Crypto Should Be Judged By Economic Role, Not Tech Design: ASIC Fintech Chief

bitcoinistPublished on 2026-03-11Last updated on 2026-03-11

Abstract

According to Rhys Bollen, head of fintech at the Australian Securities and Investments Commission (ASIC), consumer harm in crypto primarily stems from intermediaries—exchanges, custodians, lenders—rather than the tokens themselves. In a paper presented at the Melbourne Money and Finance Conference, Bollen argued that Australia should regulate digital assets based on their economic function, not their technological design. Tokens that act like securities should be treated as such, stablecoins moving money should fall under payments law, and consumer protection rules should cover the rest. This approach contrasts with jurisdictions like the U.S. and EU, which are creating crypto-specific laws. Australia is already implementing this through its Digital Asset Framework bill, which integrates digital assets into existing financial regulations rather than building a separate legal structure.

Most harm done to consumers in the crypto space has come not from the tokens themselves, but from the platforms handling them — the exchanges, custodians, lenders, and yield services.

That finding sits at the center of a new paper delivered this week by Rhys Bollen, the head of fintech at the Australian Securities and Investments Commission, who argues Australia should stop treating digital assets as something categorically new and start applying the financial laws already on the books.

Regulating What It Does, Not What It’s Called

Bollen made the case at the Melbourne Money and Finance Conference, where he argued that crypto tokens should be judged by their economic function. A token that acts like a security should be treated as one. A stablecoin that moves money should fall under payments law.

Consumer protection rules should pick up whatever else remains. His argument strips away the technological wrapping and asks a simpler question: what does this thing actually do?

Paper presented at the Melbourne Money & Finance Conference, University of Melbourne by Dr. Rhys Bollen, Senior Executive Leader, FinTech

Crypto-Specific Law

That framing puts Australia at odds with how other countries have gone about it. The US is pushing the CLARITY Act, a purpose-built crypto framework. The European Union has rolled out its Markets in Crypto-Assets rules, known as MiCA. Both create dedicated regulatory structures for digital assets.

Bollen’s position, by contrast, is that building a separate system from scratch misses the point — and leaves gaps that bad actors will find.

“Opportunities for regulatory arbitrage” is how Bollen describes those gaps. Build a crypto-specific law, and someone will structure a product to fall outside it. Attach crypto to existing law based on what the product does, and that exit shrinks.

BTCUSD trading at $69,615 on the 24-hour chart: TradingView

Australia Already Writing It Into Law

Australia isn’t waiting on theory. The country’s Digital Asset Framework bill, currently moving through parliament, doesn’t attempt to replace the Corporations Act.

Reports indicate the bill amends it — slotting digital asset platforms into the existing regulatory structure rather than building a lane beside it.

ASIC’s own guidance document, Information Sheet 225, has already confirmed that existing definitions of financial products and services under the Corporations Act can apply to crypto, depending on how a given asset functions.

Bollen was direct about what that means in practice. Regulators, he said, should be focused on intermediaries — the companies sitting between users and their crypto — rather than on the tokens themselves. That’s where the consumer harm has actually shown up.

Featured image from Cyber Security News, chart from TradingView

Related Questions

QAccording to Rhys Bollen, where has most consumer harm in the crypto space originated from?

AMost consumer harm has come not from the tokens themselves, but from the platforms handling them, such as exchanges, custodians, lenders, and yield services.

QWhat is the core argument made by the ASIC FinTech chief regarding how crypto should be regulated?

ACrypto tokens should be judged by their economic function rather than their technological design, meaning a token that acts like a security should be treated as one, and existing financial laws should be applied based on what the product actually does.

QHow does Australia's proposed regulatory approach for digital assets differ from that of the US and EU?

AAustralia is amending its existing Corporations Act to slot digital assets into the current regulatory structure, whereas the US is pushing the purpose-built CLARITY Act and the EU has created a dedicated framework called MiCA.

QWhat does the term 'regulatory arbitrage' refer to in the context of crypto regulation, as mentioned by Bollen?

A'Regulatory arbitrage' refers to the opportunities for bad actors to structure crypto products in a way that falls outside the scope of a purpose-built, crypto-specific regulatory framework, thereby creating gaps in consumer protection.

QWhat is the practical focus for regulators that Bollen suggests to prevent consumer harm in the crypto space?

ARegulators should focus on the intermediaries—the companies that sit between users and their crypto, such as platforms and service providers—rather than on the tokens themselves, as that is where the actual consumer harm has occurred.

Related Reads

When AI Begins to Audit the World: From Claude Discovering the ZEC Vulnerability, Watching the Encryption Industry Enter the 'Recursive Security Era'

**When AI Audits the World: From Claude's Discovery of a ZEC Vulnerability, Viewing the Crypto Industry Entering a "Recursive Security Era"** This article examines a pivotal shift in the blockchain security landscape, triggered by the convergence of two events: Anthropic's research on AI's "Recursive Self-Improvement" and Claude Opus 4.8's discovery of a critical vulnerability in Zcash's code. Traditionally, crypto security has relied on human experts and automated tools for periodic audits. However, the article argues AI is transitioning from a mere tool to an active participant in understanding and analyzing complex systems. Claude's ability to identify a subtle flaw in Zcash's zero-knowledge proof system demonstrates AI's potential to dramatically lower the cost and time required for risk discovery. This goes beyond finding a single bug; it signals a change in the very mechanism of how vulnerabilities are found. The core thesis introduces the concept of "Recursive Security," drawing a parallel to Anthropic's "Recursive Self-Improvement." Just as AI can accelerate its own development through feedback loops, security systems are evolving towards a continuous cycle of analysis, risk identification, remediation, and re-analysis. Security is becoming a persistent, evolving capability integrated into a system's lifecycle, rather than a one-time pre-launch audit. This shift is particularly urgent for the crypto industry, where system complexity from Layer-2 networks, modular architectures, and ZK-proofs is growing faster than human analysis capacity. AI excels at the pattern recognition and contextual understanding needed to navigate this complexity. Importantly, the article cautions that AI augments both defenders and potential attackers, accelerating the entire threat landscape. The future competitive advantage may not lie in having zero vulnerabilities, but in having the fastest risk discovery, validation, and response capabilities. The Claude-Zcash incident is thus an early signal of an era where AI-driven, recursive security systems become essential for managing risk in an increasingly complex digital world.

marsbit2h ago

When AI Begins to Audit the World: From Claude Discovering the ZEC Vulnerability, Watching the Encryption Industry Enter the 'Recursive Security Era'

marsbit2h ago

Trading

Spot
Futures
活动图片