Australian insurance businesses operate under distinct risk and compliance frameworks administered by the Australian Securities and Investments Commission (ASIC), the Australian Prudential Regulation Authority (APRA) and the Australian Transaction Reports and Analysis Centre (AUSTRAC). Requirements differ according to whether an entity is an Australian Financial Services Licence (AFSL) holder, insurer, insurance broker or other intermediary.

Getting these obligations right matters because each regulator applies its own rules, and insurers, brokers and other intermediaries can face very different requirements. This article explains the risk management, capital and AML/CTF requirements that apply to Australian insurance businesses, when AML/CTF obligations are triggered and how to keep compliance arrangements up to date.

Overview of Risk, Capital and AML/CTF Requirements for Australian Insurance Businesses

The main compliance requirements depend on the business’s regulatory status and the services it provides:

• AFSL holders: must maintain adequate risk management systems and, subject to limited exceptions, adequate financial resources under Section 912A of the Corporations Act 2001 (Cth) (‘Corporations Act‘).
• APRA-regulated insurers: must comply with prudential standards, including Prudential Standard CPS 220 Risk Management (‘CPS 220’), Prudential Standard CPS 230 Operational Risk Management (‘CPS 230’) and the capital adequacy standard for their industry.
• Reporting entities: businesses providing designated services, such as issuing life insurance policies or arranging them under an AFSL, must meet anti-money laundering and counter-terrorism financing (AML/CTF) obligations administered by AUSTRAC.

A single insurance business may be subject to all three frameworks. The sections below explain each in turn.

What Risk Management Frameworks Must Australian Insurance Businesses Maintain?

Section 912A of the Corporations Act

An AFSL holder must comply with the following obligations under the Corporations Act:

• maintain adequate risk management systems under Section 912A(1)(h); and
• do all things necessary to ensure that financial services covered by the AFSL are provided efficiently, honestly and fairly under Section 912A(1)(a).

The appropriate arrangements depend on the nature, scale and complexity of the financial services business.

Governance Structures and Internal Controls

An effective risk management framework requires governance arrangements that oversee operational risk. These arrangements are supported by:

• risk assessments;
• internal controls; and
• monitoring, reporting and escalation processes.

An APRA-regulated insurer must maintain an operational risk profile appropriate to its size, business mix and complexity.

The risk appetite must be defined through indicators, limits and tolerance levels. Internal controls must be designed, implemented, regularly monitored, reviewed and tested for operating effectiveness, with identified control gaps or material weaknesses addressed in a timely manner.

APRA Prudential Standards CPS 220 and CPS 230

APRA-regulated insurers must maintain risk management arrangements under CPS 220. Operational risk requirements are set out in CPS 230, which applies to the following entities within the APRA-regulated sector:

• general insurers;
• life companies; and
• private health insurers.

CPS 230 commenced on 1 July 2025. The amended version, released by APRA on 30 April 2026, is in force from 1 July 2026. It addresses:

• operational risks;
• critical operations;
• business continuity; and
• service provider arrangements.

What Capital and Financial Requirements Apply to Australian Insurance Businesses?

ASIC Financial Resource Requirements Under RG 166

Under Section 912A(1)(d) of the Corporations Act, an Australian Financial Services (AFS) licensee must have adequate financial resources to provide the financial services covered by its licence and carry out its supervisory arrangements. ASIC’s Regulatory Guide 166: AFS licensing: Financial requirements (‘RG 166’) explains how these obligations apply according to the nature, scale and complexity of the financial services business.

The financial resource framework may include:

• Base requirements: solvency, net assets, cash needs and audit requirements.
• Additional requirements: surplus liquid funds or adjusted surplus liquid funds, where applicable.

AFS licensees must monitor compliance with each applicable requirement on an ongoing basis under RG 166.

Distinguishing Brokers and Intermediaries From APRA Regulated Insurers

RG 166 applies to AFS licensees, including insurance brokers and other intermediaries, subject to the exclusions in RG 166.2.

Bodies regulated by APRA that are not required to comply with Section 912A(1)(d) of the Corporations Act are excluded from ASIC’s financial requirements under RG 166.4–166.5. A related body corporate that is not itself APRA-regulated may still remain subject to the AFS licensee obligations under RG 166.6.

APRA Capital Adequacy Requirements Under GPS 110, LPS 110 and HPS 110

APRA-regulated insurers are subject to prudential capital requirements rather than the financial resource framework that applies to many AFS licensees under RG 166. The relevant capital adequacy standards identified for the insurance industry are:

• GPS 110 for general insurers;
• LPS 110 for life companies.; and
• HPS 110 for private health insurers, made under Section 92(1) of the Private Health Insurance (Prudential Supervision) Act 2015 (Cth).

These standards form part of the prudential compliance framework for regulated insurers. HPS 110, for example, requires private health insurers to maintain an Internal Capital Adequacy Assessment Process and meet minimum capital requirements.

When Do AML/CTF Obligations Apply to Australian Insurance Businesses?

Which Insurance Services Are Designated Services Under the AML/CTF Act?

Under Section 6(2), table 1, items 37–39 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (‘AML/CTF Act‘), designated insurance services include:

• issuing, or undertaking liability as an insurer under, a life insurance or sinking fund policy (item 37);
• accepting premiums as the insurer under either type of policy (item 38); and
• making payments under either type of policy as the insurer (item 39).

General insurance is not a designated service under these items. Item 54 separately covers an AFSL holder that arranges for a person to receive a designated service, as explained below.

A business providing a designated service with a geographical link to Australia is a reporting entity. Its AML/CTF compliance framework must apply before the business starts providing that designated service. The program must be:

• documented;
• approved by a senior manager; and
• followed in daily operations.

When Do Insurance Brokers and Intermediaries Have AML/CTF Obligations?

Holding an AFSL does not, by itself, make an insurance business a reporting entity. Under item 54 of table 1 to Section 6 of the AML/CTF Act, an AFSL holder that makes arrangements for a person to receive a designated service, such as a life insurance policy, provides a designated service itself. A broker arranging life insurance for a client may therefore be a reporting entity, while a broker arranging only general insurance generally is not.

Where all of a reporting entity’s designated services are covered by item 54, Section 26T of the AML/CTF Act applies modified program requirements. Its AML/CTF policies need only deal with initial customer due diligence and be appropriate to the money laundering, terrorism financing and proliferation financing (ML/TF/PF) risks it may reasonably face. Several requirements do not apply, including the governance and independent evaluation requirements in Section 26F(4) and the governing body oversight duties in Section 26H.

What Should an Australian Insurance AML/CTF Framework Include?

ML/TF/PF Risk Assessments and Customer Due Diligence

For a reporting entity, the reformed framework in force from 31 March 2026 requires an AML/CTF program that identifies, assesses and manages ML/TF/PF risks.

Key controls include:

• Customer due diligence: Identify customers, assess customer risk and maintain relevant information.
• Transaction monitoring: Monitor customer activity for unusual transactions or behaviour.
• Suspicious matter reporting: Report suspicious matters where the reporting obligations apply.

The risk assessment should reflect the nature, size and complexity of the insurance business. Its findings should shape the AML/CTF policies, procedures, systems and controls used for insurance compliance.

AML/CTF Governance and Compliance Responsibilities

Unless the modified item 54 requirements apply, the reporting entity’s AML/CTF policies must deal with governance responsibilities. The reporting entity must:

• identify a governing body;
• appoint an AML/CTF compliance officer to oversee day-to-day compliance; and
• obtain senior manager approval for the AML/CTF program.

The policies must also provide for due diligence and training for personnel who perform functions relevant to the business’s AML/CTF obligations. Under Section 26H(1), the governing body must exercise appropriate ongoing oversight of the business’s ML/TF/PF risk assessment and its compliance with its AML/CTF policies, the AML/CTF Act and the AML/CTF Rules.

Independent Evaluations and AML/CTF Program Reviews

Under Section 26F(4)(f) of the AML/CTF Act, independent evaluations must be conducted at a frequency appropriate to the nature, size and complexity of the insurance business, and at least once every three years. This requirement does not apply to reporting entities whose only designated services fall under item 54, because Section 26T disapplies Section 26F(4).

The Anti-Money Laundering and Counter-Terrorism Financing Transitional Rules 2026 set different deadlines for the first independent evaluation, depending on the entity’s enrolment status, prior review history and AUSTRAC account number.

Under Section 26D of the AML/CTF Act, reporting entities must review their ML/TF/PF risk assessment when specified changes occur and at least once every three years, and their AML/CTF policies must provide for reviews and updates in those circumstances. This includes reviewing:

• the ML/TF/PF risk assessment;
• AML/CTF policies;
• internal controls; and
• compliance procedures.

How Should Australian Insurance Businesses Maintain Their Compliance Frameworks?

Regular Risk Assessments and Compliance Reporting

Australian insurance businesses should:

• conduct regular risk assessments;
• monitor capital requirements applicable to the business;
• review internal controls; and
• maintain compliance reporting.

Under CPS 230, controls must be tested at a frequency suited to the risks being controlled, with results reported to senior management. Material weaknesses must be included in the operational risk profile until remediation is complete.

Reviewing Frameworks Following Business or Regulatory Changes

A compliance framework should be reviewed when an insurer changes its products, services, business structure, technology or service provider arrangements. Under CPS 230, an APRA-regulated entity must assess how new products, services, geographies and technologies affect its operational risk profile.

Conclusion

Australian insurance businesses need a compliance framework that reflects their activities, structure and regulatory status. Requirements administered by ASIC, APRA and AUSTRAC apply differently to insurers, brokers, intermediaries and reporting entities.

For insurance businesses reviewing these obligations, contact AFSL House for risk, capital and AML/CTF compliance support for insurance businesses. To identify applicable compliance requirements, strengthen governance and support effective compliance management, contact AFSL House’s lawyers for AFSL compliance and regulatory support.

Frequently Asked Questions

Disclaimer: All information provided in this article is strictly general in nature and is not intended to be, nor should it be relied upon as, legal advice.

Australian insurance businesses that provide financial services to retail clients must maintain a dispute resolution system under the Corporations Act 2001 (Cth) (‘Corporations Act‘). That system includes an internal dispute resolution (IDR) procedure meeting the Australian Securities and Investments Commission’s (ASIC) enforceable requirements in Regulatory Guide 271 Internal Dispute Resolution (‘RG 271’) and membership of the Australian Financial Complaints Authority (AFCA).

These requirements affect insurers and intermediaries that handle customer complaints, including how they identify and record complaints, respond within the usual 30 calendar days, report IDR data to ASIC, and maintain complaints policies and processes. This article explains the compliance obligations, exceptions for delayed responses, external dispute resolution rights, and lessons from ASIC’s Report 802.

What Complaints Handling Obligations Apply to Insurance Businesses?

Understanding Section 912A of the Corporations Act

Under Section 912A(1)(g) of the Corporations Act, a financial services licensee providing financial services to retail clients must have a dispute resolution system. Under Section 912A(2)(a) of the Corporations Act, that system must include an IDR procedure covering complaints connected with all financial services provided under the licence.

The IDR procedure must comply with the standards and requirements made or approved by ASIC, and firms unsure how to meet those obligations can seek advice from AFSL compliance and regulatory lawyers. RG 271 contains both enforceable requirements, which are given legal effect by Section 5 of ASIC Corporations, Credit and Superannuation (Internal Dispute Resolution) Instrument 2020/98, and ASIC’s guidance on good practice. Under Section 912A(2)(c) of the Corporations Act, the dispute resolution system must also include membership of the AFCA scheme.

Distinguishing Obligations for Insurers, Brokers and Claims Handling Providers

The obligations apply to financial services licensees that provide services to retail clients, including insurance companies and insurance brokers. Each relevant licensee must:

• maintain an IDR procedure covering complaints about the financial services provided under its licence; and
• hold AFCA membership through the AFCA scheme.

Section 912A(1)(ca) of the Corporations Act also addresses representatives of a licensee. A licensee must take reasonable steps to ensure its representatives comply with financial services laws, subject to an exception for persons providing goods or services to insured persons to satisfy an insurer’s liability where those laws relate to claims handling and settling services. This distinction matters where claims handling providers act on behalf of an insurance company.

What Must an Insurance Internal Dispute Resolution Framework Include?

Identifying, Recording and Investigating Complaints Under ASIC RG 271

Under RG 271.27–RG 271.29, any expression of dissatisfaction that falls within the RG 271 definition of a complaint must enter the IDR process, even if the customer does not use the word “complaint”. ASIC also recommends that insurers take a proactive approach to identifying complaints (RG 271.30).

An insurance company must record every complaint it receives under RG 271. The complaints process should then support appropriate investigation, escalation and resolution, rather than requiring the customer to repeat the same concern to multiple staff members.

ASIC Report 802 found that insurers failed to identify one in six customer complaints, denying those customers access to the protections of the IDR framework.

Establishing Complaints Policies, Staff Responsibilities and Recordkeeping

Under RG 271.172, an insurance company must have a complaints policy that is publicly available and readily accessible, an internal procedure for managing complaints, and information about its IDR process that is available to complainants free of charge.

Insurers must also have adequate resources and give staff appropriate authority to resolve complaints (RG 271.142–RG 271.143 and RG 271.146–RG 271.147). In addition, ASIC expects staff to understand their responsibilities within the complaints process and receive suitable training (RG 271.145 and RG 271.148–RG 271.150).

Section 912A(1)(f) of the Corporations Act requires a financial services licensee to ensure its representatives are adequately trained and competent to provide the licensed financial services.

Complaint records should capture the outcome provided, when it was delivered and relevant information about the issues, products, services and remedies involved. ASIC Report 802 found that many insurers could not record when outcomes were provided, or capture more than one issue or outcome for a complaint, limiting the firm’s ability to monitor delays and identify matters affecting more than one consumer.

What Are the Timeframes for Resolving Insurance Complaints?

The General 30 Calendar Day IDR Response Requirement

Under RG 271.56, an insurer must generally provide a written IDR response within 30 calendar days of receiving a complaint. However, RG 271.71 allows certain complaints resolved or closed within five business days to be handled without a written response. Under RG 271.75, a written response is still required for complaints about declined insurance claims or claim values, or where the customer requests one. Separate exceptions for complex complaints or circumstances beyond the insurer’s control apply under RG 271.64–RG 271.66.

The written response must:

• state the final outcome;
• explain the complainant’s right to escalate the complaint to AFCA; and
• provide AFCA’s contact details.

If the insurance company rejects the complaint in full or part, the response must also address the issues raised, explain the reasons for the decision, and identify the findings and information relied upon under RG 271.53–RG 271.54 and RG 271.112.

Managing Exceptions, Delay Notifications and AFCA Escalation Rights

A complaint may fall outside the 30-calendar-day response timeframe where resolving it is complex or circumstances beyond the insurer’s control prevent resolution. Under RG 271.64–RG 271.66 and RG 271.112, the insurer must send a written delay notification explaining the reason for the delay and informing the complainant of their right to take the complaint to AFCA.

Public holidays, late allocation of a complaint, staff leave, workflow problems, or resource constraints do not, by themselves, extend the timeframe. ASIC Report 802 found that all reviewed insurers failed to provide some delay notifications within the required period, while some notifications did not explain the delay or disclose the right to external dispute resolution.

When Can Insurance Complaints Be Escalated to AFCA?

AFCA membership gives eligible customers access to an external dispute resolution process when their complaint is not resolved through the insurer’s IDR process. AFCA Limited operates the scheme on a not-for-profit basis, with an independent chair and equal representation of industry and consumer experience on its board.

Circumstances for Referring Unresolved Complaints to AFCA

A customer may take a complaint to AFCA where the insurer:

• rejects the complaint;
• does not provide an IDR response within 30 calendar days; or
• issues a delay notification.

Under RG 271, a written IDR response must explain the customer’s right to escalate the complaint to AFCA and provide AFCA’s contact details.

A delay notification must also state the reason for the delay, explain the customer’s right to external dispute resolution and provide AFCA’s details. An insurer’s complaints policy should not suggest that a customer must complete every stage of the internal complaints process before contacting AFCA.

How Can Insurance Businesses Maintain Complaints Handling Compliance?

Monitoring Complaints, Root Cause Analysis and IDR Data Reporting

Under RG 271.118–RG 271.120, insurers must identify, escalate and manage systemic issues arising from complaints, being issues that affect, or may affect, more than one consumer. ASIC also recommends that businesses regularly review complaint outcomes and examine underlying causes as part of continuous improvement (RG 271.186–RG 271.197). Complaint data can reveal recurring problems with products, services, claims handling or internal processes. Staff training, integrated systems and controls for tracking outcome implementation can help identify delays and emerging issues.

Under Section 5 of the ASIC Corporations (Internal Dispute Resolution Data Reporting) Instrument 2022/205 (Cth) (‘IDR Data Reporting Instrument’), a financial services licensee must provide ASIC with IDR information within two months after each six-month reporting period ending on 30 June or 31 December. The information must be submitted through ASIC’s Regulatory Portal in CSV format. A licensee with no reportable complaints must submit a confirmation to ASIC through the same portal.

Addressing Common Compliance Failures Identified in ASIC Report 802

ASIC’s Cause for complaint: Complaints handling in general insurance Report 802 identified failures that insurance businesses should test against their own complaints process. During ASIC’s review of 11 general insurers, businesses:

• failed to identify 1 in 6 customer complaints;
• often failed to identify systemic issues from complaints data;
• omitted required information from 1 in 8 written responses rejecting complaints; and
• failed to include required information in 1 in 5 delay notifications.

All reviewed insurers provided some delay notifications late. Insurance businesses should check whether staff identify every complaint, whether records capture each issue and outcome, and whether communications meet RG 271 requirements.

Conclusion

Insurance businesses providing financial services to retail clients must maintain an IDR system under the Corporations Act and RG 271, including AFCA membership, timely responses, accurate records and IDR data reporting. ASIC Report 802 showed that missed complaints, weak communication, delayed notifications and failures to identify systemic issues remain significant compliance concerns.

To strengthen your complaints process, contact AFSL compliance lawyers at AFSL House for assistance with IDR policies and complaints handling frameworks and AFSL compliance arrangements. Our regulatory and compliance specialists can help your insurance business assess its procedures, address gaps and support consistent handling of customer complaints.

Frequently Asked Questions

Disclaimer: All information provided in this article is strictly general in nature and is not intended to be, nor should it be relied upon as, legal advice.

Australian insurance businesses may be required to prepare or provide disclosure documents under Chapter 7 of the Corporations Act 2001 (Cth) (‘Corporations Act’), including a Product Disclosure Statement (PDS) for retail clients, a Financial Services Guide (FSG) from the providing entity, and a Target Market Determination (TMD) made publicly available by the insurer. These documents serve different purposes, with obligations varying between insurers, brokers, distributors, retail clients and wholesale clients.

The requirements also extend to insurance policy wordings, timing, content, exemptions and website disclosure information. This article explains who prepares each document, when it must be provided, and how the rules apply to Australian insurance businesses managing insurance policies and other financial products.

Which Disclosure Documents Do Australian Insurance Businesses Need?

The disclosure documents an insurance business needs depend on its role, the insurance product and whether its clients are retail or wholesale clients. The main documents are:

• PDS: Explains the insurance product, including its features, benefits, risks and costs.
• FSG: Explains the financial services offered by an insurer, broker or other providing entity.
• TMD: Identifies the intended target market and sets out conditions governing the distribution of the insurance product.
• Other documents: Certain insurance products may require additional documents, such as Key Facts Sheets or statutory notices.

A PDS and FSG are generally given to retail clients. A TMD, by contrast, must be prepared and made publicly available, but it is not ordinarily provided to clients as a disclosure document.

Navigating Chapter 7 of the Corporations Act

Chapter 7 of the Corporations Act establishes disclosure obligations for businesses providing financial services. For insurance businesses, the main documents include:

• the PDS, prepared by the insurer or other product issuer; and
• the FSG, given by the Australian financial services (AFS) licensee or authorised representative providing the service.

Under Sections 941A and 941B of the Corporations Act, a providing entity must generally give an FSG to a retail client before providing a financial service.

Under Sections 1012A–1012C of the Corporations Act, a product issuer or seller must generally give a PDS at or before recommending, issuing or selling a financial product to a retail client.

Distinguishing Retail Versus Wholesale Insurance Obligations

Retail client status determines whether the PDS and FSG obligations apply. Section 761G(5) of the Corporations Act treats certain general insurance products as retail products, including insurance commonly used for personal purposes, such as:

• car insurance;
• home and contents insurance;
• contents insurance; or
• landlord insurance.

Wholesale clients generally do not need to receive a PDS or FSG. A broker may provide financial services as an AFS licensee or authorised representative, while the insurer usually prepares the PDS as product issuer. The providing entity remains responsible for the FSG, subject to applicable exemptions, including claims handling that does not involve representing the client in pursuing an insurance claim under Section 941C(7A) of the Corporations Act.

What Must Australian Insurers Disclose in Product Disclosure Statements?

Key Content Requirements for a Product Disclosure Statement

The insurer, as product issuer, must prepare the PDS or arrange for it to be prepared.

Under Section 1013D of the Corporations Act, the PDS must contain enough important information for a retail client to make an informed decision. Depending on the product, this includes:

• Product features, benefits and risks
• Premiums, fees, exclusions and tax implications
• Cooling-off rights, dispute resolution and access to further information

The Corporations Act also sets out specific requirements for the form and content of a PDS. The PDS must:

• identify the issuer and, for a sale PDS, the seller (Section 1013D(1)(a));
• describe significant benefits, risks and costs, including how benefits may be provided and, where relevant, factors affecting returns (Sections 1013D(1)(b)–(f));
• carry the title “Product Disclosure Statement” on the cover or at or near the front (Section 1013B(1));
• be dated (Section 1013G); and
• be worded and presented in a clear, concise and effective manner (Section 1013C(3)).

Australian Securities and Investments Commission (ASIC) Regulatory Guide 168 (RG 168.6–168.8) explains how ASIC applies these requirements in practice, including its expectations for clear, concise and effective disclosure.

PDS Timing Rules and Applicable Exemptions

As noted above, a PDS must generally be given at or before the relevant recommendation or offer. However, under Section 1012G of the Corporations Act, a PDS may be provided later in certain time-critical situations where the client expressly requests immediate advice or issue of an eligible product and the statutory conditions are met. The required product information must first be given orally under Section 1012G(3)(a). The PDS must then be provided as soon as practicable, and no later than the applicable confirmation time or the end of the fifth day after the product was issued or sold, whichever occurs first.

A PDS may not be required in limited circumstances under the Corporations Act, including:

• Existing information: reasonable grounds exist to believe the client already received or could access all required information under Section 1012D(1)–(2).
• Interim insurance: the product is an interim contract of insurance under Section 1012D(9).
• Solicited insurance calls: certain general insurance offers made during a solicited phone call meet the conditions in Section 1012GA(1).
• Renewals: the client receives a Supplementary PDS containing information not included in the original PDS.

What Must Insurance Businesses Include in a Financial Services Guide (FSG)?

Essential FSG Content for Brokers and Licensees

The FSG helps the client decide whether to obtain services from the providing entity.

Under Sections 942B and 942C of the Corporations Act, the FSG must contain information such as:

• Services: the financial services likely to be provided and the relevant financial products.
• Remuneration: commissions, benefits, referral payments and how remuneration is calculated.
• Relationships: associations or relationships with financial product issuers that could influence the service.
• Complaints: the dispute resolution system and how it can be accessed.
• Entity details: names, contact details and relevant licence or authorised representative numbers.
• Binder arrangements: if services are provided under a binder, the FSG must identify those services, state that they are provided under a binder and explain the significance of that arrangement.

The FSG must be worded and presented in a clear, concise and effective manner. It must not contain misleading or deceptive material.

FSG Timing, Exemptions and Website Disclosure Alternatives

Under Section 941D(1) of the Corporations Act, an FSG must generally be given as soon as practicable after it becomes apparent that a financial service will be provided, and before the service is provided. A later FSG may be permitted in a time-critical situation where the client requests immediate service, it is not reasonably practicable to provide the FSG beforehand, and the FSG is given as soon as practicable, no later than five days after the service.

An FSG is not required for certain services, including the claims handling and settling services exemption described above under Section 941C(7A) of the Corporations Act.

Website disclosure information may be used instead of giving an FSG for financial product advice or dealing that implements that advice. Under Section 941C(5A) of the Corporations Act and ASIC Corporations (Financial Services Guide, General Advice Warning and Advertising Related Relief) Instrument 2025/234 (‘ASIC Instrument 2025/234’), the information must:

• contain the required FSG statements;
• be readily accessible on the providing entity’s website; and
• remain up to date with the preparation or last-updated date shown.

Can Insurers Combine a PDS and FSG?

A general insurance PDS and FSG may be combined in specified circumstances. This can apply where the providing entity is the product issuer, or an authorised representative or related body corporate of the issuer, for a general insurance product. Under Regulation 7.7.08A of the Corporations Regulations 2001 (Cth) (‘Corporations Regulations’), the combined document must be divided into identifiable FSG and PDS parts, titled “Combined Financial Services Guide and Product Disclosure Statement”, and given at the earlier of the required FSG or PDS time.

What Are the Target Market Determination (TMD) Requirements for Insurers?

Understanding Part 7.8A and Section 994B

Part 7.8A of the Corporations Act requires the product issuer, including an insurer issuing the relevant insurance product, to prepare a TMD before retail product distribution conduct begins.

Under Section 994B of the Corporations Act, the TMD must:

• be in writing;
• describe the target market;
• set distribution conditions;
• identify review triggers;
• specify review periods; and
• state the information distributors must report.

A TMD must also be made publicly available free of charge under Section 994B(9) of the Corporations Act. ASIC Regulatory Guide 274 explains that public access does not make a TMD a client disclosure document. A TMD is not given to clients as a substitute for a PDS, which remains the relevant disclosure document for retail clients.

Target Markets, Distribution Conditions and Review Triggers

An insurer must describe the target market using objective characteristics connected to likely objectives, financial situation, needs, and the product’s key attributes.

In addition to the distribution conditions, review triggers and review periods described above, the TMD must state complaint reporting periods and other information required from distributors under Section 994B(5) of the Corporations Act.

Insurance brokers are not automatically responsible for preparing the insurer’s TMD. A broker acting as a distributor must take reasonable steps under Section 994E(3) of the Corporations Act to ensure retail product distribution conduct is consistent with the TMD.

Review triggers may include:

• changes to policy features;
• claim outcomes;
• lapse or cancellation rates;
• complaints; or
• distribution outside the target market.

What Other Insurance Disclosure and Policy Documents Are Required?

Policy Wordings and Insurance Contracts Act Notices

Insurance policy wordings must reflect the applicable rules under the Insurance Contracts Act 1984 (Cth) (‘Insurance Contracts Act’). Since 5 October 2021, a consumer insurance contract carries a duty to take reasonable care not to make a misrepresentation under Section 20B of the Insurance Contracts Act, rather than the traditional duty of disclosure.

The traditional duty of disclosure continues for insurance contracts that are not consumer insurance contracts under Section 21 of the Insurance Contracts Act. Under Section 22 of the Insurance Contracts Act, the insurer must clearly inform the insured in writing about the general nature and effect of that duty before the contract is entered into.

When Should Insurers and Brokers Review Their Disclosure Documents?

Insurers and brokers should review their PDSs, FSGs, TMDs and policy wordings whenever a change could affect the accuracy or completeness of the information they contain. Common review triggers include:

• changes to product features, policy terms, exclusions or benefits;
• changes to premiums, fees, excesses or other costs;
• new distribution channels, distributors, authorised representatives or binder arrangements;
• changes to the services, remuneration, associations or contact details disclosed in an FSG;
• complaints, claims outcomes or distributor reports suggesting the product is not reaching its target market; and
• changes to legislation, regulations, ASIC instruments or regulatory guidance.

For TMDs, the review should also follow the review triggers and review periods set under Section 994B(5)(d)–(f) of the Corporations Act. Under Section 994C, the insurer must review the TMD when an event or circumstance reasonably suggests that it may no longer be appropriate.

Where a document is no longer accurate, a supplementary or replacement document may be required, and financial services compliance and regulatory advice for insurers and brokers can help determine what updates are required.

Conclusion

Accurate disclosure documents help Australian insurers, brokers and distributors meet their obligations under the Corporations Act, including requirements for PDSs, FSGs and TMDs, making it sensible to contact AFSL compliance lawyers at AFSL House for insurance businesses for regulatory support. Insurance policies must also reflect the applicable requirements under the Insurance Contracts Act, including the duty to take reasonable care not to make a misrepresentation for consumer insurance contracts.

With these requirements in mind, insurers and insurance brokers can contact AFSL House for assistance drafting and reviewing PDSs, FSGs, TMDs and policy wordings. AFSL House provides clear regulatory and compliance support for accurate insurance documents, including Insurance disclosure document drafting and compliance support.

Frequently Asked Questions

Disclaimer: All information provided in this article is strictly general in nature and is not intended to be, nor should it be relied upon as, legal advice.

Australian insurance businesses need an Australian Financial Services Licence (AFSL) where they provide a financial service such as advice, dealing, or claims handling and settling. An AFSL strategy should reflect the business’s products, services, distribution arrangements, client types, and plans for growth.

Licensing may involve an independent AFSL, appointment as an authorised representative of another licensee, or applicable exemptions and relief, including ASIC Corporations (Basic Deposit and General Insurance Product Distribution) Instrument 2025/520 (‘ASIC Instrument 2025/520’). This article explains how insurers, brokers, underwriting agencies, distributors, InsurTech businesses, and claims management providers can assess authorisations, compliance requirements, and the distinction between AFSL obligations administered by the Australian Securities and Investments Commission (ASIC) and Australian Prudential Regulation Authority (APRA) authorisation for insurance business.

When Do Insurance Businesses Need an AFSL?

Understanding AFSL Requirements Under the Corporations Act 2001 (Cth)

Running a financial services business generally requires an AFSL. Under Section 911A of the Corporations Act 2001 (Cth) (‘Corporations Act’), a business providing financial services to clients must be authorised under an AFSL unless an exemption applies. Section 766A of the Corporations Act identifies activities treated as a financial service.

Activities that may require an AFSL include:

• Providing financial product advice, including recommendations about insurance products.
• Dealing in a financial product.
• Providing claims handling and settling services.

Claims handling and settling services have been regulated under the AFSL regime since 1 January 2022. These services can include:

• Assisting with a claim.
• Assessing an insurer’s liability.
• Deciding whether to accept or reject a claim.
• Quantifying liability.
• Offering to settle a claim.

How Products, Services and Distribution Arrangements Influence Licensing

The products offered and the services performed by an insurance business affect its licensing requirements. Financial products include life insurance and general insurance, while private health insurance is dealt with under the Private Health Insurance Act 2007 (Cth) (‘Private Health Insurance Act’) rather than treated as an AFSL product for this licensing strategy.

The business model also matters. A broker, underwriting agency, distributor, InsurTech business, or claims management provider may perform different financial services, such as personal advice, dealing, or claims handling. Those activities, together with the distribution arrangement, determine whether the business needs its own AFSL, operates as an authorised representative, or relies on an available exemption.

Distinguishing an AFSL from APRA Authorisation

An AFSL authorises financial services such as advice, dealing, or claims handling. It regulates the services provided in connection with financial products, including life insurance and general insurance.

APRA authorisation addresses a different activity. Under the Insurance Act 1973 (Cth) (‘Insurance Act’), a business carrying on insurance business by undertaking liability by way of insurance requires proper authority from APRA. The definition includes liability connected with loss or damage, subject to stated exclusions such as life insurance, health insurance, and funeral benefits.

Which AFSL Licensing Structure Is Right for an Insurance Business?

Once an insurance business has identified the financial services it provides, it can generally choose between three structures: holding its own AFSL, operating as an authorised representative of another licensee, or distributing products under ASIC relief. The right choice depends on the business model, the level of control required and the compliance responsibility the business is prepared to take on.

Obtaining an Independent AFSL versus Operating as an Authorised Representative

An insurance business can hold its own AFSL or provide a financial service as an authorised representative of an existing AFS licensee. Under Section 916A of the Corporations Act, an authorised representative operates under the appointment of that licensee.

An independent AFSL gives the business direct responsibility for its licensing obligations, compliance arrangements and operational decisions, so businesses assessing this structure can speak with insurance AFSL lawyers and licensing advisers.

Operating as an authorised representative can be faster and less costly to establish, because the licensee holds the AFSL and is responsible for its representatives’ conduct under Division 6 of Part 7.6 of the Corporations Act. However, the business can only provide the services covered by the licensee’s authorisation, and it depends on the licensee’s appointment continuing.

Relying on Applicable Exemptions and ASIC Relief

Certain exemptions may affect whether an insurance business needs an independent AFSL or an authorised representative appointment. Under ASIC Instrument 2025/520, eligible distributors may deal in specified basic deposit, general insurance or bundled consumer credit insurance products without being appointed as authorised representatives.

The distributor must act under a licensee’s written authorisation, and the specified conditions must be met. The licensee must also take reasonable steps to ensure retail clients receive information about its dispute resolution system and, for relevant insurance products, written information about whom the distributor acts for and any remuneration or benefits. The relief does not cover financial product advice or remove the licensee’s consumer protection obligations under the Corporations Act. The instrument is repealed at the start of 1 October 2030.

Key Considerations for Choosing a Licensing Structure

The appropriate licensing structure depends on the business model, the financial service provided and the level of control the business needs over its operations. Key considerations include:

• Regulatory responsibility: whether the business will manage its own AFSL compliance or operate under another licensee.
• Costs: the financial effect of maintaining an independent licence, an authorised representative arrangement or relevant relief.
• Operational control: the business’s ability to control its services, distribution arrangements and future expansion.

The structure should reflect current operations and anticipated growth, including changes to products, services or distribution arrangements.

How Should Australian Insurance Businesses Determine Their AFSL Authorisations?

Authorisations for Insurance Advice Dealing Distribution and Claims Handling

An AFSL should reflect each financial service provided by the business, such as financial product advice, dealing, or claims handling and settling services.

An insurance business must hold the appropriate AFSL authorisation for each of these services, including claims handling and settling services under Section 766G of the Corporations Act.

Distinguishing General Insurance Life Insurance and Client Types

The required authorisation also depends on the insurance product involved. Financial products include general insurance and life insurance, so an insurance broker or other financial service provider should identify the product types covered by its services before selecting its AFSL authorisations.

The client classification also affects the authorisation structure. A business should identify whether it provides services to retail clients, wholesale clients, or both. These classifications should match the business model, the products offered, the advice or dealing services provided, and the relevant compliance arrangements.

What Should an Insurance AFSL Application Include?

Demonstrating Organisational Competence and Financial Resources

Under Section 913B of the Corporations Act, ASIC must grant an AFSL application only if it has no reason to believe the applicant is likely to contravene its general obligations under Section 912A, the applicant satisfies the fit and proper person test, and any other prescribed requirements are met. An insurance applicant should therefore show:

• Organisational competence: responsible managers with knowledge and skills relevant to the insurance products and services sought, such as general insurance advice or claims handling, as explained in ASIC Regulatory Guide 105.
• Financial resources: adequate financial resources to provide the proposed services and carry out supervisory arrangements, as set out in Regulatory Guide 166.
• Compliance and risk management: arrangements for monitoring compliance, managing conflicts of interest and supervising representatives or distributors.
• Dispute resolution and compensation: internal dispute resolution procedures, Australian Financial Complaints Authority membership and, for retail clients, adequate compensation arrangements such as professional indemnity insurance under Section 912B.

Applications must be submitted through the ASIC Regulatory Portal. The application should also explain how the applicant will meet its compliance arrangements as an AFS licensee.

Meeting ASIC Assessment Requirements and Common Application Challenges

For insurance applicants, common issues include seeking authorisations that do not match the proposed services (for example, omitting claims handling or the relevant product classes), responsible managers whose experience does not cover the insurance products sought, and gaps in arrangements for supervising representatives or distributors.

The application must provide correct and complete information about the proposed AFS business, including the arrangements supporting its operation.

An incomplete or incorrect application may be returned or refused. ASIC may also request further information, creating delays while the application is assessed. A careful review of the application before submission can help identify missing information or inconsistencies.

When Should an Australian Insurance Business Review Its AFSL Strategy?

Addressing New Insurance Products Expanded Services and Business Restructuring

An insurance business should review its AFSL strategy when it introduces new insurance products, expands its financial services, changes distribution arrangements, or restructures its business. These changes may affect the business’s AFSL, authorisations, compliance arrangements, or relationship with an authorised representative or licensee.

The review should assess whether the licensing structure remains suitable for current operations and planned business growth. This includes checking whether the business:

• provides advice;
• deals in financial products; or
• provides claims handling and settling services.

Determining When an AFSL Variation or Additional Authorisation is Required

An insurance business may need an AFSL variation under Section 914A of the Corporations Act when its activities change beyond the scope of its existing authorisations. An additional authorisation may also be required where the business begins providing a financial service not already covered by its AFSL.

Conclusion

An effective AFSL strategy should reflect an insurance business’s products, services, distribution arrangements and client types. Choosing between an independent AFSL, an authorised representative arrangement or available relief, while separating AFSL obligations from APRA authorisation, helps the business manage compliance as operations and growth plans change.

For support with that process, contact AFSL strategy and licensing support for insurance businesses from AFSL House’s lawyers. Its team can assist insurance businesses with AFSL applications, authorisations and variations so the licensing structure fits the business model.

Frequently Asked Questions

Disclaimer: All information provided in this article is strictly general in nature and is not intended to be, nor should it be relied upon as, legal advice.

Australian lenders and mortgage brokers must maintain governance, risk management and compliance frameworks suited to their credit activities and regulatory obligations, with governance, risk, and compliance support for lenders and mortgage brokers available where needed. Australian Credit Licence (ACL) holders must meet Section 47 of the National Consumer Credit Protection Act 2009 (Cth) (‘NCCP Act‘), while anti-money laundering and counter-terrorism financing (AML/CTF) duties depend on the designated services provided rather than ACL status.

Under the reformed AML/CTF framework, existing reporting entities generally became subject to the new program requirements on 31 March 2026, while newly regulated professional designated services became subject to AML/CTF obligations on 1 July 2026. Relevant businesses must address money laundering, terrorism financing (ML/TF) and proliferation financing risks through written policies, customer due diligence, transaction monitoring and suspicious matter reporting. This article explains the governance and risk management obligations of ACL holders, when AML/CTF obligations apply to lenders and mortgage brokers, what an AML/CTF program must include and how to keep compliance frameworks up to date.

What Governance and Compliance Frameworks Must ACL Holders Maintain?

Section 47 of the NCCP Act

Under Section 47(1)(a) of the NCCP Act, an ACL holder must take all necessary steps to conduct authorised credit activities efficiently, honestly and fairly. Section 47(1)(b) of the NCCP Act also requires adequate arrangements to ensure clients are not disadvantaged by conflicts of interest.

The statutory compliance arrangements must address:

• Competence and training: The licensee must maintain its own competence under Section 47(1)(f) of the NCCP Act, while ensuring representatives are trained and competent under Section 47(1)(g).
• Dispute resolution: Section 47(1)(h) of the NCCP Act requires an internal dispute resolution procedure.
• Representative supervision: Section 47(1)(e) requires reasonable steps to ensure representatives comply with credit legislation.
• Risk management: Unless regulated by the Australian Prudential Regulation Authority, Section 47(1)(l) requires adequate financial, technological and human resources, together with adequate risk management systems.

Governance Structures and Documented Compliance Policies

Section 47(1)(k) of the NCCP Act requires adequate arrangements and systems to ensure compliance with the obligations in Section 47, together with a written plan documenting those arrangements and systems. Section 47(2) of the NCCP Act requires adequacy to be assessed against the nature, scale and complexity of the licensee’s credit activities.

The Australian Securities and Investments Commission (ASIC) Regulatory Guide 205 Credit licensing: General conduct obligations (RG 205) is guidance, not a replacement for Section 47 of the NCCP Act. RG 205 describes compliance concepts, explains what ASIC considers when assessing compliance and provides questions to help licensees design and test their measures, while each licensee remains responsible for deciding how to comply.

Risk Management Systems and Internal Controls

As noted above, Section 47(1)(l) of the NCCP Act requires adequate risk management systems unless the licensee is regulated by the Australian Prudential Regulation Authority, assessed against the nature, scale and complexity of its credit activities under Section 47(2). RG 205 does not prescribe a particular risk management model, so recommended governance practices may add controls suited to the business but should not be presented as statutory requirements.

Risk assessments, compliance monitoring, conflicts management, complaints handling, internal controls and staff training can help a lender or mortgage broker manage its regulatory risks. In particular, the conflicts and training obligations in Section 47(1)(b) and (g) of the NCCP Act, discussed above, sit alongside the internal dispute resolution procedure required by Section 47(1)(h), which must cover disputes relating to the licensee’s credit activities or those of its representatives. Section 47(1)(j) of the NCCP Act also requires compensation arrangements in accordance with Section 48 of that statute, supporting consumer protection when a breach causes loss.

When Do AML/CTF Obligations Apply to Lenders and Mortgage Brokers?

The Designated Services Framework Under Section 6

AML/CTF obligations depend on the designated services a business provides under Section 6 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (‘AML/CTF Act‘), rather than its ACL status. A business providing a designated service with a geographical link to Australia is a reporting entity.

The financial services designated services include making loans or providing finance, including hire-purchase. A lender’s AML/CTF framework should therefore reflect:

• the finance services it provides;
• its ML/TF risks;
• its customers; and
• its systems and operations.

Distinguishing Reporting Entities From Exempt Businesses

Lenders are generally reporting entities because of the loan and finance designated services discussed above. This applies to commercial lenders even where they do not hold an ACL. Reporting entities must enrol with Australian Transaction Reports and Analysis Centre (AUSTRAC) and meet applicable AML/CTF obligations.

Mortgage brokers arranging consumer home loans are generally not reporting entities because those activities do not usually involve providing a designated service. However, from 1 July 2026, a broker may provide a designated service when assisting with debt or equity financing for a company, trust or similar legal arrangement. The broker’s compliance framework should therefore assess:

• the services provided;
• the customer type; and
• the relevant financing activity.

What Should an AML/CTF Framework Include?

Risk Assessments and Customer Due Diligence

From 31 March 2026, an AML/CTF program must be matched to the business, its designated services and its risks. The program must include a written assessment of money laundering, terrorism financing and proliferation financing risks, together with policies that manage those risks.

The framework should also address:

• Customer due diligence (CDD): procedures for identifying and assessing customers.
• Transaction monitoring: controls for reviewing customer activity.
• Suspicious matter reporting (SMR): processes for identifying matters that may require reporting to AUSTRAC.

Governance Responsibilities and Oversight

The AML/CTF program must include a governance structure with a governing body overseeing the program, an AML/CTF compliance officer coordinating day-to-day compliance, and a senior manager approving the program. The governing body must oversee ML/TF risk, AML/CTF policies and compliance with the AML/CTF Act.

The governing body must receive reports from the AML/CTF compliance officer at least once every 12 months covering compliance and risk management.

Independent Evaluations of AML/CTF Programs

Under Section 26F(4)(f) of the AML/CTF Act, a reporting entity’s AML/CTF policies must provide for independent evaluations of its AML/CTF program at a frequency that is appropriate to the nature, size and complexity of its business and is at least once every three years.

The Anti-Money Laundering and Counter-Terrorism Financing Transitional Rules 2026 (Cth) (‘AML/CTF Transitional Rules‘) set different deadlines for initial evaluations, depending on the entity’s enrolment status, prior review history and AUSTRAC account number.

How Should Businesses Maintain Their Compliance Frameworks?

Ongoing ACL Compliance Monitoring

An ACL holder must ensure representatives remain adequately trained and competent under Section 47(1)(g) of the NCCP Act, as discussed above. Ongoing monitoring should test whether the compliance framework continues to support the business’s credit activities, consumer protections and regulatory obligations.

Section 47(1)(k) of the NCCP Act requires the licensee to maintain adequate arrangements and systems to ensure compliance, together with a written compliance plan. Regular compliance monitoring, such as file reviews, representative audits and breach reporting reviews, is recommended practice for testing whether those arrangements remain adequate, rather than a separately prescribed statutory process.

Reviewing AML/CTF Risk Assessments and Policies

Under Section 26D of the AML/CTF Act, reporting entities must review their ML/TF risk assessments when specified changes occur and at least once every three years. Section 26F(3)(c)–(d) requires AML/CTF policies to address reviews and updates following changes to the risk assessment, other specified circumstances and periodic reviews at least once every three years. Rules 5-1 and 5-4 of the Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 also require reviews or updates following relevant adverse independent evaluation findings. Under Section 26H(1), the governing body must exercise appropriate ongoing oversight of AML/CTF compliance and risk management.

Addressing Common Compliance Gaps

Common compliance gaps include:

• failing to understand the risk assessment;
• failing to review compliance officer reports; and
• failing to question the root cause of ongoing compliance breaches.

AUSTRAC guidance identifies these matters as indicators of inappropriate AML/CTF oversight.

Under Section 26H of the AML/CTF Act, the governing body must also take reasonable steps to ensure the business identifies, assesses, manages and mitigates ML/TF risks. Effective oversight includes questioning adverse findings, reviewing control effectiveness and monitoring progress on actions addressing non-compliance.

Conclusion

Australian lenders and mortgage brokers need governance, risk management and compliance frameworks matched to their credit activities, consumer protections and regulatory obligations. ACL requirements, AML/CTF duties, risk assessments, CDD, transaction monitoring, reporting and ongoing reviews help businesses manage regulatory risks and ensure compliance.

Businesses seeking support can contact AFSL House to develop and maintain frameworks suited to their activities, customers and regulatory requirements. AFSL House can assist with governance, risk and AML/CTF compliance support for lenders and mortgage brokers, helping businesses protect consumers, maintain appropriate policies and monitor compliance across the Australian financial services sector.

Frequently Asked Questions

Disclaimer: All information provided in this article is strictly general in nature and is not intended to be, nor should it be relied upon as, legal advice.

Credit funds that on-lend pooled investor capital may need an Australian Credit Licence (ACL) before lending begins. Whether an ACL is required depends on the borrower, loan purpose, credit terms and lending activities. Under Section 5(1) of the National Credit Code in Schedule 1 to the National Consumer Credit Protection Act 2009 (Cth) (‘NCCP Act‘), the Code generally applies where the borrower is a natural person or strata corporation, the loan is wholly or predominantly for personal, domestic or household purposes or qualifying residential investment purposes, a charge is or may be made for the credit, and the credit is provided as part of a business carried on in Australia. Business lending generally falls outside the Code.

Wholesale investor capital raising does not decide the licensing outcome. Fund operators must identify the legal credit provider and select ACL authorisations for lending or arranging loans before lending starts; an Australian Financial Services Licence (AFSL) covers financial services, not a required ACL. This article explains when the National Credit Code applies to fund lending, which entity in a fund structure needs the ACL, how a credit fund applies for one, whether an AFSL is also required, and the obligations that apply once a licence is granted.

When Does a Credit Fund Need an Australian Credit Licence?

When Does the National Credit Code Apply to Fund Lending?

Section 5(1) of the National Credit Code in Schedule 1 to the NCCP Act generally applies where the borrower is a natural person or strata corporation and the credit is wholly or predominantly for personal, domestic or household purposes, or to purchase, renovate, improve or refinance qualifying residential investment property. The credit must also meet the charging and business requirements in Sections 5(1)(c)–(d), subject to the Code’s exclusions and special rules.

Under Sections 5(1)(c)–(d) of the National Credit Code, a charge must be or potentially be payable for the credit, and the credit must be provided as part of a business carried on in Australia, including where lending is incidental to another business. Section 6 also excludes certain kinds of credit even where Section 5 is otherwise satisfied. A credit fund lending to an individual borrower for a qualifying residential investment property loan may therefore be conducting regulated Australian credit business.

Commercial lending generally falls outside the National Credit Code when the loan is wholly or predominantly for business purposes. Business loans are not regulated under the NCCP Act, while lending to companies largely falls outside the Code because Section 5 applies to natural persons or strata corporations.

What Credit Activities Require an ACL?

A person must not engage in a credit activity without a licence authorising that activity under Section 29 of the NCCP Act. The civil penalty is 5,000 penalty units, while contravention can also constitute an offence carrying a maximum penalty of two years’ imprisonment.

Credit activities identified in Section 6 of the NCCP Act include:

• providing credit under a credit contract;
• exercising a credit provider’s rights or performing its obligations;
• suggesting or assisting a consumer to apply for a credit contract;
• acting as an intermediary between a consumer and credit provider;
• acting as a mortgagee or exercising a mortgagee’s rights in relation to a regulated mortgage; and
• acting as the beneficiary of a guarantee or exercising rights in relation to a regulated guarantee.

A credit fund operator may therefore need an ACL if it provides regulated credit, acts for the credit provider, or assists borrowers with regulated loans.

Does Raising Capital from Wholesale Investors Affect ACL Requirements?

The profile of the investors supplying capital does not determine whether a credit fund needs an ACL. Marketplace lending may involve retail or wholesale investors whose money is then lent to consumers or businesses, but the licensing question turns on the borrower and the loan purpose.

A fund raising money solely from wholesale investors may still need an ACL if its loans are regulated under Section 5 of the National Credit Code. Investor classification may be relevant to other regulatory requirements, such as those applying to the fund’s investment offering under the Corporations Act 2001 (Cth) (‘Corporations Act‘), but it does not, by itself, remove the credit licensing requirements applying to regulated lending.

Which Entity in a Credit Fund Structure Needs to Hold the ACL

Identifying the Legal Credit Provider

Under Sections 6(1) and 29(1) of the NCCP Act, the entity that legally enters the loan contracts with borrowers as the credit provider generally needs an ACL authorising that activity, unless an exemption applies. The relevant entity is identified by examining the lending documents, the fund structure, and the entity performing regulated credit activities.

A fund manager or platform may perform credit activities without being the lender of record. Those activities can include:

• performing a credit provider’s obligations on its behalf;
• suggesting or assisting a consumer to apply for a loan; or
• acting as an intermediary.

Under Sections 6–9 and 29(1) of the NCCP Act, that entity may need an ACL authorisation for credit activities other than as a credit provider, unless an exemption or permitted representative arrangement applies.

Common Credit Fund Structures and Their Licensing Requirements

The entity holding the ACL depends on how the credit fund is established. Possible structures include lending by:

• A fund trustee or responsible entity: The trustee or responsible entity may be the credit provider if it enters loan contracts for the fund.
• A custodian: A custodian may become the credit provider if it enters loan contracts as trustee for investors.
• A special purpose lending vehicle: The vehicle may need the ACL if it legally provides the credit.
• An investment manager or platform: The manager or platform may need an authorisation for other credit activities if it arranges loans or assists borrowers without entering the contracts as lender.

ASIC Information Sheet 213 (INFO 213) provides guidance on identifying the credit provider in marketplace lending arrangements:

• Where the fund operator enters loan contracts: If the marketplace lending provider enters loan contracts with borrowers as trustee for investors, it is the credit provider and generally needs an ACL authorisation to engage in credit activities as a credit provider.
• Where a custodian enters loan contracts: If a registered managed investment scheme uses a custodian to enter loan contracts as trustee for investors, the custodian is the credit provider. The marketplace lending provider may also need an ACL authorisation for credit activities other than as a credit provider.
• Where investors lend directly to borrowers: If the platform facilitates loans entered directly between investors and borrowers, the investors are the credit providers and may need an ACL. The platform may also require authorisation for other credit activities.

The entity named in the loan contracts should be compared with the entity operating the platform, managing investments, or holding scheme property. Different entities may have separate credit licensing responsibilities.

Selecting the Appropriate ACL Authorisations

Under Sections 29(1) and 35(1)–(2) of the NCCP Act, the required ACL authorisation must reflect the credit activities performed by each entity, unless an exemption or permitted arrangement applies.

• Credit provider authorisation: The entity that legally provides the credit generally needs an ACL authorising it to engage in credit activities as a credit provider. This may be the fund operator, trustee, custodian or special purpose lending vehicle.
• Authorisation for other credit activities: A fund manager or platform may need this authorisation where it does not legally lend the funds but performs other regulated activities, such as exercising a credit provider’s rights, performing its obligations, suggesting or assisting consumers to apply for loans, or acting as an intermediary.

The proposed lending structure should be assessed before applying for an ACL. The assessment should identify:

• the entity entering each loan contract;
• the entity performing credit provider obligations;
• any entity arranging or facilitating loans; and
• whether any entity suggests or assists a consumer to apply for credit.

The licence authorisations should then reflect those activities, rather than the fund’s investor base or business name. ASIC states that marketplace lending providers should examine the platform structure, the entities involved, their activities, which entities need a credit licence, and the authorisations those entities require.

How Australian Credit Fund Operators Apply for an ACL

ASIC Licensing Requirements Under the NCCP Act

ASIC’s licensing material states that a person engaging in credit activities will generally need an ACL or an authorisation from a credit licensee before starting business, with ACL applications for credit fund operators providing the relevant next step.

The application process should begin by identifying the proposed credit activities, checking whether the National Credit Code applies, and considering whether an exemption is available under the NCCP Act or the National Consumer Credit Protection Regulations 2010 (Cth) (‘NCCP Regulations‘).

For a credit fund, the first step is to confirm which entity in the structure will apply. This is usually the entity that legally enters the loan contracts, such as the trustee, custodian or special purpose lending vehicle, seeking the credit provider authorisation. A fund manager or platform that arranges loans or performs the credit provider’s obligations may need its own authorisation to engage in credit activities other than as a credit provider, as explained above.

ASIC Regulatory Guide 203 (RG 203) provides guidance on credit activities, licensing exemptions, and circumstances where a credit licence may not be required.

Competence and Financial Resource Assessments

Under Section 37(1) of the NCCP Act, ASIC must grant an ACL to an applicant other than an authorised deposit-taking institution only if it has no reason to believe the applicant is likely to contravene its obligations under Section 47, the fit and proper person test in Section 37A is satisfied, and any other prescribed requirements are met. ASIC guidance can assist applicants to demonstrate compliance, but the legal obligations arise from the NCCP Act.

For a credit fund, the application should explain how these obligations will be met within the proposed lending model:

• Responsible managers: the experience and competence supporting the fund’s proposed lending, such as residential investment lending, credit assessment and loan servicing.
• Financial resources: the resources available to operate the credit business, unless the applicant is regulated by the Australian Prudential Regulation Authority (APRA).
• Systems and governance: processes for credit assessment, managing conflicts between investors and borrowers, supervising any manager or platform acting on the fund’s behalf, and complying with credit legislation under Section 47(1)(d).
• Dispute resolution: an internal dispute resolution procedure and Australian Financial Complaints Authority (AFCA) membership.

These matters should match the activities, entities, and ACL authorisations identified in the proposed lending structure.

The Application Lodgement and Assessment Process

ASIC’s application process requires the applicant to review the available credit licensing guidance, identify the proposed credit activities, and check for applicable exemptions before lodging an application. The application should be supported by information that explains the business model, the entities involved, the proposed lending activities, and the authorisations sought. For a credit fund, ASIC will need to understand the fund structure, including which entity provides credit, which entities perform other regulated credit activities, and how responsibilities are allocated between the trustee or custodian, the fund manager and any platform.

ASIC may request further information while assessing the application. The applicant should respond to those requests with accurate material that remains consistent with the proposed Australian credit business, its credit licensee responsibilities, and its intended lending operations.

Does a Credit Fund Need Both an AFSL and an ACL?

Distinguishing the AFSL and ACL Regimes

An AFSL covers financial services connected with establishing and operating a credit fund. These services may include:

• operating a managed investment scheme;
• providing financial product advice;
• dealing in financial products; or
• providing custodial or depository services under the Corporations Act.

An ACL covers regulated credit activities under the NCCP Act. If a fund provides consumer loans through its platform, an AFSL does not replace the required ACL. As a result, the fund may need both licences for separate activities.

Managed Investment Schemes Under the Corporations Act

A managed investment scheme offered to retail investors must be registered with ASIC under Section 601ED of the Corporations Act, subject to the conditions in that provision. The scheme’s responsible entity must be a public company holding an AFSL authorising it to operate the scheme under Section 601FA of the Corporations Act.

The AFSL regime applies to the fund’s investment structure. It may cover activities such as:

• operating the registered scheme;
• dealing with scheme interests; and
• providing custodial or depository services.

Dual Licensing for Credit Fund Structures

A credit fund may require both an AFSL and an ACL where its structure involves financial services for investors alongside regulated lending to borrowers. The AFSL covers the investment side, while the ACL covers consumer credit activities under the NCCP Act.

The licensing outcome depends on the entities involved and the activities each entity performs. For example:

• a responsible entity may need an AFSL to operate a registered scheme;
• a custodian that enters consumer loan contracts as lender of record may need an ACL authorisation to engage in credit activities as a credit provider; and
• a fund manager or platform that arranges those loans may need an ACL authorisation for credit activities other than as a credit provider.

Compliance Obligations After Australian Credit Fund Operators Obtain an ACL

General Conduct Obligations Under the NCCP Act

Under Section 47(1) of the NCCP Act, an ACL holder must comply with the general conduct obligations applying to its licensed credit activities. These include:

• Competence: maintaining the competence needed to perform authorised credit activities and ensuring representatives are adequately trained.
• Resources: maintaining adequate financial, technological and human resources, unless the licensee is regulated by APRA.
• Risk management: maintaining adequate risk management systems, unless the licensee is regulated by APRA.
• Dispute resolution: maintaining an internal dispute resolution procedure and AFCA membership.
• Compliance systems: maintaining adequate compliance arrangements and a written compliance plan.

These controls should reflect the entities involved, the credit activities performed and the fund’s licence arrangements.

Responsible Lending and Disclosure Requirements

Chapter 3 of the NCCP Act contains responsible lending requirements that apply before a credit licensee enters a consumer loan or assists a consumer to apply for one. The credit licensee must make inquiries about the consumer’s financial situation, requirements and objectives, verify the relevant information, then assess whether the loan would be unsuitable.

Disclosure duties also apply at different stages of obtaining credit. ASIC identifies Regulatory Guide 209 and Information Sheet 146 as guidance on responsible lending conduct and disclosure obligations. Where a custodian is the credit provider while a platform assists the consumer, each entity may have its own responsible lending obligations.

Operating Within ACL Authorisations

A credit licensee must ensure that its lending activities match the authorisations recorded on its ACL. The authorisation must reflect whether the entity provides credit as the credit provider or performs other credit activities, such as performing a credit provider’s obligations, suggesting or assisting a consumer to apply for credit, or acting as an intermediary.

Operational checks should compare:

• the entity named in each loan contract;
• the activities performed by the fund manager or platform; and
• the credit activities authorised by the ACL.

A change to the fund structure or lending model may require a fresh licensing assessment before the changed activity begins.

Conclusion

A credit fund’s ACL requirements turn on the borrower, loan purpose, legal credit provider and activities performed within the fund structure. Wholesale investor funding does not remove licensing requirements, while an AFSL does not replace an ACL where regulated consumer lending occurs.

With that assessment in mind, credit fund managers and trustees can contact AFSL House for ACL application assistance for credit funds, including help assessing licensing requirements, selecting appropriate authorisations and coordinating AFSL and ACL compliance. Explore ACL applications and credit licensing support for credit funds to obtain clear guidance before lending begins.

Frequently Asked Questions

Disclaimer: All information provided in this article is strictly general in nature and is not intended to be, nor should it be relied upon as, legal advice.

Credit or finance brokers establishing an independent credit business generally need an Australian Credit Licence (ACL) before engaging in regulated credit activities under the National Consumer Credit Protection Act 2009 (Cth) (‘NCCP Act‘), unless otherwise permitted to act as a credit representative. This distinction matters for mortgage brokers moving from an aggregator or lender arrangement to their own credit licensing structure.

The Australian Securities and Investments Commission (‘ASIC’) assesses an ACL application against organisational competence, responsible manager qualifications, fit and proper requirements, supporting documents and capacity to comply with ongoing obligations. This article explains when credit and finance brokers need an ACL, what ASIC assesses, which documents to prepare and how to apply step by step, as well as the obligations that apply once a licence is granted.

When Do Credit and Finance Brokers Need an Australian Credit Licence?

Understanding Credit Assistance and Intermediary Activities

Under Section 29 of the NCCP Act, a person must not engage in a credit activity without an ACL, unless an exception applies. Section 6 defines credit activity to include providing a credit service, which Section 7 describes as providing credit assistance or acting as an intermediary.

Under Section 8, a person provides credit assistance by, for example, suggesting that a consumer apply for a particular credit contract with a particular credit provider, or assisting the consumer to apply for it. Section 9 covers acting as an intermediary, directly or indirectly, between a credit provider and a consumer for the purpose of securing credit for the consumer.

The relevant credit activities may include providing third-party home loan credit assistance or acting for a lender in activities authorised by the licensee’s ACL. A new broker business must not begin those activities before ASIC grants the licence, unless the business operates under an existing authorised credit representative arrangement.

Distinguishing Consumer Credit from Commercial Lending

The ACL requirement depends on whether the proposed business involves credit activities covered by the NCCP Act. ASIC’s application guidance directs businesses to assess the nature of their proposed credit activities before deciding whether an ACL is required.

Operating as a Credit Representative Versus Holding an ACL

A credit or finance broker engaging in these credit activities can generally do so through one of two pathways:

• becoming a credit licence holder; or
• acting as an authorised credit representative of a credit licensee.

A mortgage broker can operate without holding an independent ACL when authorised as a credit representative of a credit licensee. Under Information Sheet 126 (INFO 126), a credit representative may engage in some or all of the credit activities authorised by the licensee’s ACL, but cannot operate beyond that authorisation.

This structure can suit a broker building experience within an aggregator or another licensed business. A broker establishing an independent credit business may apply for an ACL instead, provided the applicant satisfies the requirements of the NCCP Act, including the assessment of the applicant’s fit and proper people under Section 37A.

What Does ASIC Assess When You Apply for an Australian Credit Licence?

Under Sections 36 and 37 of the NCCP Act, an applicant must lodge an approved application. ASIC must be satisfied that the applicant can comply with the obligations in Section 47 of the NCCP Act, meets the fit and proper person test under Section 37A, and satisfies other prescribed requirements. The following sections explain how ASIC assesses these criteria in practice and the evidence it generally expects applicants to provide.

ASIC’s Licensing Assessment and Fit and Proper Requirements

Since the amendments that commenced on 18 February 2020, Section 37A of the NCCP Act extends the assessment beyond people directly performing credit duties. ASIC may assess all officers and controllers of the applicant, including:

• relevant officers;
• partners;
• trustees;
• senior managers; and
• officers of corporate controllers.

Under Section 37B of the NCCP Act, ASIC must consider matters such as:

• criminal convictions within the previous 10 years, subject to the rules on spent convictions;
• insolvency;
• licence cancellations;
• banning orders;
• disqualification orders;
• adverse regulatory action; and
• failures to follow an Australian Financial Complaints Authority determination.

Responsible Managers and Organisational Competence

ASIC assesses whether an applicant has the organisational competence to conduct its authorised credit activities. ASIC’s Regulatory Guide (RG) 206 Credit licensing: Competence and training (RG 206.39) identifies responsible managers as the people whose qualifications and experience support the quality of the business’s credit activities. The number of responsible managers may depend on the credit activities, business structure, representatives, client numbers, and operational size.

RG 206.53 expects responsible managers to have at least two years of relevant problem-free experience plus either a credit industry qualification at Certificate IV level or a higher qualification in a relevant discipline. In addition, responsible managers for a business providing third-party home loan credit assistance are expected to hold at least a Certificate IV in Finance and Mortgage Broking under RG 206.57. ASIC may examine whether experience was gained in a licensed business, including through work as a credit representative or support person.

Compliance and Financial Requirements

An ACL applicant must show that it can comply with Section 47 of the NCCP Act from the time the licence is granted. RG 206.14 identifies organisational competence as an entry requirement, while maintaining competence remains an ongoing obligation under Section 47(1)(f) of the NCCP Act after the licence is granted.

The application should address the business’s compliance arrangements and financial capacity. Relevant matters include:

• Australian Financial Complaints Authority membership for external dispute resolution;
• adequate professional indemnity insurance, supported by the required questionnaire and certificate of currency;
• systems for supervising representatives; and
• processes supporting compliance with the authorised credit activities.

What Documents Are Required for a Credit Broker ACL Application?

What Documents Must Be Submitted With an ACL Application?

An ACL application under the NCCP Act must include a summary business description, and finance brokers can obtain Australian Credit Licence application assistance for finance brokers when preparing the required materials. This should explain the proposed credit activities, the authorisations sought, the business structure, responsible managers, credit representatives, lender relationships, and the role of each responsible manager.

ASIC also requires information about responsible managers and other fit and proper people. The application materials include:

• Qualifications and relevant work experience for each responsible manager
• National criminal history checks, or overseas checks for overseas people
• Bankruptcy checks
• Statements of Personal Information

RG 204 Applying for and varying a credit licence sets out the application process, including the supporting information ASIC may require. Information Sheet 244 (INFO 244), Credit licence applications: Providing information for fit and proper people, also explains the People Proofs required for relevant officers, partners, trustees, controllers, and other fit and proper people.

ASIC generally requires criminal history checks, bankruptcy checks and Statements of Personal Information for relevant fit and proper people to be no more than 12 months old, subject to permitted exceptions or alternative evidence under INFO 244.

Can ASIC Request Additional Documents During an ACL Application?

ASIC may reject an incomplete application or request further information under Section 37(4) of the NCCP Act. Failure to respond to a statutory request within the specified time can result in the application being treated as withdrawn under Section 37(7).

ASIC may request further documents during its assessment, even where the initial ACL application has been lodged. Depending on the applicant’s structure, ASIC may accept permissible certification or alternative evidence for some people instead of criminal history checks, bankruptcy checks, and Statements of Personal Information. ASIC may later request those documents if the available evidence does not satisfy its assessment.

How Do Credit and Finance Brokers Apply for an ACL?

Navigating the Application Process and Lodgement

Under Section 36 of the NCCP Act, an applicant must lodge an application with ASIC in the approved form. The application process generally involves the following steps:

1. Determine the relevant credit authorisations: Identify the credit activities the business will engage in, such as providing credit assistance or acting as an intermediary, and select the corresponding authorisations in the application. The licence will only cover the credit activities ASIC authorises.
2. Assess responsible manager suitability: Confirm that each proposed responsible manager meets ASIC’s experience and qualification expectations explained above, and that the business has enough responsible managers for its size and credit activities.
3. Prepare the supporting evidence: Gather the business description, responsible manager qualifications and experience, People Proofs for each fit and proper person, and evidence of compliance arrangements such as Australian Financial Complaints Authority membership and professional indemnity insurance. Check that People Proofs are no more than 12 months old.
4. Complete ASIC’s online application: Complete the online ACL application, attach the supporting documents and check that the information is consistent across the application and its attachments.
5. Lodge the application: Pay the prescribed application fee and submit the required declarations. A natural person applicant, a director of a corporate applicant, or an authorised agent must submit the application and declare that the information provided is complete and accurate.
6. Respond to ASIC’s requests: After lodgement, monitor correspondence from ASIC and provide any further information it requests within the specified period, as explained below.

What Happens After You Lodge an ACL Application?

After lodgement, ASIC assesses the application against the statutory licensing criteria outlined above, including the applicant’s capacity to comply with its Section 47 obligations and the fit and proper person test.

ASIC may issue a written notice requesting further information, an audit report, or a statement about material changes to the application. An application may be delayed where:

• supporting documents are missing;
• information is incomplete; or
• responses to ASIC requests are not provided within the specified period.

Understanding ASIC’s Refusal Process and Hearing Rights

ASIC must refuse an ACL application under Section 37(2) of the NCCP Act if the application or lodged information is materially false, misleading, or omits a material matter. ASIC may also refuse the application where the statutory requirements for granting a licence are not satisfied.

Under Section 41 of the NCCP Act, ASIC may refuse to grant a licence only after giving the applicant an opportunity to appear, be represented at a private hearing, and make submissions about the proposed refusal. This gives the applicant an opportunity to respond before ASIC makes its refusal decision.

What Happens After ASIC Grants an Australian Credit Licence?

Licence Authorisations and Conditions

An approved ACL authorises a broker to engage in the credit activities specified in the licence. Sections 35 and 45 of the NCCP Act address licence authorisations and conditions that apply to the licensee.

A finance broker must stay within the scope of those authorisations. As explained earlier, INFO 126 provides that a credit representative may be authorised for some or all activities covered by the licensee’s licence, but cannot operate beyond that authority. The same principle applies when an independent broker conducts mortgage or other authorised credit activities under an ACL.

Ongoing Obligations for Credit Licensees

Under Section 47(1)(f) of the NCCP Act, an ACL holder must maintain organisational competence for its authorised credit activities. Breaching this obligation can attract a civil penalty under Section 47(4). ASIC may also suspend or cancel a licence, or impose additional licence conditions, where the relevant statutory requirements are met. ASIC explains its approach in RG 206.15–RG 206.16.

Credit licensees must also ensure representatives are adequately trained and competent under Section 47(1)(g) of the NCCP Act, as explained in RG 206.21. In addition, ASIC’s licensing guidance identifies ongoing obligations such as:

• Australian Financial Complaints Authority membership;
• representative supervision;
• compliance arrangements; and
• records supporting those activities.

Conclusion

Obtaining an ACL requires selecting suitable credit activities, demonstrating organisational competence, identifying qualified responsible managers and preparing complete supporting documents for ASIC. The process also requires careful attention to fit and proper requirements, application accuracy, professional indemnity insurance and ongoing credit licensing obligations under the NCCP Act.

For brokers establishing an independent credit business, contact AFSL House to request a consultation about Australian Credit Licence applications for finance brokers. ACL application lawyers for finance brokers at AFSL House can assist with ACL application strategy, preparation, ASIC lodgement and ongoing credit licensing compliance, helping create a clear structure for the mortgage or finance broker business.

Frequently Asked Questions

Disclaimer: All information provided in this article is strictly general in nature and is not intended to be, nor should it be relied upon as, legal advice.

Lenders and mortgage brokers providing consumer credit must meet credit disclosure obligations under the National Consumer Credit Protection Act 2009 (Cth) (‘NCCP Act‘) and the National Credit Code. The required disclosure document depends on the business’s role, credit activity, and transaction: a credit guide, credit quote, credit proposal disclosure document, written assessment, pre-contractual statement, information statement, or Key Facts Sheet may apply.

Consumer credit disclosure does not apply to commercial lending, while separate low-cost credit contract rules for buy now pay later contracts have applied since 10 June 2025. This guide explains the documents required for each role, what they must contain, when they must be given, and the consequences of non-compliance with responsible lending obligations.

Disclosure Requirements Under the NCCP Act

The Disclosure Framework Under Chapter 3 and Schedule 1

Chapter 3 of the NCCP Act establishes responsible lending disclosure obligations for credit licensees, credit assistance providers and credit representatives. It covers documents such as a credit guide, credit quote, credit proposal disclosure document and written assessment.

Schedule 1, the National Credit Code, regulates consumer credit contracts where:

• the lender operates a credit business;
• a charge is made for providing credit;
• the debtor is a natural person or strata corporation; and
• the credit is mainly for personal, domestic, household or residential investment purposes.

These consumer credit disclosure rules do not apply to commercial lending or business loans.

Distinguishing Documents for Lenders Versus Mortgage Brokers

The required credit disclosure documents depend on the business role. A credit provider may be a lender, assignee or lessor, while a mortgage broker usually operates as a credit assistance provider.

• Credit providers, assignees, and lessors: Must generally provide a credit guide. A credit provider must also provide a final written assessment when requested under Section 132 of the NCCP Act.
• Credit assistance providers, including mortgage brokers: Must mainly provide a credit guide, credit quote, credit proposal disclosure document and preliminary written assessment when requested. A credit quote may not be required where the relevant fee exemption applies.
• Credit representatives: Must generally provide a credit guide. Typically, there are no separate requirements for a credit quote, credit proposal disclosure document or written assessment.

Sections 113, 114, 120, 121, 126, 132 and 158 of the NCCP Act identify key obligations for these roles. The applicable documents depend on the credit activities performed, the fees charged and whether the consumer requests a written assessment.

What Lenders and Mortgage Brokers Must Disclose in Credit Guides

Mandatory Information for Credit Guides

A credit guide must be provided in writing under Section 113 of the NCCP Act by a credit assistance provider, including a mortgage broker, when it becomes apparent that credit assistance is likely to be provided. Under Section 126 of the NCCP Act, a credit provider must provide a credit guide as soon as practicable after it becomes apparent that a credit contract is likely to be entered into.

The required information depends on the entity’s role. A credit guide must generally include:

• Business identification: the name, contact details and Australian credit licence number or credit representative number.
• Fees and remuneration: applicable fees, charges, indirect remuneration, methods of calculation and relevant lender relationships.
• Lender relationships: the six credit providers or lessors with whom a credit assistance provider conducts the most business.
• Dispute procedures: internal dispute resolution contact details and access details for the Australian Financial Complaints Authority.
• Responsible lending information: relevant obligations under the NCCP Act, including information about requesting a written assessment.

Under Section 158 of the NCCP Act, credit representatives also have credit guide obligations. Their guide must include applicable indirect remuneration, fees and charges, lender relationships, third-party referral payments and volume bonus information, subject to the relevant qualifications in the National Consumer Credit Protection Regulations 2010 (Cth) (‘NCCP Regulations‘).

Timing Requirements and Relevant Exemptions

A credit assistance provider must give its credit guide as soon as practicable after it becomes apparent that credit assistance is likely to be provided, and a credit provider as soon as practicable after it becomes apparent that a credit contract is likely to be entered into, as set out above.

A credit guide may not be required where the same consumer received one within the previous 12 months, provided the required Australian Financial Complaints Authority (‘AFCA’) contact details were already supplied and remain unchanged. Regulation 28P of the NCCP Regulations also recognises exemptions for certain product designers, franchisees, credit representatives, debt collectors and shared-responsibility arrangements. A credit assistance provider may also be exempt from giving a credit quote where no fees or charges are imposed, subject to the applicable disclosure conditions in Regulation 28C of the NCCP Regulations.

Additional Disclosure Documents for Mortgage Brokers

Quotes for Credit Assistance

Under Section 114 of the NCCP Act, a licensee must provide a written credit quote before providing credit assistance involving a particular credit contract, credit provider or credit limit increase. The consumer must sign and date the quote, or otherwise accept it in the prescribed manner, before credit assistance is provided. The licensee must also give the consumer a copy of the accepted quote.

The quote must identify:

• the services covered;
• the maximum amount payable;
• relevant fees and charges;
• amounts payable to another person on the consumer’s behalf; and
• whether payment remains due if the credit contract is not entered into.

Regulations 28C–28D of the NCCP Regulations provide further requirements. A quote is not required where the credit assistance provider does not impose, or intend to impose, fees or charges, subject to the prescribed disclosure conditions.

Credit Proposal Disclosure Documents

Under Section 121 of the NCCP Act, a licensee must provide a credit proposal disclosure document at the same time as providing credit assistance for a particular credit contract. The document must state:

• the consumer’s fees and charges;
• fees likely to be payable to the credit provider or another person;
• a reasonable estimate of indirect remuneration; and
• the method used to calculate those amounts.

The document must also disclose payments to third-party referrers, include a statement about volume bonus arrangements, and estimate the credit likely to remain available after specified payments. Regulations 28E–28H of the NCCP Regulations prescribe further requirements. A fee amount may be omitted where it was disclosed in a credit quote given no more than 30 days earlier, remains unchanged, and the proposal document refers to that quote.

Preliminary Written Assessments

Under Section 120 of the NCCP Act, a credit assistance provider must give a consumer a free copy of the preliminary written assessment if requested within seven years after the date of the credit quote. The obligation does not apply where the provider did not provide credit assistance.

The timeframe depends on when the request is made:

• Within two years of the quote: the assessment must be provided within seven business days.
• More than two years after the quote: the assessment must be provided within 21 business days.

The credit assistance provider must not request or demand payment for supplying the assessment. Section 120 of the NCCP Act also creates civil penalties for non-compliance, with a criminal penalty applying to specified contraventions as a strict liability offence.

Additional Disclosure Documents for Lenders

Pre-Contractual Statements and Information Statements

Under Section 16 of Schedule 1 to the National Credit Code, a credit provider must give the debtor a pre-contractual statement plus an information statement before entering a credit contract or before the debtor makes an offer, whichever occurs first. The pre-contractual statement must set out the matters required by Section 17 of the National Credit Code, including prescribed financial information.

The pre-contractual statement may form part of the proposed credit contract or be provided separately. It may also be varied before the contract is entered into by written notice setting out the variation. A credit provider may disclose a comparison rate before entering the contract, but it must be calculated as prescribed by the regulations with the required warnings.

Written Unsuitability Assessments

Under Section 132 of the NCCP Act, a consumer may request a written copy of the lender’s assessment before entering a credit contract or increasing a credit limit. The credit provider must provide the assessment before the contract is entered into, or the limit is increased.

A consumer may also request the assessment within seven years after the credit contract is entered into, or the credit limit is increased. Requests made within two years must be answered within seven business days; later requests must be answered within 21 business days. The credit provider must not charge for supplying the assessment.

Home Loan Key Facts Sheets

Section 133AA of the NCCP Act defines a standard home loan as a standard-form credit contract used to purchase residential property or refinance credit used mainly for that purpose.

If the proposed credit contract is a standard home loan, the NCCP Act imposes the following Key Facts Sheet obligations on the lender:

• Website obligation: Under Section 133AC, a licensee whose website can be used to apply for, or make an inquiry about, its standard home loans must enable consumers to generate an up-to-date, printable Key Facts Sheet for each of those loans through the website.
• Request obligation: Under Section 133AD, a licensee must provide an up-to-date Key Facts Sheet when a consumer requests one other than through the website, or where the regulations require one in prescribed circumstances, once the consumer has given their name and required contact details.
• Content: Under Section 133AB, the Key Facts Sheet must contain the information required by the regulations, which may include consumer-specific information about the cost and implications of the loan.

The obligation to provide a Key Facts Sheet is therefore triggered by a consumer request or a prescribed circumstance, rather than arising automatically for every home loan. If the lender needs more information to prepare the Key Facts Sheet, it must tell the consumer what information is required under Section 133AE.

Under Sections 133AE(4) and 133AF of the NCCP Act, a lender has a defence for not providing a Key Facts Sheet where:

• it has told the consumer what information it needs and the consumer has not provided that information;
• it, or another person, has already provided the consumer with a Key Facts Sheet for the same loan that would be the same apart from its date;
• it reasonably believes the consumer would not be eligible for the standard home loan; or
• the regulations provide that a Key Facts Sheet is not required.

Low-Cost Credit Contracts and Buy Now Pay Later

The low-cost credit contract rules apply to buy now pay later contracts from 10 June 2025. From then, a person engaging in credit activities involving buy now pay later contracts must hold an Australian credit licence with the appropriate authorisations, subject to the transitional arrangements described in Information Sheet 285.

A buy now pay later contract may qualify as a low-cost credit contract if it satisfies the requirements for that category, including prescribed requirements concerning:

• fees;
• charges; and
• the period during which credit may be provided under Section 13E of the National Credit Code.

Providers of low-cost credit contracts may elect to comply with modified responsible lending obligations, but they must still meet specific disclosure requirements under the National Credit Code.

Under Section 16(1A) of the National Credit Code, a credit provider must not enter into a low-cost credit contract unless it has first given the debtor:

• a precontractual statement setting out the matters required by Section 17 to be included in the contract document; and
• an information statement that complies with the requirements prescribed by the regulations and any requirements determined by the Australian Securities and Investments Commission (ASIC) under Section 16(1B).

These documents must be given before the contract is entered into or before the debtor makes an offer, whichever occurs first. The key difference from ordinary consumer credit contracts is the information statement: under Section 16(1), an ordinary credit contract requires an information statement in the form prescribed by the regulations, whereas the information statement for a low-cost credit contract may also be subject to requirements set by ASIC by legislative instrument.

Under Section 17(7A) of the National Credit Code, where more than one repayment is to be made under a low-cost credit contract, the contract document must state the frequency of repayments and, if ascertainable, the amount and number of repayments and the total amount of the repayments. If the repayment amount is not ascertainable, the contract must state the method of calculating the repayments.

A buy now pay later contract that is not a low-cost credit contract is not automatically regulated in the same way as an ordinary credit contract. Under Section 13B of the National Credit Code, the Code applies where it would otherwise apply, and also extends to certain buy now pay later contracts involving a constitutional corporation that would otherwise fall outside the Code, for example because no charge is made for providing credit or because of the short-term credit or account-charge exclusions. Whether and how the Code applies therefore depends on the contract and the parties.

How Credit Disclosure Documents Must Be Provided

Disclosure Timing and Electronic Delivery

Under Regulation 28L of the NCCP Regulations, a disclosure document may be given personally. Electronic delivery or access through an electronic document retrieval system is permitted only with the consumer’s consent, which may be withdrawn at any time.

For precontractual documents, regulations 72A–72C of the NCCP Regulations apply alongside Section 16 of Schedule 1 to the National Credit Code. The credit provider must be reasonably satisfied that the debtor received the documents before entering into the credit contract or making an offer.

Electronic documents must be provided in a format that can be saved or printed. Retrieval systems require notice identifying the documents, access details, and a reasonable period for retrieval.

Combining Multiple Disclosure Documents

Two or more disclosure documents may be combined into one document if all requirements of the NCCP Act and the NCCP Regulations are met, including the required timing.

A credit assistance provider may combine a credit guide with a credit quote where:

• all required information for each document is included;
• the combined document is provided as soon as practicable after credit assistance becomes likely; and
• credit assistance is not provided until the consumer accepts the quote by signing and dating it.

Consequences for Failing to Meet Disclosure Obligations

Civil Penalties and Criminal Offences

A failure to meet credit disclosure obligations is a breach of the law, and businesses facing compliance issues should seek advice from Australian credit licence compliance and regulatory lawyers.

Under Sections 113, 114, 120, 121, 126 and 132 of the NCCP Act, relevant contraventions are civil penalty provisions, each specifying a penalty of 5,000 penalty units. However, this is the penalty specified for each provision, not necessarily the maximum a court may impose.

Under Section 167B of the NCCP Act, the maximum pecuniary penalty is calculated differently for individuals and bodies corporate:

• Individuals: the greater of the specified penalty and, if the court can determine it, three times the benefit derived and detriment avoided because of the contravention.
• Bodies corporate: the greatest of the specified penalty multiplied by 10, three times the benefit derived and detriment avoided, and 10% of annual turnover for the relevant 12-month period (capped at 2.5 million penalty units).

Certain failures may also constitute strict liability criminal offences. Under Sections 113, 120 and 126 of the NCCP Act, a person who contravenes specified requirements may face a criminal penalty of 50 penalty units.

In addition, ASIC may:

• suspend or cancel a credit licence;
• impose licence conditions; or
• issue an infringement notice.

Common Compliance Failures

Common failures occur when a credit provider or credit assistance provider does not provide the required disclosure document at the correct time. Examples include:

• failing to give a credit guide;
• providing a credit quote without required acceptance; or
• omitting fees, charges or indirect remuneration from a credit proposal disclosure document.

A pre-contractual statement or information statement provided after the relevant credit contract is entered into may not satisfy Section 16 of Schedule 1 to the National Credit Code.

Similar issues may arise when:

• a written assessment is not provided within the applicable seven-business-day or 21-business-day period; or
• a provider charges for supplying an assessment.

Conclusion

The disclosure document required depends on the business role, credit activity and transaction, with responsible lending obligations applying differently to credit providers, mortgage brokers and credit representatives. Accurate credit disclosure, timely delivery and complete information about fees and charges help reduce the risk of civil penalties, criminal offences and regulatory action.

For support with drafting a credit guide, credit quote, credit proposal disclosure document, credit contract or written assessment, contact AFSL and Australian credit licensing compliance lawyers at AFSL House. The AFSL House team assists lenders and mortgage brokers with credit licensing and disclosure compliance, including ongoing Australian credit licence compliance.

Frequently Asked Questions

Disclaimer: All information provided in this article is strictly general in nature and is not intended to be, nor should it be relied upon as, legal advice.

A bank answers to the Australian Prudential Regulation Authority (‘APRA’) for its financial soundness, risk management and ability to meet obligations to depositors, while the Australian Securities and Investments Commission (‘ASIC’) oversees how it provides financial services and credit and treats customers. These obligations are often managed by separate treasury, risk, finance, legal, compliance, product and customer teams, creating a risk of duplicated controls, missed requirements or late breach identification.

This article maps the ongoing APRA prudential standards and ASIC conduct obligations that apply to a bank, credit union, mutual bank or digital bank according to its size, category, licences and activities. It also explains where the regimes overlap and how one compliance program can meet both regulators’ requirements without gaps.

Which Prudential & Conduct Obligations Apply to an Australian Bank Once It Is Operating?

APRA & Prudential Regulation

APRA supervises authorised deposit-taking institutions (‘ADIs’), including banks, credit unions and building societies, under the Banking Act 1959 (Cth) (‘Banking Act‘). Under Section 11AF of the Banking Act, APRA may determine prudential standards that applicable ADIs must comply with.

These standards address:

• Capital adequacy and loss-absorbing capacity;
• Liquidity and funding risk;
• Credit risk and counterparty concentrations;
• Governance, risk management and remuneration;
• Operational resilience, business continuity and information security; and
• Prudential reporting, audit and notifications.

Prudential standards are binding requirements. APRA Prudential Practice Guides explain supervisory expectations and possible implementation approaches but do not usually create separate legal obligations.

ASIC & Conduct Regulation

ASIC administers the main financial services and consumer credit conduct requirements applying to a bank. Under Section 911A of the Corporations Act 2001 (Cth) (‘Corporations Act‘), a bank carrying on a financial services business generally needs an Australian Financial Services Licence (‘AFSL’) covering the relevant services, unless an exemption applies.

Deposit-taking facilities and non-cash payment facilities may constitute financial products under Sections 763A, 763D and 764A(1)(i) of the Corporations Act. A bank conducting regulated consumer credit activities may also need an Australian Credit Licence (‘ACL’) under Section 29 of the National Consumer Credit Protection Act 2009 (Cth) (‘NCCP Act‘).

The Australian Securities and Investments Commission Act 2001 (Cth) separately prohibits misleading or deceptive conduct under Section 12DA and unconscionable conduct under Sections 12CA and 12CB.

Where AUSTRAC, AFCA & the Industry Codes Fit

A bank’s compliance responsibilities also include regimes administered by bodies other than APRA and ASIC. Banks providing designated services under Section 6 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) must meet applicable anti-money laundering and counter-terrorism financing requirements, including customer due diligence and transaction monitoring.

AFSL and ACL holders must maintain applicable dispute resolution arrangements, including Australian Financial Complaints Authority (‘AFCA’) membership where required under Section 912A(2) of the Corporations Act and Section 47 of the NCCP Act.

A subscriber may also have additional commitments under the Australian Banking Association’s Banking Code of Practice or the Customer Owned Banking Association’s Customer Owned Banking Code of Practice. Subscription, contractual arrangements and relevant statutory provisions determine whether those commitments apply.

How Obligations Change With ADI Size & Category

The prudential requirements applying to a bank depend on its size, complexity, business model and regulatory classification. APRA’s proportionality framework distinguishes significant financial institutions (‘SFIs’) from non-significant financial institutions (‘non-SFIs’), with SFI-specific governance and remuneration requirements and simplified requirements available to non-SFIs where provided.

Other ADI categories also affect the compliance assessment:

• Foreign ADI branches operate under Australian branch requirements and standards that address their particular structure.
• Restricted ADIs must comply with their restricted authorisation conditions and the prudential requirements applying to that status.
• Credit unions and mutual banks remain subject to the ADI prudential framework, with application determined by their classification and activities rather than mutual ownership alone.

A bank should assess its APRA classification, corporate structure, licence permissions, products and applicable regulatory determinations before deciding which obligations apply.

What Prudential Standards Must Australian Banks Meet Day to Day?

Capital Adequacy

Prudential Standard APS 110 Capital Adequacy (‘APS 110’) requires an ADI to maintain regulatory capital above its applicable prudential capital requirements. The baseline minimum ratios are:

• 4.5% Common Equity Tier 1 (‘CET1’) capital;
• 6.0% Tier 1 capital; and
• 8.0% Total Capital.

APRA may set higher institution-specific requirements. APS 110 also requires CET1 capital buffers above these minimums, being the capital conservation buffer and the countercyclical capital buffer, and an ADI whose capital falls into the buffer range is restricted in paying dividends and bonuses. From 1 January 2027, APRA’s removal of Additional Tier 1 capital from the framework means there will no longer be a separate Tier 1 minimum, and ADIs using the internal ratings-based approach to credit risk will move to minimums of 6.0% CET1 and 9.25% Total Capital.

APS 110 also requires relevant ADIs to maintain an Internal Capital Adequacy Assessment Process (‘ICAAP’). The ICAAP should:

• assess material risks;
• set capital targets and buffers against the bank’s risk appetite;
• forecast capital needs;
• test stress scenarios; and
• support contingency planning.

Capital forecasts should connect with the bank’s business plan and board-approved risk appetite rather than being monitored only as finance measures.

Liquidity

Prudential Standard APS 210 Liquidity (‘APS 210’) requires an ADI to manage liquidity and funding risk and maintain enough liquidity to meet obligations as they fall due. The applicable method depends on the ADI’s classification.

Locally incorporated Liquidity Coverage Ratio (‘LCR’) ADIs must generally maintain:

• an LCR of at least 100%; and
• a Net Stable Funding Ratio of at least 100%.

A Minimum Liquidity Holdings ADI must maintain eligible liquid assets equal to at least 9% of its liabilities, unless APRA requires a higher amount. APS 210 also requires liquidity stress testing, funding risk assessment and contingency planning.

Credit Risk & Large Exposures

Prudential Standard APS 220 Credit Risk Management (‘APS 220’) requires a credit risk management framework suited to the ADI’s size, business mix and complexity. The framework covers:

• credit assessment;
• approval limits;
• credit risk appetite;
• collateral;
• borrower monitoring;
• problem exposures;
• impairment;
• recovery; and
• independent review.

Prudential Standard APS 221 Large Exposures limits concentration risk by restricting exposures to an individual counterparty or connected group. A large exposure is generally one equal to or above 10% of the ADI’s Tier 1 Capital, while the general limit on the ADI’s aggregate exposures to a single counterparty or group of connected counterparties is 25% of Tier 1 Capital, subject to specified exceptions and APRA determinations. From 1 January 2027, these thresholds and limits will be measured against CET1 capital rather than Tier 1 Capital. The bank must monitor connected borrowers, guarantees, commitments and relevant off-balance-sheet arrangements.

Risk Management & Governance

Prudential Standard CPS 220 Risk Management (‘CPS 220’) requires an ADI to maintain risk management arrangements covering its material risks. The arrangements must support the identification, measurement, evaluation, monitoring, reporting and control of those risks, and include:

• a risk appetite statement;
• a risk management strategy; and
• a written business plan.

CPS 220 also requires an annual risk management declaration to APRA. Prudential Standard CPS 510 Governance addresses board responsibilities, composition, committees and oversight. Prudential Standard CPS 520 Fit and Proper requires assessments of responsible persons’ competence, character, integrity and experience. Prudential Standard CPS 511 Remuneration addresses incentives, risk culture and long-term soundness, with different requirements for SFIs and non-SFIs.

Operational Resilience & Information Security

Prudential Standard CPS 230 Operational Risk Management (‘CPS 230’) has operated in full for all ADIs since 1 July 2026, following the relevant transitional arrangements. It requires a bank to:

• identify critical operations;
• set tolerance levels for disruption;
• test business continuity arrangements; and
• manage risks arising from material service providers.

CPS 230 also covers operational risk incidents and related notifications. A material operational risk incident must be reported to APRA as soon as possible and no later than 72 hours after the applicable conditions are met. A disruption to a critical operation outside its tolerance level must be reported as soon as possible and no later than 24 hours. Prudential Standard CPS 234 Information Security (‘CPS 234’) requires information security capabilities, security controls, incident response and notification of relevant cyber incidents and material control weaknesses.

Prudential Reporting & Notifying APRA

Banks must provide regular prudential information to APRA under applicable reporting standards and the Financial Sector (Collection of Data) Act 2001 (Cth). Reporting may cover:

• capital;
• liquidity;
• credit exposures;
• financial performance;
• asset quality; and
• other prudential measures,

depending on the ADI’s category and activities.

A bank must also assess whether an event triggers notification to APRA. These events may include:

• a breach of a prudential standard;
• deterioration in financial condition;
• a material operational risk incident; or
• another circumstance identified by the relevant requirement.

The notification deadline depends on the applicable test. A bank should maintain records showing the trigger, responsible person, reporting channel and deadline for each type of notification.

What Conduct Obligations Apply to Australian Banks as AFSL & ACL Holders?

Section 912A Obligations & How They Apply to APRA-Regulated Banks

Section 912A(1)(a) of the Corporations Act requires an AFSL holder to provide financial services efficiently, honestly and fairly. Section 912A(1)(aa) requires adequate arrangements to manage conflicts of interest, while Section 912A(1)(c) requires the bank to comply with the financial services laws and Sections 912A(1)(ca) and (f) require it to take reasonable steps to ensure its representatives comply with those laws and are adequately trained and competent.

Under Sections 912A(4) and 912A(5) of the Corporations Act, Section 912A(1)(d), concerning financial, technological and human resources, and Section 912A(1)(h), concerning risk management systems, do not apply to a bank regulated by APRA, so those matters are addressed through APRA’s prudential standards instead. These provisions do not remove the bank’s obligations under other applicable provisions of the Corporations Act or APRA standards.

Responsible Lending & NCCP Obligations

A bank conducting regulated consumer credit activities must comply with the NCCP Act and Schedule 1 to that Act (‘National Credit Code‘). Section 47 of the NCCP Act sets general conduct obligations for ACL holders, including requirements concerning:

• efficient, honest and fair conduct;
• conflicts of interest;
• compliance arrangements; and
• representative conduct.

Chapter 3 of the NCCP Act contains responsible lending obligations. Sections 128 to 133 address assessments before entering into regulated credit contracts or increasing credit limits, while Sections 130 and 131 concern reasonable inquiries, verification and unsuitability. ASIC’s Regulatory Guide 209: Credit Licensing—Responsible Lending Conduct (‘RG 209’) provides regulatory guidance on these requirements.

Design & Distribution Obligations

Part 7.8A of the Corporations Act establishes design and distribution obligations for covered financial products, which may include deposit accounts, payment facilities, credit cards and home loans, depending on the product and applicable exclusions. Under Section 994B of the Corporations Act, an issuer must prepare a target market determination (‘TMD’) identifying the consumers for whom the product is likely to be appropriate.

Sections 994C, 994D and 994E of the Corporations Act address TMD reviews, distribution and reasonable steps. Section 994G of the Corporations Act requires notification of certain significant dealings outside a TMD as soon as practicable and within 10 business days after the issuer becomes aware of the dealing. ASIC’s Regulatory Guide 274: Product Design and Distribution Obligations (‘RG 274’) provides related guidance.

Complaints Handling & Financial Hardship

Section 912A(2) of the Corporations Act and Section 47 of the NCCP Act require the dispute resolution arrangements outlined above, including AFCA membership where required. ASIC’s Regulatory Guide 271: Internal Dispute Resolution (‘RG 271’) sets enforceable standards and guidance for receiving, investigating and resolving complaints.

Financial hardship obligations arise under Sections 72 to 75 of the National Credit Code. Under Section 72 of the National Credit Code, a debtor who considers they cannot meet, or will be unable to meet, obligations under a regulated credit contract may give the credit provider a hardship notice. Where sufficient information is available, the credit provider usually has 21 days to notify the debtor of its decision.

Breach Reporting to ASIC

AFSL holders and ACL holders must assess reportable situations under the Corporations Act and the NCCP Act. Sections 912D and 912DA of the Corporations Act apply to AFSL holders, while Sections 50A and 50B of the NCCP Act apply to credit licensees.

Reportable situations can include significant breaches or likely significant breaches, certain extended investigations, serious fraud, gross negligence and prescribed matters. A report is usually due within 30 calendar days after the licensee first knows, or is reckless as to whether, there are reasonable grounds to believe a reportable situation has arisen. ASIC’s Regulatory Guide 78: Breach Reporting by AFS Licensees and Credit Licensees (‘RG 78’) provides guidance on applying the reporting regime.

How Does the Financial Accountability Regime Affect Banking Executives?

Who Counts as an Accountable Person

Section 10 of the Financial Accountability Regime Act 2023 (Cth) (‘FAR Act‘) establishes the framework for identifying accountable persons. It covers directors and senior executives whose actual responsibilities meet the statutory definition, including prescribed responsibilities and functions set by the applicable Minister rules.

A bank should assess responsibilities rather than relying on job titles. Accountable functions may include:

• Overall management and control;
• Financial management, risk management and compliance;
• Internal audit, human resources and remuneration; and
• Information management, technology and other prescribed functions.

Section 23 of the FAR Act also requires accountable persons to collectively cover the bank’s operations and relevant group. Accountability statements and maps can help document how those responsibilities are allocated.

Accountability Obligations

Sections 20 and 21 of the FAR Act impose obligations on accountable entities and accountable persons. Under Section 21 of the FAR Act, an accountable person must act with honesty, integrity, due skill, care and diligence.

The accountable person must also:

• Deal with APRA and ASIC in an open, constructive and cooperative way;
• Take reasonable steps to prevent matters that could adversely affect the bank’s prudential standing or prudential reputation; and
• Take reasonable steps to prevent material contraventions of specified laws by the bank.

These duties do not create automatic personal liability whenever a failure occurs. The assessment depends on the person’s responsibilities, the circumstances and the steps reasonably required. Evidence may include committee papers, management reports, control testing, remediation decisions and escalation records.

Registration, Notification & Deferred Remuneration

Section 24 of the FAR Act restricts a bank from having an unregistered accountable person perform the relevant role, subject to applicable exceptions. Section 31 of the FAR Act establishes notification obligations, with notifications generally required within 30 days of a relevant notifiable event.

The enhanced notification threshold for ADIs is generally based on total assets of $20 billion under the relevant Minister rules. This threshold is separate from APRA’s SFI classification.

Part 4 of the FAR Act establishes deferred remuneration requirements. Subject to applicable thresholds, exceptions and modifications, a bank must generally defer at least 40% of an accountable person’s variable remuneration for at least four years. For ADIs, these requirements apply to remuneration decisions made in the first financial year beginning after 15 September 2024.

How APRA & ASIC Administer the FAR Together

APRA and ASIC jointly administer the FAR Act. APRA’s focus remains connected to prudential soundness and financial stability, while ASIC’s focus includes financial services and credit conduct.

A single failure may raise issues for both regulators. A widespread lending system failure, for example, may involve prudential controls, customer outcomes and the oversight exercised by executives responsible for lending, technology or customer operations.

Depending on the facts, consequences under the FAR Act may include regulatory investigation, directions, disqualification processes or other statutory enforcement measures. The regime provides civil penalties for specified accountable entity obligations, while individuals may face disqualification and other consequences under applicable provisions. Accountable persons are not exposed to civil penalties under the FAR Act for breaching their own accountability obligations, but a breach can lead to disqualification and a reduction of their variable remuneration.

How Can an ADI Run One Compliance Program That Satisfies Both APRA & ASIC?

Building a Single Obligations Register

A central obligations register can connect each applicable prudential, financial services, credit and accountability requirement to the bank’s operating arrangements, supported by financial services compliance and regulatory advice from AFSL House. Each entry should identify:

• the relevant Act, prudential standard or regulatory instrument;
• the activity or entity covered;
• the responsible person or function;
• the control; and
• the evidence showing that the control operates.

The register should also record reporting duties, deadlines, assurance arrangements, testing frequency, control weaknesses and remediation owners. FAR accountability may sit with a senior executive while day-to-day controls are performed by an operational manager, so the register should distinguish accountability from control ownership.

Aligning the Risk Management Framework With Conduct Risk

CPS 220 requires a bank to maintain a risk management framework covering its material risks. CPS 230 includes conduct risk and compliance risk within operational risk management, so conduct risk should be assessed within the bank’s broader risk arrangements rather than kept in a separate system.

The risk appetite statement may include indicators such as:

• recurring customer remediation;
• responsible lending breaches;
• products distributed outside their target market;
• complaints handling weaknesses; and
• delayed escalation of reportable situations.

A single product approval process can also assess capital, liquidity, credit risk, consumer suitability, design and distribution obligations, operational resilience, disclosure and FAR accountability.

Managing Breaches & Incidents Across Both Regulators

One incident may engage separate obligations to APRA and ASIC, each with its own legal test and reporting deadline, making coordinated advice from banking regulatory compliance lawyers important. A payment provider failure affecting customer access may raise issues under:

• CPS 230;
• CPS 234;
• Section 912A of the Corporations Act;
• the ASIC reportable situations regime; and
• the FAR Act.

A single incident workflow can record the facts, affected customers and services, classify the risks, assess each notification requirement, allocate responsibility and track remediation. The workflow must preserve separate assessments. Under CPS 230, some notifications are due within 72 hours or 24 hours, while ASIC reports are usually due within 30 calendar days when the statutory test is met.

Assurance & Independent Review

A bank should coordinate compliance monitoring, internal audit and other assurance work without treating different regulatory tests as interchangeable. One review of lending operations may test:

• APS 220;
• responsible lending requirements under the NCCP Act;
• design and distribution obligations under Part 7.8A of the Corporations Act;
• hardship responses; and
• breach escalation.

Paragraph 44 of CPS 220 requires the risk management framework’s compliance and effectiveness to be reviewed by internal and/or external audit at least annually. Paragraph 45 requires a comprehensive review by operationally independent and appropriately qualified persons at least every three years.

Common Gaps Between Prudential & Conduct Compliance

Gaps often arise when teams assess the same activity through separate systems without sharing relevant information. Common examples include:

• Product changes made without reviewing the TMD.
• Service provider failures treated only as technology incidents.
• Hardship and complaints data not reaching credit risk or the board.
• FAR accountability documents that do not reflect actual decisions.
• Duplicate testing that produces inconsistent findings.
• Incident assessments delayed until an internal investigation is complete.

A coordinated governance and reporting structure can reduce these gaps while preserving the separate evidence required for APRA prudential standards, ASIC conduct obligations and the FAR Act.

Conclusion

Australian banks need financial resilience and fair customer outcomes, with APRA prudential standards and ASIC conduct requirements applying throughout their operations. A coordinated compliance program can connect capital, liquidity, risk management, customer treatment, product governance and executive accountability without creating duplicated controls or missed obligations.

For banks, credit unions and mutual banks seeking help with these requirements, contact AFSL compliance and regulatory lawyers at AFSL House to review your prudential and conduct compliance arrangements. AFSL House assists banking businesses with financial services law, regulatory compliance frameworks and governance matters, helping teams clarify responsibilities and manage their obligations with greater confidence.

Frequently Asked Questions

Disclaimer: All information provided in this article is strictly general in nature and is not intended to be, nor should it be relied upon as, legal advice.

Since 31 March 2026, Australian banks have operated under a reformed anti-money laundering and counter-terrorism financing (‘AML/CTF’) regime that replaced the former Part A and Part B program structure with a money laundering and terrorism financing (‘ML/TF’) risk assessment, AML/CTF policies and explicit governing body oversight. Transitional arrangements still affect customer identification, independent evaluations and international value transfer reporting.

Boards, AML/CTF compliance officers and financial crime teams must understand their responsibilities, the requirements that apply to their bank and the evidence needed to show the Australian Transaction Reports and Analysis Centre (‘AUSTRAC’) and the Australian Prudential Regulation Authority (‘APRA’) that controls operate effectively.

What Does the Reformed AML/CTF Regime Require of Australian Banks?

Which Banking Services Are Designated Services?

Section 6 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (‘AML/CTF Act‘) identifies the designated services that bring banking activities within the AML/CTF regime. Services commonly provided by a bank include:

• Opening and operating accounts
• Accepting deposits
• Providing loans and other financing
• Transferring value domestically or internationally
• Providing correspondent or nested services
• Offering foreign exchange and other financial products covered by Section 6

An authorised deposit-taking institution’s status under the Banking Act 1959 (Cth) does not determine the AML/CTF treatment of every activity. Each bank should map its designated services to its products, business units, delivery channels and customer types.

What Changed for Banks From 31 March 2026

The 2026 AML/CTF reforms took effect for existing reporting entities on 31 March 2026. The former Part A and Part B structure was replaced with an AML/CTF program comprising an ML/TF risk assessment and AML/CTF policies under Section 26B of the AML/CTF Act.

Key changes include:

• Direct governing body oversight under Section 26H of the AML/CTF Act
• Express assessment of proliferation financing risk
• Senior manager approval of the risk assessment, AML/CTF policies and updates under Section 26P
• Independent evaluations of the AML/CTF program
• Reformed transfer-of-value and information-sharing obligations
• New requirements concerning nested services relationships

Transitional Deadlines Still Running for Existing Banks

Existing banks must check which transitional arrangements apply to their enrolment history, prior reviews, customer classes and reporting systems. The key future dates are:

• 31 March 2027: The first post-reform independent evaluation may be due by this date. For an eligible bank with a qualifying prior review, the applicable deadline is the later of 31 March 2027 or four years after that review.
• 31 March 2029: The transition from applicable pre-reform customer identification procedures to initial customer due diligence must be completed before this date, subject to the required transitional conditions.
• 31 March 2029: International funds transfer instruction reporting ordinarily transitions to international value transfer service reporting.
• 30 September 2029: An eligible reporting entity may nominate a later substitute date for the international value transfer reporting transition, subject to the transitional conditions and notification requirements.

Banking Groups and Reporting Groups

The AML/CTF Act allows specified obligations to be managed through a reporting group led by a designated lead entity. Section 26U of the AML/CTF Act requires the lead entity’s business assessment to include the businesses of other reporting entities in the group. Section 236B and Part 2 of the Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (Cth) (‘AML/CTF Rules‘) provide further group arrangements.

A reporting group may share its risk assessment, AML/CTF policies, compliance infrastructure and assurance arrangements. Each member remains responsible under Section 26G(2) of the AML/CTF Act for complying with the lead entity’s AML/CTF policies as they apply to that member. Group documents should identify the entities covered, each entity’s designated services, locally retained responsibilities and escalation arrangements.

Who Is Accountable for AML/CTF Compliance in an Australian Bank?

The Board’s Oversight Responsibilities

Under Section 26H(1) of the AML/CTF Act, the governing body must maintain ongoing oversight of the bank’s ML/TF risk assessment, AML/CTF policies and compliance with applicable obligations. It must also take reasonable steps to ensure the bank identifies, assesses, manages and reduces its financial crime risks.

Rule 5-6 of the AML/CTF Rules requires the bank’s policies to provide the governing body with information needed for this role. Board papers and minutes should record:

• material risks;
• control failures;
• independent evaluation findings;
• management responses;
• questions asked;
• decisions made; and
• follow-up actions.

A report marked “noted” may not show that the governing body actively performed its oversight responsibilities.

The AML/CTF Compliance Officer

A bank must designate an eligible AML/CTF compliance officer under Section 26J of the AML/CTF Act. Rule 5-14 of the AML/CTF Rules requires consideration of the officer’s:

• competence;
• technical knowledge;
• diligence;
• judgement;
• honesty;
• integrity;
• relevant convictions;
• adverse findings; and
• conflicts of interest.

Under Section 26L of the AML/CTF Act, the officer oversees and coordinates day-to-day compliance, the operation of AML/CTF policies and communication with AUSTRAC. Rule 5-7 of the AML/CTF Rules requires reports to the governing body at least once every 12 months. Under Section 26M of the AML/CTF Act, AUSTRAC must be notified within 14 days after the designation.

Senior Manager Approvals

Under Section 26P(1) of the AML/CTF Act, a senior manager must approve the bank’s ML/TF risk assessment, AML/CTF policies and updates to either document. Updates to the risk assessment must also be notified in writing to the governing body as soon as practicable under Section 26P(2) of the AML/CTF Act.

Rule 5-5 of the AML/CTF Rules requires senior manager approval for specified relationships and activities, including:

• certain foreign politically exposed person relationships;
• higher-risk domestic and international organisation politically exposed persons;
• nested services relationships; and
• qualifying reliance arrangements under Section 37A(1)(a) of the AML/CTF Act.

Approval records should identify the relationship, relevant risk factors, supporting customer due diligence, decision-maker and any conditions.

How Accountability Flows Through the Three Lines

The three-lines model provides a practical way to assign AML/CTF responsibilities within a bank, although it is not a structure prescribed by the AML/CTF Act. The model operates as follows:

• The first line consists of business and operational teams applying customer due diligence, carrying out controls, identifying unusual activity and escalating exceptions.
• The second line consists of financial crime compliance and risk functions overseeing the AML/CTF program, advising on risk, testing compliance and challenging control performance. The AML/CTF compliance officer will ordinarily sit within this function.
• The third line is internal audit, which provides independent assurance over governance, risk management and controls.

Each line should retain records showing its work, while the governing body remains responsible for oversight under Section 26H of the AML/CTF Act.

What Must a Bank’s ML/TF Risk Assessment & AML/CTF Policies Cover?

Assessing ML/TF & Proliferation Financing Risk

Under Sections 26C–26E of the AML/CTF Act, a bank must identify and assess the money laundering, terrorism financing and proliferation financing risks it may reasonably face when providing designated services. The assessment must reflect the bank’s nature, size and complexity, including:

• its customer types;
• its products and services;
• its delivery channels;
• its technologies; and
• its jurisdictions.

The assessment must be reviewed and updated under Section 26D of the AML/CTF Act and applicable requirements in the AML/CTF Rules, including Rule 5-1. A bank should record the following before introducing a new product, payment channel or customer segment:

• review triggers;
• changes in risk;
• control effectiveness; and
• the treatment of residual risks.

Customer Due Diligence & Beneficial Ownership

Part 2 of the AML/CTF Act requires initial and ongoing customer due diligence. Section 28 addresses initial customer due diligence and Section 30 addresses ongoing customer due diligence, while Sections 31 and 32 deal with simplified and enhanced customer due diligence. The AML/CTF Rules also address:

• corporate and trust customers;
• beneficial ownership;
• politically exposed persons; and
• higher-risk relationships.

A bank’s policies should explain how it:

• identifies and verifies customers and beneficial owners;
• assigns customer risk ratings;
• obtains information about the purpose of a relationship; and
• applies enhanced customer due diligence.

Where required, enhanced measures may include establishing source of funds and source of wealth. Qualifying existing customers may remain subject to transitional customer identification procedures for specified classes, but transitional arrangements do not remove ongoing customer due diligence obligations or responses required when risk changes.

Transaction Monitoring & Suspicious Matter Reporting

A bank’s AML/CTF policies must describe:

• how it monitors and analyses customer transactions and behaviour;
• whether monitoring is automated or manual; and
• how unusual activity is identified, investigated and escalated.

Rule 5-12 of the AML/CTF Rules requires policies to support timely review of material relevant to potential suspicious matters and a determination, as soon as practicable, of whether reasonable grounds for suspicion exist.

Section 41 of the AML/CTF Act establishes suspicious matter reporting obligations. Once the statutory reporting obligation arises, the applicable report must usually be submitted within 24 hours for relevant terrorism financing suspicions or within three business days for other reportable suspicious matters. Rule 5-13 of the AML/CTF Rules requires safeguards addressing tipping-off risks, including:

• confidentiality controls; and
• appropriate use of sensitive information.

Correspondent Banking Transfers of Value & Sanctions

Banks providing correspondent or nested services must address the additional risks created by indirect access to accounts, payment systems and financial services. Section 96 of the AML/CTF Act requires the following for relevant correspondent banking relationships, with ongoing assessments and record retention obligations:

• due diligence;
• written records; and
• senior officer involvement.

The bank’s policies should also address transfer-of-value requirements under the AML/CTF Rules, including the responsibilities of:

• ordering institutions;
• intermediary institutions; and
• beneficiary institutions.

Rule 5-3 of the AML/CTF Rules requires policies dealing with compliance with the Autonomous Sanctions Act 2011 (Cth) and the Charter of the United Nations Act 1945 (Cth), including controls for:

• screening;
• escalation; and
• restricted dealings.

Personnel Due Diligence & Training

Rule 5-8 of the AML/CTF Rules requires AML/CTF policies to provide for personnel due diligence, including assessment of relevant skills, knowledge, expertise and integrity before and during employment or engagement. The bank should:

• identify roles requiring screening;
• set review triggers; and
• document responses to adverse findings.

Rule 5-9 of the AML/CTF Rules requires role-based AML/CTF training that reflects personnel functions, responsibilities and the bank’s financial crime risks. Training arrangements should cover:

• customer-facing staff;
• investigators;
• payment operations;
• technology teams;
• senior managers; and
• other relevant personnel.

Training arrangements should also include records of completion, retraining and checks on whether training is being applied.

Documenting the Program

Section 26N of the AML/CTF Act requires a bank to document its AML/CTF program and other prescribed matters within the periods specified by the AML/CTF Rules. Rule 5-15 requires the risk assessment and AML/CTF policies to be documented before the bank first provides a designated service to a customer.

Under Rule 5-15(2) of the AML/CTF Rules, an update to the ML/TF risk assessment or AML/CTF policies must be documented within 14 days after the update occurs. The bank should retain:

• approval records;
• written notifications to the governing body;
• operational procedures;
• control descriptions; and
• supporting records showing that the documented program matches the controls operating across the banking business.

How Can a Bank Show Its AML/CTF Program Is Working?

Ongoing Monitoring & Reporting to the Board

A bank should use compliance testing and management information to show whether its AML/CTF controls are designed appropriately, operating as intended and responding to identified risks. Sections 26F and 26H of the AML/CTF Act, together with Rules 5-6 and 5-7 of the AML/CTF Rules, support monitoring and reporting arrangements that allow the governing body to perform its oversight role.

Board reporting should address matters such as:

• customer due diligence backlogs and beneficial ownership gaps;
• transaction monitoring coverage, alert volumes and investigation delays;
• suspicious matter reporting timeliness and quality;
• sanctions screening results and unresolved matches;
• compliance testing results and overdue remediation; and
• material system, staffing or control weaknesses.

A bank should maintain an issue register recording the affected control, risk exposure, responsible owner, target date and validation outcome. Material or systemic issues should be escalated to senior management and the governing body through documented reports, questions, decisions and follow-up actions.

Independent Evaluations

Section 26F(4)(f) of the AML/CTF Act requires AML/CTF policies to address independent evaluations of the bank’s AML/CTF program. Rule 5-10 of the AML/CTF Rules requires the evaluation to:

• examine the ML/TF risk assessment;
• assess the design of AML/CTF policies;
• test compliance with those policies; and
• evaluate how the bank identifies, assesses, manages and mitigates its financial crime risks.

The evaluator must be suitably independent and have expertise appropriate to the bank’s nature, size and complexity. The written report must record the findings and be provided to the governing body and the senior managers responsible for approvals under Section 26P of the AML/CTF Act.

The bank’s policies must set the evaluation frequency, subject to the statutory maximum interval of three years. For an existing bank, the first post-reform evaluation is subject to the transitional deadline outlined above.

Acting on Findings

An evaluation finding should trigger assessment of the affected risk, control, product, customer group and reporting obligation. Section 26D of the AML/CTF Act requires review and updating of the ML/TF risk assessment in accordance with applicable requirements, including Rule 5-1 of the AML/CTF Rules. Rule 5-4 of the AML/CTF Rules requires policies to address updates following adverse evaluation findings.

Remediation records should identify:

• the root cause and risk exposure;
• the corrective action and responsible owner;
• any interim control;
• the target completion date; and
• the testing required before closure.

Any resulting updates are subject to the senior manager approval and governing body notification requirements under Section 26P of the AML/CTF Act outlined above.

Lessons From AUSTRAC’s Enforcement Action Against Banks

AUSTRAC’s enforcement action against major banks shows why a written AML/CTF program is not enough. In June 2018, the Federal Court ordered the Commonwealth Bank of Australia to pay a $700 million civil penalty following proceedings concerning threshold transaction reporting and financial crime risk controls. The matter highlights the need to include automated banking channels within monitoring and reporting systems.

In October 2020, the Federal Court ordered Westpac Banking Corporation to pay a $1.3 billion civil penalty following proceedings involving more than 19 million contraventions of the AML/CTF Act, including deficiencies in international funds transfer reporting.

These historical matters arose under the former framework, but they identify weaknesses that remain relevant to bank programs:

• products or payment channels omitted from the ML/TF risk assessment;
• incomplete transaction data or monitoring coverage;
• reporting failures that continue over extended periods; and
• insufficient escalation of material weaknesses to senior management and the governing body.

A bank should test whether its current controls cover every designated service, payment channel and relevant customer segment, and whether remediation is independently checked before an issue is closed, with advice from AML/CTF compliance lawyers for banks at AFSL House if remediation issues arise.

How Does AML/CTF Governance Fit With APRA’s Prudential Framework?

Including AML/CTF Risk in the CPS 220 Risk Management Framework

APRA’s Prudential Standard CPS 220 Risk Management (‘CPS 220’) requires relevant APRA-regulated institutions to maintain a risk management framework. This framework includes:

• risk management strategy;
• risk appetite arrangements; and
• supporting controls.

Where AML/CTF risks are material, the bank should reflect them in its enterprise risk management processes and board reporting.

The AML/CTF risk assessment under the AML/CTF Act remains separate from the CPS 220 framework. A bank should assess whether significant AML/CTF findings amount to a significant breach of, or material deviation from, its risk management framework when preparing its annual risk management declaration to APRA.

Outsourced AML/CTF Functions & CPS 230

Various providers may perform important AML/CTF functions for a bank, including:

• know-your-customer (‘KYC’) providers;
• sanctions screening tools;
• transaction monitoring systems; and
• data-management providers.

Outsourcing does not transfer the bank’s responsibilities under Section 26F of the AML/CTF Act. Where a bank relies on another reporting entity’s customer identification or verification, Section 37A of the AML/CTF Act and the associated AML/CTF Rules must be assessed separately from ordinary outsourcing.

APRA’s Prudential Standard CPS 230 Operational Risk Management (‘CPS 230‘) may also apply to material service provider arrangements, including controls for:

• data accuracy;
• system availability;
• incidents;
• continuity; and
• access to records.

Board Composition & Fit & Proper Requirements

APRA’s Prudential Standard CPS 510 Governance supports effective board oversight within APRA-regulated institutions. APRA’s Prudential Standard CPS 520 Fit and Proper (‘CPS 520’) requires relevant institutions to assess whether individuals occupying specified positions are suitable to perform their responsibilities.

The AML/CTF compliance officer has separate eligibility requirements under Section 26J of the AML/CTF Act and Rule 5-14 of the AML/CTF Rules. A compliance officer may also fall within the scope of APRA’s CPS 520 where the role meets the applicable definition of a responsible person, but appointment to the AML/CTF role does not automatically establish that classification.

Coordinating AUSTRAC & APRA Engagement

A serious AML/CTF failure may also indicate weaknesses in a bank’s operational controls, technology, governance or wider risk management framework. A transaction monitoring failure, for example, may raise concerns under the AML/CTF Act while also requiring assessment under APRA’s prudential requirements.

AUSTRAC and APRA have arrangements for regulatory cooperation and information sharing within their statutory functions. A bank should assess each regulator’s reporting requirements, thresholds and processes separately, while maintaining:

• a consistent factual record;
• clear responsibility for remediation; and
• explanations for any differences between reports.

Conclusion

Since 31 March 2026, AML/CTF compliance for Australian banks has centred on board oversight, an approved ML/TF risk assessment, effective AML/CTF policies and evidence that controls operate as intended. Transitional arrangements, independent evaluations, customer due diligence, transaction monitoring and reporting require each bank to maintain records supporting its position with AUSTRAC and, where relevant, APRA.

For banks, credit unions and mutual banks needing help, contact AFSL House for AML/CTF banking compliance support to discuss designing, reviewing or independently evaluating an AML/CTF program. AFSL House can assist with governance arrangements, risk assessments, policies and compliance frameworks, helping your banking institution address its responsibilities with clear legal support.

Frequently Asked Questions

Disclaimer: All information provided in this article is strictly general in nature and is not intended to be, nor should it be relied upon as, legal advice.