Australia: APRA’s new regulatory expectations for crypto assets strengthen regional focus



The Australian Regulator (APRA) has written to industry, setting out its initial risk management expectations for regulated entities engaging in crypto-asset-related activities, as well as a policy roadmap for the period ahead. We examine the APRA proposals in more detail below.


  1. APRA Expectations
  2. Political Roadmap
  3. Next Steps

APRA Expectations

In response to the growing list of crypto-asset-related activities, including crypto-asset investments, crypto-asset-related lending and issuance, service providers face a range of operational risks. These include fraud, cyber, conduct, AML/CTF and technology risks.

APRA’s expectation, outlined in the letter, is that all regulated entities:

  • conduct appropriate due diligence and comprehensive risk assessment before engaging in any crypto-asset related activity and ensure they understand any risks they may incur in doing so and have measures in place to mitigate them;
  • consider the principles and requirements of Prudential Standard CPS 231 Outsourcing or Prudential Standard SPS 231 Outsourcing when relying on a third party to conduct activities related to crypto assets; and
  • Apply robust risk management controls, with clear responsibilities and relevant reporting to the Board of Directors on the key risks associated with the new businesses (e.g. assigning responsibilities for crypto asset activities to BEAR Accountable Person(s).

Potential regulatory risks include:

  • Capital Management: Note that if a crypto asset is defined as an intangible asset under relevant accounting standards, it must be deducted from Common Equity Tier 1 (CET1). The Basel Committee is deliberating on a longer-term regulatory treatment of crypto-asset exposures, which may result in distinctions for different types of crypto-assets.
  • Investment Risk: Licensees of registrable pension schemes that are considering investing in crypto assets as part of their investment strategy must be able to demonstrate how the investment is consistent with a duty to act in the best financial interests of beneficiaries, satisfies investment strategy agreements, and complies with existing regulatory requirements Requirements.
  • Operational Risk: Organizations must continue to address the inherent operational risks and identify, assess and manage fraud, cyber, behavioral, financial crime and technology risks. Questions surrounding custody or the use of third parties for redemption and operations are also likely to arise.

APRA has also noted that companies must also ensure they comply with all conduct and disclosure rules administered by ASIC, including robust conduct risk management and consideration of sales practices and product design and disclosure. Companies in doubt about regulatory, disclosure or behavioral requirements and expectations related to crypto-asset related activities are expected to consult with APRA and ASIC.

Political Roadmap

The crypto asset proposals are part of APRA’s strategic regulatory architecture modernization initiative, which aims to ensure Australia’s regulatory framework supports financial security and stability in a digital world.

In consultation with other international regulators, APRA has indicated that they are developing a longer-term regulatory framework for crypto assets and related activities in Australia. The Basel Committee’s consultation on the regulatory treatment of banking risk in crypto assets will provide the basis for internationally agreed minimum standards for eligible deposit-taking institutions (ADIs) and a starting point for regulatory expectations regarding other APRA-regulated entities.

APRA’s proposed plans for the future are summarized below.

Timed coordination activity
2022 Basel Committee consultation on crypto assets. Draft supervisory standard on new and revised operational risk management requirements (including control effectiveness, business continuity and service provider management), to be published for consultation in mid-2022.
2023 Consultation on requirements for the regulatory treatment of crypto asset exposures in Australia for FDIs (following the completion of the current Basel Committee consultation). In the meantime, APRA will assess the need for initial regulatory guidance. APRA believes that stablecoin payment arrangements bear similarities to stored value facilities (SVFs). APRA is working with the Council of Financial Regulators to develop options for including payment stablecoins in the proposed regulatory framework for SVFs. Pending broader developments in the legal framework, APRA plans to advise on prudential requirements for large SVFs in 2023.
2024 Operational risk standard expected to come into force.
2025 Crypto asset requirements are expected to come into effect. The SVF standard is expected to come into force.

Next Steps

The regulatory framework for virtual assets is evolving rapidly as regulators try to keep up with the pace of change and determine how best to balance the need to facilitate innovation while ensuring adequate investor protection. Alignment among regulators is likely to increase through the work of supranational bodies such as the International Organization of Securities Commissions (IOSCO), the Bank for International Settlements (BIS) and the Financial Action Task Force (FATF). It is important for virtual asset service providers, issuers and other ecosystem participants to understand evolving operational requirements to ensure they can make the most of their products and offer them to the widest possible customer base and markets. Conversely, institutional investors will continue to welcome more regulatory certainty and clarity about how they can continue to explore broader investment opportunities to generate potential returns for their beneficial owners.

The content is provided for educational and informational purposes only and is not intended and should not be construed as legal advice. This may qualify as “attorney solicitation” in some jurisdictions, requiring notification. Previous results do not guarantee similar results. For more information go to:


About Author

Comments are closed.