When you buy crypto on an exchange and leave it there, do you acutally know who is holding it? This is the question sits at the centre of crypto exchange custody.
On 15 October 2026, ASIC published a detailed answer - Consultation Paper 392 (CP 392). This paper proposed standards for how digital asset platforms in Australia would hold customer assets, manage conflicts of interest and back their operations with capital [1]. This article explains what (CP 392) proposes, why custody and conflicts are the focus, what the proposals would and would not change, and the questions worth asking about any platform in the meantime.
Digital asset law reform implementation: Proposed standards and guidance[1].
This is the next step after the Corporations Amendment (Digital Assets Framework) Act 2026 (received Royal Assent on 8 April 2026) which takes effect on 8 April 2027 [3]. This Act will create new licensing categories for digital asset platforms (DAPs) and tokenised custody platforms (TCPs).
Key dates:
- 27 November 2026: Consultation closes.
- March 2027: ASIC aims to publish final standards and guidance.
- 8 April 2027: The Act commences.
- 7 October 2027: Existing operators have until this date to apply for a licence or a licence variation, and eligible operators can keep running while ASIC assesses them.
[1][2][3]
ASIC Commissioner Alan Kirkland said the proposals "acknowledge the increasing role of digital assets and tokenization, including in traditional parts of the financial system" [2].
Why custody is the heart of it
Most retail traders never think about custody until something goes wrong. Retail investors often leave assets on the exchange because it is convenient, yet dont ask how those assets were held or what would happen if the business failed?
In December 2022, the US Securities and Exchange Commission alleged that FTX founder Samuel Bankman-Fried concealed "the undisclosed diversion of FTX customers' funds" to his trading firm, Alameda Research, and used "commingled FTX customers' funds" for undisclosed investments [4].
It turns out, retail investors may not be as protected as much as they assume. In a 2023 Adam Levitin (Texas Law Review essay) argued that in an exchange bankruptcy, customers could find they "would not 'own' the cryptocurrency but would be mere unsecured creditors of the exchange" [5].
What CP 392 Custody Proposals[1]:
- Segregation. Proposal B1.6 states that "Operators must safeguard and appropriately segregate underlying assets and money," with extra record-keeping, reconciliation and deficiency-correction rules for pooled assets.
- Wallet reporting. Proposal B1.10 would require operators to "report the relevant wallet arrangements, addresses and other locations to ASIC quarterly." Records would be kept for seven years. Private keys and seed phrases would not be reported [1][3].
- Offshore custody allowed, but disclosed. Proposal B2 says ASIC proposes "to not require domestic custody of underlying assets." Instead, ASIC says "the manner and location of custody are material product features and risks that require disclosure" [1].
- Emergency key access, still open. ASIC is asking for feedback on whether Australian operators should have fallback access to private keys if an overseas parent or related company fails, while noting this could add operational complexity [1][2].
Conflicts of interest: What happens when the exchange is also a trader?
A platform that runs the order book, holds customer assets and trades for its own account has incentives that may not line up with its customers' interests.
- No trading as principal on its own venue. Proposal C3.3 states: "DAP operators must not trade as principal on their own or related body corporate DAPs." Proposal C3.4 keeps exceptions for tied brokers, tied dealers, agents and certain other arrangements, with disclosure and customer consent [6].
- No paid preference for tokens. Proposal C3.5 says operators "must not accept any financial or non-financial benefit to preference a digital token admitted on the platform" [1]. This covers how tokens are listed, traded or marketed [6].
- Best outcome for clients. Proposal C2.6 would require operators executing orders on other venues to "take all reasonable steps to obtain the best outcome for the client" [1].
- Visible order books. Proposal C4.4 would make pre-trade information on order book platforms "publicly available in real time and free of charge" [1].
Retail traders often read a new listing as a signal of quality but under these proposals a listing could not be bought, but it still would not show whether the token itself is sound.
Capital, 14AUD Million
CP 392 offers three alternative capital models and ASIC has not chosen between them [6].
At Model 1, operators without qualifying third-party custody would generally need net tangible assets of at least A$14 million or 10% of average revenue, whichever is greater [2][6]. The other two models start lower. Model 3 adds activity-based amounts, including 1AUD million for trading as principal [3][6].
Operators that use qualifying independent custody could use a much lower base of A$200,000, subject to conditions [3][6]. The structure rewards separating custody from the exchange itself. ASIC also proposes that stablecoins issued or controlled by a platform or its related entities would not count towards its net tangible assets [3].
OKX Australia CEO Shange Chandra described the proposals as "appropriately onerous" [2].
What Proposal Will Not Change
ASIC is clear on this point. CP 392 states that "Many digital assets are high-risk speculative investments and will remain high-risk under this regime," and that "consumers should be aware that they could lose the entire value of their investment" [1].
Better custody rules reduce the chance that a platform loses or misuses customer assets. They do nothing about the price of the asset being held. A perfectly segregated token can still lose most of its value.
Mirror Ai's regulatory dataset shows why this matters right now. Of the Australian topics Mirror Ai scores, custody (overall 54.8, from 57 source documents) and market integrity (48.4, from 34 documents) sit in the lower half, well below licensing (71.8) [7]. These scores are directional, but they line up with what CP 392 is trying to fill in: the existing rulebook says a lot about who needs a licence, and less about how platforms hold assets and run fair markets.
ConsiderAsking Your Crypto Exchange These Questions
Whilst the above rules will not apply until 2027 (at the earliest), you may like to consider asking these questions:
- Does the platform explain where customer assets are held, and in which country?
- Does it say whether customer assets are held separately from the company's own assets?
- Does it use an independent third-party custodian, or hold assets itself?
- Does the platform, or a related company, trade on its own exchange?
- Does it explain how tokens are chosen for listing, and whether listing fees apply?
- Does it name an external complaints body in its terms?
If the answers are hard to find, that is information in itself.
None of this is a character test. Most people do not have time to read a full consultation paper before placing a trade. The knowledge gap is a time and access problem, and it is solvable.
Mirror Ai brings market data, token research and regulatory context such as CP 392 into one place, so traders can see what the rules say alongside what the research shows.
You can try Mirror Ai at https://mirror.glasslane.io/try.
FAQ
What is ASIC CP 392?
CP 392 is an ASIC consultation paper published on 15 October 2026. It proposes standards and guidance for digital asset platforms and tokenised custody platforms under the Digital Assets Framework Act, covering custody, trading conduct and financial resources [1].
Would CP 392 require crypto to be held in Australia?
No. ASIC proposes not to require domestic custody, but platforms would need to disclose how and where assets are held and report wallet arrangements to ASIC quarterly [1].
When would the new crypto exchange rules apply?
The Act commences on 8 April 2027. Final standards are expected in March 2027, and existing operators have until 7 October 2027 to apply for a licence [2][3].
Do the proposals make crypto investments safer?
They target how platforms hold assets and manage conflicts. ASIC states that many digital assets "will remain high-risk under this regime" [1].
This article is general information only and is not financial advice. Consider your own circumstances and seek professional advice before making financial decisions.
References
- ASIC, "Consultation Paper 392: Digital asset law reform implementation: Proposed standards and guidance", 15 October 2026. https://download.asic.gov.au/media/0pqj5lgc/cp392-published-15-october-2026.pdf
- Cointelegraph, "Australia proposes capital, custody rules for crypto" (Felix Ng), 15 October 2026. https://cointelegraph.com/news/australia-seeks-feedback-on-crypto-platform-rules-ahead-of-2027-rollout
- The Crypto Times, "Australia's New Crypto Rules: Exchanges May Need A$14M in Capital", 15 October 2026. https://www.cryptotimes.io/2026/10/15/asic-seeks-feedback-on-crypto-rules-ahead-of-2027-rollout/
- US Securities and Exchange Commission, "SEC Charges Samuel Bankman-Fried with Defrauding Investors in Crypto Asset Trading Platform FTX", 13 December 2022. https://www.sec.gov/newsroom/press-releases/2022-219
- Adam J. Levitin, "Not Your Keys, Not Your Coins: Unpriced Credit Risk in Cryptocurrency", Texas Law Review, Vol. 101, Issue 4, 18 April 2023. https://texaslawreview.org/?p=8596
- Crypto News Flash, "Australia Targets Crypto Exchanges Trading Against Their Users" (Alexander Zdravkov), 15 October 2026. https://www.crypto-news-flash.com/australia-targets-crypto-exchanges-trading-against-their-users/
- Mirror Ai, regulatory rules and jurisdiction score data (Australia, custody and market integrity), queried 15 October 2026. https://mirror.glasslane.io/
