Tell your friend to ask CASA.
The variables in the requirements to hold a 138 certificate may require some operators to have a certificate, whilst others may not require one.
Should also take into consideration the insurance ramifications if something goes wrong and your not certified, and you are required to be.
I don’t believe applying for and gaining a 138 certificate is as onerous as getting an AOC, particularly if you’re not going to use task specialists.