ASIC has published a report on its review of eight lenders from the motor vehicle finance (car loans) sector.

It focused on consumer outcomes, including for consumers in regional and remote locations and First Nations consumers. It found significant indicators of consumer harm.

ASIC’s recommendations included that the lenders should:
* better articulate their products, including key features and respective target markets via published target market determinations (TMDs);
* address problematic sales practices (e.g. high-pressure sales tactics and overriding consumer objections to certain types of finance);
* implement better governance frameworks to ensure adequate oversight of intermediary brokers and dealers;
* improve distribution conditions, given the market’s overwhelming reliance on distributors, including outlining how lenders will monitor compliance with those conditions;
* develop stronger product review triggers and risk frameworks, including using available harm indicators and internal data to ensure their products reach the right target market; and
* improve hardship policies and practices, such as enhanced communications on voluntary surrender and time‑to‑sell arrangements, so consumers can be aware of these options.

Legislative obligations which apply to car loans include:
* the National Consumer Credit Protection Act 2009 which applies to consumer credit, such as secured car loans: and
* the design and distribution obligations within the Corporations Act 2001, which require financial service product issuers, such as lenders and relevant product distributors, to take a consumer-centric approach to the design and distribution of financial products, along with stated conditions for distribution and triggers for product review.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

The Australian Government has responded to the Senate Rural and Regional Affairs and Transport Committee report on bank closures in regional Australia. Background.

The response addresses the 8 recommendations from the committee’s report.

The government agrees with the following 2 recommendations in principle:
* “that the Australian Government commission the Australian Competition and Consumer Commission to explore the barriers to customers switching banks, with a view to allowing those that open and/or maintain branches in regional, rural and remote
towns to attract more business”; and
*”that the Australian Government works closely with the banks and Australia Post, to require all major banks to have agreements with Bank@Post and to harmonise the terms of Bank@Post agreements to improve fairness and sustainability. Specifically, agreements should include increased deposit limits to support small businesses, provisions to facilitate identification verification, and to handle issues around temporary account closures or multiple signatory requirements. Major banks that do not put in place agreements with Bank@Post to deliver financial services should pay an increased supplementary levy.”

The Government says it has secured new and updated agreements between all four major banks, Macquarie Bank and Australia Post for Bank@Post since the publication of the report.

The Government does not support the Committee’s recommendation that the Australian Government commission an expert panel to investigate the feasibility of establishing a publicly owned bank.

It has noted the 5 other recommendations.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

The Reserve Bank of Australia (RBA) has published an Issues Paper seeking feedback on issues that should be prioritised to promote competition, efficiency and safety in payments as part of its Review into Payments System Regulation.

The Issues Paper covers merchant payment choice, competition between card payments and account-to-account payments, mobile wallets, buy now pay later, non-designated payment systems, and fraud prevention and cryptographic resilience.

The RBA expects to publish a set of regulatory priorities by the end of 2026.

The RBA intends to commence a public consultation process by mid-2027 on the prioritised issues and any proposed regulatory action to address those issues.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

The Commonwealth Budget has confirmed the Regulatory Initiatives Grid statement that the exemption of small business loans from the National Credit Act responsible lending obligations will be extended for a further 10 years to October 2036.

The Regulations currently provides that certain mixed-purpose small business loans are exempt from the responsible lending obligations so long as there is a ‘genuine’ business purpose that is not minor or incidental to a personal borrowing.

Treasury will consult on exposure draft legislation to update the National Consumer Credit Protection Regulations 2010 ahead of the current 3 October 2026 expiry.

It will apply to loans to businesses with fewer than 100 employees or a revenue of $5million or less in the previous financial year. Background.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

The Government has introduced the Cash Distribution Framework Bill 2026 into the House of Representatives to regulate cash distribution services in Australia and providers of those services.

It introduces a crisis management and resolution regime for cash distribution services that are critical to the availability of cash in Australia for those who need or want to use it.

The framework will be administered by the ACCC and the RBA. 

The RBA can designate an entity that has a significant role in the Australian cash distribution system. A designated entity is then subject to the regulatory framework, with the exercise of some of its powers, such as crisis resolution actions, available only in certain circumstances.

If passed, the Bill requires a designated entity to provide the ACCC with a list of cash distribution service agreements and access agreements.

It gives powers for the ACCC to set service-level standards.

As examples, the following services are considered “cash distribution services”:
the collection, transport or delivery of cash, including collection from the issuer of the cash for circulation;
* the administration of requests for cash;
* receiving and dealing with cash on bailment;
* the transfer or trading of cash at, or between, locations where cash is routinely stored, processed or packaged;
* the sorting, storing, processing or packaging of cash;
* quality control or counterfeit detection in relation to cash;
* facilitating the supply of cash from the issuer to cash distribution service providers and/or service points that enable deposits or withdrawals of cash (for example, bank branches, ATMs, post office outlets and ethos cash-out terminals);
* restocking or servicing of service points that enable deposits or withdrawals of cash (for example, bank branches, ATMs, post office outlets and EFTPOS cash-out terminals).

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

Recently, regulators have explained how current laws apply to businesses’ use of AI and its risks.

They discussed how companies were using AI in their businesses, how it was being governed and how risks were being managed.

Relevant existing Australian laws include:
• directors’ duties under the Corporations Act 2001;
• obligations of Australian Financial Services Licence holders under the Corporations Act and Australian Securities and Investments Commission Act 2001;
• obligations of APRA-regulated institutions;
• workplace regulation; and
• the Privacy Act 1988 (Cth).

AI advertising
ASIC has updated its guidance in RG 234 to include clarification that the law and ASIC’s guidance also apply to AI-generated advertising. It also discussed the obligation to disclose the features, benefits and risks or limitations of using customer tools and tool capability, including AI-enabled tools.

Automated decision making and disclosure
The Office of the Australian Information Commissioner has published an Automated Decision-Making Issues Paper prior to giving guidance on the automated decision-making transparency obligation.

Frontier AI Models
APRA and ASIC have focused on the risk of “frontier” AI models that can identify vulnerabilities in your systems.

APRA expressed concern that frontier AI is not just a cyber risk issue. It’s a third-party risk, a concentration risk and a sovereign access risk. A critical business process, control or cyber-defence capability that depends on a single offshore frontier AI model may be disrupted not only by an outage or cyber incident but by a regulatory decision made overseas.

See APRA’s Letter to industry

Similarly, ASIC has written to licensees and market participants to urgently strengthen their cyber resilience measures, as frontier artificial intelligence intensifies the global cyber risk environment.

ASIC says that while cyber risk has always existed, misuse of frontier AI models such as Anthropic’s Claude Mythos could expose cyber security vulnerabilities at an unprecedented speed, scale, and sophistication.

Directors’ duties
With respect to directors’ duties, in a recent speech, the Honourable Andrew Bell AC, Chief Justice of the Supreme Court of New South Wales, contrasted a company’s use of AI in its business operations, on the one hand, and the knowledge and use of Gen AI by the company’s directors in the discharge of their duties.

He even considered the concept of AI bots taking on the role of directors, or shadow directors.

ACCC
The ACCC has announced that the Digital Platform Regulators Forum, consisting of the Australian Competition and Consumer Commission (ACCC), the Australian Communications and Media Authority (ACMA), the eSafety Commissioner (eSafety) and the Office of the Australian Information Commissioner, has signed a Memorandum of Understanding to strengthen coordination in their regulation of digital platforms.

The agreement formalises how members will share information and work together on cross-cutting issues, including scams, privacy, online safety and competition concerns.

ACCC has issued its own transparency statement disclosing how it uses AI.

AI Ethics Principles
In 2025, the Commonwealth published 8 AI Ethics Principles covering:
• human, societal and environmental wellbeing;
• human rights, diversity, and the autonomy of individuals;
• fairness to individuals, communities or groups;
• privacy protection and security;
• reliability and safety;
• transparency and explainability;
• contestability; and
• accountability.

These are voluntary guidelines and have not changed the law.

But Boards should review their AI governance against these principles and the statements from the regulators.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

In preparation for the extension of the AML/CTF regime to Tranche 2 entities AUSTRAC has updated its regulator statement of expectations, as well as reporting forms.

AUSTRAC has updated its regulator statement of expectations for businesses in meeting their AML/CTF obligations.

The update sets out AUSTRAC’s expectations on managing risks where there is no settled AUSTRAC position, and meeting AUSTRAC’s regulatory expectations in FY26/27.

AUSTRAC changes transaction reporting forms from 1 July 2026
AUSTRAC has changed the transaction reporting forms, which will apply from 1 July 2026 to new reporting entities.

The changes include new threshold transaction report and suspicious matter report forms.

Existing reporting entities enrolled by 30 March 2026 will be able to transition to the new forms at any time between 1 July 2026 and 30 March 2029.

Austrac AML Transitional Rules update

Part 4 of the Transitional Rules delays the commencement of the International Value Transfer Services (IVTS) reporting framework and retains the existing International funds transfer instructions (IFTI) reporting framework, and its operation, until the commencement of the IVTS framework.

Reporting entities that were subject to IFTI reporting obligations as at 30 March 2026 will continue to submit IFTI reports until they transition to the new IVTS reporting framework.

Under the Transitional rules, the new reporting obligation for international value transfer services are deferred until 31 March 2029, unless the reporting entity elects to transition earlier.

Existing international funds transfer reporting obligations will continue to apply until then.

More transitional rules

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

The Australian Privacy Commissioner’s recent activity includes: consultation on Guidance for Transparency in Automated Decision Making, updating its Chapter 3 Australian Privacy Principles guidelines on the collection of personal information by new technology, as well as the Privacy Commissioner’s recent decision in Commissioner Initiated Investigation into IRE Pty Ltd’s rental digital platform and a compensation order against American Express Australia Limited for an insider security breach.

Consultation on Guidance for Transparency in Automated Decision Making
From 10 December 2026, APP entities that use personal information in automated decision-making (ADM) with the potential to affect rights or interests will be required to provide information in their privacy policies about the kinds of personal information used and the kinds of decisions made using ADM. Background.

The Office of the Australian Information Commissioner (OAIC) has published an Automated Decision-Making Issues Paper prior to giving guidance on the automated decision-making (ADM) transparency obligation.

The Issues Paper explains that the types of ADM that require disclosure in APP entities’ privacy policies are those that meet the following criteria:
* the entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision; and
* the decision could reasonably be expected to significantly affect the rights or interests of an individual; and
* personal information about the individual is used in the operation of the computer program to make the decision or do the thing that is substantially and directly related to making the decision.

The Paper observes that a wide range of technologies are likely to fall within the definition of “computer program”, including commonly-used software, apps, or word-processing tools.

The OAIC says that generative AI tools used to generate text, images, videos, code or synthesis, including chatbots, all fall within the definition of computer program for the purpose of the ADM obligation.

Regulated entities will need to assess the computer programs that they use that meet the disclosure criteria.

Updated Australian Privacy Principle 3 guidance
The OAIC has updated its guidance on APP 3 (collection of solicited personal information) to reflect recent determinations, and to include examples which apply the APP 3 principles to current technology use cases such as artificial intelligence and facial recognition technology, and current practices like data scraping, tracking pixels and data broking.

The changes to the APP 3 guidelines also clarify how proportionality is implicit in the APP 3 requirements, requiring entities to take a data minimisation approach.

Data minimisation is the practice of limiting the collection of all information, but especially personal information.

Financial institution insider security risk
The Australian Privacy Commissioner has ordered American Express Australia Limited (AMEX) to compensate a complainant following a finding of interference in their privacy by its employee.

In the determination in the matter of ‘BAM’ and American Express Australia Limited the Australian Privacy Commissioner found that AMEX interfered with the complainant’s privacy under the Privacy Act 1988 (Cth), by failing to take such steps as were reasonable in the circumstances to protect the complainant’s personal information from unauthorised access by employees, in breach of Australian Privacy Principle (APP) 11.1.

The findings discussed the issue of insider security risk within a financial institution.

The determination examined circumstances in which an AMEX employee’s authorised access to relevant systems enabled them to view a range of information about AMEX customers, including travel and hotel bookings, and financial transactions.

A former AMEX customer subsequently alleged that the employee had accessed their account and personal information for purposes outside of legitimate business purposes.

The Australian Privacy Commissioner concluded that AMEX had failed to meet its obligation under Australian Privacy Principle (APP) 11.1 to take reasonable steps to protect the information it held from unauthorised access particularly from insider security risks.

Under the determination, for interference with the complainant’s privacy, American Express Australia Limited must:
* pay the complainant specified amounts for economic loss, for non-economic loss caused by the interference with the complainant’s privacy, and for reimbursement of expenses the complainant incurred making the complaint;
* issue a written apology to the complainant, acknowledging its interference with the complainant’s privacy, signed by a representative of AMEX with sufficient seniority;
* implement technical controls across the relevant systems, to enable AMEX to restrict its employees’ access to specific customer information, including to protect the personal information of vulnerable or high-profile customers;
* implement account-level access logging and action logging across the relevant systems to the extent these are still in operation, to create time-stamped log entries when an employee accesses or takes action on a customer’s records.

Data minimisation and dark patterns
The Privacy Commissioner’s recent decision in Commissioner Initiated Investigation into IRE Pty Ltd (Privacy) [2026] AICmr 24 considered the collection of personal information for the purpose of processing tenancy applications and the role of RentTech platforms, such as 2Apply.

The Privacy Commissioner observed that RentTech platforms are more than just a ‘middleman’ between renters and real estate
agents; they directly collect and enable the collection of personal information.

This determination reinforces that the operators of RentTech and other online platforms may bear their own obligations under the Privacy Act to handle personal information in a manner consistent with the Australian Privacy Principles.

The Privacy Commissioner concluded that IRE Pty Ltd, trading as InspectRealEstate, interfered with the privacy of individuals whose personal information was collected via 2Apply between March 2020 and 18 March 2025, within the meaning of s 13(1) of the Privacy Act 1988 (Cth), by:
a. collecting personal information that is not reasonably necessary for its functions or activities, in breach of Australian Privacy Principle (APP) 3.2; and
b. collecting personal information by unfair means, in breach of APP 3.5.

The decision considers the role of ‘online choice architecture’ practices, ‘dark patterns’, and Online Choice Architecture practices which can include confirmshaming; biased framing; and bundled consent.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

ASIC v Bekier (Star)
In Australian Securities and Investments Commission v Bekier (Penalty Judgment) [2026] FCA 756 the Federal Court disqualified former Star Entertainment Group Limited executives Mathias Bekier and Paula Martin from managing corporations for six and seven years respectively and ordered them to pay pecuniary penalties for breaching their duties by failing to properly manage serious risks at a publicly listed casino operator . Background.

The Court ordered:
* Mr Bekier, the former Chief Executive Officer and Managing Director, to pay a pecuniary penalty of $700,000 .
* Ms Martin, the former General Counsel, Company Secretary, and Chief Legal and Risk Officer, to pay a pecuniary penalty of $400,000.

ASIC V Westpac (Hardship case)
In Australian Securities and Investments Commission v Westpac Banking Corporation [2026] FCA 651, Westpac was ordered to pay $26 million in civil penalties for failing to respond to customers who were facing financial hardship.

Westpac contravened section 72 of the National Credit with respect to a total of 277 online hardship notices within the time required by law.

The Court also accepted that Westpac failed to engage in credit activities efficiently, honestly and fairly as required by section 47 of the Credit Act due to its failure to implement adequate systems, controls, risk reviews, investigations, monitoring and analysis of the systems and processes it utilised in relation to online hardship notices.

The requests were made by customers of Westpac and its subsidiaries St George Bank, Bank SA and Bank of Melbourne – who notified they were experiencing financial hardship and were struggling to meet repayments on products including home loans, credit cards, personal loans and car loans.

Scam protection failures
In Australian Securities and Investments Commission v HSBC Bank Australia Limited [2026] FCA 847, the Federal Court ordered HSBC Bank Australia Limited (HSBC) to pay a $35 million penalty and to publish adverse publicity orders on its website, its app and in letters to impacted customers after the bank admitted to serious failures in protecting customers from scams.

The Court found that HSBC had implemented scam controls on some of its payment systems but did not implement the key controls on the IAT (internal) payment rail, where the majority of customer losses occurred.

HSBC admitted to failures in relation to the ePayments Code because it took too long to investigate customer scam reports – 144 days on average – and it did not apply rules in the Code for determining when customers or the bank should bear the losses from scams. HSBC also admitted that it did not have adequate systems in place to help customers get back into their banking after they had been scammed.

The Court held that HSBC’s failures in respect of the ePayments code were widespread and systemic.

Following ASIC’s investigation, HSBC has established a large-scale remediation program that, to date, has paid around $21.5 million in compensation, with further payments to come before the end of July 2026. HSBC has also recovered $6.5 million and returned those funds to customers.

Overcharging on consumer goods credit contracts
In Australian Securities and Investments Commission v Walker Stores Pty Ltd (In Liquidation) [2026] FCA 665 the Federal Court ordered a $33.5 million penalty against online retailer Walker Stores Pty Ltd (in liquidation), which traded as Snaffle, for unlawfully overcharging tens of thousands of consumers under credit contracts.

Snaffle carried on an online business supplying consumer goods, including home appliances and furniture to consumers by way of “credit contracts” with repayments by instalments over 12, 24 or 36 months.

Between September 2021 and 27 February 2025, Walker Stores entered into 38,562 credit contracts.

By charging consumers significantly more under those credit contracts than it was permitted to, and by failing to disclose to consumers information about those credit contracts, Walker Stores contravened the requirements of the Credit Code in 3 ways:.
First, by entering into contracts pursuant to which it sold goods at marked-up prices, Walker Stores breached s 32A of the Code, which imposes a cap on the cost of credit by way of the annual cost rate or ACR, and thereby contravened s 24(1) of the Code.
Second, the contract documents comprising each sample contract failed to set out the cash price and amount of credit provided, and thereby contravened ss 17(3)(a)(i) and 17(3)(c) of the Code, which is a “key requirement” contravention but not a civil penalty contravention.
Third, with respect to all 38,562 credit contracts entered into during the relevant period including the sample contracts, Walker Stores imposed an interest charge in excess of the maximum amount permitted under s 28 of the Code.

High Court decides digital asset product is a financial product
In Australian Securities and Investments Commission v Web3 Ventures Pty Ltd [2026] HCA 21 the High Court decided that the fixed-yield digital asset product ‘Earner’ offered by Block Earner was a financial product as it was a facility through which an investor made a financial investment., and that Block Earner consequently required an Australian financial services licence.
Background.

The High Court also accepted ASIC’s argument that Earner was a derivative as the amount returned to investors varied by reference to the value of the digital asset and exchange rates.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.