This is a compliance-systems case, not just a crypto case. Oztures wanted to offer derivatives only to wholesale clients and sophisticated investors. That model depends on the gate working. The gate did not work well enough, so retail clients accessed high-risk products without the protections they should have received.
The Court made declarations covering failures to provide Product Disclosure Statements, failures to make target market determinations, inadequate client-classification systems, licence-condition compliance, training and internal dispute resolution. The $10 million penalty was imposed even though Oztures remediated customers, cooperated with ASIC and there was no suggestion the contraventions were deliberate.
For regulated businesses, the lesson is that a policy is not enough. The onboarding workflow, evidence requirements, staff training, exception handling and complaint process all need to match the legal promise. If the business is saying retail clients cannot get through, it needs controls that actually stop them.