The fintech landscape in Australia is rapidly evolving, with regulations needing to be continuously updated in order to keep pace. The International Comparative Legal Guide (ICLG) 2021 provides legal practitioners with an analysis of the most current Australian laws and regulations regarding fintech.
In this Australian Chapter of the ICLG, we cover:
- The Fintech Landscape
- Funding for Fintech
- Fintech Regulation
- Other Regulatory Regimes / Non-Financial Regulation
- Accessing Talent
- Technology
1. The Fintech Landscape
1.1 Please describe the types of fintech businesses that are active in your jurisdiction and the state of the development of the market, including in response to the COVID-19 pandemic. Are there any notable fintech innovation trends of the past year within particular sub-sectors (e.g. payments, asset management, peer-to-peer lending or investment, insurance and blockchain applications)?
The COVID-19 pandemic had the largest impact on the Australian fintech market in the last year. The COVID-19 pandemic impacted the expected pace of regulatory change, and somewhat slowed the maturation of fintech offerings. However, while the industry faced significant obstacles in the face of broader economic uncertainty, many fintech businesses saw 2020 as an opportunity to develop and refine product and service offerings to better meet shifting consumer preferences and reflect innovations and opportunities created by technology. For example, businesses that were able to capitalise on integrating digital payment infrastructure and services and provide online services generally saw relatively higher uptake as a result of social distancing and lockdown measures.
As at the start of 2021, the Australian economy and public have recovered reasonably well from the pandemic and there is some optimism that the pace of fintech creation, development and adoption will regain some speed – particularly given the broadening of product offerings by the Australian fintech community. While previous fintech offerings were limited to operating on the periphery of traditional financial services (including lending, personal finance and asset management), the sector has now moved to disrupt the core product offering of many Australian institutional financial service providers, including payments, wallets, supply chain, wealth and investment, data and analytics and decentralised finance.
Australia’s current financial services policy and regulatory context is still largely informed by the findings of the 2017– 2019 Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry (Royal Commission). The Royal Commission made a series of recommendations for regulatory reform, focusing on matters such as prioritising the interests of consumers, overhauling conflicted remuneration structures and changing the way add-on products are distributed. A raft of legislative changes followed (or are expected to follow) to implement these recommendations and fintechs – particularly those that are motivated to provide financial services in a way that is more convenient, personalised and simplified for consumers – will be well placed to adapt to these changes, and seize the opportunity presented by the current public sentiment of dissatisfaction with traditional providers.
We note that the changes to implement the Royal Commission recommendations have generally been deferred due to COVID-19 and changing regulator priorities. However, across the financial services sector and including fintechs, we expect to see more rigorous engagement with regulators such as the Australian Securities and Investments Commission (ASIC), Australian Prudential Regulation Authority (APRA) and the Australian Transaction Reports and Analysis Centre (AUSTRAC) on licensing, conduct and disclosure and a more proactive approach to enforcement. For these regulators, fintech is likely to be a significant focus going forward, particularly the “Buy Now, Pay Later” (BNPL) and payment remittance sectors.
In November 2020, ASIC released a report on Australia’s BNPL sector, detailing the number and value of transactions and made observations regarding the potential for consumer detriment. Although ASIC has stated that it is not yet appropriate to regulate this sector specifically, it has alluded to the possibility of using its recent product intervention powers and the forthcoming (October 2021) design and distribution obligations to improve consumer outcomes.
The Reserve Bank of Australia (RBA) is currently undertaking a framework review of the regulatory regime supporting various payment methods. This includes reviewing any functionality gaps in the retail payment system, broadly capturing the role of cash, cheques and the direct entry system, the impact of new technologies and entrants (including closed loop systems and stored value systems), the resilience of the payments system against disruptions, roles of domestic-focused schemes and frameworks, cross- border payments and the possible issuance of electronic bank- notes. The report was initially slated to be produced by the end of 2020, however this has been extended to 2021.
As part of its Digital Business Package, the Government (through the Treasury) is reviewing the regulatory architecture of the Australian payments system to ensure that it remains fit for purpose and is capable of supporting continued innovation. The report is due to the Treasurer in May 2021.
There has been sustained attention on cryptocurrency and blockchain technology, and a growth in interest in the technology by established businesses. Fintech businesses have begun moving beyond the proof-of-concept stage to formalising actual use cases for distributed ledger technology, such as managing supply chains, making cross-border payments, trading derivatives, managing assets and digital currency exchanges. The ASX continues to progress its plans to adopt a blockchain-based technology for its clearing and settlement (CS) process to replace its current “CHESS” system. The ASX is currently conducting internal analysis and testing of the technology with specific customer development workspaces and is currently scheduled to be implemented by April 2022 (with provision for this to be extended to April 2023, if required).
1.2 Are there any types of fintech business that are at present prohibited or restricted in your jurisdiction (for example cryptocurrency-based businesses)?
At the time of writing, there have not been any prohibitions or restrictions on specific fintech business types. Cryptocurrency- based businesses are permitted in Australia, provided such businesses comply with applicable laws (including financial services and consumer laws).
2.1 Broadly, what types of funding are available for new and growing businesses in your jurisdiction (covering both equity and debt)?
Equity funding
Businesses can raise equity using traditional private and public fundraising methods (e.g., private placement, initial public offering, and seed and venture capital strategies), through grants and initiatives offered by Government and State/Territory agencies, and through crowdfunding.
In late 2017, a regulatory framework was introduced for crowd-sourced equity funding (CSEF) by public companies from retail investors. While reducing the regulatory barriers to investing in small and start-up businesses, the framework also created certain licensing and disclosure obligations for CSEF intermediaries (i.e., persons listing CSEF offers for public companies). This regime was extended in 2018 to also apply to proprietary companies. While there are a range of reporting requirements imposed on proprietary companies engaging in crowdfunding, there are also a number of concessions made with respect to restrictions that would otherwise apply to their fund- raising activities.
Under the CSEF framework, there are exemptions for persons operating markets and CS facilities from the licensing regimes that would otherwise be applicable to those facilities. These additional exemptions provide a means by which a person operating a platform for secondary trading can seek an exemption with tailored conditions from more onerous licensing requirements.
ASIC has released Regulatory Guides 261 Crowd-sourced funding: Guide for Companies and 262 Crowd-sourced funding: Guide for intermediaries to assist companies seeking to raise funds through CSEF and intermediaries seeking to provide CSEF services, respectively.
Debt funding
There have been calls to extend the existing crowdfunding framework to debt funding, and the Government has previously indicated that it intends to consult on this. Debt financing is less common than equity financing in the Australian fintech sector; however, businesses can approach financial institutions, suppliers and finance companies in relation to debt finance.
Initial Coin Offerings (ICOs) and Security Token Offerings (STOs)
ICOs as a method of funding for blockchain or cryptocurrency-related projects, where token issuers offer tokens in return for funds, were generally less popular in 2020 particularly given the broader market uncertainty arising as a result of the COVID-19 pandemic.
In May 2019, ASIC updated its INFO 225 Initial coin offerings guidance on the potential application of the Corporations Act 2001 (Cth) (Corporations Act) to ICOs. Entities should note that the Corporations Act may apply regardless of whether the ICO was created and offered from Australia or overseas.
Generally, ASIC has indicated that the legal status of an ICO depends on the ICO’s structure, operation, and the rights attached to the tokens offered in the ICO. Tokens offered during the ICO may trigger licensing, registration and disclosure requirements if the tokens represent financial products (e.g., interests in managed investment schemes, securities, derivatives or non-cash payment facilities). A company participating in a cryptocurrency exchange as a market maker may also be required to hold an Australian financial services licence (AFSL), and an operator of a cryptocurrency exchange may require an Australian market licence (AML), in each case where the relevant tokens constitute financial products.
Given the likelihood that many cryptocurrency-related funding rounds will be considered an offering of a financial product, there is a growing trend for offerors to pre-emptively step into the regulatory framework by means of an STO. This is where companies will knowingly offer financial products (usually represented in a digital form) and therefore comply with all applicable licensing, registration and disclosure requirements applicable to an offer of regulated products.
Regardless of whether a token constitutes a financial product, ICOs and STOs will be subject to the Australian Consumer Law, which includes a general prohibition on misleading or deceptive conduct in relation to the offer of services or products. In May 2018, ASIC received a delegation of power from the Australian Competition and Consumer Commission (ACCC), enabling it to take action where there is potential misleading and deceptive conduct associated with such offerings.
Asia Region Funds Passport and Corporate Collective Investment Vehicles
The Asia Region Funds Passport (Passport) was introduced in 2018 and is a region-wide initiative designed to facilitate the offer of interests in certain collective investment schemes (CIS), established in Passport member economies, to investors in other Passport member economies. It aims to provide Australian fund managers and operators with greater access to economies in the Asia-Pacific region by reducing regulatory hurdles.
At the time of writing, the Treasury has completed three tranches of consultation in relation to the Corporate Collective Investment Vehicle (CCIV) scheme. The CCIV scheme creates a new type of investment vehicle, which will allow Australian fund managers to pursue overseas investment opportunities through a company structure. It is intended to complement the Passport by making Australian funds more accessible to foreign investors. The legislation implementing the CCIV scheme is yet to be enacted.
The Australian funds market is dominated by unit trusts, a structure that is unfamiliar to many offshore economies where corporate and limited partnership investment vehicles are the norm throughout the Asia-Pacific region. The CCIV will provide an internationally recognised investment vehicle which will be able to be more readily marketed to foreign investors (including through the Passport).
There are concerns that the reforms will add extra complexity, given the far-reaching potential changes to corporate, partner- ship and tax laws. However, the enactment of the Passport and the CCIV may lead to new financing opportunities for fintech businesses.
2.2 Are there any special incentive schemes for investment in tech/fintech businesses, or in small/ medium-sized businesses more generally, in your jurisdiction, e.g. tax incentive schemes for enterprise investment or venture capital investment?
Incentives for investors
(a) Early stage innovation company incentives
Incentives are available for eligible investments made in start-ups known as Early Stage Innovation Companies (ESICs), which are generally newly incorporated entities with low income and expenses.
Investments of less than 30% of the equity in an ESIC would generally qualify for a 20% non-refundable tax offset (capped at AUD 200,000 per investor, including any offsets carried forward from the prior year’s investment) and a 10-year tax exemption on any capital gains arising on disposal of the investment.
(b) Eligible venture capital limited partnerships
Fintech investment vehicles may be structured as venture capital limited partnerships (VCLPs) or early stage venture capital limited partnerships (ESVCLPs), and receive favour- able tax treatment for eligible venture capital investments.
For VCLPs, benefits include tax exemptions for foreign investors (limited partners) on their share of any revenue or capital gains made on disposal of the investment by the VCLP, and concessional treatment of the fund manager’s carried interest in the VCLP. For ESVCLPs, the income tax exemption for VCLPs is extended to both resident and non-resident investors, plus investors obtain a 10% non-refundable tax offset for new capital invested in the ESVCLP.
Incentives for fintechs
The Research & Development (R&D) Tax Incentive programme is available for entities incurring eligible expenditure on R&D activities, which includes certain software R&D activities commonly conducted by fintechs. Depending on the size of the business, claimants under the R&D Tax Incentive may be eligible for one of the following incentives:
(a) Small businesses (less than AUD 20 million aggregated turnover): a 43.5% refundable tax offset; or
(b) Other businesses (aggregated turnover of AUD 20 million or more): a 38.5% non-refundable tax offset for eligible expenditure below AUD 100 million and 30% for eligible expenditure over AUD 100 million.
Significant changes to the R&D Tax Incentive programme have been enacted, which will apply from the first income year commencing on or after 1 July 2021. Under the changes, companies with an annual aggregated turnover of less than AUD 20 million will be able to access a refundable offset of 18.5% above the claimant’s corporate tax rate, which from 1 July 2021 will be 25% providing a 43.5% refundable tax offset. The changes also include the introduction of an “incremental intensity threshold”, which increases or decreases the non-refundable tax offset avail- able to companies with an annual aggregated turnover of AUD 20 million or more based on the proportion of their eligible R&D expenditure as a percentage of total business expenditure.
2.3 In brief, what conditions need to be satisfied for a business to IPO in your jurisdiction?
The ASX sets out 20 conditions to be satisfied in its Listing Rules. Briefly, these include the entity having at least 300 non-affiliated security holders each holding the value of at least AUD 2,000, and the entity satisfying either the profit test or the assets test (which requires particular financial thresholds to be met).
2.4 Have there been any notable exits (sale of business or IPO) by the founders of fintech businesses in your jurisdiction?
Despite the COVID-19 pandemic, there were a number of IPOs including that of Douugh, a “smart bank” harnessing artificial intelligence to provide banking solutions, Credit Clear, a mobile solution for payments and the streamlining of how receivables are collected of receivables, and Payright, which offers BNPL solutions.
3.1 Please briefly describe the regulatory framework(s) for fintech businesses operating in your jurisdiction, and the type of fintech activities that are regulated.
Broadly, the regulatory framework that applies to fintech businesses includes financial services and consumer credit licensing, registration and disclosure obligations, consumer law requirements, privacy and anti-money laundering and counter-terrorism financing (AML/CTF) requirements.
Licensing obligations apply to entities that carry on a financial services business in Australia or engage in consumer credit activities. The definitions of financial service and financial product are broad, and will generally capture any investment or wealth management business, payment service (e.g., non-cash payment facility), advisory business (including robo-advice), trading platform, and crowdfunding platform, triggering the requirement to hold an AFSL or be entitled to rely on an exemption. Similarly, engaging in peer-to-peer lending activities will generally constitute consumer credit activities and trigger the requirement to hold an Australian credit licence (ACL) or be entitled to rely on an exemption.
Fintech businesses may also need to hold an AML where they operate a facility through which offers to buy and sell financial products are regularly made and accepted (e.g., an exchange). If an entity operates a CS mechanism which enables parties trans- acting in financial products to meet obligations to each other, the entity must hold a CS facility licence or otherwise be exempt.
The Australian Consumer Law applies to all Australian businesses that engage or contract with consumers. Obligations include a general prohibition on misleading and deceptive conduct, false or misleading representations, unconscionable conduct and unfair contract terms in relation to the offer of services or products.
The Anti-money Laundering and Counter-terrorism Financing Act 2006 (Cth) (AML/CTF Act) applies to entities that provide “designated services” with an Australian connection. Generally, the AML/CTF Act applies to any entity that engages in financial services or credit (consumer or business) activities in Australia. Obligations include enrolment with AUSTRAC, reporting and customer due diligence.
The Banking Act 1959 (Cth) regulates those engaged in the business of banking to be authorised by APRA (i.e., be an “authorised deposit-taking institution” or ADI) before engaging in such business. It also contains the Banking Executive Accountability Regime (BEAR), which is also administered by APRA and establishes, among other things, accountability obligations for ADIs and their senior executives and directors, and deferred remuneration, key personnel and notification obligations for ADIs.
The Payment Systems (Regulation) Act 1998 (Cth) regulates purchased payment facility providers in relation to stored value facilities. Generally, such holders of stored value must be an ADI or be exempt from the requirement. The RBA is currently reviewing the regulatory framework for retail payments and closed submissions on its Issues Paper on the matter in January 2020.
The Financial Sector Collection of Data Act 2001 (Cth) (FSCODA) is designed to assist APRA in the collection of information relevant to financial sector entities. FSCODA generally applies to any corporation engaging in the provision of finance in the course of carrying on business in Australia, and APRA collects data from registered financial corporations under FSCODA. Generally, registered financial corporations with assets greater than AUD 50 million need to regularly report to APRA statements of financial position.
The Financial Sector (Shareholdings) Act 1998 (Cth) creates an ownership limit of 20% in a financial sector company without approval from the Treasurer.
3.2 Is there any regulation in your jurisdiction specifically directed at cryptocurrencies or cryptoassets?
At the time of writing, there are no laws in Australia that have been implemented to specifically regulate cryptocurrencies or cryptoassets. Generally, the predominant focus on the regulation of cryptocurrencies has revolved around its application to the established financial services regulatory framework.
Currently, the only formal monitoring of cryptocurrency activity in Australia is in relation to AML/CTF, discussed in further detail in question 4.5.
3.3 Are financial regulators and policy-makers in your jurisdiction receptive to fintech innovation and technology-driven new entrants to regulated financial services markets, and if so how is this manifested? Are there any regulatory ‘sandbox’ options for fintechs in your jurisdiction?
Regulators have also committed to helping fintech businesses more broadly by streamlining access and offering informal guidance to enhance regulatory understanding. Both ASIC and AUSTRAC have established Innovation Hubs to assist start-ups in navigating the Australian regulatory regime. AUSTRAC’s Fintel Alliance has an Innovation Hub targeted at combatting money-laundering and terrorism-financing and improving the fintech sector’s relationship with Government and regulators.
ASIC has made certain class orders establishing a fintech licensing exemption and released Regulatory Guide 257, which details ASIC’s framework for fintech businesses to test certain financial services, financial products and credit activities without holding an AFSL or ACL by relying on the class orders (referred to as the regulatory sandbox). This was updated in September 2020 with the introduction of the enhanced regulatory sandbox to allow testing of a broader range of financial services and credit activities for a longer duration. There are strict eligibility requirements for both the type of businesses who can enter the regulatory sandbox and the products and services that qualify for the licensing exemption. Once a fintech business accesses the regulatory sandbox, there are restrictions on how many persons can be provided with a financial product or service and caps on the value of the financial products or services which can be provided.
Regulators in Australia have been receptive to the entrance of fintechs and technology-focused businesses. The financial services regulatory regime adopts a technology neutral approach, whereby services will be regulated equally, irrespective of the method of delivery. However, further concessions have been made by regulators in order to support technologically-focused start-ups entering the market.
ASIC has also entered into a number of cooperation agreements with overseas regulators under which there is a cross-sharing of information on fintech market trends, encouraging referrals of fintech companies and sharing insights from proofs of concepts and innovation competitions. It is also the intention of a number of these agreements to further understand the approach to regulation of fintech businesses in other jurisdictions, in an attempt to better align the treatment of these businesses across jurisdictions.
3.4 What, if any, regulatory hurdles must fintech businesses (or financial services businesses offering fintech products and services) which are established outside your jurisdiction overcome in order to access new customers in your jurisdiction?
Regulatory hurdles include registering with ASIC in order to carry on a business in Australia (generally satisfied by incorporating a local subsidiary or registering a branch office), satisfying applicable licensing, registration and disclosure requirements if providing financial services or engaging in consumer credit activities in Australia (or qualifying to rely on an exemption to such requirements), privacy, and complying with the AML/CTF regime. Broadly, these regulatory hurdles are determined by the extent to which the provider wishes to establish an Australian presence, the types of financial products and services provided, and the type of Australian investors targeted.
In past, it has been common for foreign financial services providers (FFSPs) to provide financial services to wholesale clients in Australia by relying on ASIC’s “passport” or “limited connection” relief from the requirement to hold an AFSL. In March 2020, ASIC repealed both passport and limited connection relief and announced the implementation of a new foreign AFSL regime and funds management relief. FFSPs currently relying on passport relief or limited connection relief may do so until 31 March 2022 while other FFSPs may apply for a FAFSL from 1 April 2020, subject to certain eligibility criteria. Funds management relief will commence on 1 April 2022.
4.1 Does your jurisdiction regulate the collection/use/ transmission of personal data, and if yes, what is the legal basis for such regulation and how does this apply to fintech businesses operating in your jurisdiction?
The Privacy Act
In Australia, the Privacy Act 1988 (Cth) (Privacy Act) regulates the handling of personal information by Government agencies and private sector organisations with an aggregate group revenue of at least AUD 3 million. In some instances, the Privacy Act will apply to businesses (e.g., credit providers and credit reporting bodies) regardless of turnover.
The Privacy Act includes 13 Australian Privacy Principles (APPs), which impose obligations on the collection, use, disclosure, retention and destruction of personal information.
The Notifiable Data Breaches (NDB) scheme was introduced in 2018. The NDB scheme mandates that entities regulated under the Privacy Act are required to notify any affected individuals and the Office of the Australian Information Commissioner (OAIC) in the event of a data breach (i.e., unauthorised access to or disclosure of information) which is likely to result in serious harm to those individuals. The NDB scheme applies to agencies and organisations that the Privacy Act requires to take steps to secure certain categories of personal information.
Consumer data right and access
In response to the Productivity Commissions’ report on Data Availability and Use, the Government will be implementing the national consumer data right (CDR) framework which will give customers a right to share their data with accredited service providers (including banks, comparison services, fintechs or third parties), encouraging the flow of information in the economy and competition within the market. The CDR frame- work will first be applied to the banking sector under the “Open Banking” regime, whereby consumers will be able to exercise greater access and control over their banking data. These sharing arrangements are intended to facilitate easier swap- ping of service providers, enhancement of customer experience based on personal and aggregated data, and more personalised offerings. Under Open Banking, as at 1 July 2020, Australian bank customers can permit accredited third parties to access their savings and credit card data and, from 1 November 2020, can also give permission to accredited third parties to access mortgage, personal loan and joint bank account data.
The European Union (EU) General Data Protection Regulation has extremely broad extra-territorial reach and may also impact the data handling practices of Australian businesses offering goods and services in the EU.
4.2 Do your data privacy laws apply to organisations established outside of your jurisdiction? Do your data privacy laws restrict international transfers of data?
The Privacy Act has extra-territorial operation and extends to acts undertaken outside Australia and its external territories where there is an “Australian link” (i.e., where the organisation is an Australian citizen or organisation) or carries on a business in Australia and collects personal information in Australia.
Under the framework for cross-border disclosure of personal information, APP entities must take reasonable steps to ensure that overseas recipients handle personal information in accordance with the APPs, and the APP entity is accountable if the overseas recipient mishandles the information. The APP entity must also only disclose information for the primary purpose for which it was collected.
4.3 Please briefly describe the sanctions that apply for failing to comply with your data privacy laws.
The Privacy Act confers on the OAIC a variety of investigative and enforcement powers to use in cases where a privacy breach has occurred, including:
- the power to investigate a matter following a complaint or on the OAIC’s own initiative;
- the power to make a determination requiring the payment of compensation or other remedies, such as the provision of access or the issuance of an apology;
- enforceable undertakings;
- seeking an injunction; and
- seeking civil penalties of up to AUD 420,000 for individuals and up to AUD 2.1 million for bodies corporate.
4.4 Does your jurisdiction have cyber security laws or regulations that may apply to fintech businesses operating in your jurisdiction?
Cyber security regulation has been a key focus of regulators and the Government given the rapid innovation in the fintech space and the interplay between financial services, financial products and new technologies. Cyber criminals have also been taking advantage of the COVID-19 crisis to conduct widespread COVID-19-themed email and SMS phishing campaigns.
In August 2020, the Government released its Cyber Security Strategy 2020, which will invest AUD 1.67 billion over 10 years in a tripartite approach to protecting, improving and enforcing and this will be delivered through action by governments, businesses and the community. The Government has also established an Industry Advisory Committee to shape the delivery of short- and longer-term actions as set out in its strategy.
ASIC provides a number of resources to help firms improve their cyber resilience, including reports, articles and practice guides. In December 2019, ASIC released Report 651 Cyber Resilience of firms in Australia’s financial markets: 2018–19 (REP 651). REP 651 identifies key trends in cyber resilience practices and highlights existing good practices and areas for improvement. ASIC identified investment, education, acquisition and retention of skilled resources, and strong leadership from senior management as being core factors to maintaining strong cyber resilience. However, ASIC expressed concern towards the trend of outsourcing non-core functions to third-party providers, as this created difficulty when managing cyber security risks in a business’ supply chain.
ASIC has previously provided guidance regarding cyber security in Report 429 Cyber Resilience – Health Check and Report 555: Cyber resilience of firms in Australia’s financial market. In these reports, ASIC examined and provided examples of good practices identified across the financial services industry and questions board members and senior management of financial organisations should ask when considering their cyber resilience. ASIC’s Regulatory Guide 255 also set out the standards and frameworks against which providers of digital advice should test their information security arrangements, and nominated frame- works set out relevant compliance measures which should be put in place where cloud computing is relied upon.
Australia has ratified the Council of Europe Convention on Cybercrime (the Budapest Convention), which codifies what constitutes a criminal offence in cyberspace and streamlines international cybercrime cooperation between signatory states. Australia’s accession was reflected in the passing of the Cybercrime Legislation Amendment Act 2011 (Cth).
4.5 Please describe any AML and other financial crime requirements that may apply to fintech businesses in your jurisdiction.
The AML/CTF Act applies to entities that provide “designated services” with an Australian connection. Fintech business will often have obligations under the AML/CTF Act as financial services, and lending businesses typically involve the provision of designated services. Obligations include:
- enrolling with AUSTRAC;
- conducting due diligence on customers prior to providing any designated services;
- adopting and maintaining an AML/CTF programme; and
- reporting annually to AUSTRAC and as required on the occurrence of a suspicious matter, a transfer of currency with a value of AUD 10,000 or more, and all international funds instructions.
Digital currency exchange providers also have obligations under the AML/CTF Act and must register with AUSTRAC or face a penalty of up to two years’ imprisonment or a fine of up to AUD 105,000 (or both) for failing to register. Exchange operators are required to keep certain records relating to customer identification and transactions for up to seven years.
4.6 Are there any other regulatory regimes that may apply to fintech businesses operating in your jurisdiction?
An entity that conducts any “banking business”, such as taking deposits (other than as part-payment for identified goods or services) or making advances of money, must be licensed as an ADI. APRA has implemented a Restricted ADI framework, which allows new businesses entering the banking industry like neobanks to conduct a limited range of banking activities for two years while they build their capabilities and resources. After two years, they must either transition to a full ADI licence or exit the industry. As of February 2021, there is one Restricted ADI on APRA’s register but several Restricted ADIs have since transitioned to holding full ADI status since 2018 or handed back their licences. Being an ADI allows such entities to operate as an ADI without restrictions under the Banking Act 1959 (Cth). We note that as the neobank industry has matured, we are already seeing some consolidation with one such Australian neobank being acquired by a Big 4 institutional bank.
Fintech businesses are also subject to the prohibitions laid out in the Australian Consumer Law, which is administered by the ACCC. Broadly, this includes prohibitions on misleading and deceptive conduct, false or misleading representations, unconscionable conduct and unfair contract terms. While the Australian Consumer Law does not apply to financial products or services, many of these protections are enforced by ASIC either through mirrored provisions in the Australian Securities and Investments Commission Act 2001 (Cth) or through delegated powers.
5.1 In broad terms, what is the legal framework around the hiring and dismissal of staff in your jurisdiction? Are there any particularly onerous requirements or restrictions that are frequently encountered by businesses?
The hiring and dismissal of staff in Australia is governed under the Fair Work Act 2009 (Cth) (Fair Work Act). In relation to hiring, minimum terms and conditions of employment for most employees (including professionals) are governed by modern awards, which sit on top of the National Employment Standards. However, modern awards do not apply to employees earning over a threshold of AUD 153,600 (from 1 July 2020, threshold indexed annually), provided their earnings are guar- anteed by written agreement with their employer.
To terminate an employee’s employment, an employer has to give an employee written notice of the last day of employment. There are minimum notice periods dependent on the employee’s period of continuous service, although the employee’s award, employment contract, enterprise agreement or other registered agreement could set out longer minimum notice periods. Notice can be paid out rather than worked; however, the amount paid to the employee must equal the full amount the employee would have been paid if they worked until the end of the notice period. For serious misconduct, employers do not need to provide a notice of termination; however, the employee must be paid all outstanding entitlements such as payment for time worked or annual leave.
5.2 What, if any, mandatory employment benefits must be provided to staff?
Under the Fair Work Act, minimum entitlements for employees are set out under modern awards and include terms and conditions such as minimum rates of pay and overtime.
Australia also has 10 National Employment Standards. These include maximum weekly hours, requests for flexible working arrangements, parental leave and related entitlements, annual leave, long service leave, sick leave, compassionate leave, public holidays, notice of termination and redundancy pay, and a fair work information statement.
The Fair Work Act also has some general protection provisions governing a person’s workplace rights, freedom of association and workplace discrimination, with remedies available to employees if these provisions are contravened.
5.3 What, if any, hurdles must businesses overcome to bring employees from outside your jurisdiction into your jurisdiction? Is there a special route for obtaining permission for individuals who wish to work for fintech businesses?
Migrants require working visas from the Department of Home Affairs (DOHA) in order to work in Australia, and each type has its own eligibility requirements. Businesses can nominate or sponsor such visas.
The Temporary Skill Shortage (subclass 482) visa (TSS visa) is the most common form of employer-sponsored visa for immigration to Australia. To be eligible for the TSS visa, an applicant’s occupation must:
- be on the short-term skilled occupations list, with a maximum visa period of two years or up to four years if an International Trade Obligation applies (Hong Kong pass- port holders are eligible to stay up to five years), with an option to apply for permanent residency subject to eligibility requirements;
- be on the medium and long-term strategy skills list or the regional occupational list, with a maximum period of four years (or five years for Hong Kong passport holders) and an option to apply for permanent residency, subject to eligibility requirements; or
- have an employer that has a labour agreement with the Australian Government in effect, with a maximum period of up to four years (or five years for Hong Kong passport holders).
As at the time of writing, there is no special route for obtaining permission for individuals who wish to work for fintech businesses. However, under DOHA’s Business Innovation and Investment visa programme, DOHA has released an entrepreneur stream visa (Business Innovation and Investment (Provisional) visa (subclass 188)) for nominated applicants that, among other conditions, are younger than 55, own one or two businesses with at least AUD 500,000 turnover in the two of four fiscal years prior to receiving an invitation to apply, have personal and business assets of at least AUD 800,000 and meet certain health, probity, language and character requirements. The visa allows holders to operate a new or existing business in Australia and stay in Australia for up to four years and three months with the option to apply for a permanent Business Innovation and Investment (Permanent) visa (subclass 888) Business Innovation stream if certain requirements are met.
6.1 Please briefly describe how innovations and inventions are protected in your jurisdiction.
Patent protection is available for certain types of innovations and inventions in Australia. There are two types of patents granted in Australia:
- Standard patent: A standard patent provides long-term protection and control over an invention, lasting for up to 20 years from the filing date. The requirements for a standard patent include the invention being new, involving an inventive step and being able to be made or used in an industry.
- Innovation patent: An innovation patent is targeted at inventions with short market lives, lasting up to eight years. These quick and relatively inexpensive patents are aimed at protecting inventions that do not meet the inventive threshold, instead requiring that an invention involve an innovative step.
However, the Australian Government has begun the process of phasing out the innovation patent with the passing of legislative amendments. The last day to file a new innovation patent is 25 August 2021 and any existing innovation patents that were filed on or before 25 August 2021 will continue to be in force until their expiry.
In Australia, provisional applications can also be filed as an inexpensive method of signalling intention to file a full patent application in the future, providing applicants with a priority date. However, filing this application alone does not provide the applicant with patent protection, but does give the person filing 12 months to decide whether to proceed with a patent application.
Design protection is available, for a period up to 10 years, of any design that is both new and distinctive. Protection is based on visual appearance.
An Australian patent only provides protection in Australia. To obtain protection abroad, the applicant will need to file separate patent applications in each country or file a single international application under the Patent Cooperation Treaty (PCT), which gives the application effect in 152 countries including Australia. PCT applications based on a provisional application must be done within 12 months of filing the provisional application.
6.2 Please briefly describe how ownership of IP operates in your jurisdiction.
Broadly, the person or business that has developed intellectual property (IP) generally owns that IP, subject to any existing or competing rights. In an employment context, the employer generally owns new IP rights developed in the course of employment, unless the terms of employment contain an effective assignment of such rights to the employee. Contractors, advisors and consultants generally own new IP rights developed in the course of engagement, unless the terms of engagement contain an effective assignment of such rights to the company by whom they are engaged.
Under the Copyright Act 1968 (Cth), creators of copyright works such as literary works (including software) also retain moral rights in the work (for example, the right to be named as author).
Moral rights cannot be assigned but creators can consent to actions that would otherwise amount to an infringement.
6.3 In order to protect or enforce IP rights in your jurisdiction, do you need to own local/national rights or are you able to enforce other rights (for example, do any treaties or multi-jurisdictional rights apply)?
Options available to protect or enforce IP rights depend on the type of IP. As an example, software (including source code) is automatically protected under the Copyright Act 1968 (Cth). An owner may also apply to IP Australia, the Government body administering IP rights and legislation, for software to be registered under the Designs Act 2003 (Cth) or patented under the Patents Act 1967 (Cth). Software can also be protected contractually through confidentiality agreements between parties.
A standard, innovation or provisional patent can also be held to protect or enforce IP rights in Australia (though we note innovation patents are to be phased out later this year). Australia is also a party to the PCT, administered by the World Intellectual Property Organization. A PCT application is automatically registered as a standard patent application within Australia, but the power to successfully grant patent rights remains with IP Australia.
6.4 How do you exploit/monetise IP in your jurisdiction and are there any particular rules or restrictions regarding such exploitation/monetisation?
In Australia, there are generally five approaches to commercialising IP. These are:
- Assignment: An outright sale of IP, transferring owner- ship to another person without imposing any performance obligations.
- Direct in-house use of IP: Owners of IP may commercialise the IP within an existing entity already in their control. This is generally common if the IP was originally created in-house or was acquired as described above.
- Licensing: Permission is granted for IP to be used on agreed terms and conditions. There are three types of licence (exclusive licence, non-exclusive licence and sole licence) and each comes with conditions.
- Franchising: A method of distributing goods and services, where the franchisor owns the IP rights over the marketing system, service method or special product and the franchisee pays for the right to trade under a brand name and agrees to follow instructions on operating the franchise.
- Start-up or spin-off: Where a separate company (either new (start-up) or partitioning from an existing company (spin-off)) is established to bring a technology developed by a parent company to the market. IP activities to be carried out for spin-offs include due diligence, confidentiality, employment contracts, assignment agreements and licence agreements.
Broadly, a business can only exploit or monetise IP that the business in fact owns or is entitled to use. Restrictions apply to the use of IP that infringes existing brands, and remedies (typically injunctions and damages) are available where the use of IP infringes the rights of another business.
Visit Smart Counsel
