The Global Legal Insights series highlights essential commercial considerations with respect to current legal, economic and policy developments as analysed by legal experts around the world.

Global Legal Insights: Fintech 2020 sets out the key regulatory approaches and developments to fintech, examines the rise of regulatory and insurance technology, provides detail on the key regulators and any relevant restrictions to carrying on a fintech business, and discusses how fintech businesses may operate across borders.

The Australia chapter is set out in full below.

Approaches and developments

Australia has seen a continued proliferation of active fintech businesses, with payments, investment and data emerging as the key sectors for disruption. This has occurred despite significant uncertainty in (and in many cases, criticism of) the financial services industry as a result of the release of the Final Report of the Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry (Royal Commission) in February 2019.

As discussed below under “Regulatory bodies”, Australian regulators have generally been receptive to the growth of the Australian fintech ecosystem and there has been considerable discussion around the opportunities, risks and challenges that have arisen for market participants, customers and regulators. Australian policy-makers and bodies continue to make regulatory and legislative developments to ensure the scope of emerging services is adequately captured within the existing financial services framework. This has included increased technology-neutral or fintech-specific regulatory guidance to assist businesses  in understanding their obligations, amended legislation to bring fintech services providers within the remit of existing regimes, and the introduction of new legislation to provide greater consumer protection.

Following the delivery of the Final Report of the Royal Commission, regulatory focus has pivoted to make consumer protection the utmost priority for incumbent financial institutions. Highlighting the industry’s sales over service-related misconduct, the Royal Commission’s findings have demonstrated the need for industry-wide change to the culture and governance of financial services providers to prioritise the interests of consumers. In the future, regulators are likely to take a more stringent approach to enforcement. For example, the Australian Securities and Investments Commission (ASIC), which has announced a “why not litigate” regulatory stance, has been empowered with additional penalty provisions under the Treasury Laws Amendment (Strengthening Corporate and Financial Sector Penalties) Act 2018 (Cth) to provide greater deterrence value against misconduct in the financial services sector. This presents an opportunity for fintechs, which are historically focused on delivering customer- centric outcomes and are often better placed to respond quickly to regulatory change.

The use and offering of digital wallets continues to grow. Relevantly, the Council of Financial Regulators (comprised of Australia’s major financial regulators) made recommendations to the Australian Government (Government) for a new graduated framework for stored value facilities (i.e., digital wallets that are widely used as a means of payment and store significant value for a reasonable amount of time) to be overseen by the Australian Prudential Regulatory Authority (APRA), Australia’s banking regulator. The new framework is intended not only to be fit for purpose for the current financial system but also be able to accommodate future developments and technological advances, such as proposals for global stable coin ecosystems.

Businesses have been exploring new automated service methods including the use of robo- advisors for distributing financial advice in more cost-effective ways. There has been sustained attention on blockchain and distributed ledger technology (DLT) to the extent that fintechs have begun formalising use cases for DLT, such as managing supply chains, making cross-border payments, trading derivatives, managing assets and managing digital currency exchanges. The Australian Securities Exchange (ASX), Australia’s primary securities exchange, is currently in the process of rolling out a DLT-based replacement for its clearing and settlement process. The ASX is currently conducting internal analysis and testing of the technology which is set to conclude at the end of August 2020, with the implementation of the new system scheduled for March 2021.

The implementation of the new national Consumer Data Right (CDR) framework is anticipated to address many of the issues identified in the Royal Commission, and have a profound effect on the financial services industry by encouraging customers to switch service providers and open the market to new fintech businesses. The CDR framework will first be applied to the banking sector under the “Open Banking” regime, enabling consumers to exercise greater access and control over their banking data. The “Open Banking” regime is expected to commence in July 2020.

There have been a number of relevant legislative changes in Australia (see “Fintech offering in Australia” below). The Treasury Laws Amendment (Design and Distribution Obligations and Product Intervention Powers) Bill 2019 comes into effect on 5 April 2021 and introduces a design and distribution obligation for financial services firms as well as a product intervention power for ASIC. The new regime will require product issuers to ensure products are targeted and offered to the right customers and enable ASIC to intervene when inappropriate products are distributed. More than ever, it will be important for financial service providers, including fintechs, to consider the suitability of products and disclosure documents for their own unique customer base.

Fintech offering in Australia

Fintech businesses have been disrupting the Australian banking, investment and wealth management, payments, advisory, trading and fundraising sectors through offers of alternatives to the relatively concentrated traditional providers of these financial services. These alternative offers generally focus on providing financial services in a way that prioritises customer experience and outcomes, utilises technology solutions such as apps and smart devices in the delivery of financial services, or disintermediates the provision of financial services.

Fintech businesses must comply with all existing laws and regulations for financial services and consumer credit activities in Australia. The Government has taken steps to alleviate the regulatory burden on fintechs looking to test the Australian market prior to a full product or service launch. See “Key regulations and regulatory approaches” below for further discussion.

Regulatory guidance has also been updated to address the fintech sector. For example, ASIC has released specific guidance clarifying the licensing, conduct and disclosure obligations that apply to the provision of digital financial product advice. This includes requiring nomination of a person within the business who understands and will be responsible for the ongoing monitoring of the algorithms used to produce any advice provided.

ASIC has clarified how Australian financial services laws may apply to ICOs as an alternative funding mechanism. In summary, the legal status of an ICO depends on the structure, operation and the rights attached to the tokens offered. Tokens offered during the ICO may trigger licensing, registration and disclosure requirements, if the tokens are financial products (e.g., interests in managed investment schemes, securities, derivatives or non-cash payment facilities). Cryptocurrency-related funding rounds are increasingly being considered an offering of a financial product and there is a growing trend for offerors to pre-emptively step into the regulatory framework by means of a security token offering (STO).

Blockchain technology continues to capture the attention of established businesses. In the past couple of years, Australia has witnessed the application of DLT in solutions across a broad range of financial market operators, financial institutions, financial service providers and fintechs which has prompted new regulation. In 2018, ASIC introduced a two-tiered market licensing regime for financial market operators and updated its corresponding regulatory guidance. Specifically, the guidance reflects a risk-based assessment that will be undertaken, which is consistent with the approach taken internationally to the administration of market licensing. Under the revised Australian Market Licence (AML) regime, market venues can be designated as being either Tier 1 or Tier 2, depending on their nature, size, complexity and the risk they pose to the financial system, investor confidence and trust. While Tier 1 market venues are, or are expected to become, significant to the efficiency and integrity of (and confidence in) the Australian financial system, Tier 2 licences will be able to facilitate a variety of market venues and will have reduced obligations to accommodate new and specialised market platforms. The tiered market regime is expected to impact, amongst others, market operators and operators of market-like venues, as well as platforms seeking to offer secondary trading.

The Australian banking sector is highly regulated with stringent licensing, conduct (including reporting) and regulatory capital requirements which act as significant hurdles for new businesses entering the market.  Any entity that conducts any “banking business”, such   as taking deposits (other than as part-payment for identified goods or services) or making advances of money, must be licensed as an authorised deposit-taking institution (ADI). Recently, APRA released a new Restricted ADI framework which allows new businesses entering the banking industry to conduct a limited range of banking activities for two years while they build their capabilities and resources. After such time, they must either transition to a full ADI licence or exit the industry. In January 2019, the first Restricted ADI licensee was granted a full ADI licence which allows it to operate as an ADI without restrictions under the Banking Act 1959 (Cth). The licensee is a “neobank”, which is a wholly digital quasi- bank that intends to provide full banking services to customers via a solely mobile platform. These types of entities use an internet or mobile platform to interact with customers and offer a different user experience from a traditional bank. Including this licensee, two neobanks launched in Australia in 2019, with another neobank in beta phase but yet to be launched to the wider public. These neobanks have largely been met with a positive response from the market and significant uptake by consumers.

Fintech businesses will generally have obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act) and Anti-Money Laundering and Counter-Terrorism Financing Rules Instrument 2007 (No.1) (AML/CTF Rules). The AML/CTF Act applies to entities that provide “designated services” with an Australian connection. In 2018, the AML/CTF Act was amended to capture digital currency exchange providers within the scope of the regime by registering and enrolling with the Australian Transaction Reports and Analysis Centre (AUSTRAC). Registered exchanges are required to implement know-your-customer processes to adequately verify the identity of their customers, adopt and maintain an AML/CTF programme as well as meet ongoing obligations to monitor and report suspicious and large transactions. The money-laundering risk associated with social media platforms is likely to become a focus for Australian regulators such as AUSTRAC. In early 2019, the Asia/Pacific Group on Money Laundering published a report on the capacity for money laundering and terrorism financing through the abuse of social media services, particularly due to the anonymity of users and speed of payment flows. The report provided measures for authorities to overcome detection, investigation and prosecution challenges. AUSTRAC has not yet responded to the report; however, we would expect to see consideration of the risks incorporated in any future proposed reforms to the AML/CTF Act.

Regulatory and insurance technology

The rising cost of compliance has prompted many companies using artificial intelligence (AI), customer due-diligence (e.g., “know-your-customer”) and data breach monitoring (e.g., “know-your-data”) technologies to invest in regulatory technology, or regtech. ASIC has indicated the benefits of regtech to provide better outcomes for consumers and has hosted annual forums to provide an environment for collaborative information sharing between businesses and to promote stakeholder engagement. It has also been reported that ASIC has actively encouraged incumbent financial institutions to partner with fintechs to harness regtech to automate regulatory reporting, manage compliance and ensure clarity to how regulation is interpreted.

ASIC undertook four regtech initiatives in 2019 using Government funding intended to promote Australia as a world leader in developing and adopting regtech solutions to risk management and compliance problems relating to financial services. These events were designed to further promote regtech adoption with respect to monitoring and analysing financial advertising, detecting problematic financial advice, and highlighting the use case for voice analytics and voice-to-text technology for regulatory activity. One initiative included a proof-of-concept chatbox, which was developed to help businesses navigate the credit and financial services licensing regulatory framework. The industry has called for ASIC to design regulation and guidance in formats aiding regtech applications, to provide best practice-style guidance on compliance and the use of algorithms in the provision of financial services, and to harmonise industry standards with respect to risk management, compliance and reporting obligations. AUSTRAC has also hosted a regtech showcase, inviting demonstrations from providers of innovative solutions to regulatory challenges presented in the AML/CTF space.

Investments in insurance technology in Australia have increased, with companies and fintechs focusing on forging cross-sector alliances in order to embed their offerings into alternative value propositions. Insurance technology has the potential to disrupt individual sections of the insurance value chain, augment the existing processes of underwriting risk and predicting loss, and improve the existing capabilities of insurers, reinsurers, intermediaries and service providers. The increase in partnerships and alliances between insurance fintechs and incumbents with established customer bases will be effective for insurance start-ups to fuel expansion.

There have not been any specific changes to legislation or regulation due to regtech or insurance technology; however, this may change in the future as uptake increases and becomes more mainstream.

Regulatory bodies

Australia has a twin peaks model of regulation with respect to financial services:

1. ASIC is Australia’s primary corporate, markets, financial services and consumer credit regulator. It is responsible for regulating consumer protection and maintaining market integrity within the financial system. ASIC supervises the conduct and regulation of Australian companies, financial markets, and financial service and consumer credit providers.
2. APRA is concerned with maintaining the safety and soundness of financial institutions, promoting financial stability in Australia and is tasked with protecting the interests of depositors, policy-holders and superannuation fund members. APRA oversees ADIs (e.g., banks, building societies and credit unions), general and life insurers, friendly societies, reinsurers and superannuation funds.

AUSTRAC is responsible for administering Australia’s anti-money laundering and counter- terrorism financing regime under the AML/CTF Act and the AML/CTF Rules. AUSTRAC may pursue a wide range of enforcement sanctions under the AML/CTF Act which include imposing civil and criminal penalties (which can be significant in value), enforceable undertakings, infringement notices, remedial directions, and power to cancel or suspend registrations of providers of digital currency exchange and designated remittance services. AUSTRAC plays an active role in setting and implementing international standards and is a member of regional and global groups such as the Financial Action Task Force and the Asia/ Pacific Group on Money Laundering.

The Office of the Australian Information Commissioner (OAIC) administers the Privacy Act 1988 (Cth) (Privacy Act) which regulates the handling of personal information by Federal Government agencies and some private sector organisations. The Privacy Act includes  13 Australian Privacy Principles (APPs), which impose obligations on the collection, use, disclosure, retention and destruction of personal information. The APPs extend to an act done, or practice engaged in, outside Australia by an organisation that has an “Australian link” (including where it carries on business in Australia and has collected or held personal information in Australia, either before or at the time of the act or practice).

Fintechs may also be subject to the prohibitions laid out in the Australian Consumer Law, which is enforced by the Australian Competition and Consumer Commission (ACCC). Broadly, these include prohibitions on misleading and deceptive conduct, false or misleading representations, unconscionable conduct and unfair contract terms. Whilst the Australian Consumer Law does not apply to financial products or services, many of these protections are enforced by ASIC either through mirrored provisions in the Australian Securities and Investments Commission Act 2001 (Cth) (ASIC Act) or through delegated powers.

The Reserve Bank of Australia is Australia’s central bank and provides a range of banking services to the Government and its agencies, overseas central banks and official institutions. It is also responsible for maintaining the stability of the financial system through monetary policy and regulating payment systems.

The Fair Work Commission is Australia’s national workplace relations tribunal and is responsible for administering the provisions of the Fair Work Act 2009 (Cth) (Fair Work Act), which governs the regulation of employment in Australia. In relation to hiring, minimum terms and conditions of employment for most employees (including professionals) are governed by modern awards, which sit on top of the National Employment Standards. The Fair Work Commission’s powers and functions broadly include dealing with unfair dismissal claims, anti-bullying claims, unlawful termination claims, setting and reviewing minimum wages in modern awards and making orders to stop or suspend industrial action.

Key regulations and regulatory approaches

Regulatory framework for fintech businesses

Fintech businesses must comply with the applicable licensing, registration and disclosure obligations under Australia’s financial services regime.

Fintech businesses carrying on a financial services business in Australia must hold an Australian financial services licence (AFSL) or be exempt from the requirement to be licensed. Financial services are broadly defined under the Corporations Act 2001 (Cth) (Corporations Act), which is administered by ASIC, to include the provision of financial product advice, dealing in financial products (as principal or agent), making a market for financial products, operating registered schemes and providing custodial or depository services. A financial product is a facility through which, or through the acquisition of which, a person makes a financial investment, manages a financial risk or makes a non-cash payment.

The Australian credit licence (ACL) regime applies to entities who engage in consumer credit activities in Australia, such as providing credit under a credit contract or consumer lease. Fintech businesses that provide marketplace lending products and related services will constitute consumer credit activities and will generally trigger the requirement to hold an ACL, or otherwise be exempt from the requirement to hold an ACL. Consumer credit activity is regulated by ASIC and under the National Consumer Credit Protection Act 2009 (Cth) and associated regulations.

Fintech businesses may also need to hold an AML where they operate a facility through which offers to buy and sell financial products are regularly made (e.g., an exchange). If an entity operates a clearing and settlement mechanism which enables parties transacting in financial products to meet obligations to each other, the entity must hold a clearing and settlement facility licence or be otherwise exempt.

As discussed above in “Regulatory bodies”, the Privacy Act regulates the handling of personal information by Federal Government agencies and some private sector organisations. In 2018, the Notifiable Data Breaches (NDB) scheme was introduced and mandates that entities regulated under the Privacy Act are required to notify any affected individuals and OAIC in the event of a data breach (i.e., unauthorised access to or disclosure of information) which is likely to result in serious harm to those individuals. The NDB scheme applies to agencies and organisations that the Privacy Act requires to take steps to secure certain categories of personal information.

Fintech innovation and regulatory developments

Australian regulators and policy-makers in the financial services sector have sought to improve and engage with technology-focused businesses. The financial services regulatory regime adopts a technology-neutral approach so that services are regulated equally, irrespective  of the delivery method. Regulators have supported the market entrance of fintechs by streamlining access and offering informal guidance to enhance regulatory understanding. Both ASIC and AUSTRAC have established Innovation Hubs to assist fintech businesses more broadly in understanding their obligations under Australian law. ASIC’s Innovation Hub provides tailored information and access to informal assistance intended to streamline the AFSL process for fintech start-ups. AUSTRAC’s Fintel Alliance also has an Innovation Hub targeted at combatting money laundering and terrorism financing and improving the fintech sector’s relationship with the Government and regulators.

ASIC has also issued instruments establishing a fintech licensing exemption and released regulatory guidance detailing its regulatory sandbox for fintech businesses to test financial services, financial products and credit activities for up to 12 months without holding an AFSL or ACL. There are strict eligibility requirements for both the types of businesses that can enter the regulatory sandbox and the products and services that qualify for the licensing exemption.

Restrictions

At the time of writing, there have not been any explicit prohibitions or restrictions on fintech business types. Australian regulators and policy-makers have generally sought to encourage and support fintech businesses, provided such businesses comply with applicable laws (including financial services and consumer laws).

However, the Government has introduced new obligations under the Treasury Laws Amendment (Design and Distribution Obligations and Product Intervention Powers) Act 2019 (Cth) (DDO & PIP Act) for financial products and credit products issued and distributed to retail clients. The DDO & PIP Act introduces design and distribution obligations requiring financial product issuers to make a “target market determination” for the product, conduct distribution in accordance with the determination, notify ASIC of significant dealings inconsistent with the determination and regularly review the determination. The DDO & PIP Act also empowers ASIC to intervene using its product intervention power when it considers a financial product has, will, or is likely to result in significant consumer detriment. The design and distribution obligations were slated to take effect on 5 April 2021, but ASIC has announced a deferral until 5 October 2021 after noting the significant impact of COVID-19 on the industry. ASIC has already utilised its product intervention power in relation to short-term credit practices, the sale of add-on financial products by car yard intermediaries, over-the-counter binary options and contracts for difference.

Cross-border business

Collaboration

Australian regulators and policy-makers have sought to improve their understanding of, and engagement with, fintech businesses by regularly consulting with industry on proposed regulatory changes and entering into international cooperation and information-sharing agreements. ASIC has entered into a number of cooperation agreements and information- sharing agreements with overseas regulators for the purpose of facilitating cross-border financial regulation and removing barriers to market entry. Under these arrangements there is a sharing of information on fintech market trends, encouraging referrals of fintech companies and sharing insights from proofs of concept and innovation competitions. Through these agreements, regulators hope to further understand the approach to regulation of fintech businesses in other jurisdictions, in an attempt to better align the treatment of these businesses across jurisdictions. ASIC currently has either information-sharing or cooperation agreements with numerous jurisdictions, including the China Securities Regulatory Commission, Hong Kong’s Securities and Futures Commission, the Monetary Authority of Singapore, the Swiss Financial Market Supervisory Authority, the United States Commodity Future Trading Commission, the Capital Markets Authority of Kenya, Indonesia’s Otoritas Jasa Keuangan and Canada’s Ontario Securities Commission.

ASIC has also committed to supporting financial innovation in the interests of consumers by joining the Global Financial Innovation Network (GFIN), which was formally launched in January 2019 by a group of financial regulators across 29 member organisations. The GFIN is dedicated to facilitating regulatory collaboration in a cross-border context and provides more efficient means for innovative businesses to interact with regulators.

In 2019, a number of fintech associations formed the Asia-Pacific FinTech Network which is designed to facilitate greater collaboration, cooperation and innovation across the region. The network will focus on sectors including regtech, blockchain, payment systems, AI and financial inclusion. The network is predicted to accelerate fintech development and lower financial costs both domestically and internationally.

Foreign financial services providers

Carrying on a financial services business in Australia will require a foreign financial service provider (FFSP) to hold an AFSL, a Foreign Australian Financial Services Licence (FAFSL) or rely on an exemption. The FAFSL regime became effective on 1 April 2020, replacing the previous “passport” relief, and is designed to be more streamlined than the AFSL application process. FFSPs must be regulated overseas by specified sufficiently equivalent regulatory regimes to be eligible to apply for a FAFSL to provide certain financial services to wholesale clients in Australia.

The FAFSL regime is currently available to entities regulated by certain regulators in Denmark, France, Germany, Hong Kong, Luxembourg, Ontario in Canada, Singapore, Sweden, United Kingdom and the United States. FFSPs from another jurisdiction are entitled to apply to extend the FAFSL regime to other regulatory regimes.

Entities currently relying on “passport” relief will have until 31 March 2022 to apply for a FAFSL, AFSL, cease carrying on a financial services business in Australia or rely on another form of exemption. FFSPs currently relying on “limited connection” relief can continue relying on such relief until 31 March 2022.

ASIC has also unveiled the ASIC Corporations (Foreign Financial Services Providers— Funds Management Financial Services) Instrument 2020/199 (Funds Management Relief Instrument) under which eligible FFSPs will not be required to hold an AFSL if the FFSP is carrying on a financial services business by engaging in “inducing” conduct while providing certain funds management financial services to certain Australian investors. Conduct that amounts to inducing includes attempts to persuade, influence or encourage a particular person to become a client. FFSPs that are carrying on a financial services business other than because of inducing conduct will not be eligible to rely on the Funds Management Relief Instrument. Funds management licensing relief will commence on 1 April 2022.

New structures

In June 2018, the Government passed the Corporations Amendment (Asia Region Funds Passport) Act 2018 (Cth), which incorporates the Asia Region Funds Passport (Passport) into the Corporations Act.  The Passport is a region-wide initiative to facilitate the offer  of interests in certain collective investment schemes established in Passport member economies to investors in other Passport member economies. It aims to provide Australian fund managers with greater access to economies in the Asia-Pacific by reducing existing regulatory hurdles. Australia, Japan, Korea, New Zealand and Thailand are all signatories to the Passport’s Memorandum of Cooperation. The Passport officially launched on 1 February 2019 and Australia has passed laws to enable the Passport to operate. Broadly, the Passport requires an eligible fund to apply to its home regulator for a passport and comply with home economy requirements in order to be registered (for Australian funds, this effectively requires registration as a managed investment scheme with ASIC). Once registered, the fund must notify the host regulator and meet host economy requirements relating to disclosure, distribution and complaints handling (for offshore funds wishing to be offered in Australia, this effectively requires compliance with the corresponding obligations for registered managed investment schemes).