In preparation for the extension of the AML/CTF regime to Tranche 2 entities AUSTRAC has updated its regulator statement of expectations, as well as reporting forms.

AUSTRAC has updated its regulator statement of expectations for businesses in meeting their AML/CTF obligations.

The update sets out AUSTRAC’s expectations on managing risks where there is no settled AUSTRAC position, and meeting AUSTRAC’s regulatory expectations in FY26/27.

AUSTRAC changes transaction reporting forms from 1 July 2026
AUSTRAC has changed the transaction reporting forms, which will apply from 1 July 2026 to new reporting entities.

The changes include new threshold transaction report and suspicious matter report forms.

Existing reporting entities enrolled by 30 March 2026 will be able to transition to the new forms at any time between 1 July 2026 and 30 March 2029.

Austrac AML Transitional Rules update

Part 4 of the Transitional Rules delays the commencement of the International Value Transfer Services (IVTS) reporting framework and retains the existing International funds transfer instructions (IFTI) reporting framework, and its operation, until the commencement of the IVTS framework.

Reporting entities that were subject to IFTI reporting obligations as at 30 March 2026 will continue to submit IFTI reports until they transition to the new IVTS reporting framework.

Under the Transitional rules, the new reporting obligation for international value transfer services are deferred until 31 March 2029, unless the reporting entity elects to transition earlier.

Existing international funds transfer reporting obligations will continue to apply until then.

More transitional rules

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

The Australian Privacy Commissioner’s recent activity includes: consultation on Guidance for Transparency in Automated Decision Making, updating its Chapter 3 Australian Privacy Principles guidelines on the collection of personal information by new technology, as well as the Privacy Commissioner’s recent decision in Commissioner Initiated Investigation into IRE Pty Ltd’s rental digital platform and a compensation order against American Express Australia Limited for an insider security breach.

Consultation on Guidance for Transparency in Automated Decision Making
From 10 December 2026, APP entities that use personal information in automated decision-making (ADM) with the potential to affect rights or interests will be required to provide information in their privacy policies about the kinds of personal information used and the kinds of decisions made using ADM. Background.

The Office of the Australian Information Commissioner (OAIC) has published an Automated Decision-Making Issues Paper prior to giving guidance on the automated decision-making (ADM) transparency obligation.

The Issues Paper explains that the types of ADM that require disclosure in APP entities’ privacy policies are those that meet the following criteria:
* the entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision; and
* the decision could reasonably be expected to significantly affect the rights or interests of an individual; and
* personal information about the individual is used in the operation of the computer program to make the decision or do the thing that is substantially and directly related to making the decision.

The Paper observes that a wide range of technologies are likely to fall within the definition of “computer program”, including commonly-used software, apps, or word-processing tools.

The OAIC says that generative AI tools used to generate text, images, videos, code or synthesis, including chatbots, all fall within the definition of computer program for the purpose of the ADM obligation.

Regulated entities will need to assess the computer programs that they use that meet the disclosure criteria.

Updated Australian Privacy Principle 3 guidance
The OAIC has updated its guidance on APP 3 (collection of solicited personal information) to reflect recent determinations, and to include examples which apply the APP 3 principles to current technology use cases such as artificial intelligence and facial recognition technology, and current practices like data scraping, tracking pixels and data broking.

The changes to the APP 3 guidelines also clarify how proportionality is implicit in the APP 3 requirements, requiring entities to take a data minimisation approach.

Data minimisation is the practice of limiting the collection of all information, but especially personal information.

Financial institution insider security risk
The Australian Privacy Commissioner has ordered American Express Australia Limited (AMEX) to compensate a complainant following a finding of interference in their privacy by its employee.

In the determination in the matter of ‘BAM’ and American Express Australia Limited the Australian Privacy Commissioner found that AMEX interfered with the complainant’s privacy under the Privacy Act 1988 (Cth), by failing to take such steps as were reasonable in the circumstances to protect the complainant’s personal information from unauthorised access by employees, in breach of Australian Privacy Principle (APP) 11.1.

The findings discussed the issue of insider security risk within a financial institution.

The determination examined circumstances in which an AMEX employee’s authorised access to relevant systems enabled them to view a range of information about AMEX customers, including travel and hotel bookings, and financial transactions.

A former AMEX customer subsequently alleged that the employee had accessed their account and personal information for purposes outside of legitimate business purposes.

The Australian Privacy Commissioner concluded that AMEX had failed to meet its obligation under Australian Privacy Principle (APP) 11.1 to take reasonable steps to protect the information it held from unauthorised access particularly from insider security risks.

Under the determination, for interference with the complainant’s privacy, American Express Australia Limited must:
* pay the complainant specified amounts for economic loss, for non-economic loss caused by the interference with the complainant’s privacy, and for reimbursement of expenses the complainant incurred making the complaint;
* issue a written apology to the complainant, acknowledging its interference with the complainant’s privacy, signed by a representative of AMEX with sufficient seniority;
* implement technical controls across the relevant systems, to enable AMEX to restrict its employees’ access to specific customer information, including to protect the personal information of vulnerable or high-profile customers;
* implement account-level access logging and action logging across the relevant systems to the extent these are still in operation, to create time-stamped log entries when an employee accesses or takes action on a customer’s records.

Data minimisation and dark patterns
The Privacy Commissioner’s recent decision in Commissioner Initiated Investigation into IRE Pty Ltd (Privacy) [2026] AICmr 24 considered the collection of personal information for the purpose of processing tenancy applications and the role of RentTech platforms, such as 2Apply.

The Privacy Commissioner observed that RentTech platforms are more than just a ‘middleman’ between renters and real estate
agents; they directly collect and enable the collection of personal information.

This determination reinforces that the operators of RentTech and other online platforms may bear their own obligations under the Privacy Act to handle personal information in a manner consistent with the Australian Privacy Principles.

The Privacy Commissioner concluded that IRE Pty Ltd, trading as InspectRealEstate, interfered with the privacy of individuals whose personal information was collected via 2Apply between March 2020 and 18 March 2025, within the meaning of s 13(1) of the Privacy Act 1988 (Cth), by:
a. collecting personal information that is not reasonably necessary for its functions or activities, in breach of Australian Privacy Principle (APP) 3.2; and
b. collecting personal information by unfair means, in breach of APP 3.5.

The decision considers the role of ‘online choice architecture’ practices, ‘dark patterns’, and Online Choice Architecture practices which can include confirmshaming; biased framing; and bundled consent.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

ASIC v Bekier (Star)
In Australian Securities and Investments Commission v Bekier (Penalty Judgment) [2026] FCA 756 the Federal Court disqualified former Star Entertainment Group Limited executives Mathias Bekier and Paula Martin from managing corporations for six and seven years respectively and ordered them to pay pecuniary penalties for breaching their duties by failing to properly manage serious risks at a publicly listed casino operator . Background.

The Court ordered:
* Mr Bekier, the former Chief Executive Officer and Managing Director, to pay a pecuniary penalty of $700,000 .
* Ms Martin, the former General Counsel, Company Secretary, and Chief Legal and Risk Officer, to pay a pecuniary penalty of $400,000.

ASIC V Westpac (Hardship case)
In Australian Securities and Investments Commission v Westpac Banking Corporation [2026] FCA 651, Westpac was ordered to pay $26 million in civil penalties for failing to respond to customers who were facing financial hardship.

Westpac contravened section 72 of the National Credit with respect to a total of 277 online hardship notices within the time required by law.

The Court also accepted that Westpac failed to engage in credit activities efficiently, honestly and fairly as required by section 47 of the Credit Act due to its failure to implement adequate systems, controls, risk reviews, investigations, monitoring and analysis of the systems and processes it utilised in relation to online hardship notices.

The requests were made by customers of Westpac and its subsidiaries St George Bank, Bank SA and Bank of Melbourne – who notified they were experiencing financial hardship and were struggling to meet repayments on products including home loans, credit cards, personal loans and car loans.

Scam protection failures
In ASIC v HSBC Bank, ASIC announced that the Federal Court ordered HSBC Bank Australia Limited (HSBC) to pay a $35 million penalty and to publish adverse publicity orders on its website, its app and in letters to impacted customers after the bank admitted to serious failures in protecting customers from scams.

The Court found that HSBC had implemented scam controls on some of its payment systems but did not implement the key controls on the IAT (internal) payment rail, where the majority of customer losses occurred.

HSBC admitted to failures in relation to the ePayments Code because it took too long to investigate customer scam reports – 144 days on average – and it did not apply rules in the Code for determining when customers or the bank should bear the losses from scams. HSBC also admitted that it did not have adequate systems in place to help customers get back into their banking after they had been scammed.

The Court held that HSBC’s failures in respect of the ePayments code were widespread and systemic.

Following ASIC’s investigation, HSBC has established a large-scale remediation program that, to date, has paid around $21.5 million in compensation, with further payments to come before the end of July 2026. HSBC has also recovered $6.5 million and returned those funds to customers.

Overcharging on consumer goods credit contracts
In Australian Securities and Investments Commission v Walker Stores Pty Ltd (In Liquidation) [2026] FCA 665 the Federal Court ordered a $33.5 million penalty against online retailer Walker Stores Pty Ltd (in liquidation), which traded as Snaffle, for unlawfully overcharging tens of thousands of consumers under credit contracts.

Snaffle carried on an online business supplying consumer goods, including home appliances and furniture to consumers by way of “credit contracts” with repayments by instalments over 12, 24 or 36 months.

Between September 2021 and 27 February 2025, Walker Stores entered into 38,562 credit contracts.

By charging consumers significantly more under those credit contracts than it was permitted to, and by failing to disclose to consumers information about those credit contracts, Walker Stores contravened the requirements of the Credit Code in 3 ways:.
First, by entering into contracts pursuant to which it sold goods at marked-up prices, Walker Stores breached s 32A of the Code, which imposes a cap on the cost of credit by way of the annual cost rate or ACR, and thereby contravened s 24(1) of the Code.
Second, the contract documents comprising each sample contract failed to set out the cash price and amount of credit provided, and thereby contravened ss 17(3)(a)(i) and 17(3)(c) of the Code, which is a “key requirement” contravention but not a civil penalty contravention.
Third, with respect to all 38,562 credit contracts entered into during the relevant period including the sample contracts, Walker Stores imposed an interest charge in excess of the maximum amount permitted under s 28 of the Code.

High Court decides digital asset product is a financial product
In Australian Securities and Investments Commission v Web3 Ventures Pty Ltd [2026] HCA 21 the High Court decided that the fixed-yield digital asset product ‘Earner’ offered by Block Earner was a financial product as it was a facility through which an investor made a financial investment., and that Block Earner consequently required an Australian financial services licence.
Background.

The High Court also accepted ASIC’s argument that Earner was a derivative as the amount returned to investors varied by reference to the value of the digital asset and exchange rates.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

AFCA has published Edition 8 of its Systemic Issues Insight Report, covering systemic issues identified and examples of better practice to prevent systemic issues from arising across the financial services sector in the first half of the 2025–26 financial year.

The report identified cross-sector themes, including failure to reflect obligations in operations, complaint handling failures, system migrations and automation failures, third-party administration and operational risk oversight, claims handling delays and consumer vulnerability not embedded into processes.

It also identifies issues specific to sectors: banking and finance, general insurance, life insurance, Investments and advice, superannuation, and small business.

Outcomes included financial remediation, as well as non-financial remedies such as correction of consumer credit reporting and member account records, improved claims handling oversight, including stronger monitoring of delays and escalation controls, system fixes to address calculation errors, platform configuration issues and transaction processing limits, and operational reforms to better identify and support vulnerable customers.

AFCA observed that systemic issues investigations reflect increasing reliance across financial services on automated workflows, structured decision tools, artificial intelligence and machine learning applications, outsourced administration and system-driven processing.

It says these arrangements can improve efficiency and consistency. However, systemic risk may arise where system outputs are treated as determinative without sufficient human oversight, where configuration settings do not adequately account for exceptions, or where firms lack clear visibility over the performance of outsourced operational processes.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

The Australian Prudential Regulation Authority (APRA) has released for consultation a new draft licensing framework for locally-incorporated Authorised Deposit-taking Institutions (ADIs) as well as a new three tier approach, following the Council of Financial Regulators’ Review into Small and Medium-sized Banks. Background.

The draft framework consists of draft ADI Licensing Criteria and draft ADI Licensing Guidelines.

The three key changes to the ADI licensing framework are:
* Replacing the existing guidelines with legally effective licensing criteria. Applicants must demonstrate that they meet the ADI Licensing Criteria within 12 months of submitting a licensing application;
* Discontinuing the Restricted ADI (RADI) pathway given its limited take-up and the challenges that new entrants using this pathway have faced in developing sustainable business models; and
* Publishing all licensing decisions including refusals, to improve the transparency of APRA’s decision-making.

Third tier for Most Significant Financial Institutions
APRA has also confirmed it will introduce a formal three-tiered approach to regulation proportionality within the banking prudential framework.

APRA’s new framework will introduce a third tier of Most Significant Financial Institutions (MSFIs) for banks with total assets greater than $300 billion.

It will also raise the asset value threshold for banks to qualify as a Significant Financial Institution (SFI) from $20 billion to $30 billion, and automatically provide a 12-month transition period when a regulated institution moves to a higher tier.

APRA also commits to providing non-SFIs with additional time to comply with new and revised prudential requirements when it is appropriate to do so.

The changes will take effect from 1 July 2026.

The MSFI threshold of $300b is equivalent to around 5 per cent of system assets.

APRA will review the threshold on a regular basis to ensure it remains appropriate.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

Treasury has released for consultation draft codes and rules under the Scams Prevention Framework (SPF). Background.

The Codes establish 4 distinct categories of provisions:

* common provisions that apply across the banking, telecommunications, and digital platforms sectors;
* provisions that apply only to the banking sector;
* provisions that apply only to the telecommunications sector; and
* provisions that apply only to the digital platforms sector.

Compliance with these code obligations is the primary factor when considering
whether a regulated entity has taken reasonable steps for the purposes of the corresponding SPF principles of prevent, detect and disrupt in Division 2 of Part IVF of the Competition and Consumer Act.

The draft Codes set out:
Governance requirements;
Prevention requirements;
Detection requirements;
Reporting requirements;
Disruption requirements;
Response requirements; and
Internal dispute resolution rules.

The draft rules specify that a person is not an SPF consumer of a covered banking service where they do not have a direct relationship with the regulated entity providing the service (the bank), or they are not making a payment to, or receiving a payment from, the bank. This exception is intended to ensure that business-to-business banking services, such as those providing back-end payment infrastructure, are not captured by the banking designation.

The draft Internal Dispute Resolution rules provide for automatic reimbursement of scam victims for verified scam losses below $3,000.

While Ministerial Guidance will make it clear that entities should reimburse consumers for scam losses under $3,000, entities will be liable for losses where they have breached their obligations under the SPF for all values of scam losses.

The draft states that where more than one regulated entity has breached its obligations under the SPF, liability should be shared equally between those breaching entities.

While entities will be required to coordinate their response to the consumer, each entity will be responsible for directly reimbursing consumers for any losses the entity is liable for.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

The Australian Prudential Regulation Authority (APRA) and the Australian Securities and Investments Commission (ASIC) have announced that they will streamline aspects of the Financial Accountability Regime (FAR) to reduce regulatory burden without lowering accountability standards.

APRA and ASIC say they will remove key functions requirements from the FAR regulator rules; raise the materiality threshold for notifying APRA and ASIC of changes in accountability; and no longer require information on accountable persons’ direct reports in accountability maps.

ASIC will streamline the responsible manager Australian financial services licensing requirements for FAR entities by reducing the requirements to submit evidence of competence from October 2026.

APRA and ASIC will consult on the changes and aim to implement them by the end of 2026.

APRA has also commenced consultation on an updated draft of CPS 510 Governance, which removes duplicated fit and proper reporting now that Financial Accountability Regime reporting is in place.

The new CPS 510 is designed to:
• strengthen requirements for board governance, conflicts management and the fitness and propriety of directors and executives;
• improve flexibility by enabling boards to delegate APRA’s board requirements in other prudential standards, and by aligning governance requirements with other codes and regimes where appropriate; and
• harmonise requirements by combining five existing prudential standards into one and setting consistent governance minimums for all APRA-regulated entities.

Draft CPS 510 includes a 12-year tenure limit for non-executive directors.

For clarity, tenure includes:
* total time irrespective of whether this has been served in consecutive appointment terms;
* the time an alternate director acts in the capacity as a non-executive director;5 and
* any tenure as a director on a predecessor entity in the event of a merger or transfer.

APRA’s proposal outlines that a Board may approve an extension in each individual circumstance of up to an additional 12 months. APRA proposes that an entity must notify APRA of an extension within 10 days of board approval.

The new standard will be finalised later in 2026 and come into effect in January 2028.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

The government has introduced the Treasury Laws Amendment (Business Registries Stabilisation and Uplift) Bill 2026 into the House of Representatives.

The Bill proposes amendments to the Corporations Act 2001 (Cth) and other legislation to strengthen the Director Identification Number (DIN) regime and link it to ASIC’s Companies Register.

If passed, the Bill will link the DIN to ASIC’s publicly available Companies Register. Companies will be required to provide each director’s DIN to ASIC as part of standard corporate registration and reporting practices, including applications for registration, notification of changes and annual reporting.

The Bill also allows directors to provide an alternative address in place of their usual residential address on ASIC documentation.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

ASIC has updated Information Sheet 294 FAQs: AFS licence applications (INFO 294) to include a new requirement for AFS licensees to submit and maintain their official website URL so it is published on ASIC registers.

AFS licensee website addresses will be published on the ASIC Professional Registers Search from June 2026.

Listing website addresses will enable consumers and businesses to check that they are dealing with genuine AFS licensee websites and combat impersonation scams where criminals copy the name and licence details of AFS licensees to create fake websites.

ASIC has begun to collect AFS licensee website addresses for all existing AFS licensees via the Regulatory Portal on a voluntary basis.

If an AFS licensee provides ASIC with its website addresses (or confirms that it does not operate a website) then they must keep those details up to date. For example, an AFS licensee must inform ASIC, in relation to the websites used to carry on its financial services business, when it starts operating a website, stops using a website address it previously listed, or changes its principal website address.

ASIC has also updated the following information sheets to clarify the scope of permitted activities, advice conduct and disclosure obligations, and ongoing financial and reporting requirements:

* INFO 227 What can limited AFS licensees do?

* INFO 228 Limited AFS licensees: Advice conduct and disclosure obligations

* INFO 229 Limited AFS licensees: Complying with your licensing obligations

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.