Fintech Market Entry Playbook: Licensing & Launching in ANZ

Australia and New Zealand together form one of the most sophisticated and digitally active financial services markets in the Asia-Pacific region. Australia's banking system is dominated by four major retail banks — Commonwealth Bank, Westpac, ANZ Bank, and NAB — yet the regulatory environment has actively encouraged challenger fintechs through innovation pathways, open banking mandates, and a sandbox regime. The Consumer Data Right (CDR), launched in banking on 1 July 2020, means Australian consumers can now port their financial data to accredited third parties, creating a structural advantage for data-driven lenders, financial advisers, and payments platforms that know how to use it.

New Zealand sits adjacent — culturally, linguistically, and commercially — and its comparatively lighter regulatory burden makes it an accessible first beachhead before a full Australian push. Irish and European fintechs in particular have used this corridor effectively. Wayflyer, the Dublin-founded revenue-based financing platform, scaled its ANZ revenue to over A$20 million within 18 months of establishing a Sydney base, benefiting from strong demand among Australian e-commerce merchants for non-dilutive growth capital. Fexco, another Irish financial services group, built an ANZ payments and FX corridor that now serves multinational clients across both markets.

The regulatory roadmap, however, is dense. Foreign companies that underestimate the licensing sequence — foreign company registration, AFSL, credit licence, AUSTRAC registration, and CDR accreditation — can find themselves unable to serve Australian retail clients for 12–18 months after arriving. This guide maps the entire pathway.

Foreign fintechs entering Australia will interact with several distinct regulators, each governing a different slice of financial services:

• ASIC (Australian Securities and Investments Commission) — issues Australian Financial Services Licences (AFSL) and Australian Credit Licences (ACL); regulates BNPL providers, investment platforms, and financial advisers.
• AUSTRAC (Australian Transaction Reports and Analysis Centre) — registers virtual asset service providers and remittance dealers; enforces AML/CTF obligations across designated services.
• Treasury / RBA — driving the new Payment Service Provider (PSP) licensing framework and payments system modernisation.
• ACCC (Australian Competition and Consumer Commission) — accredits data recipients under the Consumer Data Right; manages CDR rules and technical standards.

In New Zealand, the primary financial services regulator is the Financial Markets Authority (FMA), which licences financial advice providers, fund managers, and derivatives issuers. All financial service providers must also register on the Financial Service Providers Register (FSPR).

The Australian Financial Services Licence (AFSL) is the central operating licence for any business that provides or deals in a financial product in Australia. Under Chapter 7 (s.911A) of the Corporations Act 2001, a person must hold an AFSL to: provide financial product advice; deal in a financial product (including securities, derivatives, and managed investments); operate a registered managed investment scheme; provide custodial or depository services; or provide traditional trustee services.

Critically for foreign companies, the FFSP (Foreign Financial Services Provider) exemption — which previously allowed offshore-licensed firms to serve certain Australian wholesale clients without an AFSL — was removed on 1 April 2020. ASIC's Regulatory Guide RG 1 (updated June 2025) now requires foreign companies to register as a foreign company in Australia under Division 2 of Part 5B.2 of the Corporations Act — before applying for an AFSL. There is no shortcut: the foreign company registration is a prerequisite, not a parallel process.

Once registered, the company lodges an AFSL application with ASIC, demonstrating the organisational competence, financial resources, risk management systems, and compliance arrangements required to carry on the authorised financial services. The licence specifies the exact services and financial products the holder may provide.

ASIC does not publish a fixed fee schedule that captures the full cost of obtaining an AFSL, because most of the expense is professional fees rather than regulatory fees. The following figures are indicative, drawn from commentary and adviser benchmarks — not stated in ASIC primary sources, and actual costs will vary significantly by licence scope and business complexity.

• Application/advisory costs: obtaining an AFSL can exceed A$20,000 in legal and compliance adviser fees, depending on the breadth of authorisations sought.
• Ongoing compliance: annual compliance reviews typically range from A$8,000 to A$25,000; compliance audits average around A$10,000.
• Risk of non-compliance: operating without an AFSL exposes a business to fines of up to A$22,000 and imprisonment of up to two years.

Timeline from application to grant typically runs four to twelve months depending on application quality, complexity, and ASIC's current processing load. ASIC will issue a notice of incomplete application if further information is required, which can extend the process significantly. Businesses should build a minimum of six months' lead time into their market-entry plan. For those needing to test a product before committing to a full licence, the Enhanced Regulatory Sandbox (covered in Section 4) offers an interim pathway.

The licensing sequence for a foreign fintech entering Australia follows a prescribed order that cannot be shortened:

1. Register as a foreign company with ASIC under Part 5B.2 of the Corporations Act 2001. This requires a registered Australian address, a local agent, and lodgement of constitutional documents. ASIC's standard processing time is one to two weeks if documentation is in order.
2. Appoint a Responsible Manager — an individual (or individuals) who meets ASIC's knowledge and competence requirements for the specific financial services and products to be covered by the licence.
3. Establish compliance infrastructure — written compliance procedures, dispute resolution membership (AFCA), PI/D&O insurance, and financial resource projections. ASIC will assess these before granting the licence.
4. Lodge the AFSL application via ASIC Connect, specifying the exact financial services and product authorisations required.

Wayflyer's Sydney launch illustrates the value of sequencing correctly: by establishing a local entity early and engaging a compliance adviser in parallel with product localisation, the team was able to service Australian merchants without extended regulatory delays. Companies that attempt to serve Australian retail clients before holding an AFSL risk enforcement action from ASIC under Chapter 7.

The Australian Credit Licence (ACL) is issued by ASIC under the National Consumer Credit Protection Act 2009 (NCCP Act). It is required for any entity that engages in a credit activity with Australian consumers — including providing credit, providing credit assistance, or being a credit service provider. Foreign fintechs operating in consumer lending, mortgage broking, peer-to-peer lending, or — critically from mid-2025 — buy now pay later (BNPL) must hold an ACL.

The licensing process mirrors the AFSL in structure: the applicant must demonstrate competent and credit-qualified management, adequate resources, an internal dispute resolution procedure, and membership of the Australian Financial Complaints Authority (AFCA). An ACL can be held separately from, or alongside, an AFSL depending on the business model. Fintechs that both advise on and provide credit will typically need both licences.

The Treasury Laws Amendment (Responsible Buy Now Pay Later and Other Measures) Act 2024 extended the National Credit Code to BNPL products by classifying them as low cost credit contracts (LCCCs). From 10 June 2025, any entity engaging in credit activities involving BNPL contracts must:

• Hold a current Australian Credit Licence (ACL) with the relevant BNPL authorisations;
• Be a member of AFCA (Australian Financial Complaints Authority), providing consumers access to free external dispute resolution;
• Comply with responsible lending obligations calibrated to LCCC parameters — including a rebuttable presumption that LCCCs with a credit limit of A$2,000 or less are 'not unsuitable' for the consumer;
• Observe a proposed A$200 fee cap (excluding default fees) in the first year of a credit contract to qualify as a LCCC.

BNPL providers who were operating before 10 June 2025 under the previous exemption-based regime are required to have obtained an ACL before that date or immediately cease offering new BNPL products to Australian consumers. The reform brings Australia broadly into line with comparable UK and EU consumer credit frameworks. For foreign BNPL platforms eyeing the Australian market, budget for a minimum six-month runway to obtain the ACL, join AFCA, and update disclosure documents, terms, and product design to comply with the new conduct obligations.

The ASIC Enhanced Regulatory Sandbox (ERS) commenced on 1 September 2020, replacing the previous limited ASIC sandbox. It allows eligible natural persons and businesses to test innovative financial services or credit activities without holding an AFSL or ACL for up to 24 months — a significant window for startups and foreign companies validating product-market fit before committing to full licensing costs.

To be eligible, applicants must satisfy two tests:

• Net public benefit test: the testing activity delivers a demonstrable benefit to consumers or the financial system beyond mere commercial gain.
• Innovation test: the product or service is genuinely new or significantly different from existing market offerings.

Applications are submitted by email to ersnotifications@asic.gov.au. There is no application fee, but ASIC may impose conditions. Conduct and disclosure obligations apply as if the entity were a full AFS or credit licensee during the testing period.

The ERS is a testing environment, not a scaled operating licence. ASIC imposes strict financial exposure caps to protect consumers during the testing period. The Treasury background paper and ASIC's ERS guidance confirm the following per-activity limits:

• Non-cash payment facilities: up to A$10,000 per client wallet
• Credit contracts: up to A$25,000 per client, with a maximum term of four years
• International securities: up to A$10,000 per client
• Life risk insurance: up to A$300,000 of cover
• Superannuation: up to A$40,000 per client
• Total client exposure cap: A$5 million across all clients combined

Once the A$5 million aggregate cap is reached — or once the 24-month period expires — the entity must either hold a full AFSL/ACL or cease the activity. For most Series A-stage fintechs, the ERS provides enough runway to demonstrate unit economics to investors and run a structured regulatory engagement process with ASIC in parallel. It should not be treated as a long-term substitute for licensing.

Any business providing virtual asset services in Australia must be registered with AUSTRAC before offering services to Australian customers. This is a pre-commencement obligation — registration cannot be applied for retrospectively, and operating without registration exposes a business to serious AML/CTF enforcement.

Under the AML/CTF reforms passed by Parliament on 29 November 2024, AUSTRAC is renaming digital currency exchange (DCE) providers to virtual asset service providers (VASPs) to align with FATF international standards. Currently, only fiat-to-crypto exchanges are regulated. From 31 March 2026, AUSTRAC's regulatory scope expands to cover all VASPs — including crypto-to-crypto exchanges, wallet providers, and certain NFT and DeFi platforms. A publicly searchable VASP register is now live, allowing consumers and businesses to verify whether a provider is legitimately registered.

Registration with AUSTRAC is not a light-touch process. Registered entities must:

• Implement a written AML/CTF Program covering risk assessment, controls, and governance;
• Conduct KYC/CDD on customers before providing a designated service and on an ongoing basis;
• File Transaction Threshold Reports (TTRs) for cash transactions above A$10,000;
• File Suspicious Matter Reports (SMRs) for transactions that raise AML/CTF concerns;
• Report international funds transfer instructions (IFTIs) for cross-border transfers.

AUSTRAC may refuse, suspend, or cancel registration if it determines a business poses an unacceptable risk of facilitating money laundering or terrorism financing. Fexco, which operates a significant FX and payments corridor across ANZ, illustrates the scale of compliance infrastructure required for a full-service payments and virtual asset operation — including dedicated compliance teams and ongoing AUSTRAC engagement.

The AUSTRAC designated services expansion from 31 March 2026 is the single largest structural change to Australian crypto and digital payments regulation since DCE licensing began. From that date, all of the following will be captured as regulated VASPs under the AML/CTF Act:

• Crypto-to-crypto exchange services (previously unregulated);
• Virtual asset custodians and wallet service providers;
• Virtual asset transfer services;
• Businesses facilitating participation in initial coin offerings (ICOs) and certain token issuances.

For foreign fintechs planning to launch crypto-adjacent services in Australia in 2025 or early 2026, this creates a hard regulatory clock. Any business that will be caught by the expanded definition must register with AUSTRAC before 31 March 2026 or cease offering those services to Australian customers. AUSTRAC has signalled it will actively enforce the new scope from the effective date. The 2024 reform also simplifies the AML/CTF program requirements to reduce administrative burden on lower-risk businesses, but the registration and reporting obligations remain non-negotiable. Early engagement with an AML/CTF compliance specialist familiar with AUSTRAC's expectations is strongly recommended for any virtual asset business planning an Australian launch.

Australia is undergoing the most significant reform of its payments regulatory architecture in decades. The Treasury payments licensing reform — with Tranche 1 legislation released for consultation in October–November 2025 — introduces a mandatory AFSL licensing requirement for Payment Service Providers (PSPs) performing defined payment functions. This means that fintechs currently operating in payments on the assumption that they don't need an AFSL may find that assumption overturned when the new regime commences.

Key structural changes in Tranche 1 include:

• Mandatory AFSL for PSPs performing certain payment functions (including issuing and acquiring payment products);
• APRA supervisory powers over major Stored Value Facility (SVF) providers and designated PSPs — meaning foreign e-money and wallet businesses may face prudential as well as conduct regulation;
• SVF trust account requirement: SVF providers must segregate and hold payment-related customer funds in a trust account at an authorised deposit-taking institution (ADI);
• Mandatory revised ePayments Code strengthening consumer protections for electronic payments.

The reforms are intended to commence approximately 12 months after Royal Assent, with a one-month transition period for existing AFS licensees and a six-month period for new applicants. Tranche 2 (covering common access requirements and an industry standard-setting body) is expected to be consulted during 2026. Foreign payments fintechs should monitor the Treasury consultation page closely and engage legal counsel to map their specific payment functions against the new PSP licence categories.

The Consumer Data Right (CDR) is Australia's opt-in, economy-wide data portability reform. In banking, the CDR has been live since 1 July 2020 when all Australian banks were required to begin sharing consumer data with accredited third parties. The energy sector followed; non-bank lending is the next sector in scope.

For foreign fintechs, the CDR creates a structural opportunity: a bank customer can consent to share their transaction history, account details, and product data with any ACCC-accredited data recipient — enabling personalised financial advice, account aggregation, credit scoring, and switching services that were previously impossible without manual data entry or screen-scraping.

To receive consumer banking data under the CDR, a fintech must obtain ACCC accreditation as a data recipient. The ACCC assesses applicants against CDR rules covering: data security standards; privacy and consent management; information security certifications (ISO 27001 recommended); incident response; and governance. Recent technical updates include the mandatory Authorization Code Flow from 12 May 2025 and binding CDR Receipts standards from 14 July 2025 — meaning any accredited recipient's technical integration must be current to avoid non-compliance. The Data Standards Body sets the technical standards; compliance with those standards is a condition of accreditation.

Foreign fintechs pursuing CDR accreditation should expect a review period of several months and should begin technical build against the current standards (available at cdr.gov.au) well before lodging the accreditation application with the ACCC.

Yes. The CDR framework includes a Sponsored Accreditation pathway, under which a fully accredited data recipient (the "Sponsor") can sponsor a less-mature fintech (the "Sponsored Recipient") to access CDR data under the Sponsor's accreditation umbrella. This is a lower-cost, faster pathway for early-stage companies that cannot yet meet the full ACCC accreditation requirements independently.

Under this arrangement, the Sponsored Recipient must still meet certain minimum requirements — including privacy and data security standards — and the Sponsor bears responsibility for the Sponsored Recipient's CDR conduct. It is a viable bridge for foreign fintechs that want to validate their CDR-based product in Australia before investing in independent accreditation. Many Australian CDR-accredited fintechs and aggregators now offer sponsorship as a commercial service. Prospective entrants should evaluate whether a sponsored arrangement fits their risk appetite and data access needs before committing to the full independent accreditation process.

New Zealand operates a distinct financial services regulatory framework from Australia's. Foreign fintechs providing financial services to New Zealand resident clients must register on the Financial Service Providers Register (FSPR) under the Financial Service Providers (Registration and Dispute Resolution) Act 2008.

Registration on the FSPR is triggered once a business reaches both of the following thresholds with NZ resident clients:

• At least 10 NZ resident clients; AND
• At least NZ$10,000 of transactions with those clients per year.

These thresholds were introduced specifically to prevent misuse of FSPR registration by offshore companies seeking a regulatory stamp without genuine NZ operations. Any fintech that meets or expects to meet both thresholds must register before providing the services.

Financial advisers in New Zealand must be engaged by a licensed Financial Advice Provider (FAP). The FMA licenses FAPs under the Financial Markets Conduct Act 2013. Registration on the FSPR does not substitute for a FAP licence if the business is providing financial advice. Fintechs should carefully map their NZ product against the regulated advice definitions to determine whether a FAP licence is required in addition to FSPR registration.

From 1 July 2026, consumer lenders in New Zealand must be licensed by the FMA under an updated regime that replaces the previous requirement for Commerce Commission certification. This is a material change for foreign fintechs operating or planning to operate consumer lending products in New Zealand — including personal loans, instalment credit, and BNPL-style products.

Under the new FMA licensing requirement, consumer lenders must demonstrate fit and proper governance, responsible lending practices, adequate dispute resolution access (via an approved scheme), and compliance with the Credit Contracts and Consumer Finance Act 2003 (CCCFA). The CCCFA already imposes extensive affordability assessment, disclosure, and interest rate cap obligations on consumer lenders; the 2026 FMA licensing layer adds a broader conduct and governance assessment.

Foreign fintechs targeting the NZ consumer lending market should allow at least 12 months of lead time for the FMA licensing process and ensure their NZ legal entity is established, their dispute resolution scheme membership is in place, and their responsible lending policies are localised to NZ law before lodging the application. Annual confirmation of FSPR registration details is also required — this is an ongoing obligation, not a once-off step.

Use this checklist to sequence your regulatory and commercial preparation before going live in Australia and New Zealand. The order matters — do not begin client-facing activity before the foundational steps are complete.

Australia — Structural Setup

• ☐ Register as a foreign company with ASIC under Part 5B.2 of the Corporations Act (prerequisite for all AU licences)
• ☐ Appoint a Responsible Manager(s) meeting ASIC competency requirements for your intended authorisations
• ☐ Engage an Australian AFS/credit licensing specialist to scope your required AFSL and/or ACL authorisations
• ☐ Join AFCA (Australian Financial Complaints Authority) — required for AFSL, ACL, and BNPL operations

Australia — Licensing and Regulatory Registration

• ☐ If testing a product first: assess eligibility for the ASIC Enhanced Regulatory Sandbox (ERS) — 24 months, A$5M total client cap
• ☐ Lodge AFSL application with ASIC via ASIC Connect (timeline: 4–12 months)
• ☐ If providing consumer credit or BNPL: lodge ACL application simultaneously; ensure ACL and AFCA membership in place before 10 June 2025 cut-off for BNPL
• ☐ If providing virtual asset / crypto services: register with AUSTRAC as a VASP before commencing operations; implement AML/CTF Program, KYC/CDD, and reporting framework; note expanded VASP scope from 31 March 2026
• ☐ If operating payment services: monitor Treasury PSP licensing reform and map your payment functions to new licence categories; budget for AFSL extension ~12 months post Royal Assent
• ☐ If building on open banking data: commence ACCC CDR accreditation process or engage a sponsored accreditation partner; comply with CDR technical standards (including Authorization Code Flow from 12 May 2025)

Australia — Ongoing Compliance

• ☐ Implement Privacy Act 1988 / Australian Privacy Principles compliance program
• ☐ Establish internal dispute resolution (IDR) procedure meeting RG 271 standards
• ☐ Maintain AFSL/ACL annual compliance review and audit obligations
• ☐ File AUSTRAC reports (TTRs, SMRs, IFTIs) on schedule

New Zealand

• ☐ Register a NZ company or branch with the Companies Office
• ☐ Register on the FSPR once you reach ≥10 NZ clients or NZ$10,000 in transactions
• ☐ If providing financial advice: obtain FMA Financial Advice Provider (FAP) licence
• ☐ If providing consumer lending: apply for FMA consumer lender licence ahead of the 1 July 2026 mandatory deadline
• ☐ Confirm annual FSPR registration details each year
• ☐ Ensure compliance with the NZ Credit Contracts and Consumer Finance Act 2003 (CCCFA) for lending products

Generally no. Providing financial services to Australian retail clients without holding an AFSL is a criminal offence under Chapter 7 of the Corporations Act 2001. The penalty is fines of up to A$22,000 and/or up to two years' imprisonment. The only lawful pathways during the application period are:

• Wholesale clients only: The AFSL requirement applies to services to retail clients. If your product is genuinely targeted at sophisticated/wholesale investors only, you may be able to operate under a wholesale carve-out while the application is processed — but you must obtain a formal legal opinion confirming your clients qualify.
• Enhanced Regulatory Sandbox: If you meet ASIC's net public benefit and innovation tests, the ERS allows up to 24 months of testing without an AFSL, subject to the A$5M aggregate client exposure cap.
• Appointed Representative: Operate under the authorisation of an existing AFSL holder as an appointed representative while your own application is in progress, subject to the licence holder's consent and supervision obligations.

No. The AFSL and the Australian Credit Licence (ACL) are separate licences issued under different legislation. An AFSL issued under the Corporations Act does not authorise the holder to engage in credit activities — those require a separate ACL under the National Consumer Credit Protection Act 2009.

From 10 June 2025, BNPL providers must hold an ACL with BNPL authorisations and be a member of AFCA. If your fintech combines an investment platform (AFSL) with a buy now pay later or lending product (ACL), you need both licences. Budget and timeline for the applications should be planned concurrently to avoid gaps.

Yes. AUSTRAC registration is not transferable from overseas licences. Any business providing virtual asset services with a geographical link to Australia — including serving Australian customers from offshore — must register with AUSTRAC before providing those services. Holding a MiCA, FCA, or other overseas virtual asset licence provides no exemption.

From 31 March 2026, the definition of regulated VASP activity expands significantly to cover crypto-to-crypto exchanges, wallet providers, and virtual asset transfer services — not just fiat-to-crypto exchanges. If your exchange currently operates without AUSTRAC registration on the basis that it only handles crypto-to-crypto transactions, you must register before that date. AUSTRAC's public VASP register means non-registered providers are visible to regulators and the public alike.

In some respects, yes — but the gap is closing. New Zealand does not have an equivalent of the AFSL or ACL for most non-advice, non-lending financial services, and the FSP registration threshold (≥10 clients AND ≥NZ$10,000 in transactions) means very early-stage testing is possible without formal licensing. The FMA is generally regarded as responsive and proportionate for smaller applicants.

However, the 2026 consumer lending licence requirement under the FMA brings NZ closer to Australia's licensing culture for credit products. The FSPR registration process itself is straightforward, but membership of an approved dispute resolution scheme is mandatory for FSPR registration — the primary schemes are Financial Services Complaints Limited (FSCL), the Banking Ombudsman, and ICNZ. For fintechs with a combined ANZ strategy, it is worth obtaining NZ dispute resolution scheme membership early, as this satisfies a condition of both FSPR registration and the future FMA consumer lender licence.

Based on the sequential steps involved, a realistic end-to-end timeline for a foreign fintech seeking both an AFSL and an ACL in Australia — without using the ERS — is 9 to 18 months from the decision to enter the market to being licensed and able to serve retail clients. The breakdown is approximately:

• 1–4 weeks: foreign company registration with ASIC
• 4–12 weeks: pre-application preparation (compliance frameworks, Responsible Manager appointment, AFCA membership, insurance)
• 4–12 months: ASIC AFSL review and grant (varies by complexity; incomplete applications restart the clock)
• Parallel: ACL application can be lodged simultaneously with AFSL application
• Parallel: AUSTRAC registration (typically 4–8 weeks if documentation is complete)
• 2–6 months: ACCC CDR accreditation (if required), running after AFSL grant

Companies that use the ERS pathway or an appointed representative arrangement can begin serving clients much earlier, but with the limitations described in the ERS section. Wayflyer's rapid ANZ revenue growth was achieved in part by investing in the compliance infrastructure early — demonstrating that regulatory speed-to-market is a competitive differentiator, not just a compliance cost.