Paul Derham – The Business of Compliance: Law, Growth and Digital Assets

The House is Digital: The House’s digital podcast is where Australia’s tech future takes shape. Welcome to the frontline of Australia’s digital revolution. We are talking with Paul Durham. is the managing partner at Holy Nethicut and one of Australia’s most experienced financial services lawyers. Paul Durham. Amy Rose. 25 years. Yeah. Offering guidance to businesses around the legal landscape that they need to take into consideration when they’re building their businesses. Over that period, 25 years, there’s been some changes. There’s been some changes in tech. There’s been some changes in business structures. We’ve gone local, global, you’ve dealt with them all. Tell me the story. The story? The story also of different transition periods. Sure. Well, fortuitously or not, when I started in 2001 was when the Corporations Act came out. Before that, it was called this thing called the Corporations Law. And there was a couple of years of transition and this idea of licensing across all these different activities was introduced. And that was in Chapter 7 of the Corporations Act. That was a new chapter. and that was called the Financial Services Reform Act. And so because that was when I started as a lawyer, you tend to specialize in the area that you start often. And so I’ve been helping businesses navigate those changes for 25 years and our law firm, Holley & Vickert Lawyers is a financial services regulatory firm. There’s about 35 of us still doing that. And since then, The Corporations Act has nearly doubled in size. It’s now 4,000 pages, 800,000 words. It’s a monster. Sorry to hear. Sorry to hear for all those listening, including whether they’re lawmakers, regulators or the regulated population. Sorry for everyone. And over that time, when the government sees that there’s a corporate failure, like there was a corporate failure back in, I think it was before the reforms in 2013, shortly before that it was called Storm Financial and there was some others where bad advice was given. So the government has to be seen to do something about it. So it introduces something new like a best interests duty or prohibition on paying a conflict remuneration. And so the Corporations Act and the law that governs all of the things we’re talking about in the digital economy, many of the things, ⁓ suddenly gets more complicated and gets bigger. And do you think the government throws out the parts of the law that no longer spark joy? Do you think they would do that at the same time as introducing or buying some new clothing for their cupboard, so to speak? They don’t. They just leave it there. And so it gets longer and more complicated. so we’ve seen best interest duty being introduced back then, ⁓ the removal of exemptions from accountants being able to set up self-managed super funds. A few years later, we’ve seen the introduction of crowd-sourced funding as a technology solution to raising capital for smaller capital raises, which hasn’t really worked, but we are still involved in that space. So that was another wave of reforms. And probably one of the bigger waves of reforms was in 2021, where we had this shift away from anything goes as long as you disclose. So that’s what governments all around the world used to require protection of consumers by making sure disclosure documents were very carefully written. And that’s based on what’s called efficient market theory. If you disclose the balance sheet of a listed company, investors will make an informed decision. What people realize, behavioral psychologists realize, no one reads the disclosure documents. And so instead let’s put more responsibility on the product issuers to ensure their products are appropriate to their audience. And so in 2021, we saw the design and distribution laws come in and that is going to be something that has to be navigated by the new entrance to the digital economy. ⁓ So anyway, there’s a bit of a progression and over that time the law has gotten longer and more complicated, but some of the principles remain the same as they have been for hundreds of years when it comes to how to navigate them. so how do businesses navigate? mean, from small scale to large scale businesses, they obviously come to you. They seek advice. Some give poor advice. sounds like as they have in the past, some give fair advice. ⁓ it’s hard when you don’t have that regulatory clarity though to give advice. How are these players navigating the regulatory landscape? I think the headline is, businesses that have the right attitude and the right skills will thrive even in the ambiguity in Australia. Okay, so that’s the principle. And if I tell you a tale of two licensees, to illustrate this, we helped two payments businesses come into Australia from London. Both of them were in London, they were competitors, they had very similar… footprints globally, we got both of them a payments license to do ⁓ what’s called a non-cash payment, offer a non-cash payment ⁓ and ⁓ conduct foreign exchange contracts and various derivative contracts for their clients or enter into them with their clients. And we did that for both of them, same business. And after about two years, ⁓ one of them wound up and I asked the business owner, why did they stop? And he said, the market in Australia is too. ⁓ There’s not a market for us. All the people we’re calling are getting 10 calls from our competitors that week. ⁓ It’s market saturation. The regulation is too onerous. And he packed up and left. Did you agree with that? Well, at the same time, the other business was flourishing. Same market, same client categories, same regulation, same business model, and they were flourishing. So my first headline is, yes, we’ve got ambiguity. anyone can still do really well here. It’s just harder. And what’s the mechanisms in inside the business though? Is it, is it compliance by design? Is it, was that other company a tick box of compliance? How were they navigating it to be so successful? I think they were just better at running a business and they believed that this was a opportunity here in Australia and they had some vision. Look, as lawyers, we always think You said by design, this idea of including all of your service providers from the beginning, obviously it’s more expensive, it’s a more ⁓ structured way of building your business. And I understand some businesses do very well starting with no money and scrappy and tech startups. And I applaud them as well. But you get to a point where if you want to play in the Australian Financial Services ⁓ regulatory space, you just have to chart a path and… ⁓ There’s lots of businesses doing that right now. When you have a business that has compliance by design, what does that look like then? Is it responsible managers? Is it a mindset? Is it a culture? it? That’s a good question. So maybe if I widen it out, like what’s the difference between a business that takes compliance seriously and a business that doesn’t? Before I answer that question, I reckon I’ve got a short sentence to summarize. the thread that I think I’ve noticed over the last 25 years. Over that time, our firm has run hundreds and hundreds of half day sessions for senior leaders within large organizations across most of Australia’s banks. In fact, all of them over the years have used us. We also train government regulators. We also train fund managers, global payments businesses, global crypto exchanges. All large organizations will get us in-house. all categories will get us in-house to train them on how to do the right thing from a governance perspective. And yes, so ⁓ what we do is we just tell stories about what goes wrong and what behaviors would have avoided that thing going wrong. And I think the one conclusion that I’ve arrived at is that wise leaders know that non-financial risk management is the only pathway to enduring success. Okay, so I’m gonna break that down. So what is non-financial risk management? It’s managing the risk that your business launders money. It’s managing the risk that your business accidentally says something misleading. It’s managing the risk that your business does something that actually needed a license and didn’t have one, so that’s a risk. So wise leaders know that these non-financial risks are the only way for long-term profitability. Just to illustrate this with a point. There’s a recent case, ASIC against Allianz, an insurer, where the insurer has a few billion dollars in revenue. It rolled out some travel insurance products and it got a quote from a law firm to review their website. The law firm quoted 25 to $30,000 and the general manager said, ⁓ we’ll get internal legal to do this one. They ended up with a $16 million fine, $16.8 million fine because the promotional material was misleading. insurance products were described as unlimited, but actually if you lost your luggage, it was an unlimited cover. There was a cap on that cover. And so this idea of wisdom being, you know that managing non-financial risk is the only pathway to long-term, enduring success, long-term profitability, I think is a characteristic that we are constantly teaching to people. Just to give you one more example, the CEO of the Commonwealth Bank, Ian Nareve, resigned. because the Commonwealth Bank unwittingly facilitated money laundering through its intelligent ATMs. And ⁓ Russian crime syndicates realized they could stuff duffel bags of drug money into these ATMs and send it offshore. And this went on for a long time. And red audit flags were being escalated to the Board Risk Committee and the Board Audit Committees. And they were being discussed at a board level. The board did not prioritize that non-financial risk. And that was the ultimate compliance failing that led to his resignation. ⁓ And the criticism from APRA about the Commonwealth Bank at the time was they were so enamored with their profitability, they didn’t think non-financial risk management really mattered. And so I think that was a really good cautionary tale. There’s lots of new cautionary tales. The former CEO of the NZ Bank, he was doing this massive uplift program for compliance, and he said publicly, I regret not doing it quicker. He’s resigned. The board has chosen to not pay him his bonus. And so anyway, these are all like even the top of corporate Australia. Some of those people don’t get that right. And anyway, so that’s one of the key messages that I’m constantly telling people whenever they ask, even if they don’t ask. seems like there’s a gap in wisdom, maybe because we don’t irrespective of who you are and what role you’re in. You need that advice, whether it’s from you or someone, you need someone to teach you that these are the frameworks that you need to have in place. So you probably need to get the word out. ⁓ a little more full because there’s a lot of businesses in Australia who are engaging in the digital economy and who will touch multiple different layers within that digital tech stack who are going to make mistakes. And that’s across the board cybersecurity as well. so they need to hear real stories about what happens when people don’t think about these things. And if they have a, if they’re hungry to learn, if they have that ability to really listen, you know, that they will hear those stories and they will augment their plans. The other thing is ⁓ to use ⁓ our friend Darcy’s favorite saying is choose your favorite robot. These AI ⁓ LLMs are very good at helping people understand what regulations they need to navigate. It’s a little bit like if you try and write, do some coding, some people can vibe code themselves, but you can use AI to get you to a certain point to understand the complexity of the legal regulation. And then after that, I guess, You know, you probably do need some help. So yeah, um, look, people, there’s a, there’s a, a, a proverb that says, um, to win, to win battles, you need many advisors. So that’s sort of written a few thousand years ago. I think, I think that’s still true today. I’m going to, because you brought it up, uh, I’m, I want to talk about your role as a lawyer, AI and the event of shadow lawyers or partners within your firm who aren’t human. How do you see that rolling out? I love this question. I’m a very much an early adopter. even this week was talking to someone about how they are planning on using blockchain to ⁓ create a footprint for AI agents to bring some accountability to them. ⁓ And so the rise of agentic AI ⁓ will and Can you explain what agentic AI is? Yeah, so an agent is somebody that does something on your behalf, right? So if you type something into a large language model and ask it a question and gives you an answer, you have to then copy and paste that into an email and send that email to someone yourself. But an agent can send it to someone on your behalf. That’s the definition of agency, right? I think the ability to, one, use large language models to help you with legal research and ⁓ summarize things and draft things and review things, that’s already happening across the legal space globally. But using agents to do things on your behalf is slowly being rolled out. And I think the first victim is the junior lawyer who won’t get hired ⁓ because AI is really good in the hands of a good lawyer. ⁓ AI in the hands of a junior lawyer has a different role to play. And we haven’t found that some of those use cases are very good. So I think the challenge will be for the junior lawyers to reimagine their roles as technology lawyers. you reimagined their roles? Well, ⁓ look, right now we’re recruiting for quite a few lawyers because we’re quite busy ⁓ across AML, CTF and crypto and a few other categories. We’re not looking for junior lawyers ourselves at the moment, but we do have two grads and ⁓ a couple of junior lawyers. So yeah, the legal landscape is shifting. I know some lawyers that you might even interview in this podcast would be of the view that a genteel will replace lawyers very quickly. I’m not of that view. ⁓ But I do believe we have to be at the table. Otherwise we’re on the menu. To borrow from Mark Carney’s quote when he was talking about middle powers to the World Economic Forum in January. So I feel that way about this topic. Okay. And if we envision the whole digital economy, I want to talk about, ⁓ obviously digital assets, tokenization, AI, the tech stack, the role that you play is it. And correct me if I’m wrong. You have to consider all of these when you’re talking to some of your clients who are, they’re probably, ⁓ in financial services, but obviously they’re leveraging from these technologies and they’re using AI and they’re, maybe even perhaps replacing some of their team with AI. how does that look for Australia? If we have, what does the business landscape look like as Australian businesses become half digital, half physical, and how do you advise on that? Well, mean, another client I was talking to this week literally said they just, they’re definitely in the agentic AI space. They just actually got rid of their junior staff, full stop, and they’ve replaced them with agents. I don’t know how it’s going to play out. There’s a spectrum of predictions that we’re all reading, okay? And ranging from sort of, you know, terminated to end times within the next five years. I don’t know if you’ve read Scary Smart by Mogordat, the former head of AI at Google X. That’s the direction he’s gone. He said that it will be like Terminator 2 and then everything will settle down once robots find peace. So then that’ll just be a period of war. That’s sort of at one end of the spectrum. The other is, like I said in Canberra two weeks ago, nearly a third of lawyers won’t touch AI because it’s dangerous in this survey that the LPLC, which is the Legal Practitioners Liability Committee, ran a survey. There’s still a lot of people that won’t be using it. So a lot of things will, it’s like parts of the economy will speed up and then parts of the economy will slow down and maybe there’ll be a gap. Not sure. see in our, in the digital asset industry that ⁓ investment or attention to different technologies happens when there’s regulation around it. could it be that for the legal fraternity that when there is regulation around AI and there are platforms that are approved or certified then that cohort of anti-AI lawyers will be on boarded? Yeah, there’ll be some that will. If you follow why people go along the adoption curve, sometimes it’s because everyone’s doing it and you literally can no longer use your checkbook. You have to use the new form of payment to use that as an example. And sometimes when there’s a level of regulation, there is more adoption. And so if we bring that back to digital assets, I have heard from people within banks, that they will be relooking at their appetite to bank some of these fintechs once these digital economy fintech businesses get licensed. So ⁓ I think that principle will play out. Yeah. think adoption across a whole lot of technologies, whether it’s AI or whether it’s ⁓ digital asset businesses getting banking will, will improve with regulation. And so when things improve with regulation, let’s focus now just on digital assets. What is the outlook? look like we know that there’s some certainty coming. know that some businesses are looking at coming on shore into Australia to launch. There’s some consolidation happening, but what does it look like from an Australian point of view? Like are we thriving or are we just succeeding? we barely making it? think we’re just getting by. Right. So The new laws around regulating basically custodial ⁓ arrangements where a business holds a digital asset or a token and the token’s underlying real world asset. Okay, they’re the two platforms. ⁓ Just regulating that brings clarity for Big End of Town. They’ve got clarity, that means they can roll out a plan, they can get a budget together, they can offer that in Australia. So that works, right? ⁓ But there’s a lot of things that… haven’t been done. Nothing has been done about how do we regulate decentralized finance. $2 billion is getting exchanged every day through Uniswap offshore, in a decentralized manner. So the law is still silent on a whole bunch of things, and the law is still very complex. So it’s hard to do business here, but larger organizations can chart a path. So what I hope is ⁓ is that we can go beyond just okay to some place of being a visionary. Right. So why do a lot of the digital economy, global businesses have had offices in Singapore, Dubai, better Hong Kong, the U S why, because there is a different appetite for the economic opportunity and the, the, the risk that comes with it. There is a different risk appetite. and that risk appetite is there because there are some visionaries. And how do you become a visionary if you’re a lawmaker? You listen to the people that are just doing great things, right? You first seek to understand before being understood. Lawmakers need to do more of that. They will get vision of the future of money. They’ll get vision of where the digital economy can be. And what is it, $20 billion opportunity just based on some of the research that… ⁓ DFC, I see OKX and DECA are releasing in a couple of days. So, yeah, I’m giving you a really long answer, but I would love, I would love people in Australia to say, we picked this and we were part of this incredible opportunity and seizing it. I’ve got three teenage kids and I sometimes hear them brag when they’re talking about artists. I was listening to that guy or that girl before they were famous and they say that proudly, right? The political equivalent of that is we made space for these opportunities before so many other countries did. And I’m proud of that. It’s part of my mark as a politician or as a regulator, you can still play a role in making space. Understandably, the chairman or chairwoman will push down their political ideology to an extent. I mean, they don’t say that, but… ⁓ you know, their, regulatory priorities actually is a better way of saying it. They’ll push that down, but it would be awesome if the people that are going to today’s conferences, like the Deca conference or the policy we had in Canberra, if we could look back in 10 years and say, picked that and we were there and we helped make that happen. anyway, I mean, we, have, it’s a, it’s a slow burn, isn’t it? It’s a very slow burn. mean, you, you’re the first lawyer in this space way back in, was it, I think 20. The first media article or the first email that I saw between you and Ron Tucker was from like 2011 or 12. was, so you’ve been in this space for a really long time. you’ve seen the waves and there’s a lot of work that’s gone into it. So I think it’s safe to say that you did see it coming and you paved the way and you laid some of the plumbing and a lot of people who are now doing other things also did contribute to that. And even, you know, I, ⁓ I’ve been to internet conferences in the past and, know, the TCP IP and the plumbers of the internet. you know, then they’re not recognized, but they were there. So I think that you can go to sleep tonight knowing that you, you, you were there for that. Yep. But on the, policy makers and the politicians being able to say, I was there for that. I helped build that infrastructure around this innovation. ⁓ it’s just bigger than Ben-Hur. needs the relationship with industry more than ever to inform. Yes, 100 % agree. And both sides, all sides of government to come together and have a constant dialogue because every single day something new is happening. I mean, I saw the new Chinese robots. don’t know if you’ve seen them a couple of weeks ago, know, dancing and they are scary. Fun looking, but scary. so we don’t have a great deal of time. ⁓ and so that everyone needs to come to the camp right now. But I mean, what do we do? I mean, I, we, we spoke to Aaron Violi, who’s, ⁓ the member for Casey and he was very much, ⁓ ready to engage and he’s the shadow minister for the digital economy. And he agrees like, this is a group effort. But how, but with this fragmentation, this fragmentation in industry, this fragmentation within government, there’s also other priorities in government. you said, it’s a slow burn and continue doing what you’re doing, Amy Rose, and that is getting people together in the right places in Canberra today. We’re in Melbourne. ⁓ so when you’re in Melbourne, you get, ⁓ an MP who believes in this, on this podcast, you bring people together, you get a one to many message out like this podcast and others. You get people in little rooms, you get people in big rooms, you keep telling compelling stories, you get people who have the energy to get up there and do it. ⁓ And I think we just keep doing that. And we have had the benefit of spending a lot of time with some members of parliament across state and federal. And the federal members of parliament, like Andrew Charlton and Simon Kennedy, you can see them bringing along their colleagues and getting them to listen to stories about the economic opportunity, about how the technology works. And just, I think we just need to be relentless. know, relentless and consistent, consistency compounds, right? And so sometimes consistency is boring, but consistency is, I’m just saying in another way what you said, it’s a slow burn. We’ve just got to keep at it. is, consistency for us isn’t boring. It’s quite fun really. Sorry, consistency, sorry. Consistency for us is boring, but for everyone else who’s here for the first time. This is the opportunity and it’s just a couple of light bulbs away, I think, ⁓ for different people. ⁓ But we’re going to wrap up. If you could envisage, I’m going to say next two years, because we’re talking, you’re in, in the, on the coalface of the regulation. are. advising too many, probably businesses and your, your firm is obviously growing because there’s a, there’s a demand there in the next two years. What does it, what does it look like for digital asset businesses and for the wider digital economy? think legitimization is the word. We don’t just have this regulation of custodial activities coming. It’s in parliaments, in a committee, it’ll be wrapped up. The committee will be wrapped up in March. I think it’ll go through parliament pretty quickly. We then have. I think the payments reforms will be even bigger than this custodial reform piece. And so we’ve got ⁓ AML-CTF reforms as well coming through at the end of March and at the end of June, depending on your activities. And so we have legitimacy. We have three waves of regulation that will be creating some groundwork. Is it good? It’s okay. It’s adequate. The payment reforms, I think, are good. The custodial reforms, I think, are clunky and use They don’t benchmark language globally or even against our other legislation, is Obama, but it will do. And as it’s rolled out and as businesses all band together and work out a pathway, then they will find that the legitimacy brings things like more investment opportunities, more banking and other sort of infrastructure, stronger infrastructure foundations. And I think at the same time, ⁓ a greater awareness at the lawmaker and the regulator levels of the importance and the role of what the digital economy is and parts of it like decentralized finance, distributed ledger technology, and moving away from this tiny 1 % view of high risk trading, moving away from that ⁓ absolute, ⁓ it’s not an old wives’ tale, but it is a completely inaccurate picture of what we’re really trying to talk about. and actually coming to a deeper form of understanding about the economic opportunity that is around us right now. So I think that will make progress in the next two years, massive progress. Yep. And if I’m hearing you right, it is that regulatory clarity and certainty that’s the foundation of this success. Yep. So I’m as excited as you. I agree. The next couple of years is, and it’s also going to bring attention to Australia. I think so. something. We’ve moved. We’ve finally moved. Yes. Well, it’s good to see you, Thank you for coming on the show. digital, where policy meets innovation. Stay curious, stay inspired and be part of the movement building Australia’s next economy. The future is happening now. See you in the next episode.