Crypto custody might sound like a technical concern for exchanges and institutional players, but for Australian investors it cuts right to the heart of a practical question: who is actually responsible for your assets, and what protections exist if something goes wrong? As Australia's digital asset platform reforms move from consultation into law, custody arrangements are emerging as one of the most consequential areas regulators are focusing on.
What "custody" means in crypto
In traditional finance, custody refers to the holding and safeguarding of financial assets on behalf of clients. A custodian typically has legal obligations around record-keeping, segregation of assets, and restitution in the event of loss. In crypto, custody means controlling the private keys that prove ownership of digital assets on a blockchain. Hold the keys, hold the coins. That simple reality creates enormous complexity when you map it onto existing financial services law.
There are broadly three custody models used in Australia. First, exchange custody: the platform holds your private keys on your behalf (the default arrangement on most retail exchanges). Second, self-custody: you hold your own private keys in a software or hardware wallet. Third, institutional custody: a licensed third-party custodian holds keys using multi-party computation or multi-signature arrangements, typically used by SMSF trustees, family offices, and high-net-worth investors.
The Corporations Act and the custody question
Australia's Corporations Act 2001 has long required that entities holding financial products on behalf of clients must hold an Australian Financial Services Licence (AFSL) with the appropriate custody authorisation. The pivotal legal question for years has been whether crypto assets qualify as "financial products" under the Act. ASIC's position has shifted considerably: the regulator now treats many crypto assets, particularly those with investment-like characteristics, as falling within the financial product definition in certain contexts.
This matters for custody because if a platform is holding a financial product on behalf of a client, it must comply with the client money rules under Part 7.8 of the Corporations Act. Those rules require segregation of client funds from the business's own funds, a requirement that collapsed exchanges like FTX spectacularly violated. ASIC has signalled clearly that Australian-facing platforms holding client assets need to grapple seriously with whether those obligations apply to them.
Treasury's reforms and the new custody framework
The Albanese government's "Regulating Digital Asset Platforms" framework is the most direct attempt to address custody head-on. Under the proposed (and in some respects now legislated) regime, platforms providing "digital asset facilities" to clients must obtain an AFSL with a specific digital asset platform authorisation. Critically, the custody of client assets is a defined activity within that framework, meaning platforms cannot argue they are merely facilitating trades without accepting that they hold a regulated interest in their clients' coins.
The reform package draws heavily from the existing managed investment scheme rules, which already require that assets held on behalf of investors be held by a responsible entity that is separately licensed and capitalised. The effect is that the regulatory gap that allowed exchanges to commingle client assets with operating funds in Australia is closing. Platforms that have relied on informal custody arrangements will need to restructure, recapitalise, or face enforcement action.
What ASIC actually expects from custodians
ASIC released updated guidance in recent years clarifying its expectations. In practice, compliant custody under an AFSL authorisation requires several things: clear contractual arrangements that define the nature of the client's interest in held assets; segregation between client assets and the platform's proprietary holdings; adequate insurance or capital reserves to cover loss events; and regular third-party audits of the custody architecture, including key management systems.
For institutional custodians using multi-party computation (MPC) or hardware security modules (HSMs), ASIC has indicated that technological sophistication does not substitute for legal structure. A platform can have best-in-class key management but still be non-compliant if the legal relationship between the platform and the client does not properly vest the client's interest in the underlying asset.
SMSF trustees and the custody trap
SMSF trustees face a particularly acute version of this problem. The ATO requires that SMSF assets be held in the name of the fund's trustee and be clearly separated from the trustee's personal assets. When an SMSF holds crypto through an exchange that pools client assets, the trustee risks breaching the sole purpose test and the in-house asset rules if the arrangement is not properly structured. The Australian Taxation Office has previously flagged that crypto held in pooled exchange wallets may not satisfy the legal ownership requirements for SMSF assets.
For SMSF trustees, the practical implication is significant. Holding crypto through a self-custody wallet (with keys controlled by the trustee) is generally the cleaner structure from an ATO compliance perspective, but it introduces its own risk management obligations. Institutional custody through a licensed custodian, while more expensive, is increasingly the preferred solution for larger SMSF balances.
What this means if you use a retail exchange
Most Australian retail investors hold their crypto on AUSTRAC-registered exchanges like CoinSpot, Swyftx, or Independent Reserve. AUSTRAC registration covers anti-money laundering obligations, but it says nothing about custody standards. An exchange can be fully AUSTRAC-compliant and still hold client assets in a way that provides minimal legal protection if the platform becomes insolvent. The distinction matters, and it is one that Australia's new digital asset platform licensing regime is specifically designed to address.
Until those reforms are fully in force, retail investors should be aware that exchange-held crypto sits in a legal grey zone. It is unlikely to be treated as "client money" under the strict Corporations Act definition unless the exchange holds an AFSL with the appropriate authorisation. That means in an insolvency, exchange-held crypto may be treated as an unsecured claim against the platform rather than property held on trust for the investor. This is the precise risk that materialised for Australian creditors when FTX collapsed in 2022.
Reviewing how your chosen exchange handles custody disclosures is worthwhile, and the detail available in what happens when an exchange loses its AUSTRAC registration illustrates just how quickly those protections can unwind. For investors building meaningful crypto positions, understanding the custody layer beneath your exchange account is no longer optional.
What platforms and investors should do now
For platforms, the path forward involves a structured legal review of custody arrangements against the requirements of the new digital asset platform authorisation, engagement with ASIC on any no-action or transitional relief positions, and investment in custody infrastructure that meets the segregation and audit standards the regime requires.
For investors, the practical steps are simpler but still important. Ask your exchange directly whether client assets are held on trust or in a pooled arrangement. Review the exchange's terms of service to understand what claim you hold in an insolvency. Consider whether the size of your crypto position warrants moving to a licensed custodian or self-custody solution. And if you hold crypto inside an SMSF, ensure your documentation and custody structure satisfies the ATO's requirements, not just AUSTRAC's.
Crypto custody law in Australia is moving fast. The regulatory ground that looked solid two years ago has shifted considerably, and the reforms now in train will shift it further. Investors and platforms that treat custody as a secondary concern are likely to find it becomes a primary problem.
This article is general information only and does not constitute financial or legal advice. Speak to a qualified adviser before making decisions about your crypto holdings or SMSF arrangements.