An NFT project launching in or from Australia faces a legal question that most founders underestimate: the line between a collectible and a regulated financial product is determined by the rights attached to the token, not by the word "utility" on a landing page. With AUSTRAC tightening its supervision of digital-asset businesses and the Australian Securities and Investments Commission (ASIC) applying existing Corporations Act principles to token offerings, the stakes of a mis-classification are real. This guide sets out the sequential steps an NFT project – whether Australia-domiciled or inbound from another hub – must work through before a single token is minted or sold.
The short answer: most pure-collectible NFT projects do not require an Australian financial services licence (AFSL) but may still trigger AUSTRAC registration obligations if the project involves secondary-market facilitation or fiat on-ramps. The analysis turns on what the token does, who holds it, and where the money flows. A cross-border build – a project structured offshore but marketed to Australian buyers – does not escape Australian law merely by its corporate address.
The sections below walk through each decision point in sequence: classification, corporate wrapper, AUSTRAC registration, AML/CTF program obligations, banking and tax interaction, cross-border structuring, and when the analysis changes.
Step 1 – Classify the token before anything else
Token classification is the foundational step: every downstream decision – whether you register with AUSTRAC, whether you need an AFSL, how the token is taxed – flows from it. ASIC applies a substance-over-form analysis to determine whether a digital asset constitutes a financial product under the Corporations Act. The marketing label is irrelevant; the operative question is what rights the token confers on the holder.
A pure-collectible NFT – one that carries no right to profits, no governance right over a pooled enterprise, no right to a return of capital, and no payment function – is not a financial product under the Corporations Act. It is, at most, a taxable asset for capital-gains purposes. Projects that stop here avoid the AFSL pathway entirely.
The analysis shifts the moment the NFT carries any of the following: a revenue-share right, a fractional interest in real-world assets, a right to vote on the deployment of pooled funds, or a promised return. At that point, ASIC's existing managed-investment-scheme or derivative analysis becomes live. In our cross-border practice, we have seen founders assume that a "utility" label on a whitepaper settles the classification. It does not. The substance of the rights – what a reasonable investor would understand them to be – controls the outcome.
A common mistake at this step is conducting the classification analysis only under Australian law. An NFT project with a significant user base in the United States, the European Union, or Singapore must run a parallel classification analysis under the applicable regimes in those jurisdictions. A token that falls outside financial-product regulation in Australia may still be a security or a regulated crypto-asset in another market where the project's tokens are marketed or traded.
Step 2 – Determine whether AUSTRAC registration is required
AUSTRAC (the Australian Transaction Reports and Analysis Centre) regulates digital currency exchange (DCE) providers and certain payment-related activities as designated services under the Anti-Money Laundering and Counter-Terrorism Financing Act. An NFT project that facilitates the exchange of Australian dollars or other fiat currency for digital assets – or that operates a secondary marketplace where fiat is accepted – is likely carrying on a DCE service and must register with AUSTRAC before commencing that activity.
A project that operates entirely token-to-token, with no fiat on-ramp or off-ramp, sits in a different position. Most pure NFT minting platforms that accept only cryptocurrency payments are not DCE providers under the current AML/CTF Act framework, though AUSTRAC's perimeter continues to evolve and the position should be assessed against the current legislative text at the time of launch.
Registration is not a compliance end-point. Once registered, the entity must implement and maintain a written AML/CTF program covering customer identification (KYC), transaction monitoring, and suspicious-matter reporting. AUSTRAC expects the program to be proportionate to the business's risk profile. For an NFT project, the key risk areas are high-value secondary sales, anonymous buyer patterns, and cross-border fiat flows.
A common mistake at this step is conflating AUSTRAC registration with ASIC licensing. They are separate regulatory regimes with separate triggers. A project that needs AUSTRAC registration may not need an AFSL – and vice versa. Running both analyses in parallel, rather than sequentially, avoids late-stage restructuring.
Step 3 – Choose the right corporate wrapper
The corporate structure chosen for an NFT project determines who bears regulatory liability, how token proceeds are handled, and what investor protections apply. Most Australian-domiciled NFT projects operate through a proprietary company (Pty Ltd) as the issuing and operating entity. This is the standard vehicle for a contained, single-jurisdiction build.
A build with cross-border ambitions – tokens marketed globally, a team in multiple countries, or treasury management across hubs – typically uses a layered structure: an operating Pty Ltd in Australia holding the AUSTRAC registration and any local regulatory permissions, plus an offshore holding or treasury entity in a jurisdiction that offers favorable treatment for token proceeds and intellectual-property ownership. The Cayman Islands, the BVI, and Singapore are common candidates for the offshore layer, each for different reasons relating to tax treaty access, investor familiarity, and the maturity of the local digital-asset legal environment.
For projects that incorporate DAO-like governance, the wrapper question is particularly acute. A DAO (decentralized autonomous organization) operating without a legal entity is not a recognized legal person under Australian law. Its members may face unlimited joint liability. The practical solution – adopted by most commercially serious DAO builds we encounter – is to house the DAO's operational functions inside a formal entity while preserving on-chain governance for community decisions that do not create external legal obligations.
The wrapper also determines banking access. Australian banks remain conservative toward digital-asset businesses. An entity with clear regulatory status – AUSTRAC-registered, AFSL-licensed where required, with auditable AML/CTF documentation – is materially better positioned to open and maintain a bank account than an unregistered entity relying on a utility-label argument.
To map the entity structure, banking access and tax stack for your project's specific profile, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the token mechanics – change the analysis materially.
Step 4 – Build the AML/CTF program before launch
An AML/CTF program for an AUSTRAC-registered NFT business must be in place before the entity commences its designated service – not after the first transaction. AUSTRAC expects a risk assessment, a documented program, and an identified AML/CTF compliance officer as a minimum before operations begin.
For an NFT marketplace or project with secondary-sale facilitation, the KYC requirements apply to buyers and sellers at defined thresholds. Identity verification must be conducted before the designated service is provided. The program must document how the entity will monitor for unusual transaction patterns, how suspicious-matter reports will be lodged with AUSTRAC, and how the program will be reviewed and updated.
The Travel Rule – the obligation under FATF Recommendation 15 to pass originator and beneficiary information with a virtual-asset transfer – applies to Australian VASPs above applicable thresholds. Whether an NFT project falls within the Travel Rule's scope depends on whether it is characterized as a virtual-asset service provider under the applicable provisions. This is a classification question that must be answered by reference to the current legislative text, not by analogy to overseas regimes.
A common mistake here is treating the AML/CTF program as a one-time document. AUSTRAC expects ongoing testing, annual risk assessments, and updates when the business model changes. A project that adds a new token category, launches a lending feature, or opens a new geographic market should treat each change as a trigger for an AML/CTF program review.
In a recent matter, a digital-collectibles platform had operated for several months before identifying that its fiat on-ramp, processed through a third-party payment provider, triggered its own AUSTRAC registration obligation independent of the payment provider's registration. We assisted in mapping the regulatory perimeter, preparing the registration documentation, and building the AML/CTF program retrospectively. The platform regularized its position before any AUSTRAC inquiry materialized. The lesson is structural: the fiat-flow analysis must precede launch, not follow it.
Step 5 – Address the tax and banking interaction
The Australian Taxation Office (ATO) treats NFTs and other digital assets as capital-gains-tax (CGT) assets. For a project entity, the tax consequences of token issuance, secondary-market royalties, and treasury management depend on the entity's tax residency, the nature of the income, and the applicable provisions of the Income Tax Assessment Act. These are jurisdiction-specific determinations; OBOLUS works alongside allied tax counsel in Australia for the Australian-law layer.
GST treatment of NFT sales has been an area of regulatory development. The ATO's position on whether an NFT sale constitutes a taxable supply for GST purposes has evolved alongside the asset class. A project conducting significant Australian sales should obtain a considered tax opinion before launch, not an informal reading of ATO guidance documents.
Banking access is a practical constraint that must be built into the project timeline. Australian financial institutions operate Know Your Business (KYB) processes for digital-asset entities that are more demanding than for conventional businesses. An entity that can demonstrate AUSTRAC registration, a documented AML/CTF program, and a clear business model – with identifiable revenue streams and controlled fiat flows – is better positioned to pass KYB review than one that cannot.
Cross-border treasury management introduces transfer-pricing and withholding-tax considerations that the structure must account for. Royalty flows from an Australian operating entity to an offshore IP-holding entity are not tax-neutral. The structure must be documented and arm's-length-priced to avoid thin-capitalization and transfer-pricing challenges from the ATO.
Step 6 – Map the cross-border regulatory overlay
A project structured in Australia but selling tokens to buyers in the European Union, the United Kingdom, or Singapore must analyze each target market's regulatory regime independently. The principle is consistent across the leading hubs: the jurisdiction where the buyer sits, and where the token is marketed, asserts regulatory authority regardless of where the issuer is incorporated.
Under MiCA (the EU's Markets in Crypto-Assets Regulation), an NFT that qualifies as a unique and non-fungible asset may fall outside the CASP authorisation requirement – but an NFT collection structured with fungible-like liquidity characteristics, or one that confers financial-product-style rights, may be caught. The ESMA guidance on the boundary between NFTs and regulated crypto-assets is an active area of regulatory development. A project actively marketing into the EU should assess its token design against MiCA's provisions before launch.
For Singapore-targeted marketing, the MAS Payment Services Act and the securities-token analysis under the Securities and Futures Act apply. Singapore's MAS has been clear that the DPT licensing regime does not automatically apply to NFTs, but that projects must conduct their own analysis. A collectible NFT issued by an Australian entity to Singapore buyers does not escape MAS scrutiny simply by virtue of the issuer's address.
The practical consequence for a cross-border NFT project is that the legal analysis is not a single jurisdiction exercise. The team must map token classification, marketing rules, AML obligations, and tax treatment across every material jurisdiction of buyers and operations. In our cross-border practice, we coordinate that analysis with allied counsel in the relevant jurisdictions to produce a single consolidated position paper, rather than disconnected national opinions that leave gap risk unaddressed.
If your project's cross-border regulatory map is incomplete, write to OBOLUS at info@oboluslaw.com before the next marketing push. A prior application that stalled, or a banking relationship that collapsed, often traces to a gap in the jurisdictional analysis that a second read can identify and address.
Step 7 – Address smart contract and protocol legal risk
Smart-contract legal risk is distinct from securities-law and AML risk, and NFT projects frequently underweight it. A smart contract – self-executing code deployed on a blockchain that governs token issuance, royalty distribution, or secondary-sale mechanics – creates binding legal obligations in jurisdictions that recognize on-chain code as a form of agreement. Australia has not enacted bespoke smart-contract legislation, but contract-law principles apply: offer, acceptance, and consideration can be identified in a well-designed on-chain interaction, and a poorly drafted contract can create unintended obligations or liabilities.
The specific risks for NFT projects are concentrated in three areas. First, royalty enforcement: on-chain royalty mechanics are not universally enforced by all NFT marketplaces, and the legal recourse for a creator whose royalty stream is bypassed by a marketplace that does not honor the on-chain instruction depends on the legal characterization of the royalty right – a question that Australian courts have not yet definitively addressed. Second, upgrade and migration risk: a project that reserves the right to modify or migrate the smart contract must document that right clearly in its terms, because an undisclosed modification to the token's mechanics may give buyers a misrepresentation claim. Third, oracle and bridge risk: a project that uses price oracles or cross-chain bridges introduces external dependencies that the project entity may not control but for whose failures buyers may nonetheless seek to hold the project liable.
Code audits are necessary but not sufficient. A technically sound contract can still create legal risk if its behavior does not match what was promised to buyers in the project's documentation. The legal review of a smart contract asks whether the code does what the whitepaper says it does, and whether the whitepaper's description of the token's rights is accurate and compliant.
Decision matrix – which profile needs which steps
Profile A is a pure-collectible NFT project: no revenue share, no governance rights over pooled funds, no fiat on-ramp, tokens sold for cryptocurrency only. This profile likely falls outside the AFSL regime and outside AUSTRAC's DCE perimeter. The primary obligations are ATO compliance (CGT on proceeds), consumer-law compliance in the jurisdictions of sale, and smart-contract legal review. Cross-border marketing still requires a jurisdiction-by-jurisdiction token-classification check.
Profile B is an NFT project with a secondary marketplace accepting fiat, or a project that facilitates secondary trading between users in exchange for a fee. This profile is more likely to be a DCE provider under the AML/CTF Act and will require AUSTRAC registration, a written AML/CTF program, and ongoing compliance obligations. The AFSL question remains separate and turns on whether the marketplace facilitates financial products. Banking access is harder and requires the AUSTRAC registration and AML documentation to be in place first.
Profile C is an NFT project with embedded financial rights: revenue participation, governance rights over a treasury, or a fractionalization structure that gives holders an economic interest in an underlying asset pool. This profile carries material AFSL risk and may constitute a managed investment scheme or a financial product requiring disclosure and licensing. The correct path is a legal opinion before any public marketing, a restructure if the financial-product analysis is positive, and potentially a disclosure document. Cross-border exposure in this profile is significantly higher – the EU, Singapore, Hong Kong and the US each have distinct and demanding regimes for this token type.
Related at OBOLUS
- DeFi, Tokenization and Smart-Contract Law – our core practice for digital-asset projects, protocol operators and token issuers
- Cross-Chain Bridge Legal Risk for Institutional Clients – protocol and bridge-layer risk analysis for businesses with multi-chain exposure
- Corporate Tax Residency Planning in Singapore – structuring the offshore holding layer for projects with Singapore as a treasury or licensing hub
FAQ
Can a DeFi protocol be regulated?
Yes. Whether a DeFi protocol is regulated depends on what it does, not on whether it has a central operator. Regulators – including ASIC in Australia, MAS in Singapore, and ESMA under MiCA – apply a substance analysis. A protocol that facilitates trading, lending, or asset management may trigger licensing requirements even if it is governed by a DAO. The key questions are whether there is a promoter or developer who profits, and whether users are exposed to financial-product-type risks.
What legal wrapper suits a DAO?
No single wrapper suits every DAO. The choice depends on the DAO's activities, its geography, and whether it needs to hold assets, enter contracts, or employ staff. Common options include a Cayman Islands foundation, a BVI company, a Marshall Islands LLC, or – in Australia – a company limited by guarantee. The wrapper must match the DAO's legal exposure: an unincorporated DAO whose members vote on treasury deployment creates real personal-liability risk for active participants that a formal entity eliminates.
Who is liable when a smart contract fails?
Liability for a smart-contract failure is determined by the law of the jurisdiction whose courts hear the dispute, the terms of the project's documentation, and the facts of the failure. Developers who deploy a contract with known vulnerabilities, or who fail to disclose material risks, face misrepresentation and negligence exposure. Project entities that promised specific functionality face breach-of-contract claims if the contract does not perform as represented. A code audit reduces technical risk; it does not eliminate legal risk arising from the gap between documentation and on-chain behavior.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers, NFT projects, and DeFi protocol operators on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking, and compliance obligations that sit around them. We assess token classification against the substance of rights – not the marketing label – and we coordinate cross-border regulatory analysis through allied counsel in the relevant jurisdictions. Digital assets are the whole of our practice. To discuss your project, contact info@oboluslaw.com or message us via t.me/oboluslaw.
By Roman Levitt, Technology and DeFi Counsel – specializing in smart-contract legal risk, token-classification analysis, and protocol governance structuring for digital-asset businesses operating across multiple jurisdictions.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.