Australia’s digital assets regime is coming - so what does that mean for insurance?

Speaker A: Foreign.

Speaker B: Hello and welcome to uh, a special edition of the Fintech Pulse podcast. I'm your host Tim Chan, special counsel at ah, global law firm um, Norton Rose Fulbright and I'm an insurance lawyer based in Sydney and the founder of the insurartechlawyer.com blog. I'm delighted to be joined today by Ben Davis, CEO, uh and co founder at Native. Native is a global broker for digital assets and crypto bridging traditional insurance with on chain finance. Ben has over a decade of experience in insurance with seven years dedicated to crypto. An award winning broker, he's known for his innovations in the industry. Thanks so much for joining me today Ben.

Speaker A: Thanks Tim. Great to be here.

Speaker B: So today we'll be chatting about Australia's new digital assets licensing regime, uh, which will house parliament on 1 April 2026 under the corporation's amendment Digital Assets Framework Act. The act uh, follows formal consultation processes in 2023 and 2025 bringing together digital asset providers within the existing Australian financial services licensing regime administered by asic. So just touching briefly on the new regulation, the act received royal ascent on the 8th of April this year and will formally commence on the 9th of April 2027 followed by a six month transition period. So during this Runway we'll be looking at affected businesses and how they need to assess where the operating models fall within the new definitions and, and determine their licensing pathway and the governance controls and documentation to meet these new regulatory expectations. And the act sits within a wider global shift towards comprehensive digital asset regulation for organizations operating across multiple jurisdictions. This convergence increases the complexity of managing licensing requiring careful management of multi jurisdictional compliance obligations and, and understanding how these obligations interact. So this is why it's great to have you here today Ben to talk about the insurance implications arising out of this. So when the Australian Digital Assets Framework formally commences next year, digital asset providers and tokenized custody platforms will need an Australian financial services license to operate. So Ben, can you share a bit about what types of insurances um, digital asset platforms should be thinking about and how this underwriting process might m differ from traditional financial services companies?

Speaker A: Absolutely. Thanks Tim and uh, appreciate the intro there. Um, it's a, it's an incredibly exciting time for the space and for, for Australia I think um, having this regulation is a big step uh, forward for the businesses there and I think really puts Australia on the map in terms of regulatory clarity. So yeah, you know from, from a broking perspective uh, we've seen a um, marked increase in requests for professional indemnity Insurance. We actually just had one come through from one of our Australian clients for quite um, a large increase in professional Indemnity, um, just to I guess get ahead of the coming upcoming regulations and position themselves well for you know the application process and that conversation uh, with, with the regulators. Um, but aside from the professional indemnity insurance, which is um, something that we do uh, very strongly advise our clients to take if they are in any way providing professional services, technology professional services, investment advice, investments into digital assets or fiat currencies. Um, but you know, kind of the next one after that is definitely Directors and Officers Insurance. Um, you know when you run a business you can be held legally liable for the business decisions of that business. And so what Directors and Officers Insurance does is step in and pay for those liabilities uh so that you can keep your assets so you know you don't lose your house because of a bad business decision. So DNO is always kind of that, that number one, we, we want to really protect our clients assets first and foremost. Um and then comes down to exposure and budget really. Um, what we have seen over the last uh, I would say year is a consistent uh threat theme of custody. So we, we've seen that, that our clients um, and you know the, the broader sector are still being targeted for um digital asset custody exploits, whether that be on chain exploit or an exploit of um, private key infrastructure or operational security. And so depending on the client's business uh model we will um, advise whether it's you know, custody cyber, uh, technology errors and emissions, um, you know and most likely a blend. So um, just, just kind of on that custody uh side of things. Most companies will think that the smaller they are the less of a target for fraud or for exploits or, or hacking attempts. But unfortunately actually just had a client um, out uh, in Asia that they had just, they've just put in a claim for about a million dollars um because they were a victim of, of a hacking attack. And they were a small company, just a startup, they just raised a few million and already they've you know had to use their insurance which is you know, why, why we're here and why we do what we do. Um, and so luckily you know it looks like it's all covered and so that's such a breath of fresh air because without that, that million dollar um loss would have been quite, quite substantial for a small business. And so size doesn't really matter when it comes to attackers. They're looking for any sort of easy into these businesses and so that's why custody, uh, is such an important part of, of what we do and what we place. And in that custody there's actually two buckets. So you've got the crime custody, which is more of the kind of quote unquote, hot wallet, um, storage, where you've got wallets connected to the Internet that are automatically kind of trading. Um, think of them as, as the liquidity pool wallets. And then you have cold storage or, uh, kind of that vault specie risk. And so what we've seen is there's been a lot of, um, attacks or attempts on that kind of hot wallet side of things. And that's why, you know, limits are typically smaller and premiums a bit higher. Uh, and then the specie limits are typically much. Or, sorry, the specie wordings are a lot more narrow. So they're only really covering collusion and, um, theft of the private keys by, um, insider employees, or physical theft by a third party or, or damage to those private keys by physical peril. Uh, but it doesn't really, excuse me, cover any cyber risk. And so you can get much higher towers on the species side of things. Um, so you can get up to a billion in limit on the specie, where in crime you're looking at 100, you know, 200 million, probably tops in the London market. And so it really depends on the type of business and the private key architecture and what they're looking to insure as opposed to their budget. And then we work around them to create that program.

Speaker B: Yeah, right. Well, lucky that company had an insurance in place and a company in Asia. And it's good to see that these products are actually working and delivering value. Absolutely. So I guess custody is quite specific to the crypto space, but traditional coverages such as dnr, dno, as you mentioned earlier, um, also relevant for digital asset companies. Does the underwriting process differ, Ben, between for crypto companies and traditional financial services companies for a coverage such as dno?

Speaker A: Uh, it's interesting, Tim, because if you asked me, uh, six years ago, seven years ago, when I was, um, doing the underwriting on these companies, I would have said absolutely, because back then we needed white papers, we needed every policy that they had. From a AML KYC standpoint, we needed 10 different documents and the rate was really high. And you know, the terms are quite punitive back then because there's only maybe two or three different insurance companies. Now, fast forward seven, eight years later, um, the underwriting process actually looks very similar to traditional, uh, companies. And that's because liquidity has Increased. So there's more insurance companies looking to provide insurance. Uh, for these companies, uh, the regulatory perimeter, at least in the states, has drastically, uh, improved or the regulatory enforcement, I should say, um, uh, risk has, has improved substantially for these clients. And so, you know, that means rates go down, coverage increases. The US Market is writing a lot of, um, this business domestically and that's going into traditional DNO books. Now what I will note is that underwriters that have been specializing in this space for, uh, a while will know what to look out for and what to not look out for within that space. So, um, you know, simple things like, uh, you know, if there is a token, how the token was. The token issuance was done, um, how the website reads. You know, if you're, if you're looking at a website and it's talking more about gains and um, you know, uh, investment strategies rather than actually, you know, the product or the solution, you're probably, you know, there's going to be some red flags there. Uh, you know, balance sheet, um, you know, how to, uh, look at how to value tokens on the balance sheet, things like that. Um, and so there's, there are specific nuances, but I would say it's a traditional DNO underwriting today looks a lot similar, um, to, you know, the crypto underwriting that you'd need to make it. So there. Yeah, the levels have kind of equalized now. Um, uh, and, and which is, which is great. You know, this is, this is a great market to be an insurance buyer. Um, there is a lot of liquidity in the market for clients looking to, uh, looking into insurance. So whether they are buying it for the first time or they want to increase limits or broaden outcover, it's a great time to be speaking with a broker and getting into the market.

Speaker B: Thanks, Ben. Yeah, it also shows, I guess, that underwriters are uh, beginning at least to become more familiar with these types of companies as well.

Speaker A: Yeah, I would say so. I think it's been around enough that, um, uh, insurers are starting to get their heads wrapped around it. And look, I also think there's a bit of market dynamics. I mean, we're in a soft market here and people are looking to try to hit budget. And so when you're in that kind of market, people are more interested in doing, um, the exciting and innovative companies and looking to build out a little book of, of call it emerging technology. And so, you know, that that's what we're seeing. We're also seeing, um, uh, Underwriters who had built their names and uh, other insurers move around to other underwriters and then kind of start that practice there. And so that's also kind of contributing to the market liquidity where you have just that natural circulation of talent in the market that, that's bringing up this expertise uh, around, around London and you know, Australia and, and really globally. I think, you know, we're really connected now. You know, podcasts like this are fantastic to kind of share knowledge and you know there's, there's a ton of resources online where people are kind of reaching out and upskilling themselves. So I do see a uh, um, a much more um, increased interest in, in this space over the last few years. Uh, which is, which is incredible because you know, well, as we're seeing and you know, Australia putting this framework uh, together is a great example of it is that this space isn't going anywhere. It's being embraced wholeheartedly by financial uh, institutions and it's just a matter of time before you know, it's in, it's kind of underlying a, ah, lot of the financial infrastructure that we take for granted today.

Speaker B: Yeah. So on that vein actually. So with the Australian licensing regime commencing next year, uh, from an under eyes perspective, does that formal licensing regime improve insurability? Does it make it easier to get insurance?

Speaker A: Um, I think it does. I think it's, I think probably it's a little bit of a, uh, it increases the likelihood. But it also is another risk that the underwriters need to take on because now there's, you know, there can be penalties under, under a regime. The thing that I do think makes it easier for an underwriter to underwrite it is that uh, the weak link in a lot of this isn't the tech, it's the people. And having a regime in place helps at least have some standards that need to be in place for license to be given. And so I kind of look at these uh, frameworks or um, licensing regimes as a really good kind of like people barometer or risk governance barometer. Without that, it's very hard as an underwriter to get comfortable with the, the governance framework of the business without asking for a ton of documents and you know, going through it and you know, just to lose that potentially to another insurer who hasn't done due diligence and just wanted to quote because they wanted to win it. So I think this is a, a great, yeah, I guess people barometer that they can look into and assess the risk much quicker. Um, but then on the other side, you know, there is a risk that if um, the company kind of falls afoul of that regime that there are certain outcomes that, that could be insurable. So um, I think it's, it's obviously it's a very good step in the right direction. It's something underwriters need to, need to think um, about. But it by no means would I guess preclude them from wanting to write in the space because now there's regulatory clarity. I mean like if anything it's going to increase the, it's going to increase the capacity for that because they now have a framework that they understand um, to underwrite around and you know, everything else just becomes an, an appetite question and you know, a conversation with the broker.

Speaker B: Thanks Ben. Yeah, great insights there. So I think we touched on this next topic um, earlier a little bit already but I just want to delve into it a little bit more and that's on emerging threats and insurability of these threats. So as you mentioned earlier, uh, there have been some quite significant um, exploits recently. The Bybit hacksaw $1.4 billion in Ethereum based assets, um, being stolen despite them being in cold storage and DeFi exploits remain a leading loss vector. Um, as Australian platforms come under AFSL oversight. How should they be thinking about the insurability of risks like these, Ben? And are there threat categories you think are simply uninsurable? And how uh, are insurers handling this?

Speaker A: Yeah, it's a great question. And we're now wading into, I would say probably the most complex and evolving, I would say risk, um, environment that I've certainly seen in my career. I think the on chain, let's call it, you know, DeFi smart contract risk landscape is one that is uh, constantly in flux. Right? You have a hack and then you have people patching and then it happens again and again and again. And you know, because this is ultimately money, right? It's data slash money. Um, it can be incredibly profitable for these attackers which are largely North Korea. Right. A lot of the big hacks that have happened have been nation state level, very sophisticated attacks. Um, and so what has happened is companies that are looking to get into DeFi and you know we've had a lot of conversations with, with large financial institutions looking to get into decentralized finance but they can't because of compliance and insurance and kind of this nebulous area of risk. And so what we've done at Native is actually um, we've designed a uh, institutional defi insurance product that'll be coming out in the next month or so. And what that does is it's a regulated insurance option for these companies that transfers, uh, smart contract exploit, Oracle manipulation, Oracle failure, um, governance attacks onto a regulated insurance carrier. Um, and I would say without a very cohesive solution for risk, this space does look uninsurable from a regulated standpoint. And, and I'm saying that while launching an insurance product, um, and so how we've done that and how we've looked at this space is we've had to just realize that neither us nor the insurers, um, that we work with are going to outsmart North Korea. We're not going to outsmart the people that uh, launch cyber attacks for a living. However, what we can do is create uh, a ecosystem of risk vendors that can mitigate that frontline risk, um, before it becomes an insurance claim. And then if it does get through that frontline mitigation vendor and becomes an insurance claim, then we've got insurance to back it up. And so we're working with great partners like hypernative that come in and actually proactively sweep assets. They do transaction monitoring, um, they do um, scanning, um, they, they do threat detection. And so what that allows us to do is we can work with them and actually really get under the skin of what the, the risk of a particular smart contract would be and then essentially price that and then ensure that there are uh, appropriate safeguards in place for our clients so that if there was a risk, they, they do have proactive asset sweeping. And then let's just say that that doesn't work or it fails, then we have insurance to back it up. And so I don't think unless you have a technology solution, this space is insurable actually. Um, but if you work hand in hand with the ecosystem, uh, and the researchers and the security consultants and the people on the front lines kind of day in, day out, then it starts becoming much more insurable. And actually you can get to a much better rate because you have this again mitig and then kind of insurance double lock I guess, um, on that. Uh, and so, you know, and then we're also backing that up with technology of our own which does wallet monitoring and aggregation so that insurers can see their uh, portfolio at the, at the click of a button. And so from an insurance insure, underwriting, you know, risk management standpoint, it'll be a much easier way to manage aggregation, which is a big problem in this space. And then from a client perspective, they know that you know, they have um, an easy onboarding process. They have partners that are monitoring their, their frontline risk and then insurers taking their, their risk in a regulated way. And so I, I think this is a space that we're going to need to monitor and evolve with, uh, because it's ever changing. But I think with that uh, that approach it, it is insurable and I think it's the way that institutions are going to get very comfortable with this in the future.

Speaker B: Thanks Ben.

Speaker A: Yeah, I agree with all that.

Speaker B: So prevention mitigation, definitely better than a cure anytime. So really good to see these technological advancements helping make these risks more insurable. I guess I wanted to touch on next is some lessons from overseas with the Australian framework still being very new. But obviously Australia is not the first jurisdiction to introduce crypto regulation. Um, Europe's markets in crypto assets regime already requires insurance for crypto asset service provider operations. Um, from your global perspective, other lessons from other jurisdictions experience that Australia should draw on ASIC implements the new framework and hopefully that this clearer regulatory perimeter will actually bring insurers back to the table, some of whom have exited crypto altogether.

Speaker A: Yeah, I mean it's a, it's a good question. I, uh, I'm actually thinking back to when FTX imploded and there was this large contagion that, that broke out in the, the crypto industry and actually the only capacity that got withdrawn and the only insurance entities that did implode because of it were the on chain, um, discretionary cover mutuals. Right. So you had a few of them that were covering stablecoin depegs, um, and some other smart contract risk that imploded with it. But all the actual regulated insurers, even the ones that did suffer losses, they actually didn't withdraw and they didn't change too much of their underwriting practice. They might have, they might ask a few more questions and um, you know, may be a bit more careful around certain things, but we didn't actually see a broad pullback in insurance capacity during that time frame. Uh, we had the insurers that were in it largely, you know, knew that there was, you know, that the space wasn't going to go anywhere else, uh, and it was going to keep growing. And so what they did was, you know, they battened down the hatches and just kept sailing through. And so if, if I was an insurer that is looking to get into the space, this would be something that uh, I would kind of take to heart and, and use as a bit of a long term strategy where if you get into the space, you have to underwrite this for the next, you know, three, five, hopefully longer years where it's not just, you know, you write a couple and then maybe you get out if you don't like it. I think this is something that needs longevity because you need to understand the technology and you know, the mindset and um, I guess the ethos behind the space. And you know, that's really why we started Native. When we looked at the, the opportunity in the industry, um, we knew that this was not just another kind of technology. It was really its own culture, its own um, real, I guess, yeah, ethos behind the tech and making finance for, for everybody and democratizing that financial access. And so that's why when we started Native, we really wanted to build a broker for the space because we realized that it was so unique. And so if I was an insurer that was looking at, um, kind of the, the past, uh, experiences to get a good idea of how to position it, I've, I've counseled other insurers that were looking to do the same thing as to kind of play to your strengths. So do the classes that you're very familiar with and then bring in um, brokers that you're, you, you know, you're friendly with that have expertise in the space and then ask them uh, pointed questions on how they can grow and develop. And then also this is a big one. You know, engage the community, engage the digital asset companies and understand what they want and how they see it and, and you know, where they see the risks. Because often, you know, they're, they're the experts on, on their businesses. And so, you know, that's kind of how we've framed it with insurers in, in London that are looking into, into uh, getting into this. And then, you know, we're really excited that we've brought in a few new insurance carriers in 2025 and 2026 into the space that have never written a digital asset risk before. And largely it was from lunch and learns coffees, um, you know, getting them in front of clients and bringing them on risks that they felt comfortable with. So you know, slowly at first, and then, you know, you want to get 1, 2 under your belt and then kind of start building up a bit of a practice and expertise with um, some enterprising underwriters in the company. That's kind of how we've seen the, the pattern play out in London and it's done well so far.

Speaker B: Yeah, well done to you and the team, Ben, that's great to hear. So I guess looking a bit into the future, what do you think the insurance market needs to look like in three to five years time to improve confidence even more. And where would that capacity come from?

Speaker A: Yeah, it's a great, it's a great question. Again, I think this space is going to have many more, I guess, blended covers. So right now you still have a bit of a disjointed, uh, product offering between insurers and brokers. And you know, in some markets, um, the crime piece is covered under cyber and some, you know, and let's call it the U.S. a lot of the U.S. insurers are doing, um, you know, theft of digital assets under the cyber product, while in London we do it under the crime. And that leads to a bit of an awkward kind of placement process. So I think there's going to be more harmonized taxonomy or framework of how this, the, they make it cleaner.

Speaker B: So it's not all these overlapping covers.

Speaker A: Yeah, yeah, exactly, exactly. And you know, everything, you know, you get into some of these, these policies and everything's a bit different. And so I think we need kind of, yeah, one sort of policy standard that we agree, um, kind of similar to what's happened in cyber. You know, we, we kind of know what cover ransomware is now and we know how a cyber policy broadly works and the panel approach and all of that. And so I think that's going to come to crypto. Um, I also think we are going to have much more hopeful, I'm really hopeful on this, but much more cooperation between insurers and the actual community. Again, kind of taking um, a leaf out of the cyber playbook here. You saw a lot of, um, startups in the cybersecurity space, you know, really partner with insurers to help them bring risk down the books, give them more visibility, uh, you know, really help manage that whole, I guess call it risk spectrum. I think that's going to come to, to crypto as well. Um, and then we're going to have uh, probably custody standards that are going to be imposed, uh, across the board in defi. Uh, so I think, you know, defi is probably the most, uh, how do I call it? Not opportunistic, but I think it's, it's got the most, um, enthusiasm, I think, from, from the community to try to get this insured. Uh, I think we, you know, we've seen it across the board from our clients that they really want regulated insurance for this kind of quote Unquote Defi risk bucket. That, that encompasses all those, you know, smart contract exploits, Oracle failure, Oracle manipulation and governance attacks. Um, and so I think that is a massive opportunity for insurers to, to embrace the community, embrace the, the risk vendors that are already in it and then you know, work hand in hand with the brokers and the clients to, to thoughtfully create those risk solutions. So I think Defi is going to be a big area that we can improve on as an insurance community and deliver for, for the space. Um, so I think, yeah, I think, you know, kind of everything off chain, so the dno, the cyber, the tech, that, that kind of area, it's going to be a bit more of a homogenized policy and then from the DEFI stuff it's going to have ah, a lot more hopeful capacity from the regulated insurer side come in once the standards are in place. And then from the capacity perspective I think we'll start seeing more digital asset capacity enter into the space through regulated insurance vehicles. Um, I think that's going to be a big kind of theme in the future. There's a lot of large digital asset holders that are waiting on the sidelines for uncorrelated yield from kind of macro economic uh, perspective and insurance is actually a very good way to do that. Um, and insurance companies are normally very capital efficient vehicles to diversify your investment portfolio. Um, so I really believe that insurance is going to be a big investment, uh, center for the digital asset space in the next few years.

Speaker B: Really exciting Ben. It's certainly correlating with everything I'm hearing in the market as well. There certainly is that demand for more insurance. So anyway, I guess that's all we've got time for today though. So thanks so much Ben for your time and your valuable insights and really excited to hear about your new product launching in the next month or so. And to our listeners, you heard it here first. Thanks so much again, um, Ben, and thank you to everyone who's tuned into our FinTech polls podcast today. Uh, keep up to date with developments in the digital asset space by listening to our monthly 10 minute global crypto regulatory update on the FinTech Pulse podcast and by subscribing to our Inside FinTech blog on our website. Thanks again for listening and goodbye.