Original Author: Attorney Shao Jiadian
Introduction
In recent years, in compliance discussions regarding cryptocurrency payments and stablecoin projects, Australia's DCE (Digital Currency Exchange) has often been viewed as a relatively "friendly" entry path: it does not require a financial license. Instead, it only requires registration with AUSTRAC and the establishment of an anti-money laundering (AML) framework, allowing the business to conduct cryptocurrency-to-fiat currency exchange operations.
But if we stand from the perspective of...2026At this critical juncture, continuing to apply this understanding would often lead to misjudgments. Because what is currently happening in Australia is not merely an adjustment to a specific "license," but rather...Reconstructing the overall regulatory framework for virtual asset services.
The real question that needs to be answered has shifted from "Is it feasible to do DCE?" to:Under the new regulatory framework, what position does DCE hold? What issues can it still address, and what issues is it clearly unable to resolve?
The current legal status of the DCE (Digital Currency Exchange) in Australia: an anti-money laundering (AML) regulated entity, rather than a financial services license holder.
Under the current system, the so-called "Australian DCE" has its legal basis primarily in the *Anti-Money Laundering and Counter-Terrorism Financing Act 2006* (AML/CTF Act) and its supporting regulations. From a legal structure perspective, a DCE is not a financial services license under the *Corporations Act 2001*, nor does it imply that a business is recognized as a financial institution. Its essence is:When a business provides services for converting digital currencies into fiat currencies or vice versa, it falls under AUSTRAC's anti-money laundering regulatory framework and becomes a reporting entity.
The focus of such regulation is very clear:
- Whether the company identifies its customers (KYC/CDD);
- Whether transactions can be monitored and anomalies identified;
- Whether ongoing obligations such as reporting suspicious transactions have been fulfilled.
At this stage, AUSTRAC does not make value judgments about the business model itself, nor does it review whether a company is "suitable" to engage in such business. The regulatory logic is typical.Ex post (after-the-fact) regulation:First, allow the market to operate, and then correct deviations through law enforcement, audits, and penalties. It is precisely within this institutional context that the DCE has long been used by projects involving encrypted payments, OTC trading, stablecoin transactions, and others as a "entry point" for compliance.
Key Changes in 2026: Upgrade of the AML/CTF Framework and the "Registered Verification" Mechanism
The real turning point came from Australia's systematic revision of its AML/CTF regime. By the end of 2024, Australia enacted the *AML/CTF Amendment Act 2024*, and the Department of Home Affairs, together with AUSTRAC, has been advancing supporting rule updates. These updates clearly and systematically incorporate virtual asset-related designated services into the AML regulatory framework. According to the implementation arrangements that have been published,A key reform milestone related to virtual assets is March 31, 2026.This round of reform will bring at least three substantial changes:
First, the regulatory target has expanded from a "DCE single point" to a "set of virtual asset services."Fiat-to-cryptocurrency exchanges are still regulated but no longer the sole focus. Activities such as exchanges between virtual assets, value transfers, and execution of payments are now included within AUSTRAC's risk assessment and regulatory scope.
Second, the regulatory approach is shifting from post-event to pre-event.Under the new framework, merely completing enrollment is no longer sufficient to grant the qualification to conduct business. For relevant virtual asset services, companies must obtain approval from AUSTRAC.Registration Confirmation, services shall not be provided before confirmation.
Third, the focus of compliance has shifted from "whether or not there is registration" to "whether there is a sustainable compliance capability."AUSTRAC is no longer concerned solely with formal compliance documentation, but rather whether companies truly understand their service types, fund flows, and risk exposures, and have the ongoing capability to fulfill their AML/CTF obligations.
This means that the space for the previous practice of "launching first and then making up for compliance later" has been significantly reduced at the institutional level.
The Role Evolution of DCE: From "Passport" to "Service Type Label"
Under the new AML/CTF framework, DCE (Digital Currency Exchange) will not be abolished, but its legal significance has changed. Before 2026, "whether one holds a DCE license" was almost equivalent to "whether one can legally operate a cryptocurrency exchange business in Australia." After 2026, a more accurate positioning of DCE will be that it isA specific type of service within AUSTRAC's virtual asset service regulatory framework.Whether a business can legally operate depends on three more substantive issues:
- What virtual asset-related services are actually provided;
- Have these services been registered and confirmed;
- Whether the corresponding AML/CTF framework is aligned with the service risks.
In this context, emphasizing merely "whether DCE exists or not" is no longer sufficient to fully describe a company's compliance status.
Second Regulatory Line: Why ASIC Introduced the "Digital Asset Platforms and Custodians" Framework
If the reform of AUSTRAC addresses the issue of "whether funds are flowing in compliance," then the core focus of ASIC is:Who is responsible for safeguarding and controlling the assets on behalf of the client, and who bears the legal liability in the event of risks.This logic is particularly reflected in the Australian Treasury's 2025 publication, "Regulating Digital Asset Platforms – Exposure Draft Legislation." The draft proposes to revise the Corporations Act 2001 to explicitly include certain types of digital asset platforms and custodial arrangements within the regulatory framework for financial products and financial services. The regulatory approach adopted in the draft does not focus on whether "virtual assets are securities," but rather on...Functionality and ControlExpand. The key judgment lies in:
- Whether the private key is held on behalf of the customer;
- Whether to manage account balances or internal ledgers;
- Whether there is substantial control over asset transfers.
Once a business involves the aforementioned elements, the platform's legal role is no longer that of a mere technical intermediary or an entity with anti-money laundering obligations, but rather enters the financial services category of "managing assets on behalf of clients," which typically requires obtaining an AFSL and complying with stricter behavioral, governance, and client asset protection requirements.
Australia's virtual asset regulation—actually, it all comes down to this one dividing line.
Australia adopts a highly function-oriented, tiered regulatory approach for virtual asset services. The core determination is not whether the activity involves crypto assets, but ratherDoes the platform start managing and controlling assets on behalf of others?When the business involves only virtual assets,Redemption, Transfer, or Payment ExecutionAt this point, the primary risk lies in the compliance of fund transfers, and the regulatory focus naturally falls on anti-money laundering (AML) and counter-terrorist financing (CTF). Such businesses can be conducted after completing registration with AUSTRAC, obtaining confirmation of registration, and continuously fulfilling AML/CTF obligations.
However, once the business model evolves to holding private keys on behalf of customers, centrally managing assets, or creating customer balance rights through account-based arrangements, the nature of the risk changes. At this point, the customer's reliance on the platform's creditworthiness becomes a central issue. The relevant business will no longer merely involve anti-money laundering obligations but must be incorporated into the financial services regulatory framework led by ASIC and require an Australian Financial Services License (AFSL).
In other words,Simple value transfers fall under AUSTRAC's jurisdiction; however, once you manage assets on behalf of others, you must enter the ASIC-regulated financial services framework.This demarcation line forms the fundamental logic of Australia's virtual asset regulatory framework.
As of early 2026, is it still necessary to complete the DCE registration now?
In this context, whether to "implement DCE right now" is no longer a matter of right or wrong, but rather a(n)Phase-based strategy selection.For companies with clear plans to conduct genuine cryptocurrency exchange or payment operations in Australia in the long term, and with relatively well-defined business models, completing the current DCE (Digital Currency Exchange) registration in advance still holds practical significance: it helps establish a compliance track record, implement AML/CTF (Anti-Money Laundering and Counter-Terrorist Financing) systems ahead of time, and lays the groundwork for subsequent registration confirmation.
But we must have a clear understanding that:The current DCE can only be regarded as a transitional foundation, not the final compliance state beyond 2026.Whether registering now or in the future, it is inevitable to complete registration under the new framework and undergo more proactive regulatory review.
The core of the Australian pathway is not the DCE, but the regulatory logic itself.
If we were to provide a higher-level assessment of Australia's virtual asset regulation, the conclusion might be:Australia has not attempted to solve all issues with a single new license, but rather through functional layering, it is gradually incorporating virtual asset services into the existing legal framework.DCE still exists, but it is merely an entry label within this framework. What truly determines the compliance path is how a company addresses key issues such as "redemption, transfer, custody, and control" in its business design. After 2026, understanding the regulatory logic itself will be far more important than fixating on a specific registration or license.