08/08/2022

The fintech landscape in Australia is rapidly evolving, with regulations needing to be continuously updated in order to keep pace. The International Comparative Legal Guide 2022 provides legal practitioners with an analysis of the most current Australian laws and regulations regarding fintech. 

In this Australian Chapter of the ICLG, we cover:

  1. The Fintech Landscape
  2. Funding for Fintech
  3. Fintech Regulation
  4. Other Regulatory Regimes / Non-Financial Regulation
  5. Accessing Talent
  6. Technology

The Fintech Landscape

Please describe the types of fintech businesses that are active in your jurisdiction and the state of the development of the market, including in response to the COVID-19 pandemic and ESG (Environmental, Social and Governance) objectives. Are there any notable fintech innovation trends of the past year within particular sub-sectors (e.g. payments, asset management, peer- to-peer lending or investment, insurance and blockchain applications)?

While the COVID-19 pandemic was the defining feature of the Australian landscape over the year 2020–21, in 2022, the Australian economy and public have recovered reasonably well from the pandemic and there has been a focus on fintech and the rapid digital evolution of the financial sector in Australia. Many fintech businesses saw the pandemic as an opportunity to develop and refine product and service offerings to better meet shifting consumer preferences and reflect innovations and opportunities created by technology. For example, businesses that were able to capitalise on integrating digital payment infrastructure and services and provide online services generally saw relatively higher uptake as a result of social distancing and lockdown measures.

As of 2022, the pace of fintech creation, development and adoption has regained speed, propelled by a broadening of product offerings by the Australian fintech community and assisted by the maturing of the Australian policy and regulatory approach. While previous fintech offerings were limited to operating on the periphery of traditional financial services (including lending, personal finance and asset management), the sector has now moved to disrupt the core product offering of many Australian institutional financial service providers, including payments, wallets, supply chain, wealth and investment, data and analytics and decentralised finance. In the data and investment sector in particular, there have been opportunities for fintechs to assist businesses with growing investor preferences for sustainable investing by collating and analysing Environmental, Social and Governance (ESG) data.

Regulators and the Government face the challenge of adapting and aligning existing financial regulation to new products and services, balancing innovation with consumer protection.  Regulators such as the Australian Securities and

Investments Commission (ASIC), Australian Prudential Regulation Authority (APRA) and the Australian Transaction Reports and Analysis Centre (AUSTRAC) have become more proactive on licensing, conduct and disclosure and have taken a more rigorous approach to enforcement.

Australia’s current financial services policy and regulatory context is still largely informed by the findings of the 2017– 2019 Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry (Royal Commission). The Royal Commission made a series of recommendations for regulatory reform, focusing on matters such as prioritising the interests of consumers, overhauling conflicted remuneration structures and changing the way add-on products are distributed. A raft of legislative changes followed (or are expected to follow) to implement these recommendations and fintechs – particularly those that are motivated to provide financial services in a way that is more convenient, personalised and simplified for consumers – will be well placed to adapt to these changes, and seize the opportunity presented by the current public sentiment of dissatisfaction with traditional providers. As part of the Government’s response to the Royal Commission, the Australian Law Reform Commission (ALRC) conducted an inquiry into simplifying Australia’s financial services regulatory framework to make it “more adaptive, efficient and navigable for consumers and regulated entities”. The ALRC will provide interim reports on three areas, being the design and use of definitions in corporations and financial services legislation, the regulatory design and hierarchy of laws, and the potential to reframe or restructure Chapter 7 of the Corporations Act 2001 (Cth) (Corporations Act) (i.e., the overarching financial services laws). The first interim report on definitions has been released and the next interim report on regulatory design and legislative hierarchy is expected to be released on 30 September 2022.

However, regulators and legislators are also looking beyond the findings of the Royal Commission as the financial services sector adapts. On 8 December 2021, the Federal Treasurer announced an intention for the Government to proceed with a reform of Australia’s regulatory framework as it applies to payments and crypto assets.

The announcement comes after the completion of a raft of targeted reviews in this space, including the Council of Financial Regulators’ (CFR) Stored Value Facility Review, the Treasury Payments System Review, the Senate Select Committee on Australia as a Technology and Financial Centre and the Parliamentary Joint Committee Inquiry into Mobile Payments and Digital Wallets.

The Treasurer committed the Government to having the following in place by mid-2022:

  • a strategic longer-term plan for the payments system, developed with industry and reviewed annually;
  • details of additional powers for the Treasurer to set payment system policy;
  • changes necessary to modernise payments system legislation to accommodate new and emerging payment systems, including consideration of “buy now pay later” (BNPL) and digital wallets;
  • completed consultation on the establishment of a licencing framework for digital currency exchanges;
  • finalised consultation on a custody or depository regime for businesses that hold crypto assets on behalf of consumers; and
  • obtained advice from the CFR, working with other relevant agencies, on the underlying causes and policy responses to the issue of de-banking.

For the past few years there has been sustained attention on blockchain technology and a growth in interest in the technology by established businesses in the financial services sector. In particular, there has been growing interest in how decentralisation and new governance models such as decentralised autonomous organisations (DAOs) can exist and be regulated. It is expected that further clarity on the application of the Australian regulatory regime to such models will come in due course – the Senate Select Committee on Australia as a Technology and Financial Centre recommended the introduction of a new DAO legal entity in Australian corporate law and this recommendation has been agreed to by the Government.

The ASX continues to progress its plans to adopt a block-chain-based technology for its clearing and settlement (CS) process to replace its current “CHESS” system and this is currently scheduled to be implemented by April 2023.

Are there any types of fintech business that are at present prohibited or restricted in your jurisdiction (for example cryptocurrency-based businesses)?

At the time of writing, there have not been any prohibitions or restrictions on specific fintech business types. Cryptocurrency based businesses are permitted in Australia, provided such businesses comply with applicable laws (including financial services and consumer laws). 


Funding for Fintech 

Broadly, what types of funding are available for new and growing businesses in your jurisdiction (covering both equity and debt)? 

Equity funding

Businesses can raise equity using traditional private and public fundraising methods (e.g., private placement, initial public offering, and seed and venture capital strategies), through grants and initiatives offered by Government and State/Territory agencies, and through crowdfunding.

In late 2017, a regulatory framework was introduced for crowd-sourced equity funding (CSEF) by public companies from retail investors. While reducing the regulatory barriers to investing in small and start-up businesses, the framework also created certain licensing and disclosure obligations for CSEF intermediaries (i.e., persons listing CSEF offers for public companies). This regime was extended in 2018 to also apply to proprietary companies. While there are a range of reporting requirements imposed on proprietary companies engaging in crowdfunding, there are also a number of concessions made with respect to restrictions that would otherwise apply to their fundraising activities.

Under the CSEF framework, there are exemptions for persons operating markets and CS facilities from the licensing regimes that would otherwise be applicable to those facilities. These additional exemptions provide a means by which a person operating a platform for secondary trading can seek an exemption with tailored conditions from more onerous licensing requirements.

ASIC has released Regulatory Guides 261 Crowd-sourced funding: Guide for Companies and 262 Crowd-sourced funding: Guide for intermediaries to assist companies seeking to raise funds through CSEF and intermediaries seeking to provide CSEF services, respectively.

Debt funding

There have been calls to extend the existing crowdfunding framework to debt funding, and the Government has previously indicated that it intends to consult on this. Debt financing is less common than equity financing in the Australian fintech sector; however, businesses can approach financial institutions, suppliers and finance companies in relation to debt finance.

Asia Region Funds Passport and Corporate Collective Investment Vehicles

The Asia Region Funds Passport (Passport) was introduced in 2018 and is a region-wide initiative designed to facilitate the offer of interests in certain collective investment schemes (CIS), established in Passport member economies to investors in other Passport member economies. It aims to provide Australian fund managers and operators with greater access to economies in the Asia-Pacific region by reducing regulatory hurdles.

On 10 February 2022, the Government passed the Corporate Collective Investment Framework and Other Measures Bill 2021 (Cth), with the commencement of the Corporate Collective Investment Vehicle (CCIV) scheme stated to commence on 1 July 2022 following royal assent. The CCIV scheme creates a new type of investment vehicle, which will allow Australian fund managers to pursue overseas investment opportunities through a company structure. It is intended to complement the Passport by making Australian funds more accessible to foreign investors. Both retail and wholesale CCIVs must be registered with ASIC.

The Australian funds market is dominated by unit trusts, a structure that is unfamiliar to many offshore economies where corporate and limited partnership investment vehicles are the norm throughout the Asia-Pacific region. The CCIV will provide an internationally recognised investment vehicle which will be able to be more readily marketed to foreign investors (including through the Passport).

There are concerns that the reforms will add extra complexity, given the far-reaching potential changes to corporate, partnership and tax laws. However, the enactment of the Passport and the CCIV may lead to new financing opportunities for fintech businesses.

Are there any special incentive schemes for investment in tech/fintech businesses, or in small/ medium-sized businesses more generally, in your jurisdiction, e.g. tax incentive schemes for enterprise investment or venture capital investment?

Incentives for investors

  1. Early stage innovation company incentives

Incentives are available for eligible investments made in start-ups known as Early Stage Innovation Companies (ESICs), which are generally newly incorporated entities with low income and expenses.

Investments of less than 30% of the equity in an ESIC would generally qualify for a 20% non-refundable carry forward tax offset (capped at AUD 200,000 per investor and their affiliates combined in each income year, including any offsets carried forward from the prior year’s investment) and a 10-year tax exemption on any capital gains arising on disposal of the investment (provided they are held for at least one year but less than 10 years).

    2. Eligible venture capital limited partnerships

Fintech investment vehicles may be structured as venture capital limited partnerships (VCLPs) or early stage venture capital limited partnerships (ESVCLPs), and receive favourable tax treatment for eligible venture capital investments. For VCLPs, benefits include tax exemptions for foreign investors (limited partners) on their share of any revenue or capital gains made on disposal of the investment by the VCLP, and concessional treatment of the fund manager’s carried interest in the VCLP. For ESVCLPs, the income tax exemption for VCLPs is extended to both resident and non-resident investors, plus investors obtain a 10% carry forward non-refundable tax offset for new capital invested in the ESVCLP.

Incentives for fintechs

The Research & Development (R&D) Tax Incentive programme is available for entities incurring eligible expenditure on R&D activities, which includes certain software R&D activities commonly conducted by fintechs. From 1 July 2021, depending on the size of the business, claimants under the R&D Tax Incentive may be eligible for one of the following incentives:

  1. Small businesses (less than AUD 20 million aggregated turnover): a refundable offset of 18.5% above the claimant’s corporate tax rate, which from 1 July 2021 is 25% (if the claimant is eligible for the lower corporate tax rate), providing a total 43.5% refundable tax offset; or
  2. Other businesses (aggregated turnover of AUD 20 million or more): a non-refundable tax offset of the claimant’s corporate tax rate, plus an incremental premium of either 8.5% (for R&D expenditure between 0% and 2% R&D intensity) or 16.5% (for R&D expenditure above 2% R&D intensity). A claimant’s incremental premium is based on its R&D intensity, which is the proportion of the claimant’s eligible R&D expenditure as a percentage of total business expenditure.

In brief, what conditions need to be satisfied for a business to IPO in your jurisdiction?

The ASX sets out 20 conditions to be satisfied in its Listing Rules. Briefly, these include the entity having at least 300 non-affiliated security holders each holding the value of at least AUD 2,000, and the entity satisfying either the profit test or the assets test (which requires particular financial thresholds to be met).

Have there been any notable exits (sale of business or IPO) by the founders of fintech businesses in your jurisdiction?

Despite the COVID-19 pandemic, there were a number of IPOs including that of Butn, which operates a payments and funding solution for organisations, Beforepay, an app providing “pay on demand” services and Propell Holdings Ltd., a digital finance platform for small and medium-sized businesses.


Fintech Regulation 

Please briefly describe the regulatory framework(s) for fintech businesses operating in your jurisdiction, and the type of fintech activities that are regulated.

Broadly, the regulatory framework that applies to fintech businesses includes financial services and consumer credit licensing, registration and disclosure obligations, consumer law requirements, privacy and anti-money laundering and counter-terrorism financing (AML/CTF) requirements.

Licensing obligations apply to entities that carry on a financial services business in Australia or engage in consumer credit activities. The definitions of financial service and financial product are broad, and will generally capture any investment or wealth management business, payment service (e.g., non-cash payment facility), advisory business (including robo-advice), trading platform, and crowdfunding platform, triggering the requirement to hold an Australian financial services licence (AFSL) or be entitled to rely on an exemption. Similarly, engaging in peer-to- peer lending activities will generally constitute consumer credit activities and trigger the requirement to hold an Australian credit licence (ACL) or be entitled to rely on an exemption.

Fintech businesses may also need to hold an Australian market licence (AML) where they operate a facility through which offers to buy and sell financial products are regularly made and accepted (e.g., an exchange). If an entity operates a CS mechanism which enables parties transacting in financial products to meet obligations to each other, the entity must hold a CS facility licence or otherwise be exempt.

The Australian Consumer Law applies to all Australian businesses that engage or contract with consumers. Obligations include a general prohibition on misleading and deceptive conduct, false or misleading representations, unconscionable conduct and unfair contract terms in relation to the offer of services or products. In May 2018, ASIC received a delegation of power from the Australian Competition and Consumer Commission (ACCC), enabling it to take action where there is potential misleading and deceptive conduct associated with financial products.

The Anti-money Laundering and Counter-terrorism Financing Act 2006 (Cth) (AML/CTF Act) applies to entities that provide “designated services” with an Australian connection. Generally, the AML/CTF Act applies to any entity that engages in financial services or credit (consumer or business) activities in Australia. Obligations include enrolment with AUSTRAC, reporting and customer due diligence.

The Banking Act 1959 (Cth) regulates those engaged in the business of banking to be authorised by APRA (i.e., be an “authorised deposit-taking institution” or ADI) before engaging in such business. It also contains the Banking Executive Accountability Regime (BEAR), which is also administered by APRA and establishes, among other things, accountability obligations for ADIs and their senior executives and directors, and deferred remuneration, key personnel and notification obligations for ADIs.

The Payment Systems (Regulation) Act 1998 (Cth) regulates purchased payment facility providers in relation to stored value facilities. Generally, such holders of stored value must be an ADI or be exempt from the requirement. The RBA is currently reviewing the regulatory framework for retail payments and closed submissions on its Issues Paper on the matter in January 2020.

The Financial Sector Collection of Data Act 2001 (Cth) (FSCODA) is designed to assist APRA in the collection of information relevant to financial sector entities. FSCODA generally applies to any corporation engaging in the provision of finance in the course of carrying on business in Australia, and APRA collects data from registered financial corporations under FSCODA. Generally, registered financial corporations with assets greater than AUD 50 million need to regularly report to APRA statements of financial position.

The Financial Sector (Shareholdings) Act 1998 (Cth) creates an ownership limit of 20% in a financial sector company without approval from the Treasurer.

Is there any regulation in your jurisdiction specifically directed at cryptocurrencies or cryptoassets?

At the time of writing, there are no laws in Australia that have been implemented to specifically regulate cryptocurrencies or cryptoassets. Generally, the predominant focus on the regulation of cryptocurrencies has revolved around its application to the established regulatory frameworks (e.g., financial services and consumer credit).

Currently, the only formal monitoring of cryptocurrency activity in Australia is in relation to AML/CTF, discussed in further detail in Please describe any AML and other financial crime requirements that may apply to fintech businesses in your jurisdiction. However, there have been numerous Government reviews that are ongoing or have recently been completed in connection with how cryptocurrency and cryptocurrency-adjacent services should be regulated (see the Fintech Landscape). It is expected that the recommendations from these reviews will have significant effects on the current regulatory regimes relevant to cryptocurrency.

From a regulatory guidance perspective, ASIC has released INFO 225 Crypto-assets (INFO 225) to assist businesses involved with cryptocurrency or providing cryptocurrency-adjacent services. INFO 225 covers regulatory considerations for cryptocurrency offerings, misleading and deceptive conduct, trading platforms and cryptocurrency offered via a regulated investment vehicle.

Are financial regulators and policy-makers in your jurisdiction receptive to fintech innovation and technology-driven new entrants to regulated financial services markets, and if so how is this manifested? Are there any regulatory ‘sandbox’ options for fintechs in your jurisdiction?

Regulators in Australia have generally been receptive to the entrance of fintechs and technology-focused businesses. The financial services regulatory regime adopts a technology-neutral approach, whereby services will be regulated equally, irrespective of the method of delivery. However, further concessions have been made by regulators in order to support technologically-focused start-ups entering the market and numerous reviews are ongoing or have recently been completed in connection with how cryptocurrency, payments and stored value should be regulated (see the Fintech Landscape).

ASIC has made certain class orders establishing a fintech licensing exemption and released Regulatory Guide 257, which details ASIC’s framework for fintech businesses to test certain financial services, financial products and credit activities without holding an AFSL or ACL by relying on the class orders (referred to as the regulatory sandbox). This was updated in September 2020 with the introduction of the enhanced regulatory sandbox to allow testing of a broader range of financial services and credit activities for a longer duration. There are strict eligibility requirements for both the type of businesses who can enter the regulatory sandbox and the products and services that qualify for the licensing exemption. Once a fintech business accesses the regulatory sandbox, there are restrictions on how many persons can be provided with a financial product or service and caps on the value of the financial products or services which can be provided.

Regulators have also committed to helping fintech businesses more broadly by streamlining access and offering informal guidance to enhance regulatory understanding. Both ASIC and AUSTRAC have established Innovation Hubs to assist start-ups in navigating the Australian regulatory regime. AUSTRAC’s Fintel Alliance has an Innovation Hub targeted at combatting money-laundering and terrorism-financing and improving the fintech sector’s relationship with the Government and regulators. The Innovation Hub also assesses the impact of emerging technologies such as blockchain and cryptocurrency.

ASIC has also entered into a number of cooperation agreements with overseas regulators under which there is a cross-sharing of information on fintech market trends, encouraging referrals of fintech companies and sharing insights from proofs of concepts and innovation competitions. It is also the intention of a number of these agreements to further understand the approach to regulation of fintech businesses in other jurisdictions, in an attempt to better align the treatment of these businesses across jurisdictions.

What, if any, regulatory hurdles must fintech businesses (or financial services businesses offering fintech products and services) which are established outside your jurisdiction overcome in order to access new customers in your jurisdiction?

Regulatory hurdles include registering with ASIC in order to carry on a business in Australia (generally satisfied by incorporating a local subsidiary or registering a branch office), satisfying applicable licensing, registration and disclosure requirements if providing financial services or engaging in consumer credit activities in Australia (or qualifying to rely on an exemption to such requirements), privacy, and complying with the AML/CTF regime. Broadly, these regulatory hurdles are determined by the extent to which the provider wishes to establish an Australian presence, the types of financial products and services provided, and the type of Australian investors targeted.

In the past, it has been common for foreign financial services providers (FFSPs) to provide financial services to wholesale clients in Australia by relying on ASIC’s “passport” or “limited connection” relief from the requirement to hold an AFSL. In March 2020, ASIC repealed both passport and limited connection relief and announced the implementation of a new foreign AFSL regime and funds management relief. FFSPs currently relying on passport relief or limited connection relief may do so until 31 March 2023.

As part of the 2021–2022 Budget, the Government announced its intention to “restore previously well-established regulatory relief for foreign financial service providers”. On 17 February 2022, the Government introduced the Treasury Laws Amendment (Streamlining and Improving Economic Outcomes for Australians) Bill 2022, which seeks to introduce:

  • the comparable regulator exemption, which exempts FFSPs authorised to provide financial services in a comparable regime from the requirement to be licensed when dealing with wholesale clients;
  • the professional investor exemption, which exempts FFSPs that provide financial services from outside Australia to professional investors from the requirement to be licensed in Australia; and
  • an exemption from the fit and proper person assessment to fast track the AFSL process for FFSPs authorised to provide financial services in a comparable regulatory regime.

However, an Australian federal election has been called for Saturday 21 May 2022, meaning that all unpassed bills that were in progress have now lapsed (i.e., they cannot progress further or be considered until a new Government is formed following the election). This includes the proposed legislation intended to replace the current passport regime.


Other Regulatory Regimes/Non-Financial Regulation 

Does your jurisdiction regulate the collection/use/ transmission of personal data, and if yes, what is the legal basis for such regulation and how does this apply to fintech businesses operating in your jurisdiction?

The Privacy Act

In Australia, the Privacy Act 1988 (Cth) (Privacy Act) regulates the handling of personal information by Government agencies and private sector organisations with an aggregate group revenue of at least AUD 3 million. In some instances, the Privacy Act will apply to businesses (e.g., credit providers and credit reporting bodies) regardless of turnover.

The Privacy Act includes 13 Australian Privacy Principles (APPs), which impose obligations on the collection, use, disclosure, retention and destruction of personal information.

The Notifiable Data Breaches (NDB) scheme was introduced in 2018. The NDB scheme mandates that entities regulated under the Privacy Act are required to notify any affected individuals and the Office of the Australian Information Commissioner (OAIC) in the event of a data breach (i.e., unauthorised access to or disclosure of information) which is likely to result in serious harm to those individuals. The NDB scheme applies to agencies and organisations that the Privacy Act requires to take steps to secure certain categories of personal information.

Consumer data right and access

In response to the Productivity Commissions’ report on Data Availability and Use, the Government will be implementing the national consumer data right (CDR) framework which will give customers a right to share their data with accredited service providers (including banks, comparison services, fintechs or third parties), encouraging the flow of information in the economy and competition within the market. The CDR framework will first be applied to the banking sector under the “Open Banking” regime, whereby consumers will be able to exercise greater access and control over their banking data. These sharing arrangements are intended to facilitate easier swapping of service providers, enhancement of customer experience based on personal and aggregated data, and more personalised offerings. Under Open Banking, as at February 2022, Australian major and non-major bank customers can share personal banking data as well as data connected to home loans, personal loans, overdrafts, business finance.

The European Union (EU) General Data Protection Regulation has extremely broad extra-territorial reach and may also impact the data handling practices of Australian businesses offering goods and services in the EU.

Do your data privacy laws apply to organisations established outside of your jurisdiction? Do your data privacy laws restrict international transfers of data?

The Privacy Act has extra-territorial operation and extends to acts undertaken outside Australia and its external territories where there is an “Australian link” (i.e., where the organisation is an Australian citizen or organisation) or carries on a business in Australia and collects personal information in Australia.

Under the framework for cross-border disclosure of personal information, APP entities must take reasonable steps to ensure that overseas recipients handle personal information in accordance with the APPs, and the APP entity is accountable if the overseas recipient mishandles the information. The APP entity must also only disclose information for the primary purpose for which it was collected.

Please briefly describe the sanctions that apply for failing to comply with your data privacy laws.

The Privacy Act confers on the OAIC a variety of investigative and enforcement powers to use in cases where a privacy breach has occurred, including:

  • the power to investigate a matter following a complaint or on the OAIC’s own initiative;
  • the power to make a determination requiring the payment of compensation or other remedies, such as the provision of access or the issuance of an apology;
  • enforceable undertakings;
  • seeking an injunction; and
  • seeking civil penalties of up to AUD 444,000 for individuals and up to AUD 2.22 million for bodies corporate.

In October 2021, the Government released draft legislation intending to increase the maximum penalties to the greater of:

  • AUD 10 million;
  • three times the benefit obtained through misuse of personal information; and
  • 10% of the company’s annual domestic turnover.

Does your jurisdiction have cyber security laws or regulations that may apply to fintech businesses operating in your jurisdiction?

Cyber security regulation has been a key focus of regulators and the Government given the rapid innovation in the fintech space and the interplay between financial services, financial products and new technologies. Cyber criminals have also been taking advantage of the COVID-19 crisis to conduct widespread COVID-19-themed email and SMS phishing campaigns.

In August 2020, the Government released its Cyber Security Strategy 2020, which will invest AUD 1.67 billion over 10 years in a tripartite approach to protecting, improving and enforcing and this will be delivered through action by governments, businesses and the community. The Government has also established an Industry Advisory Committee to shape the delivery of short-and longer-term actions as set out in its strategy. As part of the Cyber Security Strategy 2020, on 27 August 2021, the Government closed consultation options for regulatory reforms and voluntary incentives to strengthen the cyber security of Australia’s digital economy. The focus of the consultation was to (1) set clear cyber security expectations, (2) increase transparency, and (3) protect consumer rights through appropriate legal remedies for victims.

ASIC provides a number of resources to help firms improve their cyber resilience, including reports, articles and practice guides. In December 2019, ASIC released Report 651 Cyber Resilience of firms in Australia’s financial markets: 2018–19 (REP 651). REP 651 identifies key trends in cyber resilience practices and highlights existing good practices and areas for improvement. ASIC identified investment, education, acquisition and retention of skilled resources, and strong leadership from senior management as being core factors to maintaining strong cyber resilience. However, ASIC expressed concern towards the trend of outsourcing non-core functions to third-party providers, as this created difficulty when managing cyber security risks in a business’ supply chain.

ASIC has previously provided guidance regarding cyber security in Report 429 Cyber Resilience – Health Check and Report 555: Cyber resilience of firms in Australia’s financial market. In these reports, ASIC examined and provided examples of good practices identified across the financial services industry and questions board members and senior management of financial organisations should ask when considering their cyber resilience. ASIC’s Regulatory Guide 255 also set out the standards and frameworks against which providers of digital advice should test their information security arrangements, and nominated frameworks setting out relevant compliance measures which should be put in place where cloud computing is relied upon.

Australia has ratified the Council of Europe Convention on Cybercrime (the Budapest Convention), which codifies what constitutes a criminal offence in cyberspace and streamlines international cybercrime cooperation between signatory states. Australia’s accession was reflected in the passing of the Cybercrime Legislation Amendment Act 2011 (Cth). 

Please describe any AML and other financial crime requirements that may apply to fintech businesses in your jurisdiction.

The AML/CTF Act applies to entities that provide “designated services” with an Australian connection. Fintech business will often have obligations under the AML/CTF Act as financial services and lending businesses typically involve the provision of designated services. Obligations include:

  • enrolling with AUSTRAC;
  • conducting due diligence on customers prior to providing any designated services;
  • adopting and maintaining an AML/CTF programme; and
  • reporting annually to AUSTRAC and as required on the occurrence of a suspicious matter, a transfer of currency with a value of AUD 10,000 or more, and all international funds instructions.

Digital currency exchange providers also have obligations under the AML/CTF Act and must register with AUSTRAC or face a penalty of up to two years’ imprisonment or a fine of up to AUD 111,000 (or both) for failing to register. Digital currency exchange providers must renew registration every three years. Exchange operators are required to keep certain records relating to customer identification and transactions for up to seven years.

Are there any other regulatory regimes that may apply to fintech businesses operating in your jurisdiction?

An entity that conducts any “banking business”, such as taking deposits (other than as part-payment for identified goods or services) or making advances of money, must be licensed as an ADI. For locally incorporated entities, APRA offers a restricted pathway to becoming an ADI, known as a restricted ADI (RADI) licence. Becoming a RADI may be appealing to new entrants that do not have the resources and capabilities to establish an ADI and need time to develop these resources and capabilities. The restricted pathway allows entrants to conduct limited banking business as a RADI for a maximum of two years, before needing to meet the requirements of the full prudential framework and applying for an ADI licence. The initial conditions on a RADI licence are more restricted than those of a full ADI licence, reflecting the restricted range of activities permitted under the licence. This pathway can assist entrants in seeking the investment required to operationalise the business while progressing compliance with the full prudential framework and an ADI licence application. Entrants that cannot meet the requirements of an ADI are expected to exit banking business. Generally, APRA will subject new ADIs and RADIs to greater prudential supervision than established ADIs in the initial years of being licenced. This includes APRA accounting for the heightened risk profile of new ADIs and RADIs by adopting adjusted capital requirements, contingency planning and deposit restrictions. For new ADIs, APRA will assess the sustainability and track record of the new ADI when determining whether the ADI is established and these adjustments are no longer necessary. Fintech businesses are also subject to the prohibitions laid out in the Australian Consumer Law, which is administered by the ACCC. Broadly, this includes prohibitions on misleading and deceptive conduct, false or misleading representations, unconscionable conduct and unfair contract terms. While the Australian Consumer Law does not apply to financial products or services, many of these protections are enforced by ASIC either through mirrored provisions in the Australian Securities and Investments Commission Act 2001 (Cth) or through delegated powers.


Accessing Talent

In broad terms, what is the legal framework around the hiring and dismissal of staff in your jurisdiction? Are there any particularly onerous requirements or restrictions that are frequently encountered by businesses?

The hiring and dismissal of staff in Australia is governed under the Fair Work Act 2009 (Cth) (Fair Work Act). In relation to hiring, minimum terms and conditions of employment for most employees (including professionals) are governed by modern awards, which sit on top of the National Employment Standards. However, modern awards do not apply to employees earning over a threshold of AUD 158,500 (from 1 July 2021, threshold indexed annually), provided their earnings are guaranteed by written agreement with their employer.

To terminate an employee’s employment, an employer must give an employee written notice of the last day of employment. There are minimum notice periods dependent on the employee’s period of continuous service, although the employee’s award, employment contract, enterprise agreement or other registered agreement could set out longer minimum notice periods. Notice can be paid out rather than worked; however, the amount paid to the employee must equal the full amount the employee would have been paid if they worked until the end of the notice period. For serious misconduct, employers do not need to provide a notice of termination; however, the employee must be paid all outstanding entitlements such as payment for time worked or annual leave.

What, if any, mandatory employment benefits must be provided to staff?

Under the Fair Work Act, minimum entitlements for employees are set out under modern awards and include terms and conditions such as minimum rates of pay and overtime.

Australia also has 11 National Employment Standards. These include maximum weekly hours, requests for flexible working arrangements, parental leave and related entitlements, annual leave, long service leave, sick leave, compassionate leave, public holidays, notice of termination and redundancy pay, and a fair work information statement.

The Fair Work Act also has some general protection provisions governing a person’s workplace rights, freedom of association and workplace discrimination, with remedies available to employees if these provisions are contravened.

What, if any, hurdles must businesses overcome to bring employees from outside your jurisdiction into your jurisdiction? Is there a special route for obtaining permission for individuals who wish to work for fintech businesses?

Migrants require working visas from the Department of Home Affairs (DOHA) in order to work in Australia, and each type has its own eligibility requirements. Businesses can nominate or sponsor such visas.

The Temporary Skill Shortage (subclass 482) visa (TSS visa) is the most common form of employer-sponsored visa for immigration to Australia. To be eligible for the TSS visa, an applicant’s occupation must:

  • be on the short-term skilled occupations list, with a maximum visa period of two years or up to four years if an International Trade Obligation applies (Hong Kong passport holders are eligible to stay up to five years), with an option to apply for permanent residency subject to eligibility requirements;
  • be on the medium-and long-term strategy skills list or the regional occupational list, with a maximum period of four years (or five years for Hong Kong passport holders) and an option to apply for permanent residency, subject to eligibility requirements; or
  • have an employer that has a labour agreement with the Australian Government in effect, with a maximum period of up to four years (or five years for Hong Kong passport holders).

As at the time of writing, there is no special route for obtaining permission for individuals who wish to work for fintech businesses. However, DOHA has created a Global Business & Talent Attraction Taskforce to attract high value businesses and individuals to Australia (along with their ideas, networks and capital). The Taskforce facilitates the Global Talent Visa program and Global Talent Employer Sponsored program. To be invited to apply for a visa under the Global Talent Visa program, a candidate must be highly skilled in one of the 10 target sectors (including digitech and financial services and fintech) and be able to attract a salary that meets the high income threshold (as of 1 July 2021, the high income threshold is AUD 158,500).


Technology

Please briefly describe how innovations and inventions are protected in your jurisdiction.

Patent protection is available for certain types of innovations and inventions in Australia. A standard patent provides long-term protection and control over a device, substance, method or process, lasting for up to 20 years from the filing date. The requirements for a standard patent include the invention being new, involving an inventive step and being able to be made or used in an industry. Previously, inventions could be patented under an innovation patent (targeted at inventions with short market lives); however, these can no longer be applied for. Pre-existing innovation patents are still enforceable.

In Australia, provisional applications can also be filed as an inexpensive method of signalling intention to file a full patent application in the future, providing applicants with a priority date. However, filing this application alone does not provide the applicant with patent protection, but does give the person filing 12 months to decide whether to proceed with a patent application.

Design protection is available, for a period of up to 10 years, of any design that is both new and distinctive. Protection is based on visual appearance.

An Australian patent only provides protection in Australia. To obtain protection abroad, the applicant will need to file separate patent applications in each country or file a single international application under the Patent Cooperation Treaty (PCT), which gives the application effect in 155 countries including Australia. PCT applications based on a provisional application must be carried out within 12 months of filing the provisional application.

Please briefly describe how ownership of IP operates in your jurisdiction.

Broadly, the person or business that has developed intellectual property (IP) generally owns that IP, subject to any existing or competing rights. In an employment context, the employer generally owns new IP rights developed in the course of employment, unless the terms of employment contain an effective assignment of such rights to the employee. Contractors, advisors and consultants generally own new IP rights developed in the course of engagement, unless the terms of engagement contain an effective assignment of such rights to the company by whom they are engaged.

Under the Copyright Act 1968 (Cth), creators of copyright works such as literary works (including software) also retain moral rights in the work (for example, the right to be named as author). Moral rights cannot be assigned but creators can consent to actions that would otherwise amount to an infringement.

In order to protect or enforce IP rights in your jurisdiction, do you need to own local/national rights or are you able to enforce other rights (for example, do any treaties or multi-jurisdictional rights apply)?

Options available to protect or enforce IP rights depend on the type of IP. As an example, software (including source code) is automatically protected under the Copyright Act 1968 (Cth). An owner may also apply to IP Australia, the Government body administering IP rights and legislation, for software to be registered under the Designs Act 2003 (Cth) or patented under the Patents Act 1967 (Cth). Software can also be protected contractually through confidentiality agreements between parties.

A standard or provisional patent can also be held to protect or enforce IP rights in Australia. Australia is also a party to the PCT, administered by the World Intellectual Property Organization. A PCT application is automatically registered as a standard patent application within Australia; however, the power to successfully grant patent rights remains with IP Australia.

How do you exploit/monetise IP in your jurisdiction and are there any particular rules or restrictions regarding such exploitation/monetisation?

In Australia, there are generally five approaches to commercialising IP. These are:

  • Assignment: An outright sale of IP, transferring ownership to another person without imposing any performance obligations.
  • Direct in-house use of IP: Owners of IP may commercialise the IP within an existing entity already in their control. This is generally common if the IP was originally created in-house or was acquired as described above.
  • Licensing: Permission is granted for IP to be used on agreed terms and conditions. There are three types of licence (exclusive licence, non-exclusive licence and sole licence) and each comes with conditions.
  • Franchising: A method of distributing goods and services, where one party (franchisor) grants another party (franchisee) the right to use its trade mark or trade name as well as the use of its business systems and processes in return for payment and royalties. These licensed rights are used by the franchisee to provide goods or services to agreed specifications controlled by the franchisor.
  • Start-up or spin-off: Where a separate company (either new (start-up) or partitioning from an existing company (spin-off)) is established to bring a technology developed by a parent company to the market. IP activities to be carried out for spin-offs include due diligence, confidentiality, employment contracts, assignment agreements and licence agreements.

Broadly, a business can only exploit or monetise IP that the business in fact owns or is entitled to use. Restrictions apply to the use of IP that infringes existing brands, and remedies (typically injunctions and damages) are available where the use of IP infringes the rights of another business.

DOWNLOAD PDF
""
 
""