The Australian Financial Complaints Authority (AFCA) has released a consultation paper on proposed changes to its Scheme Rules to enable it to consider scam-related complaints under the Scams Prevention Framework (SPF) from 31 March 2027. Background.

The Australian Government has authorised AFCA as the single external dispute resolution scheme to consider scam-related complaints under the SPF about regulated entities under the first three designated SPF sectors; banking, digital platforms and telecommunications.

Consumers who have been impacted by a scam are expected to first raise their concerns directly with the relevant regulated entity through Internal Dispute Resolution. The SPF Codes and Rules are not settled; however, the Government has proposed that regulated entities will be required to co-operate at IDR and that consumers will have the right to escalate a complaint to AFCA if they are unsatisfied with the outcome.

The AFCA Scheme Rules will be organised into separate divisions. These comprise the new Rules that will apply specifically to SPF complaints (the Scam Rules) and the existing Rules for financial services complaints, the Financial Firm Rules.

Some complaints may raise issues across the SPF and other laws (including financial services laws and telecommunications codes). AFCA will determine the most appropriate process to manage them, while maintaining the distinct legal responsibilities under each framework.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

The Australian Banking Association has published an updated industry guideline of good industry practice for how banks may support and provide extra care for customers experiencing financial abuse.

The guideline says that “financial abuse occurs when another person exerts power and control to exploit, monitor or sabotage someone’s access to, or use of, money, finance or property, business assets and liabilities, without their knowledge or consent. In some situations, a person may feel pressured, coerced or unable to refuse a directive from the person causing harm.”

The guideline applies to customers to whom the Banking Code applies. It includes individuals, small businesses and guarantors.

Part B2 of the Banking Code includes a commitment that member banks will take extra care with customers who are experiencing vulnerability, including financial abuse and the abuse of older people.

The guideline explains what financial abuse is, how a bank may recognise that a customer is experiencing financial abuse, and the steps a bank may take to help when they are aware a customer is experiencing financial abuse.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

With Memoranda of Understanding in place between financial services regulators covering information sharing, and in response to increased expectations from the Government, cybersecurity breaches, AI rogue agents attacks and AML/CTF non-compliance by the same organisation can now result in multiple coordinated enforcement actions from ASIC, APRA and Austrac.

It is now accepted that “non-financial risk management” does in fact have significant financial and prudential implications, both for the company itself and its directors and officers.

Your systems need to prevent you from committing a breach but also to identify when a breach occurs so that you can report it to a regulator.

Less than 10 years ago CBA’s Chief Risk Officer told the Banking Royal Commission that “ the state of our systems that recorded and aggregated instances of misconduct … were not particularly advanced. They were not particularly well connected. The difficulty that the bank experienced was that various incidents of misconduct were recorded on different systems in different business units, without necessarily being all encompassed in a single business unit.”

The expectation now is that businesses have systems with high-quality data accessible to identify how, or to what extent, the entity as a whole is failing to comply with the law.

It is not uncommon now for APRA to impose licence conditions and capital requirements on a regulated entity when APRA says the entity “does not have a complete view of its regulatory obligations, material risks and key controls; there are material deficiencies in governance, accountability, compliance management, risk oversight and risk management capability; and key weaknesses have persisted despite several years of remediation activity”.

An Austrac investigation can lead to a penalty action as well as an ASIC action for breach of financial services licence obligations.

And for an APRA-regulated entity, additional APRA licence conditions and capital requirements can be imposed as well as ASIC actions against directors and executives.

Under the Financial Accountability Regime (previously the Banking Executive Accountability Regime) directors and executives are financially accountable for past deficiencies in relation to cybersecurity protection and enforcement of anti-money laundering laws.

Proving that you have addressed alleged deficiencies requires documenting decisions and maintaining records.

Otherwise, the company will face remediation and compliance costs as well as a penalty, and executives will risk losing bonuses and incentives.

And for a listed company, there is the risk of a shareholder class action.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

In a recent speech ASIC Commissioner Simone Constant stated that ASIC is undertaking active surveillances across wholesale and retail funds to check whether all private credit participants are adopting its 10 principles for private credit (pdf) as a practical benchmark for self-assessment and uplift. Background

She discussed the role of fund managers, institutional investors and superannuation trustees, and valuers, auditors and ratings agencies in ensuring that investors can have confidence that the information and the assessments they are relying on are sound.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

The Australian Attorney-General has released a Consultation Paper and Exposure Draft Privacy Amendment (Personal Data Protection) Bill 2026 to modernise and strengthen Australia’s privacy laws as well as responding to emerging risks from new technologies, including artificial intelligence, wearable surveillance technologies (such as smart glasses and ear buds) and connected vehicles.

It is also intended to provide greater certainty for businesses and other regulated entities.

The paper canvasses a range of proposed reforms, including:
* amending the definition of personal information to cover information that ‘relates to’ an individual who is identified or reasonably identifiable, and a new definition of reasonably identifiable is introduced.
* making it clear that personal information is ‘collected’ when an entity includes it in a record or generally available publication, regardless of the source from which, or how, the information is obtained. The amendments also clarify when entities will be taken to collect sensitive information that is derived from other personal information, regardless of whether the entity makes a separate record of that sensitive information.
* introducing a definition of disclosure based on whether an entity makes personal information accessible to another person or body, including where personal information is transmitted or stored overseas.
* strengthening and clarifying requirements for data security and minimisation, and responses to data breaches
* introducing a right for individuals to request the erasure of personal information held by large digital platforms, and an exception where compliance is technically impossible or infeasible and
* supporting research and innovation by simplifying research exceptions and facilitating the handling of personal information for ethically approved human research.

Existing APPs 3, 4 and 6 would be replaced with a new framework for the collection, use and disclosure of personal information. This framework is centred around a new test which permits the handling of personal information only where it is fair and reasonable in the circumstances, with reference to a non-exhaustive list of factors. There are exceptions where a permitted general or health situation applies or the information handling is required or authorised by law.

Data breach notification
The proposed amendments provide that an entity must, within 72 hours of becoming aware of reasonable grounds to believe that an eligible data breach has occurred, give the Information Commissioner a statement that notifies the Commissioner of the eligible data breach and sets out required content.

The introduction of the 72-hour notification requirement would not alter the obligation for assessment of suspected eligible data breaches. An entity that has reasonable grounds to suspect that there may have been an eligible data breach but has not yet established reasonable grounds to believe that an eligible data breach has occurred, must continue to take all reasonable steps to ensure that the assessment is completed within 30 days.

The small business exemption has not been removed.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

The National Consumer Credit Protection Amendment (Small Business Exemption) Regulations 2026 have been registered to amend the National Consumer Credit Protection Regulations 2010 by extending the existing exemption from responsible lending obligations for small business borrowers for 10 years from 4 October 2026.

The exemption provides that mixed purpose loans to a consumer (for example, where a small business operated by an individual applies for a single loan to be used for both personal and commercial purposes) are exempt from responsible lending requirements so long as there is a ‘genuine’ small business purpose component that is not minor or incidental.

Under the genuine purpose test, the lender need only establish that there is a genuine business purpose that is not minor or incidental to the overall purposes of the related credit provision.

For the purposes of the exemption, a small business meets the test in the Australian Small Business and Family Enterprise Ombudsman Act 2015 by having fewer than 100 employees or revenue of $5 million or less in the previous financial year.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

In Australian Securities and Investments Commission v Venture 5 Group Pty Ltd [2026] FCA 1278 the Federal Court of Australia imposed a penalty of $3.5 million against Venture 5 Group Pty Ltd (trading as CashnGo) regarding its use of, and reliance on, unfair contract terms in more than 47,000 standard form small amount credit contracts (SACCs) with consumers.

CashnGo admitted that, after a consumer missed a repayment, its Default Term and Authority Terms allowed CashnGo’s automated systems to monitor a consumer’s bank account balance, repeatedly attempt to make withdrawals to recover the missed payment, as soon as funds became available, without prior notice of the timing, frequency or amount of the intended unscheduled withdrawal, and undertake the Unscheduled Withdrawals Practice without giving consumers the ability to opt out.

CashnGo admitted, and the Court ordered, that those terms are unfair.

Each Indemnity Term would compel a consumer to indemnify CashnGo for any penalties or costs incurred by CashnGo in litigation involving the exercise of its right to conduct the Unscheduled Withdrawals Practice. Further, consumers would be required to indemnify CashnGo even in respect of CashnGo’s conduct that was intentional, negligent or dishonest.

The Limitation of Liability Terms would prevent consumers from enforcing their rights including for intentional or negligent acts by CashnGo which cause loss and damage to consumers.

The Court ordered that the Default and Authority terms are void from 14 September 2026 in all SACCs current consumer contracts. The Court also ordered that from 14 September 2026, CashnGo introduce replacement terms into its contracts, which will allow consumers to opt out of CashnGo’s Unscheduled Withdrawals Practice.

CashnGo also admitted, and the Court held, that its Limitation of Liability terms and Indemnity terms were unfair, and the Court declared those terms void from the start of all SACCs entered into with consumers from 20 April 2022, which means those terms should be treated as having never formed part of the contracts.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

Treasury has released a draft Treasury Laws Amendment (Banning Unfair Non-Competes) Bill 2026 to ban non‑compete clauses for Australian workers under $190,100 per year (the Fair Work Act high‑income threshold).

The Bill will amend the Competition and Consumer Act to cover arrangements between businesses that prevent or restrict the hiring of staff (‘no-poach’ agreements) or fix, control or cap remuneration and other employment conditions (‘wage-fixing’ agreements).

The amendments also introduce narrow exemptions for no-poach and wage-fixing agreements in limited circumstances, including joint ventures, secondments, labour-hire arrangements and professional sporting leagues, where specific conditions are satisfied.

The Government will also consult on:

* a ban of co‑worker non‑solicitation clauses;
* a ban on no‑poach and wage‑fixing arrangements;
* a ban on cascading restraint of trade clauses; and
* appropriate exemptions and safeguards to protect legitimate business interests.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

Treasury has published a new Financial Innovation Strategy that will support a coordinated whole-of-government approach to financial innovation, starting with changes to the ASIC Regulatory Sandbox and the Consumer Data Right.

The Government has announced that ASIC will be authorised to modernise the sandbox framework to better support testing and adoption.

They will repeal the existing Enhanced Regulatory Sandbox legislative framework and replace it with a more flexible model administered through ASIC’s existing powers.

They have identified a growing role for targeted sandboxes in strategically important areas such as AI, tokenised assets, digital money and digital financial market infrastructure.

They will establish a Digital Financial Market Infrastructure (DFMI) sandbox to provide a regulator-supported environment to trial innovative market models and infrastructure.

It will enable participants to assess how these models interact with existing trading, clearing and settlement arrangements, and identify whether adjustments to regulatory settings may be needed to facilitate innovation while maintaining market integrity and stability.

The Government will improve the Consumer Data Right so it is easier to use and better targeted to high-value use cases.

This includes changes to how business consumers nominate representatives to share data, expanding third-party disclosures, implementing a minimum threshold in the banking sector and continuing the rollout of the CDR to the non-bank lending sector.

Treasury, jointly with the ATO, is developing a business case to explore whether taxpayers could share ATO-held tax data through the CDR.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

The Cash Distribution Framework Bill 2026 has been passed by both Houses of Parliament and is awaiting Royal Assent.

UPDATE: The Act received Royal Assent on 26 August 2026.

The bill establishes a framework to regulate cash distribution services in Australia, including an oversight framework for service agreements and access agreements and powers for the Australian Competition and Consumer Commission to set service-level standards.

It focuses primarily on the cash-in-transit sector, which has become concentrated around one dominant provider.

Cash distribution services include cash access facilities, cash storage and processing, cash transport and cash access support.

The main elements of the Bill include:
* the Reserve Bank of Australia can designate an entity that has a significant role in the cash distribution system. The designated entity is then subject to the regulatory framework.
* the ACCC can oversee pricing and other terms in agreements covering critical cash distribution services and access to facilities, and to set service-level standards to support access to cash.
* the Reserve Bank crisis readiness and resolution powers enable the RBA to step in if a designated provider becomes financially unviable, helping to ensure cash distribution does not stop.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.