Approaches and developments
Australia has seen a continued proliferation of active fintech businesses, with payments, investment and data emerging as the key sectors for disruption. Despite significant uncertainty in (and in many cases, criticism of) the financial services industry as a result of the Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry (Royal Commission), the Australian approach to fintech has remained supportive of new and innovative financial services and products. This has been further demonstrated through increased technological capabilities developed in the wake of the COVID-19 pandemic.
As discussed below under “Regulatory bodies”, Australian regulators have generally been receptive to the growth of the Australian fintech ecosystem and there has been considerable discussion around the opportunities, risks and challenges that have arisen for market participants, customers and regulators. Australian policy-makers and bodies continue to make regulatory and legislative developments to ensure the scope of emerging services is adequately captured within the existing financial services framework. This has included increased technology-neutral or fintech-specific regulatory guidance to assist businesses in understanding their obligations, amended legislation to bring fintech services providers within the remit of existing regimes, and the introduction of new legislation to provide greater consumer protection.
The findings of the Royal Commission were a catalyst for turning regulatory focus to consumer protection and making this the utmost priority for incumbent financial institutions and industry-wide changes to the culture and governance of financial services providers are reflective of this. Regulators have taken a more stringent approach to enforcement. For example, in addition to its “why not litigate” regulatory stance, the Australian Securities and Investments Commission (ASIC) has commenced using its recently acquired product intervention powers to impose conditions and restrictions on the provision of financial products and services that have the potential to cause significant consumer detriment (discussed below). This presents an opportunity for fintechs, which are typically focused on delivering customer-centric outcomes and are often better placed to respond quickly to regulatory change.
Various physical distancing restrictions imposed by State and Federal Governments during the COVID-19 pandemic witnessed an increase in the creation and implementation of technology solutions across a broad range of industries. In response to stressed economic conditions, regulators implemented a range of exemptions to facilitate utilising technology to fulfil corporate actions and processes (e.g., electronic signatures). While these measures were not specifically targeted at fintechs (regulators have generally maintained their technology neutral stance), it has led to accelerated digital education and adoption across various financial service and product delivery channels.
Use of digital wallets and contactless payment solutions has surged. Recognising that such solutions are growing beyond the scope of current regulation, there is consultation underway. The Council of Financial Regulators (comprised of Australia’s major financial regulators) has made recommendations for a new framework for stored value facilities (i.e., digital wallets that are widely used as a means of payment and store significant value for a reasonable amount of time) to be overseen by the Australian Prudential Regulatory Authority (APRA), Australia’s banking regulator. The Reserve Bank of Australia (RBA) is currently undertaking a holistic review of the regulatory framework for card payments (due late 2021) and the Australian Treasury is undertaking a simultaneous review of the overall regulatory architecture of the Australian payments systems.
Businesses have continued to explore new automated service methods including the use of robo-advisors for distributing financial advice. There has been sustained attention on blockchain and distributed ledger technology (DLT) to the extent that fintechs have begun formalising use cases for DLT to manage supply chains, make cross-border payments, trade derivatives, and manage assets and digital currency exchanges. The Australian Securities Exchange (ASX), Australia’s primary securities exchange, is currently in the process of rolling out a DLT-based replacement for its clearing and settlement process. The ASX is currently analysing and testing the technology, and releasing technical documentation.
2020 saw the launch of the new national Consumer Data Right (CDR) framework, initially applied to the banking sector under the “Open Banking” regime. The CDR enables consumers to exercise greater access and control over their banking data and is anticipated to have a profound effect on the financial services industry by encouraging customers to switch service providers and open the market to new fintech businesses.
There have been a number of relevant legislative changes in Australia (see “Fintech offering in Australia” below). The Treasury Laws Amendment (Design and Distribution Obligations and Product Intervention Powers) Bill 2019 introduced a design and distribution obligation (DDO) for financial services firms as well as a product intervention power (PIP) for ASIC. The new DDO regime will apply from 5 October 2021 and requires product issuers to ensure products are targeted and offered to the appropriate customers. ASIC has held its PIP since 2019; however, it has only recently commenced intervening in the distribution of products it considers as carrying a risk of significant consumer detriment. More than ever, it will be crucial for financial service providers, including fintechs, to consider the suitability of products and disclosure documents for their own customer base.
Fintech offering in Australia
Fintech businesses have been disrupting the Australian banking, investment and wealth management, payments, advisory, trading and fundraising sectors through offers of alternatives to the relatively concentrated traditional providers of these financial services. These alternative offers generally focus on providing financial services in a way that prioritises customer experience and outcomes, utilises technology solutions such as apps and smart devices in the delivery of financial services, or disintermediates the provision of financial services.
Fintech businesses must comply with all existing laws and regulations for financial services and consumer credit activities in Australia. The Government has taken steps to alleviate the regulatory burden on fintechs looking to test the Australian market prior to a full product or service launch. See “Key regulations and regulatory approaches” below for further discussion.
Regulatory guidance has also been updated to address the fintech sector. For example, ASIC has released specific guidance clarifying the licensing, conduct and disclosure obligations that apply to the provision of digital financial product advice. This includes requiring nomination of a person within the business who understands and will be responsible for the ongoing monitoring of the algorithms used to produce advice.
ASIC has clarified how Australian financial services laws may apply to a range of cryptocurrency offerings, whether through initial coin offerings or security token offerings as an alternative funding mechanism, non-fungible token offerings or fund offerings with cryptocurrency assets. In summary, the legal status of these offerings depends on the structure, operation and the rights attached to the tokens offered. Issuing tokens may trigger licensing, registration and disclosure requirements if the tokens are financial products (e.g., interests in managed investment schemes, securities, derivatives or non-cash payment facilities).
Blockchain technology continues to capture the attention of established businesses, and there is now an awareness of decentralised finance and its potential implications. In the past couple of years, Australia has witnessed the application of DLT in solutions across a broad range of financial market operators, financial institutions, financial service providers and fintechs, which has prompted new regulation. Given the rapidly evolving blockchain sector (particularly as institutional businesses move from observational practices to implementation), regulators have generally maintained a technology neutral stance to the application of the law and regulation. In addition to current reviews being undertaken (see payments review “Approaches and developments”), over the past few years, there have been numerous framework developments to lower barriers to entry for fintech providers.
In 2018, ASIC introduced a two-tiered market licensing regime for financial market operators and updated its corresponding regulatory guidance. Specifically, the guidance reflects a risk-based assessment that will be undertaken, which is consistent with the approach taken internationally to the administration of market licensing. Under the revised Australian Market Licence (AML) regime, market venues can be designated as being either Tier 1 or Tier 2, depending on their nature, size, complexity and the risk they pose to the financial system, investor confidence and trust. While Tier 1 market venues are, or are expected to become, significant to the efficiency and integrity of (and confidence in) the Australian financial system, Tier 2 licences will be able to facilitate a variety of market venues and will have reduced obligations to accommodate new and specialised market platforms. The tiered market regime is expected to impact, amongst others, market operators and operators of market-like venues, as well as platforms seeking to offer secondary trading.
The Australian banking sector is highly regulated with stringent licensing, conduct (including reporting) and regulatory capital requirements which act as significant hurdles for new businesses entering the market. Any entity that conducts any “banking business”, such as taking deposits (other than as part-payment for identified goods or services) or making advances of money, must be licensed as an authorised deposit-taking institution (ADI). To lower barriers to entry, APRA introduced a Restricted ADI framework which permits new businesses entering the banking industry to conduct a limited range of banking activities for two years while they build their capabilities and resources. After such time, they must either transition to a full ADI licence or exit the industry. Since then, various “neobanks” (which are wholly digital quasi-banks that provide full banking services to customers via a solely mobile platform) have progressed through the Restricted ADI route and granted full ADI licences. Neobanks have largely been met with a positive response from the market and significant uptake by consumers.
Fintech businesses will generally have obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act) and Anti-Money Laundering and Counter-Terrorism Financing Rules Instrument 2007 (No.1) (AML/CTF Rules). The AML/CTF Act applies to entities that provide “designated services” with an Australian connection. To address the rise of cryptocurrency offerings, the AML/CTF Act also captures digital currency exchange providers, which must register and enrol with the Australian Transaction Reports and Analysis Centre (AUSTRAC). Registered exchanges are required to implement know-your-customer processes to adequately verify the identity of their customers, adopt and maintain an AML/CTF programme as well as meet ongoing obligations to monitor and report suspicious and large transactions.
Buy now, pay later (BNPL) has continued to be a growth area, with some providers now dominating the Australian fintech landscape. Many BNPL providers operate outside the Australian credit licensing regime on the basis of exemptions. This has given rise to calls to action with respect to BNPL industry regulation and in 2020, ASIC undertook a review of the industry, reporting on the impact on consumers and upcoming regulatory developments. Importantly, these regulatory developments rely on existing and impending regulatory changes rather than proposing new industry specific policy and regulation, which ASIC stated “remain[s] a matter for Government and, ultimately, the Parliament”. However, in reaction to various consumer concerns, the Australian Finance Industry Association (which includes a range of BNPL providers in its membership) drafted a voluntary BNPL Code of Practice (BNPL Code), which came into effect on 1 March 2021. The BNPL Code sets out nine Key Commitments regarding how BNPL products are to be designed and distributed to consumers and has been adopted by an estimated 95% of the Australian BNPL market.
Regulatory and insurance technology
The rising cost of compliance has prompted many companies using artificial intelligence (AI), customer due-diligence (e.g., “know-your-customer”) and data breach monitoring (e.g., “know-your-data”) technologies to invest in regulatory technology, or regtech. ASIC has indicated the benefits of regtech to provide better outcomes for consumers and has hosted annual fora for collaboration between businesses and to promote stakeholder engagement. It has also been reported that ASIC has actively encouraged incumbent financial institutions to partner with fintechs to harness regtech to automate regulatory reporting, manage compliance and ensure clarity to how regulation is interpreted.
During 2019–2020, ASIC undertook five regtech initiatives (another three were put on hold due to COVID-19), being:
- a machine-learning trial to help ASIC identify potential misconduct in financial services promotions to vulnerable consumers (in response to COVID-19);
- engaging a regtech consultancy firm to deliver an organisation-wide voice analytics operational framework to incorporate into supervisory and investigative projects involving audio file reviews;
- a proof-of-concept project that aimed to automate data flows and reporting matters of interest to improve licensing and misconduct and breach reporting processes;
- a first-phase natural language processing application to extract core prospectus information for supervisory analysis; and
- engaging regtech consultants to develop an enhanced evidence score capability in relation to ASIC’s evidence document system.
Investments in insurance technology in Australia have increased, with companies and fintechs focusing on forging cross-sector alliances in order to embed their offerings into alternative value propositions. Insurance technology has the potential to disrupt individual sections of the insurance value chain, augment the existing processes of underwriting risk and predicting loss, and improve the existing capabilities of insurers, reinsurers, intermediaries and service providers. The increase in partnerships and alliances between insurance fintechs and incumbents with established customer bases will be effective for insurance start-ups to fuel expansion.
There have not been any specific changes to legislation or regulation due to regtech or insurance technology; however, this may change in the future as uptake increases and becomes more mainstream.
Regulatory bodies
Australia has a twin peaks model of regulation with respect to financial services:
- ASIC is Australia’s primary corporate, markets, financial services and consumer credit regulator. It is responsible for regulating consumer protection and maintaining market integrity within the financial system. ASIC supervises the conduct and regulation of Australian companies, financial markets, and financial service and consumer credit providers.
- APRA is concerned with maintaining the safety and soundness of financial institutions, promoting financial stability in Australia and is tasked with protecting the interests of depositors, policy-holders and superannuation fund members. APRA oversees ADIs (e.g., banks, building societies and credit unions), general and life insurers, friendly societies, reinsurers and superannuation funds.
AUSTRAC is responsible for administering Australia’s anti-money laundering and counter- terrorism financing regime under the AML/CTF Act and the AML/CTF Rules. AUSTRAC may pursue a wide range of enforcement sanctions under the AML/CTF Act which include imposing civil and criminal penalties (which can be significant in value), enforceable undertakings, infringement notices, remedial directions, and power to cancel or suspend registrations of providers of digital currency exchange and designated remittance services. AUSTRAC plays an active role in setting and implementing international standards and is a member of regional and global groups such as the Financial Action Task Force and the Asia/ Pacific Group on Money Laundering.
The Office of the Australian Information Commissioner (OAIC) administers the Privacy Act 1988 (Cth) (Privacy Act) which regulates the handling of personal information by Federal Government agencies and some private sector organisations. The Privacy Act includes 13 Australian Privacy Principles (APPs), which impose obligations on the collection, use, disclosure, retention and destruction of personal information. The APPs extend to an act done, or practice engaged in, outside Australia by an organisation that has an “Australian link” (including where it carries on business in Australia and has collected or held personal information in Australia, either before or at the time of the act or practice).
Fintechs may also be subject to the prohibitions in the Australian Consumer Law, which is enforced by the Australian Competition and Consumer Commission (ACCC). Broadly, these include prohibitions on misleading and deceptive conduct, false or misleading representations, unconscionable conduct and unfair contract terms. Whilst the Australian Consumer Law does not apply to financial products or services, many of these protections are enforced by ASIC either through mirrored provisions in the Australian Securities and Investments Commission Act 2001 (Cth) (ASIC Act) or through delegated powers.
The Reserve Bank of Australia is Australia’s central bank and provides a range of banking services to the Government and its agencies, overseas central banks and official institutions. It is also responsible for maintaining the stability of the financial system through monetary policy and regulating payment systems.
The Fair Work Commission is Australia’s national workplace relations tribunal and is responsible for administering the provisions of the Fair Work Act 2009 (Cth) (Fair Work Act), which governs the regulation of employment in Australia. In relation to hiring, minimum terms and conditions of employment for most employees (including professionals) are governed by modern awards, which sit on top of the National Employment Standards. The Fair Work Commission’s powers and functions broadly include dealing with unfair dismissal claims, anti-bullying claims, unlawful termination claims, setting and reviewing minimum wages in modern awards and making orders to stop or suspend industrial action.
Key regulations and regulatory approaches
Regulatory framework for fintech businesses
Fintech businesses must comply with the applicable licensing, registration and disclosure obligations under Australia’s financial services regime.
Fintech businesses carrying on a financial services business in Australia must hold an Australian financial services licence (AFSL) or be exempt from the requirement to be licensed. Financial services are broadly defined under the Corporations Act 2001 (Cth) (Corporations Act), which is administered by ASIC, to include the provision of financial product advice, dealing in financial products (as principal or agent), making a market for financial products, operating registered schemes and providing custodial or depository services. A financial product is a facility through which, or through the acquisition of which, a person makes a financial investment, manages a financial risk or makes a non-cash payment.
The Australian credit licence (ACL) regime applies to entities who engage in consumer credit activities in Australia, such as providing credit under a credit contract or consumer lease. Fintech businesses that provide marketplace lending products and related services will constitute consumer credit activities and will generally trigger the requirement to hold an ACL. Consumer credit activity is regulated by ASIC and under the National Consumer Credit Protection Act 2009 (Cth) and associated regulations.
Fintech businesses may also need to hold an AML where they operate a facility through which offers to buy and sell financial products are regularly made (e.g., an exchange). If an entity operates a clearing and settlement mechanism which enables parties transacting in financial products to meet obligations to each other, the entity must hold a clearing and settlement facility licence or be otherwise exempt.
Generally, fintech businesses that operate as holders of stored value in relation to purchased payment facilities under the Payment Services (Regulation) Act 1998 (Cth) are required to be an ADI unless otherwise exempt (see the above “Fintech offering in Australiaˮ section). A purchased payment facility is a facility (other than cash) where the facility is purchased and can be used to make payments up to the amount available for use under the facility and the payments are made by the provider or a person acting under an arrangement with the provider, rather than the user of the facility.
As discussed above in “Regulatory bodies”, the Privacy Act regulates the handling of personal information by Federal Government agencies and some private sector organisations.
Fintech innovation and regulatory developments
Australian regulators and policy-makers in the financial services sector have sought to improve and engage with technology-focused businesses while continuing to reinforce consumer protection as a key regulatory priority. As noted, regulators have generally adopted and maintained a technology-neutral approach so that services are regulated consistently, irrespective of the delivery method. Regulators have supported the market entry of fintechs by streamlining access and offering informal guidance to enhance regulatory understanding. Both ASIC and AUSTRAC have established Innovation Hubs to assist fintech businesses more broadly in understanding their obligations under Australian law. ASIC’s Innovation Hub provides tailored information and access to informal assistance intended to streamline the AFSL process for fintech start-ups. AUSTRAC’s Fintel Alliance also has an Innovation Hub targeted at combatting money laundering and terrorism financing, improving the fintech sector’s relationship with the Government and regulators and assessing the impact of new technologies such as blockchain and cryptocurrency.
Under the Corporations (FinTech Sandbox Australian Financial Services Licence Exemption) Regulations 2020 and National Consumer Credit Protection (FinTech Sandbox Australian Credit Licence Exemption) Regulations 2020, the Government and ASIC have established a sandbox for fintech businesses to test financial services, financial products and credit activities for up to 12 months without holding an AFSL or ACL. There are strict eligibility requirements for both the types of businesses that can enter the regulatory sandbox and the products and services that qualify for the licensing exemption.
Restrictions
At the time of writing, there have not been any explicit prohibitions or restrictions on fintech business types. Australian regulators and policy-makers have generally sought to encourage and support fintech businesses, provided such businesses comply with applicable laws (including financial services and consumer laws).
As discussed above in “Regulatory developmentsˮ, the Government has introduced new obligations under the Treasury Laws Amendment (Design and Distribution Obligations and Product Intervention Powers) Act 2019 (Cth) (DDO & PIP Act) for financial products and credit products issued and distributed to retail clients. The DDO & PIP Act introduced DDOs requiring financial product issuers to make a “target market determination” for the product, conduct distribution in accordance with the determination, notify ASIC of significant dealings inconsistent with the determination and regularly review the determination. The DDO & PIP Act also empowered ASIC to intervene using its PIP when it considers a financial product has, will, or is likely to result in significant consumer detriment. The DDOs come into effect on 5 October 2021, while ASIC has already utilised its PIP in relation to short- term credit practices, the sale of add-on financial products by car yard intermediaries, over- the-counter binary options and contracts for difference.
Cross-border business
Collaboration
Australian regulators and policy-makers have sought to improve their understanding of, and engagement with, fintech businesses by regularly consulting with industry on proposed regulatory changes and entering into international cooperation and information-sharing agreements. ASIC has entered into a number of cooperation agreements and information- sharing agreements with overseas regulators for the purpose of facilitating cross-border financial regulation and removing barriers to market entry. Under these arrangements, there is a sharing of information on fintech market trends, encouraging referrals of fintech companies and sharing insights from proofs of concept and innovation competitions. Through these agreements, regulators hope to further understand the approach to regulation of fintech businesses in other jurisdictions, in an attempt to better align the treatment of these businesses across jurisdictions. ASIC currently has either information-sharing or cooperation agreements with numerous jurisdictions, including the China Securities Regulatory Commission, Hong Kong’s Securities and Futures Commission, the Monetary Authority of Singapore, the Swiss Financial Market Supervisory Authority, the United States Commodity Future Trading Commission, the Capital Markets Authority of Kenya, Indonesia’s Otoritas Jasa Keuangan and Canada’s Ontario Securities Commission.
ASIC has also committed to supporting financial innovation in the interests of consumers by joining the Global Financial Innovation Network (GFIN), which was formally launched in January 2019 by a group of financial regulators from around the globe. GFIN currently has over 60 organisations dedicated to facilitating regulatory collaboration in a cross-border context and provides more efficient means for innovative businesses to interact with regulators.
Foreign financial services providers
The regulation of foreign financial service providers (FFSPs) in Australia is changing. Up until recently, FFSPs that carry on a financial services business in Australia have typically relied on either “sufficient equivalenceˮ relief (also known as passport relief) and the “limited connectionˮ relief. Passport relief was repealed effective from 31 March 2020, but is subject to a 36-month transitional period available to FFSPs that already relied on the relief as at the date of the repeal. It was available to certain FFSPs providing financial services to wholesale clients only, where such FFSPs are regulated by a foreign regime considered by ASIC to be “sufficiently equivalent” to the Australian regime. Limited connection relief is set to be repealed from 31 March 2023 and is available to an FFSP that is not carrying on a business in Australia under the ordinary tests but is deemed to be carrying on a financial services business in Australia only because it is inducing, or intending to induce, a person in Australia to use its financial services, and where such services are provided to wholesale clients only. Conduct that amounts to inducing includes attempts to persuade, influence or encourage a particular person to become a client.
Passport relief and limited connection relief have been replaced by a new foreign Australian financial services licence (FAFSL) regime, which commenced on 1 April 2020). The FAFSL regime is designed to be more streamlined than the AFSL application process. FFSPs must be regulated overseas by specified sufficiently equivalent regulatory regimes to be eligible to apply for a FAFSL to provide certain financial services to wholesale clients in Australia. The FAFSL regime is currently available to entities regulated by certain regulators in Denmark, France, Germany, Hong Kong, Luxembourg, Ontario in Canada, Singapore, Sweden, United Kingdom and the United States. FFSPs from another jurisdiction are entitled to apply to extend the FAFSL regime to other regulatory regimes.
ASIC has also unveiled the ASIC Corporations (Foreign Financial Services Providers – Funds Management Financial Services) Instrument 2020/199 (Funds Management Relief Instrument) under which eligible FFSPs will not be required to hold an AFSL if the FFSP is carrying on a financial services business by engaging in “inducing” conduct (as above) while providing certain funds management financial services to certain Australian investors. FFSPs that are carrying on a financial services business other than because of inducing conduct will not be eligible to rely on the Funds Management Relief Instrument. Funds management licensing relief will commence on 6 April 2023.
We note that at the time of writing the future of the FFSP regime as provided by FAFSLs and the Funds Management Relief Instrument is unclear as the 2021–2022 Australian Federal budget announcements indicate that these aspects of the regime are being considered further (and may be unwound). The Australian Commonwealth Treasury is currently undertaking a consultation process on options that could restore regulatory relief for FFSPs and create a fast-track licensing process for FFSP. The consultation period closed on 30 July 2021. Further details regarding timing and implementation of the outcomes of the consultation process are not yet known.
New structures
In June 2018, the Government passed the Corporations Amendment (Asia Region Funds Passport) Act 2018 (Cth), which incorporates the Asia Region Funds Passport (Passport) into the Corporations Act. The Passport is a region-wide initiative to facilitate the offer of interests in certain collective investment schemes established in Passport member economies to investors in other Passport member economies. It aims to provide Australian fund managers greater access to economies in the Asia-Pacific by reducing existing regulatory hurdles. Australia, Japan, the Republic of Korea, New Zealand and Thailand are all signatories to the Passport’s Memorandum of Cooperation. The Passport officially launched on 1 February 2019 and Australia has passed laws to enable the Passport to operate. Broadly, the Passport requires an eligible fund to apply to its home regulator for a passport and comply with home economy requirements in order to be registered (for Australian funds, this effectively requires registration as a managed investment scheme with ASIC). Once registered, the fund must notify the host regulator and meet host economy requirements relating to disclosure, distribution and complaints handling (for offshore funds wishing to be offered in Australia, this effectively requires compliance with the corresponding obligations for registered managed investment schemes).
In addition to the Passport, the Australian Treasury has been consulting on the Corporate Collective Investment Vehicle (CCIV) scheme, which will be a new type of investment vehicle that aims to expand the range of collective investment schemes offered in Australia and will enhance the competitiveness of funds by improving access to overseas markets. The CCIV regime is intended to complement the Passport, which will allow Australian fund managers to pursue overseas investment opportunities through a company structure. Two draft Bills implementing the CCIV regime were released for public consultation in January 2019, but no submissions or reports have been issued to date.
