ASIC CP 392: Asset-Holding Standards for Crypto Platforms

Video transcript

ASIC's CP 392 sets out how Australian crypto platforms must hold client assets. Comments close on November 27, 2026.

Under the Digital Assets Framework Act, these standards are binding, and breaching them is a civil penalty. The drafts may still change, with final instruments planned for March 2027.

Pooling is allowed, with conditions. Reconcile each business day, fix any shortfall by the end of the second business day, and keep a written pooling policy. Each token class needs its own reconciliation.

Operators must record each wallet's function, address and holdings, and report them to ASIC within 10 business days after each quarter. Private keys are not required.

Client instructions must be verified and logged, with controls to prevent and detect unauthorised or erroneous transfers. Think address allowlisting, signing thresholds, velocity limits and outbound monitoring.

ASIC declines to set hot and cold wallet ratios or detailed key management rules. That is not lighter. Without a ratio to point to, you must prove your own design works.

Operators stay responsible for any custodian. Before you submit, inventory every wallet, time your shortfall detection, walk one withdrawal end to end, and map every custodian with your monitoring evidence.

Guardian tests the reconciliation, transfer controls and custodian oversight CP 392 describes. Read the full guide, or talk to Guardian at guardian.security.

The ASIC digital assets consultation that will shape how Australian platforms hold client crypto is Consultation Paper 392.

ASIC released it on October 15, 2026 with four attachments, including draft asset-holding standards. Comments close at 5pm AEDT on November 27, 2026.

The standards matter because the law makes them binding. Section 912BB of the Digital Assets Framework Act requires licensees to comply with them, and it is a civil penalty provision.

The drafts bind no one yet, and ASIC says the final instruments may change considerably. It plans to publish them in March 2027.

This guide covers the draft asset-holding standards in Attachment 2.

This article explains the technical and security side of ASIC CP 392. It is not legal advice; confirm how it applies to you with counsel.

Where CP 392 Fits

The Corporations Amendment (Digital Assets Framework) Act 2026 creates two products. A digital asset platform (DAP) is a facility under which an operator possesses digital tokens for clients, and may offer trading, settlement or staking.

A tokenised custody platform (TCP) holds underlying assets, such as gold or another token, and creates a digital token representing rights to each one.

A platform operating on April 8, 2027 must apply for an AFS license or variation by October 7, 2027. It can keep operating while ASIC assesses the application.

Holding and Reconciliation

Sections 12 to 15 set out where client assets may sit. Each must be held on trust, under the client property rules, or under another legally effective arrangement that protects clients in an insolvency.

ASIC proposes not to require domestic custody. It asks whether a fallback, such as emergency access to private keys for a domestic operator, is needed.

Section 16 is the core safeguarding rule. Records must identify each asset, its client, the client's rights and the amount, well enough to find and correct any discrepancy promptly.

Pooling is allowed. The Act stops ASIC from banning one wallet for many clients if internal accounting identifies each client's tokens. Each pooled arrangement needs:

• client tokens kept separate from the operator's and any custodian's own property;
• a written pooling policy, reviewed at least once every 13 months;
• records of each client's holding of each class of token;
• reconciliation each business day, or less often only where that is ordinary and reasonable commercial practice; and
• any shortfall corrected by the end of the second business day after it arises.

Class matters more than it looks. ASIC's note says ETH, ERC-20 ETH and ETH on a layer 2 network are each a separate class.

Each class needs its own onchain total, its own ledger total and its own shortfall clock.

Wallet Records and Reports

Section 20 requires records of each wallet's function, the relationship between wallets, every address, and each class and amount held.

Within 10 business days after each quarter, the operator must report its wallet arrangements and addresses to ASIC. Material changes must be notified as soon as practicable.

Records must be kept for seven years from when they are made, or from when the arrangement they describe ends.

Reports need not include private keys, seed phrases or anything else that could authorize a transfer.

ASIC asks whether it could collect only storage addresses rather than deposit addresses. If you generate a deposit address per client, answer with numbers.

Section 21 requires a unique identifier for each token class, with a public list. An identifier issued under ISO 24165 may qualify.

Transfers and Custodians

Section 17 bars acting on an instruction without reasonable steps to verify it. Each instruction, its verification and the action taken must be recorded.

Section 18 protects withdrawal rights. Platform rules may restrict withdrawals only to comply with a law, where reasonably necessary to manage fraud, operational error, cyber or financial crime risk, or where the standards permit.

Operators must also have “adequate arrangements to prevent, detect and respond to unauthorised or erroneous” redemptions or transfers.

ASIC does not list the controls. Think address allowlisting, transaction verification before signing, signing thresholds, velocity limits and outbound monitoring.

An operator that uses a custodian stays responsible for compliance, including for any sub-custodian. Sections 22 to 25 require it to:

• be satisfied, before appointment, that the custodian has adequate arrangements and controls;
• monitor it under a written process, and track remediation of any material incident;
• move assets away if a problem cannot be fixed within a reasonable period;
• review the monitoring and the agreement at least once every 13 months; and
• have a written agreement covering reconciliation each business day, audit rights and incident notice.

What ASIC Did Not Prescribe

Paragraph 66 of CP 392 notes that some overseas regulations set hot and cold wallet allocations and key management processes.

ASIC's current view is that such rules would be inconsistent with its principles-based, technology-neutral approach. It points to the good practice already in Section F of RG 133.

That guidance treats as good practice:

• hardware held in isolated cold storage;
• key material on internet-connected systems no more than strictly necessary;
• geographically distributed backups;
• signing without a single point of failure, such as multisig or sharding;
• whitelists where a product only needs to pay known addresses; and
• controls verified independently, for example through SOC 1 and SOC 2 reports, GS 007 or ISO 27001.

Hong Kong is more prescriptive, as our guide to the SFC custody circular shows.

Principles-based does not mean lighter. Without a ratio to point to, an operator has to show that its own design meets the outcome.

How to Respond by November 27

Send submissions to the Fintech Team at fintech@asic.gov.au by 5pm AEDT on November 27, 2026. ASIC will not treat a submission as confidential unless you ask.

The asset-holding questions are B1 to B5. Technical evidence carries most weight on these:

• B1Q3: whether the standards can be met in practice. Run your per-class reconciliation against the draft.
• B1Q4: which obligations need a longer transition, and the system change each needs.
• B2Q2: whether emergency fallbacks are needed if ASIC does not require domestic custody.
• B5Q2 and B5Q3: the risks of reporting wallet addresses, including deposit versus storage addresses.

Then check your own position against the draft:

1. Inventory every wallet and address, and its function.
2. Time how long it takes to detect and correct a shortfall, per class.
3. Walk one withdrawal end to end against the section 17 records.
4. Test the transfer controls, not just their documentation.
5. Map each custodian and sub-custodian, its agreement and your monitoring evidence.
6. Assign an identifier to every token class.

For the wider picture, see our overview of crypto regulatory compliance.

How Guardian Helps

Guardian's regulatory readiness assessment maps the DAF Act, the draft standards and RG 133 provision by provision: the control, the evidence and the gap.

The evidence comes from testing: pentests of the apps and APIs that decide withdrawals, signer inventories read from the chain and Managed Security monitoring. The legal reading stays with your counsel.

Frequently Asked Questions

When do ASIC's asset-holding standards take effect?

ASIC plans final instruments in March 2027. The draft would commence on April 8, 2027 with the Act, or the day after registration if later.

Does CP 392 require cold storage or a hot and cold wallet ratio?

No. ASIC's current view is that such rules would be inconsistent with its principles-based, technology-neutral approach. RG 133 Section F already favors cold storage as good practice.

Does ASIC want platforms to report private keys?

No. Quarterly reports cover wallet arrangements and addresses, and need not include private keys or seed phrases. ASIC says it does not seek them.

What is the difference between a digital asset platform and a tokenised custody platform?

A digital asset platform holds digital tokens for clients and may offer trading, settlement or staking. A tokenised custody platform holds underlying assets, such as gold, and issues tokens representing rights to them.

Sources

• ASIC: CP 392 Digital asset law reform implementation: Proposed standards and guidance (October 15, 2026)
• ASIC: Consultation Paper 392, full text (October 15, 2026)
• ASIC: Attachment 2 to CP 392, draft Asset-Holding Standards Instrument 2027/XX (October 15, 2026)
• ASIC: User guide for CP 392 (October 15, 2026)
• ASIC: 26-245MR ASIC consults on implementation of new digital asset laws (October 15, 2026)
• Federal Register of Legislation: Corporations Amendment (Digital Assets Framework) Act 2026, No. 38, 2026
• ASIC: Regulatory Guide 133 Funds management and custodial services: Holding assets (December 10, 2024)
• Guardian: Regulatory and Compliance Assessments