal and functional structure, the services provided in relation to it and any applicable exclusion or relief. A wallet allowing payments to multiple third parties will generally require closer NCP analysis.

Does a closed-loop wallet fall outside the NCP regime?

Potentially. As discussed above, Section 763D(2)(a)(i) of the Corporations Act excludes a facility where payments can only be made to one person, but the legal payee structure must satisfy that requirement.

What is the current low-value NCP exemption?

The current relief is in ASIC Instrument 2026/167. As detailed in the low-value section above, the definition caps holdings at $1,000 per person and $10 million in aggregate, and requires that the facility not be a component of another financial product.

Are crypto wallets NCP facilities?

They can be. The judgement in ASIC v BPS Financial [2025] FCAFC 74 confirmed that the Qoin Wallet arrangement was an NCP facility, and ASIC says both custodial and non-custodial wallets may be caught where they enable third-pary payments.

Are stablecoins regulated as NCP facilities?

Some may be. ASIC currently considers certain stablecoins likely to constitute NCP facilities, but the analysis depends on the rights, functionality and surrounding arrangement.

Are BNPL products NCP facilities?

A qualifying credit facility can fall within the exclusion in Section 765A(1)(h) of the Corporations Act. However, a separate stored-value or cash wallet added to a BNPL platform may require its own NCP analysis.

Can an NCP provider operate as an authorised representative instead of obtaining its own AFSL?

Potentially, where the requirements of Section 911A(2)(a) of the Corporations Act are genuinely satisfied. Following the Full Federal Court decision in ASIC v BPS Financial [2025] FCAFC 74, a formal appointment alone is insufficient if the business is actually providing the service on its own behalf.

Are the new payment service provider reforms already in force?

Not yet. The Government is developing a broader PSP licensing regime, but the current NCP and AFSL framework continues to apply until those reforms are enacted and commenced.

Responsible Manager Changes and AFSL Variations: When a Key Person Change Triggers Action

Hannah Deuk — Tue, 01 Sep 2026 05:02:52 +0000

Introduction

A change to an Australian financial services licence (AFSL) holder’s responsible managers does not automatically require an AFSL variation. An ordinary responsible manager change generally requires notification to the Australian Securities and Investments Commission (ASIC). However, where the person is named in a key person condition on the AFSL, their departure can also require an application to vary that condition.

The distinction matters because ASIC relies on responsible managers when assessing whether an AFSL holder maintains the organisational competence required by Section 912A(1)(e) of the Corporations Act 2001 (Cth) (‘Corporations Act‘). A key person departure can therefore create both a licence-condition issue and a competence issue. In this article, we explain when a responsible manager change triggers an AFSL variation, the applicable notification periods, and what licensees should do before a key person leaves.

Interactive Tool: Check If Your Responsible Manager Change Triggers an AFSL Variation

AFSL Responsible Manager Change Checker

Quickly determine if your Responsible Manager change triggers an AFSL variation, special ASIC notification, or both.

Is the departing person named in a key person condition on your AFSL?

Will the remaining responsible managers collectively cover all AFSL authorisations after this change?

⚠️ Key Person Departure: AFSL Variation Required

Because the departing person is named in a key person condition, you must apply to vary your AFSL under Section 914A(2)(b) of the Corporations Act 2001 (Cth). You must also notify ASIC in writing within five business days, addressing the required details. Failure to act can result in licence suspension or enforcement action.

Tip: Prepare evidence of replacement competence or demonstrate why the key person condition can be removed.

See: Condition 3 of PF 209 and Section 912A(1)(b) of the Corporations Act 2001 (Cth).

Legal References:

Section 914A(2)(b) of the Corporations Act 2001 (Cth)

Section 912A(1)(b) of the Corporations Act 2001 (Cth)

Condition 3 of PF 209 Australian financial services licence conditions

Speak to a lawyer about AFSL key person changes

✅ Ordinary Responsible Manager Change: Notify ASIC

You only need to notify ASIC of the change within 10 business days under Regulation 7.6.04(1)(b) of the Corporations Regulations 2001 (Cth). No AFSL variation is required, but you must ensure the remaining responsible managers still collectively meet the competence requirements of Section 912A(1)(e) of the Corporations Act 2001 (Cth).

Legal References:

Regulation 7.6.04(1)(b) of the Corporations Regulations 2001 (Cth)

Section 912A(1)(e) of the Corporations Act 2001 (Cth)

Get legal advice on responsible manager notifications

❌ Competence Gap: Immediate Action Needed

Your remaining responsible managers do not collectively cover all AFSL authorisations. This is a breach of Section 912A(1)(e) of the Corporations Act 2001 (Cth) and may also breach licence conditions. You must appoint a suitable replacement or seek a variation to your AFSL before the change occurs. Continuing without coverage risks ASIC enforcement or suspension.

Legal References:

Section 912A(1)(e) of the Corporations Act 2001 (Cth)

Section 912A(1)(b) of the Corporations Act 2001 (Cth)

Speak to a lawyer about AFSL competence gaps

⚖️ Not Sure? Get an AFSL Review

If you are unsure whether the departing person is a key person or only a responsible manager, you should urgently review your AFSL conditions and competence matrix. Legal advice can clarify your obligations and help you avoid accidental breaches of Section 912A(1)(b) of the Corporations Act 2001 (Cth) and Section 912A(1)(e) of the Corporations Act 2001 (Cth).

Legal References:

Section 912A(1)(b) of the Corporations Act 2001 (Cth)

Section 912A(1)(e) of the Corporations Act 2001 (Cth)

Get legal advice on your AFSL obligations

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Responsible Managers and Organisational Competence

The Corporations Act does not create a statutory office called a “responsible manager”. Responsible managers are part of ASIC’s framework for assessing compliance with Section 912A(1)(e) of the Corporations Act, which requires an AFSL holder to maintain the competence to provide the financial services covered by its licence.

ASIC explains in Regulatory Guide (RG) 105 AFS licensing: Organisational competence (‘RG 105‘) that it looks to the knowledge and skills of the people who manage the financial services business. Responsible managers should be directly responsible for significant day-to-day decisions about the ongoing provision of financial services and, collectively, have the knowledge and skills relevant to the services and products covered by the AFSL.

This means a departure should be assessed by reference to the competence the person contributes, not simply the number of responsible managers remaining. A licensee may still have several responsible managers but lose coverage for a particular service or product if the departing person was the only one with relevant expertise.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

When is Notifying ASIC Enough

The first question is whether the departing person is simply a responsible manager or is also named in a condition on the AFSL.

For an ordinary responsible manager change, the licence itself usually does not need to be varied. However, the change must generally be notified to ASIC.

The prescribed licence condition in Regulation 7.6.04(1)(b) of the Corporations Regulations 2001 (Cth) (‘Corporations Regulations‘) requires a licensee to lodge particulars of a change to information entered in the financial services licensee register within 10 business days after the change, unless the change results directly from an ASIC action. ASIC’s responsible manager process identifies Regulations 7.6.04(1)(b) and 7.6.05(1)(g) as relevant to responsible manager changes.

ASIC’s Regulatory Portal can be used to:

appoint a new responsible manager;
cease an existing responsible manager;
change responsible manager details; and
update the time a responsible manager spends performing the role.

The notification does not itself resolve the competence question, and ongoing AFSL compliance services may be needed to assess and address any gap. After the change, the licensee must still satisfy Section 912A(1)(e) of the Corporations Act. If the remaining responsible managers no longer collectively cover the AFSL authorisations, the business needs to address that gap.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

When Varying Your AFSL May Be Required

Responsible Manager Named in a Key Person Condition

The position changes where the responsible manager is named in a key person condition.

ASIC may impose or vary AFSL conditions under Section 914A of the Corporations Act. ASIC’s standard key person condition appears in condition 3 of Pro Forma (PF) 209 Australian financial services licence conditions (‘PF 209′), although licensees should check the wording of their own AFSL because conditions can be tailored.

As per RG 105, a key person condition may be imposed where the licensee is heavily dependent on the knowledge and skills of one or two responsible managers. This can arise where:

the business is small and relies heavily on one or two principals;
only one responsible manager has expertise for a particular financial service or product; or
the organisational competence assessment depends substantially on one individual.

A key person condition therefore identifies someone whose competence ASIC considers materially important to the licensee.

When the Variation Trigger Arises

If the responsible manager named in a key person condition is no longer a responsible manager for the licence, the licensee needs to apply to vary the AFSL.

The variation can generally take one of two forms:

nominate another responsible manager as the key person; or
ask ASIC to remove the key person condition by demonstrating that the licensee is no longer dependent on one responsible manager.

The statutory mechanism is an application under Section 914A(2)(b) of the Corporations Act to vary or revoke the relevant licence condition.

The practical distinction is straightforward: an ordinary responsible manager change updates ASIC’s records; a change to a responsible manager named in a key person condition also affects the AFSL itself.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Responsible Manager and Key Person Notification Periods

Responsible manager changes and key person departures can involve different notification periods.

As outlined above, an ordinary responsible manager change is generally notified within 10 business days after the change.

By contrast, the key person condition discussed above (condition 3 of PF 209) requires the licensee to notify ASIC in writing within five business days if a named key person ceases to be an officer of the licensee or ceases performing duties for its financial services business. The standard condition requires the notice to address:

when the key person ceased;
details of any replacement;
if there is no replacement, why one has not been nominated; and
how the licensee will continue to comply with the Corporations Act and its AFSL conditions.

The five-business-day period arises from the licence condition, not from a general rule applying to every responsible manager. The actual AFSL should therefore be checked.

For a named key person, the licensee may need to manage three connected steps:

the ordinary responsible manager notification;
the key person notification required by the licence condition; and
the AFSL variation.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Replacing the Key Person or Removing the Condition

Replacing the Key Person

Where the business remains dependent on one person’s expertise, the likely pathway is to appoint an appropriately qualified replacement responsible manager and seek to substitute that person into the key person condition.

If the replacement is not already recorded as a responsible manager, ASIC currently requires the responsible manager change notification to be completed before the variation application is started.

The replacement should cover the relevant competence rather than merely occupy the departing person’s job title.

Removing the Key Person Condition

A licensee may instead seek to remove the condition if it is no longer dependent on a single person. This may be relevant where the licensee now has:

several responsible managers with overlapping expertise;
broader management capability;
greater internal knowledge across its licensed services and products; or
a structure that no longer relies heavily on the originally named person.

A variation applicant can explain why the licensee is no longer dependent on one responsible manager. The issue is whether the business can demonstrate continuing organisational competence without a named key person, not whether removal would simply be administratively convenient.

Evidence ASIC May Require

Where a new responsible manager is appointed, ASIC focuses on whether that person genuinely contributes relevant competence to the financial services business.

Depending on the application, supporting material may include:

relevant roles and experience;
qualifications;
a Statement of Personal Information;
criminal history checks; and
where applicable, overseas police or bankruptcy checks.

For a key person variation, ASIC will also require information showing how the responsible manager or responsible managers support the proposed change.

The evidence should demonstrate how the responsible managers collectively cover the financial services and products authorised by the AFSL after the departure. An up-to-date competence matrix can make this considerably easier.

ASIC can also request further information or an audit report when assessing a variation application under Section 914B of the Corporations Act.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Why a Key Person Departure Should Be Managed Before It Happens

Licence Condition and Competence Risks

Under Section 912A(1)(b) of the Corporations Act, an AFSL holder must comply with the conditions on its licence. Section 912A(1)(e) separately requires the licensee to maintain the competence to provide the financial services covered by the AFSL.

If a named key person leaves without the issue being addressed, the licensee may face:

a breach of the relevant key person condition;
a gap in the organisational competence supporting one or more AFSL authorisations;
a need to vary the AFSL or appoint a suitable replacement responsible manager; and
a separate need to assess whether the circumstances give rise to a reportable situation under Sections 912D and 912DAA.

Reportability depends on the statutory tests and should be assessed separately from the variation application.

ASIC Enforcement Shows the Practical Risk

ASIC’s recent enforcement activity illustrates the consequences of leaving a key person issue unresolved.

In November 2025, ASIC suspended the AFSL of Focused Financial Advice Pty Ltd after its key person and responsible manager had ceased in 2023. ASIC stated that the licensee had neither applied to vary its licence nor made the five-business-day notification required by its licence condition, and had continued providing financial services without the required key person.

ASIC revoked the suspension in December 2025 after approving a licence variation. The case does not mean every delayed notification will result in suspension, but it shows that prolonged failure to address a key person condition can become a substantive AFSL compliance issue.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Common Responsible Manager and Key Person Mistakes

Common problems include:

assuming every responsible manager change requires an AFSL variation;
treating a named key person as though they were an ordinary responsible manager;
checking ASIC’s records without checking the actual AFSL conditions;
waiting until the key person leaves before identifying who covers their expertise;
appointing a senior employee without testing whether they meet ASIC’s responsible manager criteria;
applying the 10-business-day responsible manager deadline without checking whether a five-business-day key person condition also applies;
assuming appointment of a replacement automatically changes the key person condition; and
asking ASIC to remove the condition without evidence that competence is sufficiently distributed across the business.

The recurring problem is treating the departure as an HR change rather than a licensing and organisational competence event.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Responsible Manager Change Review Process

Before a responsible manager leaves or materially changes role, an AFSL holder should:

Check the actual AFSL conditions: Confirm whether the person is named as a key person.
Map their competence: Identify which financial services and products rely on their knowledge and experience.
Assess the remaining responsible managers: Confirm whether they collectively continue to cover the AFSL authorisations.
Identify the regulatory steps and deadlines: Determine whether the change requires ordinary responsible manager notification only or also a key person notification and AFSL variation.
Choose the variation pathway: Decide whether another responsible manager should replace the key person or whether there is evidence to support removing the condition.
Prepare before the departure where possible: Gather replacement competence evidence and supporting documents early.

For a broader review of ongoing AFSL obligations, Click Legal’s AFSL Compliance Checklist can be used alongside the responsible manager review.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Conclusion

A responsible manager change is not automatically an AFSL variation trigger. The critical question is whether the person is also named in a key person condition and whether their departure affects the licensee’s continuing organisational competence.

Where a key person is leaving, the responsible manager notification, key person condition and competence assessment should be managed together. Addressing those issues before departure reduces the risk of an outdated licence condition or an unaddressed competence gap, so contact our AFSL compliance lawyers at Click Legal for responsible manager and key person issues.

Frequently Asked Questions

Does changing a responsible manager always require an AFSL variation?

No. An ordinary responsible manager appointment or removal generally requires notification to ASIC. A variation is also required where the change affects an AFSL condition, including where the responsible manager is named as a key person.

What is an AFSL key person?

A key person is an individual named in a condition on the AFSL because ASIC considers the licensee heavily dependent on that person’s knowledge or skills. This often occurs where one or two responsible managers are central to the licensee’s organisational competence.

How can I tell whether a responsible manager is a key person?

Check the conditions on the actual AFSL. Being recorded as a responsible manager does not itself make someone a key person.

How quickly must ASIC be notified?

Ordinary responsible manager changes are generally notified within 10 business days after the change. If the standard PF 209 key person condition applies, a separate five-business-day notification requirement applies when the key person ceases the relevant role.

Can an AFSL continue operating after its key person leaves?

That depends on the licence condition and whether the licensee continues to satisfy its organisational competence obligation. The licensee should address the condition promptly and confirm that the remaining competence arrangements support its authorised services.

Does a replacement responsible manager need exactly the same experience?

Not necessarily. ASIC assesses the responsible managers collectively. However, the replacement arrangements must ensure that the relevant financial services and products remain adequately covered.

Can ASIC remove a key person condition?

Yes. A licensee can seek removal where it can demonstrate that it is no longer dependent on a single responsible manager and can maintain organisational competence without the condition.

Should the new responsible manager be appointed before the variation application?

Where the variation relies on a new responsible manager who has not already been appointed, ASIC currently requires the responsible manager change notification to be completed before the variation application starts.

Can failing to replace a key person affect the AFSL?

Yes. Failure to comply with a key person condition can engage Section 912A(1)(b) of the Corporations Act, while a resulting competence gap can engage Section 912A(1)(e). ASIC has taken suspension action where prolonged key person and responsible manager failures formed part of substantive non-compliance.

Operating Outside Your AFSL: Risks and How an AFSL Variation Can Help

Hannah Deuk — Tue, 01 Sep 2026 04:58:04 +0000

Introduction

An Australian financial services licence (AFSL) only authorises the financial services covered by its conditions. If a business changes, its activities can move beyond the services or financial products covered by its existing licence. Section 911A(1) of the Corporations Act 2001 (Cth) (‘Corporations Act‘) requires a person carrying on a financial services business in Australia to hold an AFSL covering the financial services it provides, unless an exemption applies.

This is particularly relevant when an AFSL holder launches a new product, adds an advice or dealing service, starts servicing a different client category, acquires another business or changes its distribution model. In this article, we explain how to identify an AFSL scope gap, the regulatory and commercial consequences of operating outside your licence, and how an AFSL variation can address the authorisations required for future activities.

Interactive Tool: Check Your AFSL Coverage & Whether You Need a Variation

AFSL Scope Gap & Variation Checker

Unsure if your business activities are covered by your current AFSL? Answer a few questions to identify potential scope gaps and whether you may need an AFSL variation.

Has your business recently changed or are you planning to launch a new product, service, or client category?

Does your current AFSL specifically authorise the new or changed activities (service, product, or client type)?

Have you already started providing the new service or product before confirming AFSL coverage?

⚠️ Potential AFSL Scope Gap & Historical Non-Compliance

Your business may be operating outside the scope of its current AFSL. Under Section 911A(1) of the Corporations Act 2001 (Cth), providing a financial service not covered by your licence can trigger both criminal and civil penalty exposure (see Section 1311(1) and Section 911A(5B)). If you have already commenced the new activity, you must also consider breach reporting obligations under Section 912D(3)-(4) and the impact on client agreements under Division 11 of Part 7.6.

Immediate legal advice is strongly recommended to assess risk, reporting, and remediation steps.

Legal References

Section 911A(1) of the Corporations Act 2001 (Cth)
Section 1311(1) of the Corporations Act 2001 (Cth)
Section 911A(5B) of the Corporations Act 2001 (Cth)
Section 912A(1)(b)-(c) of the Corporations Act 2001 (Cth)
Section 912D(3)-(4) of the Corporations Act 2001 (Cth)
Division 11 of Part 7.6 of the Corporations Act 2001 (Cth)

Speak to a lawyer about AFSL breach risks

⚠️ AFSL Variation Likely Required

Your new or planned activities are not covered by your current AFSL. Section 911A(1) of the Corporations Act 2001 (Cth) requires your licence to cover all financial services provided. You should apply for a variation under Section 914A(2)(b) before commencing the new service.

Do not start the new activity until ASIC approves the variation.

Legal References

Section 911A(1) of the Corporations Act 2001 (Cth)
Section 914A(2)(b) of the Corporations Act 2001 (Cth)

Get legal advice on your AFSL variation

✅ No Immediate AFSL Scope Gap Identified

Your current AFSL appears to cover your planned or existing activities. Continue to review your licence conditions and compliance framework regularly, especially after any business changes.

If you are unsure about the legal character of a new activity, seek legal advice before proceeding.

Legal References

Section 911A(1) of the Corporations Act 2001 (Cth)
Sections 914A(6)-(7) of the Corporations Act 2001 (Cth)

Speak to a lawyer for an AFSL health check

⚖️ Uncertain AFSL Coverage – Legal Review Recommended

It’s unclear whether your AFSL covers your new or planned activities. The correct authorisations depend on the specific financial services, products, and client categories involved.

Obtain a legal review of your AFSL before proceeding to avoid compliance risks.

Legal References

Section 911A(1) of the Corporations Act 2001 (Cth)

Get a lawyer to review your AFSL authorisations

✅ No AFSL Scope Gap Detected

Your business activities appear unchanged, so no immediate AFSL scope gap has been identified. It is still good practice to review your AFSL conditions periodically and seek legal advice before making any future changes to your services, products, or client base.

If your circumstances change, re-run this checker or speak to an AFSL lawyer.

Legal References

Section 911A(1) of the Corporations Act 2001 (Cth)
Sections 914A(6)-(7) of the Corporations Act 2001 (Cth)

Speak to a lawyer for an AFSL health check

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Your AFSL Authorisations Set the Boundary

For an existing AFSL holder, the question is not simply whether the business has a licence. It is whether the licence covers the particular financial service being provided.

Section 911A(1) of the Corporations Act creates that licensing requirement. Sections 914A(6)–(7) require an AFSL to specify the financial services or classes of financial services the licensee is authorised to provide, which may be specified by reference to particular financial products or product classes.

In practice, licence scope commonly turns on the combination of:

the financial service being provided, such as financial product advice or dealing;
the financial product or product class to which the service relates; and
where relevant, whether the authorisation extends to retail clients, wholesale clients or both.

This distinction matters because authority to provide one service does not necessarily cover another service involving the same product. For example, authority to deal in a financial product does not itself authorise financial product advice about that product.

A commercially new product also does not automatically require a licence variation. If the underlying financial service, product class and relevant client category are already within the existing authorisations, the AFSL may already cover the activity. The analysis should therefore start with the actual licence conditions and the legal character of the proposed activity.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Business Changes That Can Create an AFSL Scope Gap

AFSL scope problems often arise because the business changes while its licence remains the same. The statutory question remains whether the proposed activity is already covered or another valid licensing pathway applies.

Common triggers include:

Adding a different financial service: A business authorised to deal may begin making recommendations or statements of opinion that amount to financial product advice under Section 766B of the Corporations Act.
Moving into another financial product class: Existing authorisations may cover securities but not another product class involved in the new offering.
Expanding from wholesale to retail clients: The underlying service may remain the same, but the existing authorisation may not extend to retail clients.
Changing the business’s role in a transaction: A platform, intermediary, or distributor may take on functions that change the financial services it provides.
Acquiring a business or launching a new division: The new activities need to be mapped against the acquiring entity’s existing AFSL rather than assumed to fall within it.
Changing an activity that relies on an exemption. Exemptions under Section 911A(2) and other regulatory relief depend on particular conditions. A change in the facts can change whether the exemption remains available.

An authorised representative structure cannot fill a gap in the principal AFSL. Section 916A(2) limits an authorised representative to some or all of the financial services covered by the licensee’s AFSL, and Section 916A(3) makes an authorisation void to the extent it purports to cover a service outside that licence.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Risks of Operating Outside Your AFSL

Unlicenced Financial Services Exposure

Providing a financial service that the existing AFSL does not cover can contravene Section 911A(1) of the Corporations Act, unless an exemption applies. Failure to comply with Section 911A(1) is an offence through Section 1311(1), while Section 911A(5B) separately makes the contravention a civil penalty provision.

For an existing licensee, the same conduct can also engage its general obligations. Section 912A(1)(b) requires compliance with licence conditions, while Section 912A(1)(c) requires compliance with the financial services laws. Repeated out-of-scope activity may indicate weaknesses in product approval, licensing controls or supervision.

Breach Reporting Can Be Triggered

An established contravention of Section 911A(1) of the Corporations Act by an AFS licensee also requires prompt consideration under the reportable situations regime.

Section 912D(3)(b) treats the Section 912A(1)(c) obligation to comply with relevant provisions of the Corporations Act as a core obligation. Under Section 912D(4)(b), a breach of a core obligation is taken to be significant where it is constituted by a contravention of a civil penalty provision, subject to prescribed exclusions. Because Section 911A(5B) makes a contravention of Section 911A(1) a civil penalty contravention, this statutory pathway needs to be assessed when out-of-scope conduct is identified.

Where there are reasonable grounds to believe a reportable situation has arisen, Section 912DAA(1) requires a report to the Australian Securities and Investments Commission (ASIC). Under Section 912DAA(3), the report must generally be lodged within 30 days after the licensee first knows, or is reckless as to whether, there are reasonable grounds to believe the reportable situation has arisen.

Client Agreements and Fees May Be Affected

Operating outside licence scope can also affect agreements connected with the unlicenced service.

Division 11 of Part 7.6 of the Corporations Act applies in defined circumstances. Under Section 924A, it can apply where:

a person enters into an agreement with a client who is not itself an AFS licensee,
the agreement constitutes or relates to a financial service provided in the course of the provider’s financial services business, and
the provider neither holds an AFSL covering the service nor is exempt.

The provision applies whether the client receives the service as a wholesale or retail client.

Where Division 11 applies:

Section 925A may allow the client to give notice rescinding the agreement, subject to the limitations in that section;
Section 925E can make the agreement unenforceable against the client while the statutory conditions are met and after rescission; and
Section 925F can prevent recovery of brokerage, commission or other fees connected with the agreement while that provision applies.

These consequences should not be described as automatic invalidity of every agreement impacted by a licence issue. Division 11 contains specific conditions and limitations, so the relevant contracts and circumstances need to be assessed individually.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

How an AFSL Variation Can Help

AFSL Variation Addresses the Scope Gap

Where the proposed financial service is not covered by the current licence and no exemption or other lawful pathway applies, the licensee can seek to expand its authorisations.

Although commonly described as an “AFSL variation”, adding or changing financial service and product authorisations is technically an application under Section 914A(2)(b) of the Corporations Act for ASIC to impose, vary or revoke licence conditions. That is because Sections 914A(6)–(7) place the financial services and product authorisations in the conditions on the AFSL. By contrast, Section 915A concerns varying the licence itself to reflect a change in the licensee’s name.

ASIC nevertheless describes the process operationally as varying the AFS licence. Applications to vary authorisations or conditions are now made through the ASIC Regulatory Portal.

ASIC Assesses the Business Behind the New Authorisations

A variation application is not simply a request to add wording to the licence. The licensee needs to show that it can support the proposed expanded activities.

ASIC’s current application guidance requires applicants to identify the authorisations sought and provide supporting information relevant to the proposed financial services and products. Depending on the variation, this can include information about the business model, compliance processes, responsible managers and fit and proper people.

ASIC also has statutory information-gathering powers during the application process. Under Section 914B(3) of the Corporations Act, it may request information, an audit report or other specified material relevant to the application. Section 914B(2) also empowers ASIC to refuse the application if the fit and proper person requirement in Section 913BA is not satisfied in relation to the applicant and the licence as proposed to be varied.

The practical task is therefore two-fold:

identify the correct additional authorisations; and
ensure the people, resources, and compliance arrangements can support them.

Variation Is Not a Retrospective Cure

Lodging a variation application does not itself expand the current AFSL. Until ASIC varies the relevant conditions, the business remains subject to its existing authorisations and any applicable exemption. Section 911A(1) of the Corporation Act continues to require the licence to cover services being provided.

A later variation also does not retrospectively change what the AFSL covered before approval. If the service has already commenced, the business should separately determine:

when the affected activity began;
which services, products, and clients were involved;
whether another exemption or authorisation applied at the time;
whether the activity should be stopped or modified pending resolution;
whether breach reporting is required; and
whether contracts, fees or remediation require further review.

This separates two different problems: dealing with past conduct and establishing the correct authority for future conduct.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Common AFSL Scope Mistakes

Scope gaps often arise from ordinary commercial decisions rather than deliberate non-compliance. Common examples include:

relying on an internal summary of the AFSL instead of checking the actual authorisations and conditions;
confirming that the licence covers the financial product, but not the particular financial service;
moving from wholesale to retail clients without checking whether the relevant authorisations extend to retail clients;
assuming an authorised representative can operate beyond the principal licence;
treating lodgement of a variation application as authority to commence the new activity;
carrying out the licensing review only after contracts or onboarding processes have been finalised; and
seeking additional authorisations “just in case” without identifying whether the business genuinely intends to use them.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

AFSL Scope and Variation Review Process

Before a new activity is launched, an AFSL holder can structure the review around six steps:

Map the proposed activity: Identify the service, financial product, client category and role performed by each entity involved.
Compare it with the existing AFSL: Review the actual licence authorisations and conditions rather than relying on internal descriptions.
Check alternative pathways: Determine whether the activity is already covered or whether a specific exemption or representative arrangement applies on the facts.
Identify historical exposure separately: If the activity has commenced, establish the affected period and clients and assess breach-reporting, contractual and remediation issues.
Scope the variation precisely: Identify the additional authorisations required and whether the responsible managers, resources, and compliance arrangements support them.
Align the commercial timetable with the licensing position: Do not assume a pending application expands the existing AFSL.

For businesses undertaking a broader review of their licence and compliance arrangements, Click Legal’s free AFSL Compliance Checklist provides a structured framework covering licensing, governance, breach reporting and other ongoing AFSL obligations.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Conclusion

An AFSL can remain valid while becoming too narrow for the business operating under it. The relevant test is whether the services actually being provided remain within the licence’s authorisations or are covered by another valid licensing pathway.

Where future activities sit outside that scope, contact the AFSL variation application lawyers at Click Legal to add the necessary authorisations. Where out-of-scope conduct has already occurred, the historical licensing, breach-reporting and client consequences need to be assessed separately rather than relying on the later variation to cure them.

Frequently Asked Questions

When does an AFSL need to be varied?

A variation should be considered where an existing licensee proposes to provide a financial service or service relating to a financial product that is not covered by its existing authorisations. Whether a variation is required depends on the precise licence conditions, proposed activity and any applicable exemption.

Does every new financial product require an AFSL variation?

No. A commercially new offering may still fall within an existing financial product class and service authorisation. The legal characteristics of the offering should be mapped against the existing licence before determining whether additional authorisations are required.

Can a business operate while its AFSL variation is pending?

A pending application does not itself expand the current licence. If the proposed financial service is not already covered by the AFSL or an applicable exemption, providing it before the additional authorisation takes effect can contravene Section 911A(1) of the Corporations Act.

Can an authorised representative provide services outside the AFSL holder’s authorisations?

No. Sections 916A(2)–(3) of the Corporations Act limit an authorised representative to services covered by the principal AFSL and make an authorisation void to the extent it purports to exceed that scope.

Does providing services only to wholesale clients avoid the AFSL requirement?

Not generally. Wholesale-client status affects some authorisations, obligations and exemptions, but it is not a blanket exemption from Section 911A. The particular service and applicable licensing pathway still need to be checked.

Does an AFSL variation fix previous out-of-scope activity?

No. A variation changes the licence prospectively once the relevant conditions take effect. Conduct occurring before then remains subject to the licensing framework that applied when the service was provided.

Does operating outside an AFSL need to be reported to ASIC?

An established contravention can engage the reportable situations regime under Sections 912D and 912DAA of the Corporations Act, including because Section 911A(5B) is a civil penalty provision. The precise reporting position and any applicable exclusions should be assessed when the breach is identified.

What does ASIC assess when considering an AFSL variation?

The requirements depend on the variation sought, but ASIC may assess the proposed services and products, business model, compliance arrangements, responsible managers and fit and proper people. ASIC can also request further information or an audit report under Section 914B of the Corporations Act.

How long does an AFSL variation take?

There is no single statutory decision period for every AFSL variation. Timing depends on the authorisations sought, the completeness of the application and whether ASIC requires further information; incomplete or incorrect applications can be returned, refused or delayed.

How to Operate as a Corporate Authorised Representative Under an AFSL

Hannah Deuk — Tue, 01 Sep 2026 04:52:22 +0000

Introduction

A company that provides financial services in Australia does not always need to hold its own Australian Financial Services Licence (AFSL). In some circumstances, it can operate as a Corporate Authorised Representative (CAR) of an existing AFS licensee and provide specified financial services within that licensee’s regulatory framework.

However, a CAR is not simply a company “using” another business’s AFSL. Its directors and employees may need separate sub-authorisations, its activities must remain within the scope of the AFSL and its written authority, and the company must genuinely operate as a representative of the licensee. In this article, we explain how CAR structures work, the governance responsibilities on both sides and when a company may be better suited to obtaining its own AFSL.

Interactive Tool: Check If Your Company’s CAR Structure Is Compliant

Corporate Authorised Representative (CAR) AFSL Compliance Checker

Quickly check if your company’s CAR structure and activities are compliant with AFSL requirements and recent case law.

Step 1 of 4

Is your company currently appointed as a Corporate Authorised Representative (CAR) of an AFSL holder?

Are all directors and employees who provide financial services sub-authorised by the AFSL holder?

Are all financial services provided by your company within both the AFSL holder’s licence scope and your written CAR authority?

Does your company control its own financial products, client relationships, or operate independently of the AFSL holder?

✅ CAR Structure Likely Compliant

Your CAR structure appears compliant with the Corporations Act 2001 (Cth) and recent case law.

All relevant staff are sub-authorised, your activities are within the AFSL and CAR authority, and the AFSL holder supervises your operations. However, ongoing compliance reviews are essential, especially after business changes.

For tailored legal advice or to review your CAR agreement, contact our team.

Section 911A(2)(a) of the Corporations Act 2001 (Cth)
Section 916A(1), Section 916A(3), Section 916B, Section 916F, Section 912A(1)(ca), Section 917B, Section 916D, Section 916E, Section 916C of the Corporations Act 2001 (Cth)
ASIC v BPS Financial Pty Ltd [2025] FCAFC 74

Speak to a lawyer about ongoing AFSL compliance

⚠️ Sub-Authorisation Required

Some directors or employees may be providing financial services without proper sub-authorisation.

This exposes both your company and the AFSL holder to compliance risks under the Corporations Act 2001 (Cth) and ASIC guidance. Immediate review and rectification are recommended.

Section 916B of the Corporations Act 2001 (Cth)
Section 912A(1)(ca) of the Corporations Act 2001 (Cth)

Get legal advice on CAR sub-authorisations

❌ Services May Be Outside AFSL or CAR Authority

Your company may be providing financial services outside the scope of the AFSL or your written CAR authority.

This can invalidate the authorised representative exemption and expose you to significant penalties. A detailed legal review is essential before continuing these activities.

Section 916A(3) of the Corporations Act 2001 (Cth)
Section 911A(2)(a) of the Corporations Act 2001 (Cth)
ASIC v BPS Financial Pty Ltd [2025] FCAFC 74

Speak to a lawyer about AFSL licensing and scope

⚖️ Independent Operation Risk

Your company’s independence or control over products and clients may mean you are not acting as a true representative of the AFSL holder.

Following ASIC v BPS Financial Pty Ltd [2025] FCAFC 74, a CAR must genuinely operate within the AFSL holder’s compliance framework. Written appointment and ASIC registration alone are not enough.

ASIC v BPS Financial Pty Ltd [2025] FCAFC 74
Section 911A(2)(a) of the Corporations Act 2001 (Cth)

Get legal advice on CAR business models

❌ Not a CAR – Consider AFSL Requirements

Your company is not currently a Corporate Authorised Representative.

If you are providing financial services, you may need to apply for your own AFSL or consider a CAR arrangement. Operating without the correct authorisation can result in serious penalties.

Section 911A of the Corporations Act 2001 (Cth)

Speak to a lawyer about AFSL licensing options

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Understanding the Corporate Authorised Representative AFSL Exemption

What is a Corporate Authorised Representative?

“CAR” is an industry term rather than a separate statutory licence category. Under Section 916A(1) of the Corporations Act 2001 (Cth) (‘Corporations Act‘), an AFS licensee may give a person written authority to provide specified financial services on its behalf. An authorised representative can be an individual, body corporate, partnership or certain groups of trustees. A company appointed under this provision is commonly referred to as a CAR.

The company can then rely on the authorised representative exemption in Section 911A(2)(a) for services genuinely provided as representative of the AFSL holder.

Scope of the CAR’s Authority

The CAR does not automatically receive every authorisation appearing on the AFSL. Its written appointment should identify the particular financial services it is permitted to provide. Under Section 916A(3) of the Corporations Act, an authorisation is void to the extent it purports to authorise a service that the licensee’s own AFSL does not cover.

The CAR therefore needs to operate within two boundaries:

the financial services covered by the AFSL; and
the narrower services covered by its own written authorisation.

A CAR arrangement should be reviewed whenever the company adds a new product, service, or client category. A new activity may require an expanded CAR authority, an AFSL variation by the licensee or a different licensing structure altogether.

ASIC Registration

The AFSL holder must notify the Australian Securities and Investments Commission (ASIC) when it appoints a CAR. Under Section 916F of the Corporations Act, appointments must generally be notified within 30 business days. ASIC then records the CAR on the AFS Authorised Representatives Register. Changes and cessations must also generally be notified within the prescribed period.

Registration is important, but it does not determine whether every activity carried on by the CAR is legally covered. The underlying authority and the capacity in which the financial service is actually provided remain critical.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Operating Through a Corporate Authorised Representative

Sub-Authorising Directors and Employees

A company acts through individuals. This makes sub-authorisation one of the most important practical differences between a CAR and an individual authorised representative.

Under Section 916B of the Corporations Act, an authorised representative may sub-authorise individuals to provide financial services on behalf of the licensee where the AFSL holder has given the required consent. ASIC specifically notes that a body corporate AR will generally need to sub-authorise the directors and employees who actually provide financial services.

The CAR should therefore identify which staff actually perform regulated activities rather than assuming all directors and employees automatically operate under the corporate appointment. Where an individual provides personal advice to retail clients on relevant financial products, separate Financial Advisers Register and registration requirements may also apply.

Control of Products and Client Relationships

A CAR can have its own brand, employees and commercial operations. However, the structure becomes more difficult where the company operates as an entirely independent financial services business and the AFSL holder provides little more than regulatory coverage.

Questions that matter in practice include:

who controls the regulated financial products;
who approves disclosure and marketing;
who determines which clients may be serviced;
who makes material compliance decisions; and
how the AFSL holder supervises the services provided under its licence.

The legislation does not prescribe one commercial structure. However, the actual operating model should be consistent with the proposition that the CAR provides the relevant financial services as representative of the AFSL holder.

AFSL Holder Oversight

An AFSL holder remains responsible for supervising representatives appointed under its licence, making advice from AFSL lawyers advising on licensee supervision and representative governance particularly important. Under Section 912A(1)(ca) of the Corporations Act, a licensee must take reasonable steps to ensure its representatives comply with the financial services laws. This also includes representative training, competence, resources, compliance, and supervision as part of the general AFSL framework.

Depending on the CAR’s business, oversight may include:

initial due diligence;
defined approval authorities;
compliance and incident reporting;
review of marketing and disclosure;
file or transaction monitoring;
training; and
periodic review of the CAR’s activities and authorisations.

These are practical governance controls rather than a mandatory statutory checklist. The level of oversight should reflect the services provided and the risks they create.

Liability for CAR Conduct

The CAR structure can also create significant exposure for the AFSL holder. Where Division 6 of Part 7.6 applies and the representative acts for only one licensee, Section 917B of the Corporations Act generally makes the licensee responsible, as between itself and the client, for the representative’s conduct whether or not that conduct was within authority.

That statutory allocation of responsibility is one reason CAR agreements commonly contain detailed compliance, audit, indemnity, and termination provisions. The AFSL holder is not simply licensing its number to another company. It has a direct regulatory and commercial interest in how the CAR operates.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Limits of the Corporate Authorised Representative (CAR) Model

Representative Capacity After ASIC v BPS Financial

The most important recent authority for CAR structures is ASIC v BPS Financial Pty Ltd [2025] FCAFC 74 (‘BPS Financial‘).

BPS was a CAR of an AFSL holder. However, the Full Federal Court held that it could not rely on the authorised representative exemption for financial services relating to the Qoin Wallet because BPS was acting on its own behalf, rather than as representative of its AFSL holder.

The case confirms that a written CAR appointment and ASIC registration are not enough by themselves. Section 911A(2)(a) of the Corporations Act requires the relevant financial service to actually be provided in representative capacity.

For CARs, the key issue is therefore whether the legal documents and commercial reality point in the same direction.

Independent Product Businesses

The BPS Financial decision is particularly relevant where a company independently develops and operates its own financial product before seeking a CAR arrangement.

Relevant circumstances in BPS Financial included the company’s independent development of the product, limited involvement by the AFSL holder and the overall customer-facing relationship reflecting BPS’s own business rather than the licensee’s.

The Full Court did not decide that a financial product issuer can never rely on the authorised representative exemption. However, companies that control their own product issuance, distribution and customer relationships should obtain specific advice before assuming a CAR appointment provides sufficient AFSL coverage.

CARs That Already Hold an AFSL

A company that already holds an AFSL cannot generally become an authorised representative of another licensee. Under Section 916D of the Corporations Act, an AFS licensee cannot be appointed as the authorised representative of another AFS licensee, subject to the specific exception in Section 916E. A purported appointment contrary to Section 916D is void.

This is particularly important for businesses with limited or narrow licence authorisations.If the company wants to provide additional services outside its existing AFSL, becoming a CAR of another licensee will generally not provide a simple workaround. The business may instead need to consider varying its own AFSL or another lawful structure.

Multiple AFSL Holders

A CAR may potentially represent more than one AFSL holder. Under Section 916C of the Corporations Act, multiple appointments generally require each relevant licensee to consent, unless a statutory exception applies.

Where a CAR represents multiple licensees, the company should clearly identify which AFSL holder it represents for each financial service.

That distinction is particularly significant after BPS Financial, because the exemption depends on the capacity in which the particular service is provided.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

CAR Governance in Practice

CAR Agreement and Operating Controls

The CAR agreement should do more than simply record the company’s appointment; it should be supported by AFSL compliance services for CAR agreements and operating controls.

It should clearly address matters such as:

permitted products and financial services;
retail and wholesale client restrictions;
sub-authorised staff;
approval of marketing and disclosure;
complaints, incidents, and breach escalation;
monitoring and audit rights; and
suspension and termination.

Not every one of these provisions is expressly prescribed by the Corporations Act. They help define how the representative relationship will work and support the AFSL holder’s supervisory obligations.

Changes to the CAR Business

CAR arrangements can become non-compliant when the business evolves but the licensing structure does not.

A company may, for example, add a financial product, begin servicing retail clients, change its advice model or hire new staff without checking whether those activities remain within the AFSL and CAR authority.

The CAR and AFSL holder should therefore review the arrangement before material business changes are implemented.

The relevant question is always whether the new activity remains within the AFSL, the written CAR appointment and the representative capacity required by Section 911A(2)(a) of the Corporations Act.

Ongoing Compliance Responsibilities

CAR status removes the need for the company to hold its own AFSL for services validly covered by the exemption. It does not exempt the CAR or its staff from the financial services laws more generally. Depending on the business model, obligations may still arise concerning:

disclosure;
Financial Services Guides;
advice conduct;
misleading or deceptive conduct;
conflicts and remuneration; and
financial adviser professional standards.

The precise obligations depend on the services, products and client base.

AFSL holders reviewing their CAR supervision and broader representative governance can use Click Legal’s free AFSL Compliance Checklist.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Common Corporate Authorised Representative Mistakes

CAR problems commonly arise where the parties focus on the paperwork but not the company’s actual operations. Common mistakes include:

assuming ASIC registration means every CAR activity is covered;
allowing directors or employees to provide regulated services without considering sub-authorisation;
providing services outside the CAR’s written authority;
failing to check whether the AFSL covers a new service;
treating the CAR as an independent business merely “using” the licensee’s AFSL;
launching new products without revisiting the licensing structure;
assuming a CAR can sub-authorise another company;
failing to update ASIC when appointments or details change; and
assuming CAR status removes other direct financial services obligations.

The most useful compliance question is therefore not simply “is the company a CAR?” It is:

What financial service is being provided, who is providing it, what authority covers it and on whose behalf is the service actually being provided?

CAR Versus Holding Your Own AFSL

When a CAR Structure Can Work Well

A CAR arrangement can be suitable where a company genuinely intends to operate within another licensee’s compliance and supervisory framework. It may work particularly well where:

the required services already fall within the AFSL;
the CAR is comfortable operating within the licensee’s controls;
the AFSL holder has the resources and expertise to supervise the business; and
the commercial relationship genuinely reflects representative capacity.

The structure can provide a pathway to market without the company taking on the full regulatory infrastructure associated with holding an AFSL directly.

When an Own AFSL May Be More Appropriate

A CAR structure becomes less suitable as the company seeks greater independence over its regulated business.

An own AFSL may be more appropriate where the company wants to control its products, customer relationships, disclosure, compliance systems and material financial services decisions without operating within another licensee’s framework.

Other considerations can include scalability, the cost of CAR supervision, commercial restrictions imposed by the AFSL holder and whether future products are likely to fit within the existing licence.

For businesses comparing the two pathways, Click Legal’s free AFSL Compliance Guide – Core Obligations for AFS Licensees explains the governance and compliance obligations that come with holding an AFSL directly.

CAR Due Diligence Before Appointment

Before a CAR arrangement begins, both the company and the AFSL holder should understand exactly what the structure is intended to cover.

As a practical starting point, confirm:

Financial services: Identify each regulated service the company will provide.
AFSL scope: Confirm the licence covers those services.
CAR authority: Align the written appointment with the proposed activities.
Individual authorisations: Identify directors and employees who need sub-authorisation.
Operating control: Determine who controls products, disclosure, customer relationships and material decisions.
Representative capacity: Confirm the business model supports reliance on Section 911A(2)(a) of the Corporations Act.

A CAR structure should be designed around the actual operating model rather than fitted around the business after regulated activities have already commenced.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Conclusion

A CAR structure can allow a company to provide specified financial services without holding its own AFSL, but the arrangement is not equivalent to having a licence. The CAR must remain within the AFSL holder’s licence, its written authority and the representative capacity required by the Corporations Act.

For companies considering the CAR model, the most important issues are therefore not simply appointment and ASIC registration. The structure needs to work at an operational level — including the authorisation of staff, supervision by the licensee, control of regulated activities and the degree of independence the company expects to retain — so companies can contact Click Legal’s AFSL compliance lawyers about operational CAR compliance services for help putting those requirements into practice.

Frequently Asked Questions

What is a Corporate Authorised Representative?

A CAR is a body corporate appointed as an authorised representative of an AFS licensee under Section 916A of the Corporations Act. “CAR” is an industry term rather than a separate statutory licence category.

Does a CAR need its own AFSL?

Not for services validly covered by the exemption in Section 911A(2)(a) of the Corporations Act. The service must fall within the AFSL and CAR authority and genuinely be provided as representative of the licensee.

Do CAR directors and employees need individual authorisation?

Often, yes. As discussed above, a body corporate AR will generally need to sub-authorise the directors and employees who actually provide financial services, with the AFSL holder’s consent under Section 916B of the Corporations Act.

Can a CAR sub-authorise another company?

Not under the ordinary sub-authorisation mechanism in Section 916B of the Corporations Act, which permits sub-authorisation of individuals. Another company would generally need a direct appointment from the AFSL holder.

Can a CAR provide every service on the AFSL?

No. The service must also fall within the CAR’s written appointment. The AFSL holder may authorise a CAR for only part of the licence scope.

Can a CAR develop or issue its own financial product?

Potentially, but careful analysis is required. As confirmed in BPS Financial (discussed above), the company must genuinely provide the relevant financial service as representative of the AFSL holder rather than merely act under its own independent business model.

Can a CAR be appointed by more than one AFSL holder?

Yes, subject to Section 916C of the Corporations Act, which generally requires the relevant licensees to consent unless an exception applies.

Can a company with its own AFSL also become a CAR?

Generally no — as explained above, Section 916D of the Corporations Act prevents one AFS licensee from becoming the authorised representative of another (subject to the limited Section 916E exception).

When should a CAR obtain its own AFSL?

An own AFSL may become more appropriate where the company wants independent control over its regulated products, clients, compliance framework and financial services operations rather than operating within another licensee’s supervisory structure.

Authorised Representative AFSL Exemption: How It Works and When You Can Rely on It

Hannah Deuk — Tue, 01 Sep 2026 04:46:55 +0000

Introduction

Obtaining your own Australian Financial Services Licence (AFSL) is not the only way to provide regulated financial services in Australia. In some circumstances, a business can operate as an authorised representative (AR) of an existing AFS licensee and rely on the exemption in Section 911A(2)(a) of the Corporations Act 2001 (Cth) (‘Corporations Act‘) instead of holding its own licence.

However, an AR arrangement is not simply a way to “use” another business’s AFSL. The relevant services must fall within the licensee’s authorisations and must genuinely be provided as representative of the AFSL holder. In this article, we explain how the AR exemption works, its limits, the obligations of both parties and when obtaining your own AFSL may be more appropriate.

Interactive Tool: See If You Qualify for the Authorised Representative Exemption

Authorised Representative (AFSL) Exemption Checker

Quickly check if your business can rely on the Authorised Representative exemption instead of holding its own AFSL.

Step 1 of 4

Are you currently providing, or planning to provide, financial services in Australia?

Step 2 of 4

Will your financial services be provided as a genuine representative of an AFSL holder (not as an independent principal)?

Step 3 of 4

Does the AFSL holder’s licence cover all the financial services you intend to provide?

Step 4 of 4

Are you intending to issue, vary or dispose of interests in your own financial product (e.g., as a product issuer or scheme trustee)?

✅ No AFSL or AR Exemption Needed

Based on your answers, you are not providing financial services as defined by Section 911A of the Corporations Act 2001 (Cth). No AFSL or Authorised Representative exemption is required for your activities.

Note: If your business activities change, you should reassess your licensing obligations.

Legal References:
Section 911A of the Corporations Act 2001 (Cth)

Get Financial Services Law Advice

✅ AR Exemption May Be Available

You may be able to rely on the Authorised Representative exemption under Section 911A(2)(a) of the Corporations Act 2001 (Cth), provided:

Your services are genuinely provided as representative of an AFSL holder,
The AFSL holder’s licence covers all relevant services,
You have a valid written appointment, and
You are not acting as principal for your own product/scheme.

Carefully review your arrangements to ensure you meet all requirements.

Warning: ASIC and the Courts will look at the substance of your relationship, not just paperwork or registration. See Australian Securities and Investments Commission v BPS Financial [2025] FCAFC 74.

Legal References:
Section 911A(2)(a) of the Corporations Act 2001 (Cth)
Section 916A of the Corporations Act 2001 (Cth)
Australian Securities and Investments Commission v BPS Financial [2025] FCAFC 74

Speak to a Lawyer about AR Arrangements

⚠️ AR Exemption Unlikely or Not Available

You are unlikely to qualify for the Authorised Representative exemption if:

You act as an independent principal,
Your commercial reality does not match a genuine representative relationship, or
The AFSL holder’s licence does not cover your services.

Key Risk: Operating without the correct AFSL or outside the exemption can result in civil penalties or criminal liability.

See Australian Securities and Investments Commission v BPS Financial [2025] FCAFC 74 and ASIC INFO 251 for guidance.

Next step: Consider whether you need your own AFSL or a variation to an existing licence.

Legal References:
Section 911A of the Corporations Act 2001 (Cth)
Australian Securities and Investments Commission v BPS Financial [2025] FCAFC 74

Get AFSL Licensing Advice

⚖️ Product Issuer Limitation – Specific Advice Needed

If you are issuing, varying, or disposing of interests in your own financial product or scheme, you may not be able to rely on the Authorised Representative exemption. ASIC’s guidance (INFO 251) and the decision in Australian Securities and Investments Commission v BPS Financial [2025] FCAFC 74 highlight that product issuers often act as principal, not as representative.

Action: You should obtain specific legal advice before proceeding.

Legal References:
Section 911A of the Corporations Act 2001 (Cth)
Australian Securities and Investments Commission v BPS Financial [2025] FCAFC 74

Speak to a Lawyer about Product Issuer AFSL Options

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

The Authorised Representative Exemption

AFSL Requirement Under Section 911A

Under Section 911A(1) of the Corporations Act, a person carrying on a financial services business in Australia must hold an AFSL covering the financial services it provides.

However, Section 911A(2)(a) provides an exemption where the person provides the financial service as representative of another person carrying on a financial services business and that principal either holds an AFSL covering the service or is otherwise appropriately exempt.

The exemption applies to the particular services provided as representative. It is not a general exemption from the AFSL regime for everything the representative does.

Appointment as an Authorised Representative

Under Section 916A(1) of the Corporations Act, an AFS licensee can appoint an AR by giving written notice authorising the person to provide specified financial services on the licensee’s behalf.

The authorisation may cover some or all of the services within the AFSL. However, Section 916A(3) provides that an authorisation is void to the extent it purports to cover a financial service that the licensee’s own AFSL does not cover.

The proposed activities should therefore be mapped against both:

the AFSL holder’s licence authorisations; and
the written authorisation granted to the representative.

ASIC Notification and Registration

Under Section 916F of the Corporations Act, the AFSL holder must notify the Australian Securities and Investments Commission (ASIC) of an AR appointment. As modified by Regulation 7.6.04AA of the Corporations Regulations 2001 (Cth) (‘Corporations Regulations‘), the notification period is generally 30 business days.

ASIC records authorised representatives on its AFS Authorised Representatives Register. Changes and cessations must also generally be notified within the prescribed period.

ASIC registration should not be confused with the legal basis for the arrangement. The written authorisation determines the services the representative is authorised to provide; ASIC notification is a separate statutory requirement.

Sub-Authorisations and Multiple AFSL Holders

An AR cannot simply appoint another business under the AFSL. Under Section 916B(3) of the Corporations Act, an AR may sub-authorise an individual to provide specified financial services on behalf of the licensee where the licensee has given the required written consent.

A person may also act as AR of multiple AFSL holders, but Section 916C generally requires the relevant licensees to consent, subject to the statutory exceptions.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Limits of the Authorised Representative Exemption

Representative Capacity After ASIC v BPS Financial

A written appointment under Section 916A of the Corporations Act does not automatically establish that the exemption in Section 911A(2)(a) applies.

In Australian Securities and Investments Commission v BPS Financial [2025] FCAFC 74 (‘ASIC v BPS Financial‘), the Full Federal Court held that BPS could not rely on the AR exemption in relation to financial services connected with the Qoin Wallet. Although BPS had been appointed as an AR of an AFSL holder, the Court found that BPS was acting on its own behalf, rather than as representative of the licensee.

The case therefore makes the distinction between formal appointment and actual representative capacity critical.

Assessing Genuine Representative Capacity

The Full Court did not create a fixed statutory test. Whether a business acts “as representative of” an AFSL holder depends on the facts.

In ASIC v BPS Financial, relevant circumstances included that:

BPS developed the product independently;
the AFSL holder had limited involvement in the product’s development and issue;
BPS sought an AFSL arrangement as an alternative to obtaining its own licence; and
the customer-facing and contractual arrangements principally reflected BPS’s own role.

These are not legislative requirements. They illustrate the broader inquiry into whether the commercial reality matches the claimed representative relationship.

A business should therefore not assume that an AR agreement and ASIC registration are sufficient where it effectively operates its own independent financial services business under another entity’s licence. Advice from AFSL lawyers on authorised representative arrangements can help assess whether the model is genuinely representative.

Product Issuers and Principal Activities

The ASIC v BPS Financial decision did not establish that a product issuer can never rely on the AR exemption; it was confined to the facts before the Court.

However, product issuers should approach the exemption cautiously. ASIC’s existing guidance in Information Sheet 251 (INFO 251) takes the view that a trustee of an unregistered managed investment scheme cannot rely on the AR exemption when issuing, varying or disposing of interests in its own scheme because it acts as principal in doing so.

Businesses issuing their own financial products should therefore obtain specific advice rather than assuming that an AR appointment removes the need for their own AFSL.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Obligations Under an Authorised Representative Arrangement

The AFSL Holder’s Supervisory Obligations

Appointing an AR does not allow an AFSL holder to outsource its regulatory responsibility.

Under Section 912A(1)(ca) of the Corporations Act, an AFS licensee must take reasonable steps to ensure its representatives comply with the financial services laws. Section 912A(1)(f) also requires the licensee to ensure its representatives are adequately trained and competent, while other Section 912A obligations may support the resources and systems required to supervise representatives.

In practice, appropriate oversight may include:

due diligence before appointment;
clearly defined approval authorities;
compliance and incident reporting;
file or transaction reviews;
training;
monitoring of marketing and disclosure; and
periodic review of whether the representative remains within scope.

AFS licensees reviewing their broader oversight arrangements can use Click Legal’s free AFSL Compliance Checklist.

Responsibility for Representative Conduct

The representative model can also create liability for the AFSL holder. Where Division 6 of Part 7.6 applies and the representative acts for only one licensee, Section 917B of the Corporations Act generally makes that licensee responsible, as between itself and the client, for the representative’s conduct, subject to the statutory qualifications and exceptions.

Different rules apply in some multiple-licensee arrangements, while Section 917D contains an exception where lack of authority is appropriately disclosed.

This is one reason AFSL holders should not treat AR arrangements as passive “licence-for-fee” arrangements. The licensee has a direct regulatory and commercial interest in the representative’s conduct.

Obligations That Still Apply to the Representative

The AR exemption removes the need for the representative to hold its own AFSL for the services covered by the exemption. It does not remove other financial services obligations. Depending on the services and client type, the representative may still have direct obligations relating to:

Financial Services Guides;
advice conduct;
disclosure;
misleading or deceptive conduct;
conflicted remuneration; and
professional standards applying to relevant providers.

For example, Section 941B of the Corporations Act can require an AR to provide an FSG when providing relevant financial services to a retail client, subject to the statutory exceptions.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Structuring an Authorised Representative Arrangement

Scope of the Written Authorisation

The written arrangement should clearly identify the financial services the representative is permitted to provide. It should also align with the AFSL holder’s actual licence authorisations and address matters such as:

permitted financial products and services;
retail or wholesale client limitations;
approval of marketing and disclosure;
compliance reporting;
use of the AFSL and representative number;
monitoring and audit rights; and
suspension and termination.

Not every contractual control is prescribed by legislation. These provisions help define the representative relationship and support the AFSL holder’s supervisory obligations.

Oversight in Practice

The written agreement and the actual commercial relationship should be consistent. Following ASIC v BPS Financial, particular risk arises where the representative independently controls its own products, customer relationships, disclosure, and material business decisions while the AFSL holder provides little more than regulatory cover.

The AFSL holder should therefore supervise the substance of the relationship, while the representative should ensure its operating model remains within the capacity on which its Section 911A(2)(a) exemption depends.

Changes to the Representative’s Business

An AR arrangement should be reviewed whenever the representative changes its products, services, or client base. A new financial product, advice service or dealing activity may fall outside:

the AFSL holder’s licence;
the representative’s written authority; or
the representative capacity on which the exemption relies.

That review should occur before the new service launches rather than after the representative has already operated outside scope.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Common Authorised Representative Mistakes

Common problems include:

assuming ASIC registration alone creates the AFSL exemption;
providing services outside the written authorisation;
failing to check whether the AFSL itself covers the service;
operating as an independent principal while describing the business as an AR;
using an AFSL holder primarily to obtain regulatory “coverage” without genuine representative capacity;
launching new products or services without reviewing the arrangement;
assuming an AR can freely appoint other representatives;
failing to notify ASIC of appointments, changes or cessations; and
assuming AR status removes other direct financial services obligations.

The key question is not simply whether a business appears on ASIC’s AR register. It is whether the particular financial service is within scope and is genuinely being provided as representative of the AFSL holder.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Authorised Representative Arrangement Versus Your Own AFSL

An AR arrangement can be appropriate where a business genuinely intends to provide financial services within another licensee’s regulatory and supervisory framework.

It may be less suitable where the business intends to independently control its own regulated products, customer relationships and financial services operations.

Before choosing the AR pathway, consider:

Financial services: Identify exactly which activities require AFSL authorisation.
Licence scope: Confirm that the AFSL holder’s licence covers those services.
Representative capacity: Determine whether the services will genuinely be provided as representative of the licensee.
Commercial control: Consider who controls products, disclosure, customers and key decisions.
Long-term model: Decide whether the business intends to remain within another licensee’s framework or requires regulatory independence.

For businesses comparing the AR model with holding their own AFSL, Click Legal’s free AFSL Compliance Guide – Core Obligations for AFS Licensees provides an overview of the obligations associated with direct licensing.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Conclusion

The AR exemption can allow a business to provide financial services without holding its own AFSL, but it is a limited statutory exemption, not a substitute licence. The relevant services must fall within the AFSL holder’s authorisations, be covered by the written appointment and genuinely be provided as representative of that licensee.

Following ASIC v BPS Financial, businesses relying on AR arrangements should look beyond the paperwork and test whether the commercial relationship genuinely reflects representative capacity. AFSL holders should likewise ensure representatives remain within scope and are appropriately supervised, and can contact our AFSL lawyers at Click Legal for representative supervision and compliance.

Frequently Asked Questions

Can a business provide financial services without its own AFSL as an authorised representative?

Yes. Section 911A(2)(a) of the Corporations Act can exempt a person from holding its own AFSL where the relevant financial service is genuinely provided as representative of an appropriately licensed or exempt principal.

Does becoming an authorised representative give a business its own AFSL?

No. An AR does not hold or share the AFSL. It provides specified services on behalf of the licensee within the scope of its written authority.

Does an authorised representative need to be registered with ASIC?

The AFSL holder must notify ASIC of the appointment under Section 916F of the Corporations Act, generally within 30 business days because of Regulation 7.6.04AA.

Can an authorised representative provide any service covered by the AFSL?

No. The service must also fall within the representative’s own written authorisation.

Can an AFSL holder authorise services its licence does not cover?

No. Under Section 916A(3) of the Corporations Act, an authorisation is void to the extent it purports to authorise a financial service outside the AFSL holder’s licence.

Can an authorised representative appoint its own representatives?

Only in limited circumstances. Under Section 916B(3) of the Corporations Act, an AR may sub-authorise an individual where the AFSL holder gives the required written consent.

Can a business be authorised by more than one AFSL holder?

Yes, but Section 916C of the Corporations Act generally requires the relevant AFSL holders to consent, subject to statutory exceptions.

Can a product issuer rely on the authorised representative exemption?

Potentially, but this requires particular care. ASIC v BPS Financial confirms that the business must genuinely act as representative of the AFSL holder rather than merely hold an AR appointment while acting on its own behalf.

When should a business obtain its own AFSL instead?

An AFSL may be more appropriate where the business intends to independently control and conduct its own regulated financial services business rather than operate within another licensee’s representative framework.

Operating Without an AFSL: Penalties, ASIC Action and How to Fix It

Hannah Deuk — Tue, 01 Sep 2026 04:42:04 +0000

Introduction

Operating a financial services business without the required Australian Financial Services Licence (AFSL) is not a minor compliance gap. If your business provides financial services in Australia without an AFSL covering those services, a valid exemption or an appropriate representative arrangement, it can contravene the Corporations Act 2001 (Cth) (‘Corporations Act‘). The business and individuals involved may be exposed to serious regulatory, financial and commercial consequences.

In this article, we explain the AFSL licensing requirement, the civil and criminal consequences of unlicensed conduct, the Australian Securities and Investment Commission‘s (ASIC) enforcement powers, the impact on client contracts and future licence applications, and the steps businesses should consider if they discover they have already operated without the required authorisation.

Interactive Tool: Check Your Risk of Operating Without an AFSL

AFSL Unlicensed Operation Risk Checker

Quickly assess your business’s exposure if you’ve operated without an Australian Financial Services Licence (AFSL) or outside your licence authorisations.

Have you (or your business) provided any financial services in Australia without holding an AFSL or outside your licence authorisations?

Was your AFSL application pending or in progress during the period you provided financial services?

Have you identified any clients, agreements, or fees affected by potential unlicensed conduct?

❌ Significant Risk of Penalties & ASIC Action

Your business may have breached Section 911A of the Corporations Act 2001 (Cth) by providing financial services without a valid AFSL or outside your licence authorisations. This can result in substantial civil penalties (up to $1.82 million for individuals and $18.2 million for corporations), criminal prosecution (up to five years’ imprisonment), and urgent ASIC enforcement action. Affected client agreements may be voidable, and fees may be recoverable by clients.

Immediate legal advice is essential to assess your exposure, stop unlicensed conduct, and develop a remediation plan.

Key statutory references: Section 911A of the Corporations Act 2001 (Cth), Section 911A(5B) of the Corporations Act 2001 (Cth), Section 1317G of the Corporations Act 2001 (Cth), Section 1311(1) of the Corporations Act 2001 (Cth), Section 1324 of the Corporations Act 2001 (Cth), Section 1323 of the Corporations Act 2001 (Cth), Section 925E of the Corporations Act 2001 (Cth), Section 925F of the Corporations Act 2001 (Cth), Section 925H of the Corporations Act 2001 (Cth), Section 920A of the Corporations Act 2001 (Cth), Section 913B of the Corporations Act 2001 (Cth), Section 913BA of the Corporations Act 2001 (Cth), Section 913BB of the Corporations Act 2001 (Cth), Section 93AA of the Australian Securities and Investments Commission Act 2001 (Cth).

Speak to a Lawyer About AFSL Breaches

⚠️ Risk: AFSL Application Does Not Authorise Interim Activity

Lodging an AFSL application does not permit you to provide financial services until your licence is granted. If you started onboarding clients or providing advice while your AFSL was pending, you may have breached Section 911A of the Corporations Act 2001 (Cth). This can trigger civil and criminal penalties, affect client contracts, and complicate future licensing.

Immediate legal advice is recommended to assess your risk and consider remediation steps.

Get Legal Advice on AFSL Application Risks

✅ No Immediate Risk Identified

Based on your answers, your business appears to have provided financial services only with a valid AFSL or under a valid exemption. No immediate compliance risk is identified. However, regular reviews are recommended to ensure your authorisations and exemptions remain current and match your actual services.

Request an AFSL Compliance Health Check

⚖️ Uncertain Position – Detailed Review Recommended

If you are unsure whether your activities required an AFSL or were properly authorised, a detailed legal review is strongly recommended. The AFSL regime is complex and mistakes can result in serious penalties. Mapping your services to the correct authorisations and exemptions is critical.

Speak to a Lawyer for an AFSL Position Review

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

AFSL Licensing Requirements

Core Requirement Under Section 911A

Under Section 911A(1) of the Corporations Act, a person carrying on a financial services business in Australia must hold an AFSL that covers the financial services being provided.

This is not limited to businesses with no AFSL at all. A business may also have a licensing problem where it holds an AFSL but provides a financial service outside the authorisations on that licence.

Whether an AFSL is required therefore depends on what the business actually does. Financial services under Section 766A can include providing financial product advice, dealing in financial products, making a market and operating certain managed investment schemes.

Exemptions and Representative Arrangements

Section 911A(2) of the Corporations Act contains several exemptions from the requirement to hold your own AFSL. Under Section 911A(2)(a), one important pathway is providing financial services as a representative of another person whose AFSL covers those services, subject to the representative requirements in Section 911B.

However, describing a business as a consultant, partner or “representative” of an AFSL holder is not enough. The arrangement must satisfy the relevant requirements in Sections 911A, 911B and, where applicable, Division 5 of Part 7.6, including the authorised representative provisions.

The same applies to other AFSL exemptions. The business should identify the precise exemption relied on, including any exemption under Section 911A(2), ASIC relief under Section 926A or regulatory exemption under Section 926B, and confirm that all applicable conditions continue to be satisfied.

Operating While an AFSL Application Is Pending

Lodging an AFSL application does not give a business interim permission to start providing financial services.

Section 913A of the Corporations Act provides the mechanism for applying for an AFSL, but the licensing requirement in Section 911A continues to apply until the licence is granted unless another valid exemption or representative arrangement applies.

A business that starts onboarding clients, advising on financial products or dealing in financial products while its AFSL application is “in progress” may therefore still be operating unlawfully.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Consequences of Operating Without an AFSL

Civil and Criminal Penalties

Contravening Section 911A(1) of the Corporations Act can result in both civil and criminal liability.

Under Section 911A(5B), a contravention of Section 911A(1) is also a civil penalty contravention. Section 1317G permits substantial pecuniary penalties, including maximum fixed amounts of 5,000 penalty units for an individual and 50,000 penalty units for a corporation, subject to the alternative benefit and turnover-based calculations in that section.

Under Section 4AA of the Crimes Act 1914 (Cth) and the Crimes (Amount of a Penalty Unit) Instrument 2026, one Commonwealth penalty unit is $364 for offences committed on or after 1 July 2026. The fixed statutory amounts therefore equate to $1.82 million for an individual and $18.2 million for a corporation, before considering the alternative statutory calculations.

There is also criminal exposure. Section 911A(1) is an offence through Section 1311(1), and Schedule 3 prescribes a maximum penalty of five years’ imprisonment. Under Sections 1311B and 1311C, this can instead or additionally result in a fine of up to 600 penalty units for an individual or 6,000 penalty units for a corporation.

Individuals are not automatically personally liable simply because they are directors, but exposure may arise where they themselves contravene the provision or are involved in the offending conduct.

ASIC Injunctions and Asset Preservation

ASIC does not need to wait until a final penalty proceeding before seeking to stop unlicensed conduct.

Under Section 1324 of the Corporations Act, the Court can grant an injunction restraining conduct that contravenes or would contravene the Act. Where the statutory conditions are satisfied, Section 1323 also allows the Court to make orders restricting dealings with money, financial products or other property.

Depending on the circumstances, these powers can allow ASIC to seek urgent orders stopping the business from continuing the relevant activity and preserving assets while the matter is investigated or litigated.

ASIC may also accept an enforceable undertaking under Section 93AA of the Australian Securities and Investments Commission Act 2001 (Cth) (‘ASIC Act‘). Public ASIC warnings, court proceedings and enforcement announcements can also create reputational consequences that extend beyond the direct penalty.

Contract and Fee Consequences

Unlicensed conduct can also affect the provider’s contractual rights.

Division 11 of Part 7.6 of the Corporations Act contains specific remedies relating to agreements with certain unlicensed financial services providers. Where the statutory requirements are satisfied, Sections 924A and 925A can allow a client to rescind an affected agreement.

Further consequences can include:

Section 925E: restricting the unlicensed provider from enforcing or relying on the agreement against the client;
Section 925F: restricting recovery of brokerage, commission or other fees; and
Section 925H: allowing certain fees already paid to be recovered.

These provisions do not make every contract connected with unlicensed conduct automatically void. Their application depends on the particular agreement and statutory conditions. However, a business that operated without the required AFSL should not assume it can enforce its ordinary contractual rights or retain all fees received.

Banning Orders and Personal Consequences

The consequences can extend beyond the company that provided the unlicensed services.

Under Section 920A of the Corporations Act, ASIC can make a banning order where one of the statutory grounds is satisfied, including where a person has not complied with a financial services law or has been involved in another person’s contravention.

Further, under Section 920B(1) a banning order can prohibit a person from providing financial services, controlling an entity that carries on a financial services business or performing specified functions within one.

For founders, directors and senior managers, public findings of unlicensed conduct can also have broader commercial consequences. They may affect future regulatory dealings, potential representative appointments, investor confidence, fundraising, and relationships with financial institutions and counterparties.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Delayed Licensing and Future AFSL Applications

No Retrospective Authorisation

Obtaining an AFSL later does not retrospectively authorise earlier conduct.

If the business was required to hold an AFSL when the relevant service was provided, a licence granted later may allow it to operate lawfully going forward but does not erase the historical period of unlicensed activity.

The same applies to a later authorised representative appointment. A properly structured appointment can authorise future services within its scope, but it does not retrospectively convert earlier conduct into authorised conduct.

Impact on a Future AFSL Application

Historical unlicensed activity can also complicate the licensing process itself.

Under Section 913B of the Corporations Act, ASIC must be satisfied about several matters before granting an AFSL, including the applicant’s ability to comply with its obligations as a licensee and the fit and proper person test in Section 913BA.

Under Section 913BB, the fit and proper assessment requires ASIC to consider specified matters including previous licence action, banning or disqualification orders, insolvency and relevant criminal history. It can also consider any other matter ASIC considers relevant.

Historical unlicensed conduct can therefore become something the applicant needs to explain. ASIC may want to understand how the issue arose, how long it continued, who was responsible and what remediation and governance changes have since been implemented. This makes advice from AFSL lawyers at Click Legal on historical unlicensed conduct and licensing applications important.

Operating While “Working On” the Licence

Consider a digital investment platform that starts onboarding Australian retail clients while preparing an AFSL application.

The platform operates for 18 months before identifying that its activities are not covered by an exemption. It may then need to stop the affected service, determine how existing clients and fees should be treated, address possible ASIC scrutiny and progress an AFSL application that now also involves historical non-compliance.

The fact that the business always intended to obtain an AFSL does not change whether Section 911A of the Corporations Act applied during that period.

What could have been an orderly licensing process can therefore become an urgent remediation and regulatory problem.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Common AFSL Licensing Mistakes

Businesses often enter unlicensed territory because the licensing analysis is undertaken after the business model has already launched. Common mistakes include:

assuming an AFSL is only required after reaching a particular revenue or client threshold;
starting operations because an AFSL application has already been lodged;
assuming providing services only to wholesale clients removes the AFSL requirement;
relying on an exemption without checking all of its conditions;
treating a commercial arrangement with an AFSL holder as an authorised representative appointment;
holding an AFSL but providing services outside its licence authorisations;
assuming a crypto, digital asset, software or platform-based business automatically falls outside Chapter 7 of the Corporations Act; and
continuing to operate after identifying a possible licensing issue because the business intends to correct it later.

The starting point should always be to identify what financial services the business actually provides and the legal basis authorising each service.

For a broader overview of the licensing framework and ongoing obligations, see Click Legal’s free AFSL Compliance Guide – Core Obligations for AFS Licensees.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Responding to Historical Unlicensed Conduct

Confirming the Licensing Position

The first step is to confirm whether the business was actually required to hold an AFSL for the relevant activity.

This requires mapping each product and service against the financial services definitions, identifying the relevant AFSL authorisations and checking any exemption or representative arrangement relied on.

The analysis should focus on what the business actually did, rather than how the service was described internally or to clients.

Identifying the Affected Conduct

Once a licensing gap is confirmed, establish its scope. This should include the period of unlicensed operation, the services provided, clients affected, agreements entered into and fees received.

The business should also identify who knew about or participated in the conduct and whether any client loss or other consumer harm may have resulted.

Stopping or Restricting Ongoing Services

Businesses should not assume they can continue the same activity simply because an AFSL application, licence variation or authorised representative appointment is being arranged. Where ongoing services remain outside the business’s lawful authorisation, the immediate operational position needs to be assessed.

Depending on the circumstances, this may require stopping or restructuring the affected service while the correct licensing pathway is put in place.

Remediation and ASIC Engagement

The business should then assess the regulatory and client consequences of the historical conduct. Relevant issues may include:

the enforceability of affected agreements;
fees that may be recoverable by clients;
client loss or remediation;
whether ASIC is already aware of the conduct;
whether regulatory engagement is appropriate; and
how the issue affects a pending or future AFSL application.

The appropriate response will depend heavily on the nature, duration and seriousness of the conduct.

Putting the Correct Authorisation in Place

The final step is to establish a lawful pathway before the affected financial services resume. Depending on the business model, that may involve obtaining an AFSL, varying an existing AFSL, entering into a compliant authorised representative arrangement or confirming that a specific exemption applies.

Businesses that already hold an AFSL can use Click Legal’s free AFSL Compliance Checklist to review whether their licence authorisations and wider compliance framework still match the services they actually provide.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Conclusion

Operating a financial services business without the required AFSL is not an administrative issue that can safely be fixed later. Section 911A can carry substantial civil and criminal consequences, while unlicensed conduct can also affect ASIC enforcement, client contracts, fees, future licensing and the individuals involved.

If there is uncertainty about whether a service is covered by an AFSL, representative arrangement or exemption, contact Click Legal to arrange AFSL compliance services for licensing and authorisation reviews before the service is provided. Licensing later may address the position going forward, but it does not retrospectively authorise past conduct.

Frequently Asked Questions

Is operating without an AFSL a criminal offence?

It can be. A contravention of Section 911A(1) of the Corporations Act is an offence through Section 1311(1), with a maximum penalty of five years’ imprisonment.

Is operating without an AFSL also a civil penalty contravention?

Yes. Section 911A(5B) of the Corporations Act makes a contravention of Section 911A(1) a civil penalty contravention, allowing ASIC to seek civil penalty orders.

How large can the civil penalties be?

They can run into the millions of dollars. As discussed above, the fixed maximum amounts under Section 1317G of the Corporations Act are $1.82 million for an individual and $18.2 million for a corporation, with alternative benefit and turnover-based calculations also potentially applying.

Can ASIC stop an unlicensed business from operating?

Yes. ASIC can seek an injunction under Section 1324 of the Corporations Act and asset-preservation orders under Section 1323 where the statutory requirements are satisfied.

Are contracts entered into by an unlicensed provider automatically void?

No. Division 11 of Part 7.6 of the Corporations Act provides specific remedies depending on the circumstances, including rescission, restrictions on enforcement and recovery of certain fees.

Can clients recover fees paid to an unlicensed provider?

Potentially. Section 925H Corporations Act can allow a client to recover brokerage, commission or other fees paid in connection with an affected agreement.

Can a business operate while ASIC assesses its AFSL application?

Not merely because the application has been lodged. The business still requires an AFSL, valid exemption or appropriate representative arrangement covering the financial services being provided.

Can ASIC ban a director or founder for unlicensed conduct?

Potentially. Section 920A of the Corporations Act allows ASIC to make a banning order where one of the statutory grounds is satisfied, including certain contraventions of financial services laws or involvement in another person’s contravention.

Does getting an AFSL later fix past unlicensed conduct?

No. A later AFSL can authorise future financial services within its scope but does not retrospectively authorise services provided before the licence was granted.

ASIC INFO 225 on Financial Products & Services: Complete Guide for Digital Asset Businesses

Hannah Deuk — Tue, 01 Sep 2026 04:36:49 +0000

Introduction

Businesses dealing with digital assets must determine whether their tokens or services fall within the financial product definitions under Section 763A of the Corporations Act 2001 (Cth) (‘Corporations Act‘). The Australian Securities and Investments Commission (ASIC) Information Sheet 225 (INFO 225) explains how these definitions apply to digital assets and when an Australian financial services licence is required.

This classification drives licensing, custody, risk management, and compliance obligations across a business’ operations. In this article, we explain the financial product categories in INFO 225, the licensing framework, and the steps businesses should take before ASIC’s no-action position expires on 30 September 2026.

Interactive Tool: Check If Your Digital Asset Is a Financial Product

ASIC INFO 225 Digital Asset Classification Checker

Quickly check if your digital asset or service may be a financial product under ASIC Information Sheet 225 and the Corporations Act.

What is the main function of your digital asset or service?

Does your business or platform hold or control client assets or private keys?

Are you providing advice or recommendations about digital assets to clients?

⚖️ Likely a Financial Product – AFS Licence Required

Your arrangement is likely to be classified as a financial product under ASIC Information Sheet 225 and Section 763A of the Corporations Act 2001 (Cth). If you are dealing, advising, or providing custody, you will generally need an Australian Financial Services (AFS) licence or authorised representative status.

Next steps: Review your asset against the definitions for managed investment schemes, securities, and non-cash payment facilities. Ensure your licensing, custody, and risk management protocols are up to date before the ASIC no-action position expires on 30 September 2026.

Legal References

Section 763A of the Corporations Act 2001 (Cth)
ASIC Information Sheet 225
Section 764A(1)(b) of the Corporations Act 2001 (Cth)

Speak to a lawyer about your AFSL and compliance obligations

⚠️ May Be a Non-Cash Payment Facility

Your digital asset or service may be regulated as a non-cash payment facility under Section 763D of the Corporations Act 2001 (Cth). If you enable payments to multiple parties or operate a wallet, you may require an AFS licence and must comply with ASIC custody and financial requirements.

Check if the single-payee exemption or incidental product exclusion applies. Review your AML/CTF controls and ensure AUSTRAC registration if required.

Legal References

Section 763D of the Corporations Act 2001 (Cth)
ASIC Information Sheet 225

Get legal advice on payment facility and AML/CTF compliance

⚖️ Asset May Be a Security or Derivative

Your digital asset may be classified as a security (such as a share or debenture) or a derivative under Section 92(5) of the Corporations Act 2001 (Cth) and Section 761D of the Corporations Act 2001 (Cth). This triggers strict licensing, disclosure, and ongoing compliance requirements.

Offering securities or derivatives to retail clients may also invoke additional obligations under Chapter 2L.

Legal References

Section 92(5) of the Corporations Act 2001 (Cth)
Section 761D of the Corporations Act 2001 (Cth)
ASIC Information Sheet 225

Speak to a lawyer about securities and derivatives obligations

✅ Custodial/Depository Service – Additional Requirements

If you hold or control client assets or private keys, you are likely providing a custodial or depository service under Section 766E of the Corporations Act 2001 (Cth) and must comply with ASIC custody standards, net tangible asset requirements, and client money rules.

Review your compliance with the ASIC Corporations (Custody Standards for Providers of Custodial and Depository Services) Instrument 2024/17 and ensure client assets are segregated.

Legal References

Section 766E of the Corporations Act 2001 (Cth)
ASIC Corporations (Custody Standards for Providers of Custodial and Depository Services) Instrument 2024/17
ASIC Information Sheet 225

Get legal advice on custody and compliance frameworks

⚠️ Financial Product Advice – AFS Licence Likely Needed

If you provide advice or recommendations about digital assets that are or may be financial products, you will generally need an AFS licence under Section 911A(1) of the Corporations Act 2001 (Cth) and must comply with the obligations for financial product advice in Section 766B of the Corporations Act 2001 (Cth).

Legal References

Section 911A(1) of the Corporations Act 2001 (Cth)
Section 766B of the Corporations Act 2001 (Cth)
ASIC Information Sheet 225

Speak to a lawyer about your advice obligations

❌ Unclear Classification – Seek Legal Advice

Your digital asset or service does not clearly fit the main regulated categories under ASIC Information Sheet 225. Classification depends on the asset’s rights, features, and use.

We recommend a detailed legal review to determine your obligations and avoid compliance risks.

Legal References

ASIC Information Sheet 225
Corporations Act 2001 (Cth)

Speak to a lawyer for a digital asset classification review

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Financial Products Under ASIC Information Sheet 225

Facilities for Making a Financial Investment

Under Sections 763A(1)(a) and 763B of the Corporations Act, a digital asset or related arrangement may be a facility through which a person makes a financial investment where the requirements in Section 763B are satisfied. This characterisation arises where:

a client gives money or money’s worth to another person;
the contribution is used or intended to generate a financial return or benefit; and
the client lacks day-to-day control over its use.

INFO 225 explains that the return does not need to be paid as interest, dividends or cash distributions. It may arise through retained earnings, capital growth, buy-backs or other benefits linked to the success of the business or project. A token issued to fund an exchange, with holders expecting value to increase if the exchange succeeds, may fall within this category.

Interests in a Managed Investment Scheme

The definition of ‘managed investment scheme’ in Section 9 of the Corporations Act contains three principal elements, which INFO 225 applies to digital asset arrangements. An interest in a managed investment scheme is a financial product under Section 764A(1)(b). The arrangement is more likely to meet this description where:

contributors provide money or money’s worth to acquire rights to benefits;
contributions are pooled or used in a common enterprise to produce financial benefits or interests in property; and
contributors do not have day-to-day control over the scheme’s operation.

Further, INFO 225 explains that an arrangement does not need to use a trust structure to satisfy the managed investment scheme definition. A token representing an interest in pooled funds used to acquire and manage an apartment building may be an interest in a managed investment scheme where investors expect benefits from rising property values or rental income.

Securities & Derivatives

A digital asset may be a security where the rights attached to it fall within the definition of a security in Section 92(5) of the Corporations Act, including rights resembling those attached to a share. A token giving an enforceable right to repayment of money lent to a company may be a debenture, within the definition in Section 9. Where a debenture is offered to retail investors, Chapter2L of the Corporations Act may impose further obligations.

Section 761D(1) of the Corporations Act defines a derivative by reference to future consideration whose amount or value is determined by, derived from or varies with something else. That underlying reference may include:

another digital asset;
a digital asset index;
a commodity;
real estate; or
a financial product.

Wrapped tokens and contracts linked to a digital asset may therefore require assessment as derivatives.

Non-Cash Payment Facilities

Section 763D(1) of the Corporations Act covers facilities through which a person makes, or can make, payments to more than one person without physically delivering Australian or foreign notes or coins. INFO 225 states that this may include arrangements using:

digital assets;
loyalty points; or
other forms of value.

As per INFO 225, custodial or non-custodial digital asset wallet may be a non-cash payment facility where users can transfer tokens to third parties, including users of another wallet service. Certain stablecoins may also fall within this category where they are designed, marketed and used as a payment method. The single-payee exemption in Section 763D(2)(a)(i) and the incidental financial product exclusion in Section 763E of the Corporations Act may affect the assessment.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

AFSL Requirements & Financial Services for Digital Assets

Dealing & Providing Financial Product Advice

Under Section 911A(1) of the Corporations Act, a person carrying on a financial services business in Australia generally needs an Australian Financial Services (AFS) licence, so businesses should consider AFSL compliance services for digital asset businesses when assessing their licensing obligations.

A business may also be able to provide specified services as an authorised representative under Section 916A. In both these cases, licence must include authorisations covering the relevant financial products and services, unless an exemption applies.

Under the Sections 766C(1) and (2) of the Corporations Act, dealing includes:

buying and selling a financial product;
issuing, varying or disposing of it; and
arranging for another person to deal in it.

Section 766C(3) generally excludes dealing on a person’s own behalf, subject to specified exceptions.

A business that acts as a broker for clients buying or selling digital assets that are financial products may therefore be providing a financial service. As per Section 766B(1), providing financial product advice can also require an AFS licence where a recommendation or opinion is intended to influence a consumer’s decision, including comparisons between digital assets or between a digital asset and a traditional financial product.

Custodial or Depository Services

Under Section 766E(1) of the Corporations Act, a digital asset service may involve a custodial or depository service where the provider holds a financial product, or a beneficial interest in it, on trust for or on behalf of a client.

INFO 225 states that controlling the private keys linked to a public blockchain address will likely indicate that the provider is offering a custodial or depository service. A self-custody or self-hosted wallet, where the provider does not control the client’s private keys, is unlikely to have that character.

Custody requirements are imposed through the Corporations Act and the ASIC Corporations (Custody Standards for Providers of Custodial and Depository Services) Instrument 2024/17 (‘ASIC Instrument 2024/17‘). Regulatory Guide (RG) 133 provides ASIC’s guidance on complying with these obligations. INFO 225 states that eligible digital asset custody arrangements may use omnibus holdings, but client assets must remain separate from firm assets.

Under the ASIC Corporations (Financial Requirements for Custodial or Depository Service Providers) Instrument 2023/648 (Cth) (‘ASIC Instrument 2023/648‘), a custodial or depository service provider typically requires at least $10 million in net tangible assets and 10% of average revenue. A lower requirement may apply where custody is incidental, including $150,000 where the relevant conditions are met.

Managing Conflicts of Interest & Client Money

AFS licensees must maintain adequate arrangements for managing conflicts of interest under Section 912A(1)(aa) of the Corporations Act. Digital asset businesses may face conflicts where related entities issue tokens, operate a trading platform, provide brokerage or custody, make markets, or trade on their own account.

As practical measures for managing these conflicts, ASIC identifies measures including:

assigning responsibility for conflict management;
avoiding preferential treatment of related-party assets; and
separating business functions into different legal entities where appropriate.

Client money is governed by Division 2 of Part7.8 of the Corporations Act. Money covered by that regime must be held in a separate trust account with an Australian authorised deposit-taking institution, as mandated by Section 981B. Further, Section 981H treats that money as held on trust for the person entitled to it.

This requirement separates client funds from the firm’s own money and supports protection against misuse or loss. Where the provider cannot immediately distinguish money connected with financial products from other funds, relief may be considered case by case under ASIC’s relief process.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Digital Assets Framework Reforms & ASIC No-Action Position

The Corporations Amendment Act 2026

The Corporations Amendment (Digital Assets Framework) Act 2026 (Cth) (‘Corporations Amendment Act‘) passed Parliament on 1 April 2026 and received Royal Assent on 8 April 2026. It commences on 9 April 2027. It provides a six-month statutory transition period under future Section 1730 of the Corporations Act. This is separate from ASIC’s broader 18-month roadmap for implementing the new regime.

From that date, digital asset platforms and tokenised custody platforms will come within the financial services licensing regime. ASIC will license and supervise these platforms, with the new regime supported by standards covering matters such as:

holding client assets;
transactions and settlement; and
financial requirements.

Extended No-Action Position for Digital Asset Businesses

ASIC has extended its conditional class no-action position for eligible digital asset businesses, with relevant steps generally required by 30 September 2026. The extended position covers:

businesses applying for or varying an AFS licence;
businesses operating under, or entering into, authorised representative arrangements or intermediary authorisation arrangements with an AFS licence holder; and
firms seeking an Australian Market Licence or Clearing and Settlement facility licence, including the need to notify ASIC in writing of the intended application and hold a pre-meeting with ASIC.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Risk Management & AUSTRAC Registration for Digital Asset Exchanges

Implementing Adequate Risk Management Systems

AFS licensees must have adequate risk management systems under Section 912A(1)(h) of the Corporations Act. For entities dealing with digital assets, these systems need to address risks associated with the exchanges and service providers used to access or hold those assets, and INFO 225 identifies several risks as matters requiring attention, including:

market risks;
cyber risks; and
custody risks.

The risk systems should also reflect the nature, scale and complexity of the business, including how digital assets are traded, stored and accessed.

AUSTRAC Registration & AML/CTF Compliance

As a good practice guidance, INFO 225 states that a responsible entity should conduct reasonable due diligence on each digital asset exchange it relies on. The responsible entity should be satisfied that the exchange:

is a digital currency exchange provider registered with the Australian Transaction Reports and Analysis Centre (AUSTRAC), where registration is required, or is regulated under foreign laws implementing Financial Action Task Force (FATF) recommendations on customer due diligence and record-keeping; and
has risk-based AML/CTF systems and controls supervised or monitored by a body with legal authority to enforce those requirements.

These checks support the management of customer identification, record-keeping and criminal activity risks. Click Legal’s free AML/CTF Compliance Checklist can assist reporting entities when reviewing their AML/CTF controls.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Common ASIC INFO 225 Compliance Mistakes

Relying on Overseas Digital Asset Categories

A business may incorrectly assume that an overseas label, such as “utility token” or “exchange token”, has the same meaning in Australia. INFO 225 explains that international categories do not necessarily correspond with Australian financial product categories.

Instead, the business should assess the rights, benefits, features and practical use of each digital asset against Australian law. The Australian definitions of financial products and financial services may be broader than comparable concepts in other jurisdictions, including where the issuer or service provider operates from offshore.

Treating a No-Action Position as a Legal Exemption

Treating ASIC’s no-action position as though it changes the underlying law. As discussed above, the position is an enforcement approach, not a statutory exemption, and treating it as permission to operate without assessing licensing requirements can leave a business relying on an assumption the position does not support.

Failing to Update Disclosures for Digital Assets

Digital asset communications and disclosures can become inaccurate when the asset’s rights, benefits, features, or uses change. INFO 225 states that statements about fundraising must remain consistent with the terms and conditions, offering materials and other information given to consumers.

Misleading or deceptive conduct may be prohibited whether or not the digital asset is a financial product, although the applicable statutory provision depends on the conduct and product involved. The applicable prohibitions depend on the classification of the asset:

for financial products and financial services, relevant prohibitions include Section 1041H of the Corporations Act and Section 12DA of the Australian Securities and Investments Commission Act 2001 (Cth); and
where the Australian Consumer Law applies, Section 18 of Schedule 2 to the Competition and Consumer Act 2010 (Cth) prohibits misleading or deceptive conduct in trade or commerce.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Step-by-Step Guide to ASIC INFO 225 Compliance

Step 1: Assess Digital Assets Against Financial Product Definitions

Map each digital asset and related arrangement against the financial product definitions in the Corporations Act. Review the rights, benefits, features, marketing materials and practical use associated with each asset.

The assessment should consider whether the arrangement may involve:

a facility for making a financial investment;
an interest in a managed investment scheme;
a security or derivative; or
a non-cash payment facility.

As a practical compliance measure, record the reasons for each classification and reassess the position if the asset’s rights, benefits, or features change.

Step 2: Review Existing AFSL Authorisations

Compare each digital asset service with the authorisations on the business’s AFS licence. An AFS licence does not cover every financial product or service; its scope depends on the authorisations stated on the licence.

Check whether the business is dealing, issuing, advising, making a market or providing custody in relation to a financial product. If a proposed service falls outside the existing authorisations, assess whether a licence variation or an authorised representative arrangement is required before providing that service.

Step 3: Verify AUSTRAC Registration for Partner Exchanges

Conduct reasonable due diligence on each digital asset exchange used by the reporting entity, its authorised participants, market makers or other service providers. As discussed earlier, INFO 225 expects the exchange to be AUSTRAC-registered (where required) or regulated under equivalent foreign laws, and to maintain risk-based AML/CTF systems subject to supervisory oversight. Keep records supporting the exchange-selection decision and any later review.

Step 4: Update Risk Management & Custody Protocols

Review the entity’s risk management systems against the market, cyber and custody risks associated with its digital asset activities, as Section 912A(1)(h) requires for AFS licensees.

Assess custody arrangements against RG 133, confirming that client assets remain separated from firm assets and that the provider controls the relevant private keys. The review should also address how digital assets are traded, stored and accessed, with controls suited to the nature, scale, and complexity of the business.

Step 5: Prepare for the Digital Assets Framework Transition

Map the business’s activities against the transition to the new digital assets framework (commencing 9 April 2027), covering asset holding, transactions, settlement and financial requirements.

The extended ASIC no-action position expires on 30 September 2026. As discussed above, it is an enforcement position rather than a statutory exemption. Review licensing plans and applicable conditions before that date. Click Legal’s free AML/CTF Rules 2025 Guide – Tranche 2 & Existing Reporting Entities can assist with reviewing related AML/CTF compliance work.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Conclusion

INFO 225 shows that a digital asset’s classification depends on its rights, benefits, features, practical use and related arrangements, rather than its label alone. That classification can affect whether the asset is a financial product, whether an AFS licence is required, and which custody, risk management and disclosure obligations apply.

With that distinction in mind, review each asset, service, and licence authorisation before launching or changing an offering, and consider the 30 September 2026 expiry of ASIC’s extended no-action position. Contact Click Legal’s AML/CTF compliance lawyers for clear, practical assistance with assessing your digital asset operations and preparing for the applicable licensing requirements.

Frequently Asked Questions

Are all digital assets considered financial products in Australia?

No, not all digital assets are financial products under the Corporations Act. INFO 225 explains that the classification depends on the rights and benefits attached to each digital asset, including whether it is a facility for making a financial investment or an interest in a managed investment scheme.

Does Bitcoin require an AFS licence to trade?

Bitcoin is unlikely to be a financial product, so trading it generally does not require an AFS licence. INFO 225 notes there is no identifiable issuer promising returns from pooled funds, and Bitcoin does not meet the definition of any other financial product type.

What is the penalty for operating a digital asset market without a licence?

Operating a financial market without an Australian market licence is a breach of the Corporations Act. INFO 225 confirms that platform operators must not allow financial products to be traded on their platform without the appropriate licence.

How does the extended no-action position affect digital asset businesses?

ASIC’s extended no-action position gives digital asset businesses until30 September2026 to apply for or vary an AFS licence without ASIC taking enforcement action. The position now also covers businesses operating under authorised representative arrangements and intermediary authorisation arrangements with AFS licence holders.

When will the new Digital Assets Framework commence?

The Corporations Amendment Act commences on9 April2027. ASIC has published an18-month roadmap for implementing the new regime, which will bring digital asset platforms and tokenised custody platforms under the financial services licensing framework.

Do overseas digital asset issuers need to comply with Australian laws?

Yes, Australian laws apply where a digital asset is promoted or sold, or services are provided, in Australia—even if the issuer or service provider operates from offshore. INFO 225 confirms that using offshore or decentralised structures does not remove obligations under Australian laws.

Can a digital asset wallet be a non-cash payment facility?

Yes, a digital asset wallet may be a non-cash payment facility under Section 763D of the Corporations Act. INFO 225 notes that wallets with a ‘pay anyone’ feature allowing transfers to another person’s wallet are particularly likely to fall within this category.

What are the net tangible asset requirements for digital asset custodians?

A custodial or depository service provider typically requires at least $10 million in net tangible assets under ASIC Instrument 2023/648. Where custody is incidental to other financial services, the NTA requirement drops to $150,000, or may be nil where the provider does not hold physical custody.

Are stablecoins regulated as financial products by ASIC?

Certain stablecoins are likely to be financial products, depending on their structure. INFO 225 indicates that yield-bearing stablecoins are likely to be interests in a managed investment scheme, while non-interest-bearing stablecoins pegged to fiat currency are likely to be non-cash payment facilities.

How to Conduct an AML/CTF Risk Assessment and What Should it Include

Hannah Deuk — Tue, 01 Sep 2026 04:31:49 +0000

Introduction

Under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (‘AML/CTF Act‘), every reporting entity must complete a documented risk assessment before providing any designated service. Section 26E makes it a civil penalty provision to commence services without a current risk assessment in place.

This requirement applies to reporting entities subject to Part 1A of the AML/CTF Act and regulated by the Australian Transaction Reports and Analysis Centre (AUSTRAC). In this article, we explain how to conduct an AML/CTF risk assessment and what it should include.

Interactive Tool: Check If Your AML/CTF Risk Assessment Is Up to Date & Approved

AML/CTF Risk Assessment Readiness Checker

Quickly check if your business meets the core AML/CTF risk assessment requirements under the AML/CTF Act before providing designated services.

Have you completed a documented AML/CTF risk assessment for your business within the last three years?

Has there been any significant change to your services, customers, delivery channels or countries of operation since your last assessment?

Has your risk assessment been formally approved by a senior manager or governing body as required?

✅ AML/CTF Risk Assessment Likely Compliant

Your business appears to meet the core AML/CTF risk assessment requirements.

Under Section 26C and Section 26D of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), you must maintain a documented, up-to-date risk assessment, review it at least every three years or after any trigger event, and ensure it is formally approved by senior management.

Continue to monitor for changes and update your assessment as needed.

Legal References:

Section 26C of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)
Section 26D of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)
Section 26F(4)(c) of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)

Get AML/CTF Legal Advice

⚠️ Risk Assessment Outdated or Not Reviewed After Trigger

Your AML/CTF risk assessment is outdated or has not been reviewed after a significant change.

Section 26D of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) requires a review at least every three years, or immediately after a trigger event (such as new services, customer types, or countries). Failure to comply may result in civil penalties under Section 26E.

Legal References:

Section 26D of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)
Section 26E of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)

Speak to a Lawyer about AML/CTF Reviews

❌ Risk Assessment Not Formally Approved

Your risk assessment must be formally approved by a senior manager or governing body.

Section 26F(4)(c) of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) requires that AML/CTF risk assessments are signed off by senior management. Without formal approval, your business may not be compliant and could face regulatory scrutiny.

Legal References:

Section 26F(4)(c) of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)

Get AML/CTF Legal Advice

❌ No AML/CTF Risk Assessment Completed

Your business cannot provide designated services without a compliant AML/CTF risk assessment.

Section 26E of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) makes it a civil penalty to commence services without a risk assessment that meets the requirements of Section 26C and Section 26D. Immediate action is required to avoid significant penalties.

Legal References:

Section 26C of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)
Section 26E of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)

Speak to a Lawyer about AML/CTF Risk Assessments

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

The Legal Framework for AML/CTF Reporting Entities

Understanding the Core Obligations

A reporting entity‘s risk assessment is a legal requirement, not merely an internal compliance document. Under Section 26C(1) of the AML/CTF Act, the entity must identify and assess the money laundering, terrorism financing and proliferation financing (ML/TF/PF) risks it may reasonably face when providing designated services. Further, in terms of Rule 5-15(1) of the Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (Cth) (‘AML/CTF Rules’), the risk assessment needs to be documented before the entity first commences providing the designated service.

Section 26C(2) requires the steps used for the risk assessment to suit the nature, size and complexity of the business. For reporting entities providing designated services through a permanent establishment in Australia, Section 26C(3) also identifies matters to consider, including:

the entity’s services;
customers;
delivery channels;
countries of operation;
AUSTRAC communications; and
matters specified in the AML/CTF Rules.

Civil Penalty Consequences

A reporting entity cannot commence providing a designated service to a customer unless it complies with Section 26C or Section 26D of the AML/CTF Act. Section 26E(1) applies where the entity does not have a risk assessment that meets the relevant requirements or has not completed a required review or update.

Section 26E(2) makes this a civil penalty provision, with the following consequences:

each designated service provided through a permanent establishment in Australia is treated as a separate contravention under Section 26E(3); and
each day of provision through a permanent establishment in a foreign country is treated as a separate contravention under Section 26E(4).

Where a civil penalty provision is contravened, the AUSTRAC CEO may apply for a civil penalty order under Section 176, and the Federal Court may impose a pecuniary penalty under Section 175.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Core Risk Categories Reporting Entities Must Include in an Assessment

Assessing Customer Types & Their Risk Factors

Customer types can create different ML/TF/PF risks. Under Section 26C(3)(b) of the AML/CTF Act, the assessment must consider the kinds of customers to whom designated services are provided or proposed to be provided.

AUSTRAC guidance identifies customer risk factors that may be relevant to this assessment, including:

Politically exposed persons (PEPs), including foreign PEPs, domestic PEPs and their family members or close associates;
high-net-worth individuals whose source of wealth or funds may be difficult to establish; and
non-residents, third parties, customers with significant unexplained wealth and customers using complex legal structures.

A customer’s risk may increase when combined with higher-risk services or countries.

Evaluating Products & Designated Services

The designated services offered by a business can create different ML/TF/PF risks. Under Section 26C(3)(a) of the AML/CTF Act, the risk assessment must consider existing and proposed designated services, including new or emerging technologies connected with those services.

AUSTRAC identifies factors that may increase the ML/TF risk of particular services, including whether they involve:

high-value transactions, including physical currency or virtual assets;
legal structures that conceal ownership or the source of wealth or funds;
cross-border movement or storage of value; or
virtual asset safekeeping, virtual asset exchanges, remittance services, real estate transactions or bullion.

The assessment should record why each service may be vulnerable to exploitation.

Analysing Delivery Channels & Remote Services

The way a designated service is delivered can affect the business’s exposure to ML/TF/PF risks. Section 26C(3)(c) of the AML/CTF Act requires consideration of delivery channels, including new or emerging technologies used to provide those services.

Face-to-face delivery may allow staff to observe unusual behaviour, but forged or stolen identification can still be used.

Remote service delivery may involve email, telephone, video chat or online platforms. Remote self-service may include smart ATMs, prepaid cards, online banking and online remittance services. Remote self-service channels may carry higher risk because customers can obtain services without staff assistance or face-to-face contact.

Determining Geographic & Country Risks

Country risk concerns the jurisdictions with which the business or its customers deal when designated services are provided. Under Section 26C(3)(d) of the AML/CTF Act, the assessment must consider the countries with which the reporting entity deals, or will deal, when providing its designated services. AUSTRAC guidance expects this assessment to include Australia, countries where individual customers reside and countries where corporate customers or legal arrangements are registered or formed.

The Basel AML Index may assist with assessing country risk across areas such as:

the quality of the AML/CTF framework;
bribery, corruption and financial transparency; and
legal and political risks.

The assessment should also give a high-risk rating to countries on the Financial Action Task Force (FATF) grey or blacklists, or countries subject to Australian sanctions.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Practical Steps for Conducting an AML/CTF Risk Assessment

Identifying Inherent Risks & Vulnerabilities

Begin the risk assessment by identifying the ML/TF/PF risks the business may reasonably face before applying policies, procedures, systems or controls. This is known as assessing inherent risk. As outlined above, the assessment must address risks connected with the business’s designated services, customers, delivery channels and countries.

The assessment should record realistic scenarios, relevant customer due diligence (CDD) information and transaction data, staff feedback, industry information, regulator reports and AUSTRAC communications. It should also account for new or emerging technologies and planned services that could create additional vulnerabilities.

Assessing Likelihood & Impact

After identifying each inherent risk, assess its likelihood and potential impact. Likelihood concerns the possibility of the risk occurring within a given period, while impact concerns the damage or consequence if criminals exploit the vulnerability.

A medium-complexity business may use a risk matrix by combining likelihood and impact to produce a risk rating, such as low, medium, or high. Smaller, less complex businesses may assess impact alone. The selected method should reflect the nature, size, and complexity of the business and should be explained in the risk assessment.

Evaluating & Prioritising Your Risks

The risk assessment should show how the business will respond to each rating. Review existing controls, including Know Your Customer procedures, employee screening and transaction monitoring, then identify whether further safeguards are needed.

High-risk areas may require measures such as:

limiting the services or delivery channels available to high-risk customers; and
increasing transaction or behaviour monitoring.

If a risk cannot be appropriately managed or mitigated, the business may need to consider whether it should continue providing the designated service to that customer.

Documenting & Approving the Assessment

Record the following:

the assessment methodology;
information considered;
risk ratings;
reasons for those ratings; and
proposed mitigation controls.

AUSTRAC expects the document to be understandable and usable by the governing body, senior managers, the AML/CTF compliance officer and relevant staff.

Section 26F(4)(c) of the AML/CTF Act requires the AML/CTF policies to designate one or more senior managers as responsible for approving the ML/TF risk assessment. Separately, Section 26P(1) requires the risk assessment, and any updates to it, to be approved by a senior manager. Rule 5-15(1) of the AML/CTF Rules 2025 requires the AML/CTF program to be documented before the reporting entity first commences providing a designated service.

Reporting entities reviewing their broader AML/CTF framework can also use Click Legal’s free AML/CTF Compliance Checklist to check their key compliance arrangements.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Reviewing & Updating Your AML/CTF Risk Assessment

Mandatory Three-Year Review Cycles

A reporting entity’s risk assessment cannot remain unchanged indefinitely. Under Section 26D(1)(b) of the AML/CTF Act, the reporting entity must review its ML/TF risk assessment at least once every three years.

The review must:

identify and assess any new or changed money laundering, terrorism financing and proliferation financing risks; and
reflect the nature, size and complexity of the business, as required by Section 26D(3) of the AML/CTF Act.

Trigger Events Requiring Immediate Updates

A review is also required outside the three-year cycle when a relevant risk trigger occurs. Under Section 26D(1)(a) of the AML/CTF Act, these triggers include:

a significant change to the services, customers, delivery channels or countries considered under Section 26C(3);
new information communicated by AUSTRAC about risks connected with the reporting entity’s designated services; or
an independent evaluation report containing adverse findings about the ML/TF risk assessment, as specified in Rule 5-1(1) of the AML/CTF Rules 2025.

Under Section 26D(2) of the AML/CTF Act, the timing of the review depends on the nature of the trigger:

a change within the reporting entity’s control must be reviewed before it occurs;
a change outside its control must be reviewed as soon as practicable after it occurs; and
AUSTRAC information must be reviewed as soon as practicable after it is communicated.

Section 26D(4) of the AML/CTF Act requires the risk assessment to be updated after the review identifies issues. For a significant change within the reporting entity’s control, the update must occur before the change; in other cases, it must occur as soon as practicable after the review is completed.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Governance & Compliance Officer Obligations for Reporting Entities

Board of Directors & Governing Body Oversight

The governing body retains responsibility for oversight of the reporting entity’s AML/CTF program. Under Section 26H(1) of the AML/CTF Act, it must oversee the entity’s identification and assessment of risk for its risk assessment and its compliance with AML/CTF policies, the regulations and the AML/CTF Rules.

The governing body must also take reasonable steps to ensure the entity identifies, assesses, manages and mitigates its money laundering, terrorism financing and proliferation financing risks. A breach of Section 26H(1) of the AML/CTF Act is a civil penalty provision under Section 26H(3).

Appointing an AML/CTF Compliance Officer

A reporting entity that provides a designated service must designate an eligible individual as its AML/CTF compliance officer within 28 days of commencing that service. This obligation arises under Section 26K(1) of the AML/CTF Act, and also applies when an existing officer ceases to be eligible under Section 26K(2).

Under Section 26L of the AML/CTF Act, the compliance officer oversees and coordinates:

day-to-day compliance;
the operation of AML/CTF policies; and
communication with AUSTRAC.

The reporting entity must notify AUSTRAC of the officer’s appointment within 14 days under Section 26M(1) of the AML/CTF Act.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Conclusion

An AML/CTF risk assessment identifies the money laundering, terrorism financing and proliferation financing risks connected with a reporting entity’s services, customers, delivery channels and countries. It should be documented, approved, reviewed when required and kept up to date because Section 26E of the AML/CTF Act prohibits providing designated services without a compliant risk assessment.

For reporting entities reviewing their AML/CTF arrangements, contact Click Legal to request a consultation with our AML/CTF lawyers. For clear, practical guidance on preparing, updating and maintaining a risk assessment that reflects the business and supports its compliance obligations, contact Click Legal’s AML/CTF compliance lawyers for risk assessment guidance.

Frequently Asked Questions

What is an AML/CTF risk assessment?

An AML/CTF risk assessment is a documented evaluation of a business’s exposure to money laundering, terrorism financing and proliferation financing. It forms the foundation of a reporting entity’s compliance policies under Part 1A of the AML/CTF Act.

How often must a reporting entity update its risk assessment?

A reporting entity must review its risk assessment at least once every three years under Section 26D of the AML/CTF Act. A review must also occur before any significant change to the business’s services, customers or delivery channels.

Can I provide designated services before completing a risk assessment?

No. Section 26E of the AML/CTF Act makes it a civil penalty provision to commence providing a designated service without an up-to-date ML/TF risk assessment.

What are inherent ML/TF risks?

Inherent risks are the money laundering and terrorism financing risks a business reasonably faces before applying any policies, procedures, systems or controls to mitigate them. Identifying inherent risks is necessary to build controls that appropriately address those risks.

How do delivery channels affect ML/TF risk?

Remote delivery channels without staff assistance carry the highest ML/TF risk because the absence of in-person contact makes it easier for criminals to use forged identities and avoid detection. Face-to-face channels can be lower risk but are not risk-free.

Do I need to assess proliferation financing risk?

Yes, your risk assessment must assess proliferation financing risk. Separate policies are not required if you reasonably assess the risk as low and your existing ML/TF policies appropriately manage it, as set out in Section 26F(11) of the AML/CTF Act.

Who must approve the AML/CTF risk assessment?

The risk assessment must be approved by one or more designated senior managers under Section 26F(4)(c) of the AML/CTF Act. The governing body, such as the Board, must also exercise ongoing oversight under Section 26H(1).

When must an AML/CTF Compliance Officer be appointed?

A reporting entity must designate an AML/CTF Compliance Officer no later than 28 days after commencing to provide a designated service. Section 26K of the AML/CTF Act makes failure to do so a civil penalty provision.

What is the tipping-off offence?

Under Section 123 of the AML/CTF Act, it is a criminal offence to disclose information to a customer or third party if that disclosure could reasonably prejudice a financial crime investigation.