The Consumer Finance Law Review: Australia


Australian laws impose licensing regimes and conduct obligations on certain consumer financial services activities.

The policy underpinning the regulation of consumer financial services in Australia has evolved in recent years. Laws regulating consumer financial services initially focused on ensuring that consumers were adequately informed about financial products and services offered to them. The law imposes obligations on providers of financial services to prevent unsuitable financial services being offered to consumers, and grant the regulator a power to intervene to prevent consumers from suffering significant detriment.

Legislative and regulatory framework

i Legislation

The Australian regulatory framework recognises two types of financial services: consumer credit, including consumer leases of goods, and 'other' financial services.

Consumer credit and leases

Consumer credit in Australia is regulated by the National Consumer Credit Protection Act 2009 (Cth) (the NCCP Act) and the National Credit Code (NCC) set out in Schedule 1 to that Act.

For credit to be covered by the NCC, it must have four elements:

  1. the debtor is a natural person or strata corporation;
  2. the credit is to be provided or intended to be provided wholly or predominantly:
    • for personal, household or domestic purposes (i.e., not businesses or investment purposes);
    • to purchase, renovate or improve residential property for investment purposes; or
    • to refinance credit that has been provided wholly or predominantly to purchase, renovate or improve residential property for investment purposes;
  3. a charge (interest or otherwise) is or may be made for providing the credit; and
  4. the credit provider provides the credit in the course of carrying on a business or providing credit in Australia or as part of or incidentally to any other business it carries on in Australia.2

There are no monetary or interest rate limits3 – credit that has the four elements described above will be regulated regardless of the amount of the credit provided and of the interest rate charged, unless a specific exemption applies. Once credit is regulated by the NCC, it is subject to a 48 per cent annual cost rate limit.4

The NCCP Act also regulates consumer leases, which are defined as leases of goods under which the hirer does not have a right or obligation to purchase the goods and:

  1. the goods are hired wholly or predominantly for personal, household or domestic purposes;
  2. a charge is or may be made for hiring the goods and the charge, together with any other amount payable under the lease, exceeds the 'cash price' (i.e., retail price) of the goods; and
  3. the lessor hires the goods in the course of a business of hiring goods or as part of or incidentally to any other business it carries on in Australia.5

The NCCP Act has four key limbs. The first creates a licensing regime with respect to consumer credit. Under this licensing regime, any person who wishes to engage in 'credit activities' must hold an Australian credit licence (ACL) authorising them to engage in those credit activities, or be an employee, director or authorised representative of such a person.6 'Credit activities' is defined to include providing credit, exercising the rights and obligations of a credit provider, taking the benefit of a mortgage or guarantee, exercising the rights and obligations of a mortgagee or beneficiary of a guarantee, or providing broker or intermediary-type services in relation to consumer credit or consumer leases.7 The Australian Securities and Investments Commission (ASIC), the general corporations, markets and financial services regulator in Australia, is responsible for granting ACLs.

There are several exemptions from the requirement to hold an ACL. These are provided for in the NCCP Act and the National Consumer Credit Protection Regulations 2010 (Cth) (the NCCP Regulations). Employees of an ACL holder and directors of a body corporate ACL holder are exempt from obtaining an ACL and can act as representatives of the ACL holder, when acting within the scope of their authority.8 A temporary employee is treated in the same manner as an employee who replaces another employee who is absent from work, or where they are performing substantially the same duties as that employee and are subject to similar controls or directions by the employer. There are also several other exemptions, including credit activities in connection with pawnbroking,9 employee loans,10 referral arrangements,11 employment agencies providing temporary staff or locums,12 and clerks' and cashiers' activities.13

The second key limb under the NCCP Act is set out in the NCC, which contains operational provisions relating to credit contracts and consumer leases. It prescribes the:

  1. form and content of credit and lease contract documents;
  2. disclosure requirements for fees and charges;
  3. procedures for varying consumer credit and lease contracts;
  4. circumstances in which interest may be debited to a loan account;
  5. rights to terminate consumer credit and lease contracts;
  6. procedures that must be followed by a credit provider or lessor when enforcing rights under a credit or lease contract or associated security interest;
  7. matters relating to mortgages and guarantees;
  8. advertising and marketing requirements; and
  9. related sales and issuance contracts.

The NCC contains the following notable provisions:

  1. a maximum annual cost rate (an effective interest rate taking into account non-interest charges payable) of 48 per cent per annum for consumer credit contracts;14
  2. a right for consumer debtors and lessees to request variation of their credit contracts or leases if they are suffering financial hardship;15
  3. the ability for a court to, on application by a consumer debtor or lessee, reopen and set aside or revise a transaction that is found to be unjust;16 and
  4. the ability for a court to, on application by a consumer debtor or lessee, annul or reduce certain unconscionable fees and charges.17

The third key limb under the NCCP Act is the 'responsible lending' regime. It requires credit providers and persons who advise or assist a consumer to enter into a credit contract or consumer lease to:

  1. provide a credit guide to the consumer setting out their fees, dispute resolution processes and other information required by the regulations;
  2. make reasonable enquiries about the consumer's financial situation and requirements and objectives in relation to the proposed credit contract or lease;
  3. take reasonable steps to verify the consumer's financial situation;
  4. assess whether the proposed credit contract or lease is unsuitable for the consumer;
  5. provide the consumer with a copy of the assessment on request; and
  6. not enter into the credit contract or lease, or advise or assist the consumer to enter into the credit contract or lease, if the credit contract or lease is assessed as unsuitable.18

A credit contract or lease is unsuitable if it will not meet the consumer's requirements or objectives, or if the consumer will not be able to comply with his or her obligations under the credit contract or lease or if the consumer could only comply with their obligations with substantial hardship. Whether or not a credit contract or consumer lease is unsuitable depends on the particular circumstances of each consumer. A separate assessment will need to be made with respect to each consumer who applies for credit or seeks advice or assistance in obtaining credit.19 Responsible lending enquiries are scalable according to the nature of the credit obtained. In all cases, however, it is necessary to collect at least some information about the consumer's income and expenditure. A recent Full Federal Court consideration of the obligations found the use that must be made of the information collected, and the weight to be given to particular information items, is at the credit provider's discretion, as long as they make an assessment of whether or not the credit contract will be unsuitable.20 The responsible lending provisions in the NCCP Act also contain miscellaneous rules about the need to give key facts sheets in relation to credit card contracts and standard home loans, and conduct in relation to credit cards.

In November 2020, the Australian government proposed a suite of reforms to the responsible lending obligations. These reforms were designed to stimulate the economic recovery of Australia following the systemic damage of the covid-19 pandemic. However, these reforms were met with parliamentary opposition and are unlikely to ever be implemented.

In February 2021, the National Consumer Credit Protection Amendment (Mandatory Credit Reporting and Other Measures) Act 2021 (Cth) was enacted. The Act amends the NCCP to establish a mandatory comprehensive credit reporting regime applying from 1 July 2021 and provides that a credit provider cannot refuse to provide further credit or reduce a customer's credit limit merely because financial hardship information exists. From July 2022, financial hardship reporting will be permitted within the credit reporting system. This will allow consumers to access their credit information that is held by a credit reporting body free of charge every three months. It will also require credit reporting bodies to provide consumers with their rating on a credit score scale and related information if requested by the consumer.

The fourth key limb under the NCCP Act is the imposition of criminal and civil penalties for failure to comply with an obligation in the NCCP Act or the NCC (including licensing conditions). ACLs have a general condition obliging their holder to comply with the credit legislation.21 This includes ancillary legislation discussed later in this chapter, dealing with privacy, anti-money laundering and counter-terrorism financing, and consumer protection. ASIC may take administrative action in response to non-compliance with the NCCP Act or NCC by banning a person from engaging in credit activities or imposing conditions on the person's ACL.

'Other' financial services

The provision of financial services (excluding credit) in Australia is regulated by Chapter 7 of the Corporations Act 2001 (Cth) (the Corporations Act). A person provides a financial service if they deal in, make a market for or provide advice with respect to a 'financial product'.22 A financial product is a facility through which, or through the acquisition of which, a person makes a financial investment, manages a financial risk or makes non-cash payments.23 Banking deposit products, payment facilities (e.g., stored-value cards and purchased payment facilities) and most insurance contracts are 'financial products' within the meaning of the Corporations Act.24 Credit facilities (both consumer and non-consumer) are expressly excluded from the definition of a financial product.25

Chapter 7 of the Corporations Act creates a licensing regime for the provision of financial services. Under that regime, any person who carries on in Australia a business of providing financial services must hold an Australian financial services licence (AFSL) covering the provision of the particular financial services being provided, be an employee or director of a holder of an AFSL, or be the authorised representative of the holder of an AFSL. AFSLs are granted by ASIC.

The Corporations Act distinguishes between retail and wholesale clients in relation to financial services. A person is a retail client unless they satisfy one of the conditions that qualify them to be a wholesale client.26 Broadly speaking, a retail client is the equivalent of a consumer (although the concept captures other persons, such as small businesses) and a wholesale client is someone who, because of their experience in financial services or the value of the transaction, is taken to be better able to protect their interests with regard to providers of financial services.

The Corporations Act imposes additional obligations when offering financial services to retail clients, rather than wholesale clients. A provider of financial services is required to give a retail client their financial services guide, which sets out information about the kinds of financial services provided, the remuneration of the provider, relationships of the provider that may give rise to conflicts of interest and other matters prescribed by the Corporations Act or the Corporations Regulations 2001 (Cth) (the Corporations Regulations).27 A provider of personal financial advice to a retail client must give that client a statement of advice setting out the advice, the basis on which the advice is given and other matters prescribed by the Act or the Corporations Regulations.28 A provider of financial advice to a retail client is also required to act in the best interests of the client and is prohibited from being a party to particular remuneration arrangements that are taken to carry a higher risk of creating conflicts of interest.29 A person issuing or (in certain circumstances) selling a financial product to a retail client, or advising a retail client to acquire a financial product in such circumstances, is required to give the client a product disclosure statement containing information about the benefits, risks, costs, returns and other significant characteristics of the financial product.30 The objective of these and other provisions in the Corporations Act is to ensure that retail clients have adequate information to make decisions in their interest about financial products and services. In practice, this means that some financial services are made available only to wholesale investors in order to reduce the costs of complying with the additional obligations arising from transactions with retail clients.

Failure to comply with an obligation in the Corporations Act may attract criminal or civil penalties. AFSL holders have a general obligation to comply with financial services laws, including the NCCP Act and the NCC (if applicable).31 ASIC may take administrative action in response to non-compliance with the Corporations Act by banning a person from engaging in financial services or imposing conditions on the person's AFSL.

Consumer protection under the ASIC Act

Division 2 of Part 2 of the Australian Securities and Investments Commission Act 2001 (Cth) (the ASIC Act) contains further consumer protections with respect to financial services – defined in substantially the same way as in the Corporations Act but including credit facilities. Consequently, the protections in the ASIC Act apply to financial services regulated by the Corporations Act and consumer credit and leases regulated by the NCCP Act. The ASIC Act prohibits unconscionable conduct (the unconscientious exploitation of a disadvantage suffered by another person), conduct that is misleading, deceptive or likely to mislead or deceive, and other unfair practices in connection with financial services.

The ASIC Act also provides that a term of a consumer or small business standard form contract for the supply of financial services is void if it is 'unfair'. A term of a contract is unfair if:

  1. it would cause a significant imbalance in the parties' rights and obligations arising under the contract;
  2. it is not reasonably necessary to protect the legitimate interests of the party who would be advantaged by it; and
  3. it would cause detriment to a party if it were to be relied on.

A contract is a standard form contract if it was prepared entirely by one party with no effective opportunity for the other party to negotiate the terms of the contract. In proceedings seeking a declaration that a contractual term is void, a contract is presumed to be a standard form contract unless a party to the proceedings proves otherwise.

From April 2021, the unfair contract terms regime was extended to consumer and small business insurance contracts governed by the Insurance Contracts Act 1984 (Cth) (ICA). The protections apply to new insurance contracts that are entered into, or contracts that are renewed, on or after 5 April 2021 and to terms in existing contracts that are varied from 5 April 2021.

Banking regulation

Banking business – the taking of money on deposit from customers and making advances of money32 – is regulated by the Banking Act 1959 (Cth) (the Banking Act). Under the Banking Act, a person must not carry on banking business unless they are authorised to do so by the Australian Prudential Regulation Authority (APRA).33 The Banking Act is not primarily concerned with conduct towards consumers, but rather with the protection of consumers' deposited funds. Consequently, the chief obligation for an authorised deposit-taking institution (ADI) under it is to comply with prudential standards issued by APRA.

Entities wishing to commence carrying on banking business can obtain, subject to meeting APRA's standards, a restricted ADI (RADI) authorisation from APRA, as opposed to a full or standard ADI authorisation. RADI authorisation imposes less stringent obligations than full ADI authorisation, including minimum capital requirements of only A$3 million plus a reserve for costs of winding down of 20 per cent of adjusted assets. RADIs are subject to a protected deposit limit of A$250,000 per customer and A$2 million in aggregate. RADIs are also subject to a two-year time limit to achieve the requirements for full ADI authorisation or to exit the industry. The purpose of the RADI licence is to enable the holder to build resources and capability in a restricted environment. During this stage, the holder is expected to progress to fully meet the prudential requirements to ultimately secure a full ADI licence. The RADI licence regime is likely to reduce a major barrier to entry into the banking market in Australia, resulting in greater competition and choice in relation to deposit account products. The restricted ADI licence assists those with traditional and non-traditional business models and start-up institutions,34 and at the time of writing two entities have obtained RADI licences and successfully transitioned to full ADI licences. However, one of those entities, Xinjia, has since handed back its licence, citing an 'increasingly difficult capital-raising environment'.35

The provision of purchased payment facilities (PPF) is banking business under Australian law and so requires an authority or an exemption from the Payment Systems Board (PSB) of Australia's central bank, the Reserve Bank of Australia (RBA) or a limited form of ADI authorisation from APRA. This is dealt with in further detail in Section III.i.

Payment systems

Providers of payments systems – funds transfer systems that facilitate the circulation of money – are subject to the Payment Systems (Regulation) Act 1998 (Cth) (the PSR Act). Under the PSR Act, the RBA through the PSB may designate a payment system if it considers it to be in the public interest to do so. The RBA may then impose access regimes and standards on participants in a designated payment system, and arrange for the arbitration of disputes between participants in a designated payment system. At the time of writing, the major credit, debit and prepaid card payment systems (Mastercard, Visa, American Express and EFTPOS) have been designated by the RBA and have had standards imposed on them. The Mastercard and Visa payment systems have also had access regimes imposed on them.36 Since 1 September 2017, all merchants have been prohibited from imposing surcharges on card transactions that exceed their cost of acceptance of cards for that payment system.37 The automated teller machine (ATM) system has also been designated and had an access regime imposed on it.38

The Privacy Act

Providers of consumer financial services in Australia are subject to the Privacy Act 1988 (Cth) (the Privacy Act) if they have, or have ever had, annual turnover greater than A$3 million.39 This is subject to certain exemptions, including in relation to media acts, employment records, political acts and practices, and related body corporate disclosures. In addition, there are some types of businesses to which the Privacy Act applies, irrespective of the size of the business. These include businesses providing health services, businesses that collect or disclose personal information for profit and contractors under contracts with the Commonwealth government.

The Privacy Act requires regulated entities to have and publish a privacy policy setting out how they deal with personal information; give certain disclosures when collecting personal information (called a privacy statement); use personal information only for the purposes for which it was collected and related secondary purposes; take reasonable steps to protect personal information and to ensure that it is correct and up to date; and give access to a person's personal information on request by the person.40

The Privacy Act, together with the Privacy (Credit Reporting) Code 2014, also regulates credit providers' abilities to provide information to credit reporting bodies (CRBs) and to use information obtained from CRBs. The types of information – 'credit information' – that credit providers may provide to CRBs are narrowly defined and, in the case of information about a person's default on a debt, a credit provider is required to give a grace period and at least two notices to the debtor before reporting the information to a CRB.41

The Privacy Act also contains a mandatory data breach notification regime42 requiring entities subject to the Privacy Act to investigate and notify both the regulator and affected individuals about 'eligible data breaches'. An 'eligible data breach' occurs if:

  1. there is unauthorised access to, or unauthorised disclosure of, information and a reasonable person would conclude that the access or disclosure would be likely to cause serious harm to any of the individuals to whom the information relates; or
  2. information is lost in circumstances where unauthorised access or disclosure is likely to occur and a reasonable person would conclude that the access or disclosure would be likely to cause serious harm to any of the individuals to whom the information relates.

Anti-money laundering and counter-terrorism financing

The lending of money, provision of a deposit account and provision of certain financial services (among other things) are 'designated services' under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (the AML/CTF Act).43 Consequently, providers of such services are required to:

  1. become enrolled on the Reporting Entities Roll maintained by the Australian Transaction Reports and Analysis Centre (AUSTRAC);44
  2. adopt and maintain an anti-money laundering and counter-terrorism financing programme (the AML/CTF programme);45
  3. ensure that the board and senior management approve and oversee the operation and implementation of the AML/CTF programme;46
  4. perform customer identification procedures on customers before starting to provide a designated service to them;47
  5. provide to AUSTRAC an annual report self-certifying compliance with the AML/CTF Act;48
  6. report to AUSTRAC all international funds transfer instructions,49 transactions involving the transfer of more than A$10,000 in physical currency50 and certain suspicious matters;51
  7. appoint an AML/CTF compliance officer;52
  8. conduct pre- and post-employment screenings on employees;53 and
  9. comply with document retention obligations.

ii Regulation

ASIC is the primary regulator of financial services in Australia, responsible for administering the NCCP Act, the Corporations Act and the ASIC Act. In addition to administering the statutes for which it is responsible, ASIC also has the function of promoting:

  1. the adoption of approved industry standards and codes of practice;
  2. the protection of consumer interests;
  3. community awareness of payments system issues; and
  4. sound customer–banker relationships, including through monitoring the operation of industry standards and codes of practice and monitoring compliance with such standards and codes.54

Under the NCCP Act and Corporations Act respectively, ASIC is responsible for granting ACLs and AFSLs.

ASIC has a wide range of investigative powers at its disposal, including the power to conduct investigations of its own motion,55 to compel the production of documents56 and to compel a person to attend an examination and answer questions under oath.57

ASIC has standing to commence proceedings against persons whom it believes have contravened the NCCP Act or the Corporations Act in relation to consumer financial services. Only ASIC can seek civil penalties for contraventions of these statutes. Consumers' remedies in private proceedings are limited to compensation for losses actually suffered and injunctive and declaratory relief to restrain further contraventions of the law.58

As an alternative to court proceedings, ASIC may issue infringement notices if it has reasonable grounds to believe that a person has contravened a legislative provision eligible to be dealt with by way of infringement notice. Payment of an infringement notice is not taken to be an admission of guilt, does not amount to a conviction for an offence and bars further proceedings against the recipient in relation to the conduct to which the infringement notice relates.

ASIC may also impose conditions on a person's ACL or AFSL, or make orders banning a person from engaging in credit activities or providing financial services.

All ACL holders and AFSL holders who are authorised to provide financial services to retail clients must be members of the Australian Financial Complaints Authority (AFCA) scheme.59 The AFCA scheme is a non-judicial external dispute resolution scheme established under legislation to replace the pre-existing private schemes – the Financial Ombudsman Service, and the Credit and Investments Ombudsman and Superannuation Complaints Tribunal. External dispute resolution offers a less formal and more consumer-friendly means of resolving disputes with financial services providers, as it is not constrained by the rules of evidence and may look to legal principles, applicable industry codes or guidance, good industry practice, previous decisions and fairness in all the circumstances when deciding disputes.60

Providers of electronic payment facilities may voluntarily subscribe to the ePayments Code administered by ASIC. The ePayments Code provides additional protections to consumer users of electronic payment facilities, beyond those provided for by the law (e.g., rights to require the payment facility provider to recover mistaken payments on the consumer's behalf). Being voluntary, the ePayments Code does not have legal force, though its terms are usually incorporated into subscribers' agreements with customers and so have contractual force.

APRA is responsible for administering the Banking Act. It is empowered to authorise corporations to carry on banking business and to issue prudential standards. It also oversees credit unions, building societies, general insurance and reinsurance companies, life insurance, private health insurance, friendly societies, most entities in the superannuation industry and purchased payment facility providers. All financial institutions regulated by APRA have attendant reporting obligations. For example, most banks are required under the Financial Sector (Collection of Data) Act 2001 (Cth) (FSCODA) to provide statistical information to APRA (though FSCODA also imposes reporting obligations on some financial institutions not otherwise subject to APRA supervision). APRA is funded largely by the industries that it supervises.61

The RBA is responsible for administering the PSR Act, including designating payment systems, imposing access regimes and standards on participants in designated payment systems, and arranging the arbitration of disputes between participants in designated payment systems.

The Office of the Australian Information Commissioner (OAIC) is responsible for administering the Privacy Act. The Privacy Act confers on the Information Commissioner a range of privacy regulatory powers. These include powers that allow the OAIC to work with entities to facilitate legal compliance and best privacy practice, as well as investigative and enforcement powers to use in cases where a privacy breach has occurred.

AUSTRAC is responsible for administering the AML/CTF Act. Like ASIC, it may commence court proceedings seeking penalties for contraventions of the AML/CTF Act. In recent times, AUSTRAC appears to have increased its enforcement efforts and has enjoyed some success in civil penalty proceedings. In 2020, it achieved by far the largest corporate penalty in Australian history when it agreed on a A$1.3 billion penalty to settle Westpac's 23 million alleged contraventions of AML/CTF programme compliance and transaction reporting obligations under the AML/CTF Act.62

The Australian Competition and Consumer Commission (ACCC) is responsible for protecting consumer, business and communal interests through promoting competition and fair trade in the market.63 It ensures that all individuals and businesses comply with the Competition and Consumer Act 2010 (Cth), including the Australian Consumer Law (the Consumer Law). It also issues debt collection guidelines in conjunction with ASIC.64


All the regulators identified above play a role in relation to payments.


The primary day-to-day payment methods are currently physical currency, cards, cheques and electronic funds transfers. Australian Payments Network Ltd (AusPayNet), a corporation owned by payment system participants, coordinates the clearing and settlement of payments by cheque, direct entry payments, ATMs, debit cards and high-value payments. The major card payment schemes and the BPAY system for the payment of bills operate with their own membership and rules independently of AusPayNet.65 The domestic card system is managed by eftpos Payments Australia Limited. The New Payments Platform (NPP), operated by NPP Australia Ltd, commenced operation in 2018, allowing near instantaneous direct electronic funds transfers.66

Licensing requirements

Providers of facilities by which persons can make non-cash payments must hold an AFSL authorising them to provide such a facility. However, there are exemptions from this requirement – including for providers of facilities used to make payments to one person only,67 loyalty schemes, road toll payment facilities, low value (i.e., up to A$1,000) non-cash payment facilities, gift card, scheme facilities and prepaid mobile facilities.68 Electronic funds transfer facilities offered by ADIs are deemed not to be financial products by the Corporations Regulations and so do not require an AFSL to provide to consumers.69

The PSR Act does not itself impose any licensing scheme. It allows the RBA to designate a payment system and impose access regimes and standards if it considers it to be in the public interest.70 The payment systems that have currently been designated and that have had standards or access regimes imposed on them are identified in Section II.i, under the subheading 'Payment systems'. The ATM system is also designated and subject to an access regime.71

Standards issued by the RBA govern:

  1. interchange fees in Mastercard, Visa, American Express and EFTPOS credit card and debit card schemes – interchange fees for credit card transactions must not exceed 0.8 per cent of the value of the transaction72 and interchange fees for debit card transactions must not exceed A$0.15 per transaction or 0.2 per cent of the value of the transaction (depending on whether a fixed fee or proportion of value is charged);73 and
  2. merchant pricing – merchants are prohibited from imposing surcharges for card transactions greater than their cost of acceptance for those card transactions.74

Otherwise, the scheme rules of each payment system function as a contract between members of that payment system and between each member and the operator of the payment system.

PPF as a banking business

If a payment product is likely to be a PPF under the PSR Act, two regulatory issues are raised:

  1. the PPF may be a banking business under the Banking Act and Banking Regulations.75 A provider of a PPF may only engage in 'banking business' if it is an ADI regulated by APRA; and
  2. the holder of stored value (as defined by the PSR Act)76 that makes payments in relation to a PPF that has been determined to be a banking business must be an ADI or authorised or exempted from the requirement to be an ADI before it can be the holder of the stored value.77

A PPF is a facility (other than cash) in relation to which the following conditions are satisfied:

  1. the facility is purchased by a person from another person;
  2. the facility is able to be used as a means for making payments up to the amount that, from time to time, is available for use under the conditions applying to the facility; and
  3. those payments are to be made by the provider of the facility or by a person acting under an arrangement with the provider (rather than by the user of the facility).78

A PPF will be a 'banking business' if APRA determines that the facility:

  1. is of a type for which the purchaser of the facility is able to demand payment, in Australian currency, of all, or any part, of the balance of the amount held in the facility that is held by the holder of the stored value; and
  2. is widely available as a means of payment, having regard to:
    • any restrictions that limit the number or types of people who may purchase the facility; and
    • any restrictions that limit the number or types of people to whom payments may be made using the facility.79

If a PPF falls within Declaration No. 2 2006 regarding Purchased Payment Facilities (the PPF Declaration), the provider will not be required to become an ADI. The PPF Declaration states that the PSR Act does not regulate facilities where the total amount of obligations to make payments does not exceed A$10 million or the number of people to whom payments may be made using the facility does not exceed 50 people.

A PPF provider is a special kind of ADI. It must only conduct 'banking business' as specified in Regulation 6 of the Banking Regulations. It cannot hold out that it is a fully authorised ADI. Its business activities are restricted to PPF business operations and closely related services and must be incorporated in Australia (unless APRA determines otherwise). It must also provide APRA with financial data periodically as specified in its ADI authority.

ePayments Code

The ePayments Code80 includes consumer protections exceeding those found in legislation, including:

  1. at least 20 days' advance written notice of changes to the terms and conditions of the facility that may be adverse to the consumer;81
  2. no liability for the consumer as a result of an unauthorised transaction occurring after the consumer informed the provider that a device used to make payments (e.g., a card) has been misused, lost or stolen or that the security of a passcode has been breached;82 and
  3. requiring their ADI to investigate and take steps to recover internet payments made mistakenly by the consumer, and to cooperate with other ADIs in recovering mistaken payments for their customers.83

While the ePayments Code is voluntary, it gains legal force by being incorporated into the contracts between the payment facility provider and the consumer.

New Payment Platform

Since 2018, the New Payment Platform (NPP) has enabled consumers, businesses and government agencies to make simply addressed payments in real time, with the continuous availability of the payment system. The material differences between the NPP and the direct entry system it replaced are:

  1. speed – the NPP provides near instantaneous settlement;
  2. continuous availability – the NPP is available all day, every day (as opposed to settlement only during business hours);
  3. data capability – the NPP enables more information to be sent with payments;
  4. simple addressing – payers are able to address payments to recipients by a unique, commonly known identifier, such as a mobile phone number or email address. This new form of identification, which is called PayID, is expected to facilitate more consumer-to-consumer payments by simplifying identification requirements; and
  5. allowing for third party initiated payments.

Deposit accounts and overdrafts

i Overview

Access to banking services

Deposit-taking is the defining feature of banking business in Australia. Consequently, all providers of deposit accounts must be authorised as ADIs by APRA. Further, deposit products are financial products and so their providers must, subject to some exceptions in the Corporations Act, hold an AFSL if they wish to provide such products to retail clients.

Opening a deposit account and allowing transactions to be conducted on a deposit account are designated services under the AML/CTF Act.84 Consequently, an ADI must carry out customer identification procedures and verify information about the identity of the customer before opening a deposit account for them or allowing them to conduct transactions on a deposit account. If customer identification procedures and the circumstances of the case indicate a high risk that the account will be used to facilitate money laundering or terrorism financing, the ADI may, in accordance with its AML/CTF programme, refuse to provide an account to the customer.

Otherwise, there is no law preventing ADIs from providing deposit accounts to consumers, nor is there any law compelling them to provide a deposit account to every consumer.

Deposit guarantee

Since 2008, the Banking Act has provided for the Financial Claims Scheme (FCS). The FCS allows deposit account holders at a declared insolvent ADI to be paid an amount by APRA equal to the balance of their account and accrued but uncredited interest up to the date of the ADI being declared insolvent,85 up to a limit of A$250,000 for all accounts held with that ADI.86 The A$250,000 limit applies in respect of accounts held with a particular ADI, meaning that a person who holds deposit accounts with multiple declared insolvent ADIs can potentially recover more than A$250,000 in total FCS payments.

Upon payment of an amount to a deposit account holder under the FCS, APRA is subrogated to the deposit account holder's rights against the ADI.87

In applying for authorisation, RADIs are required to demonstrate to APRA that they will not need to rely on the FCS88 to exit the industry if they do not proceed to a full ADI licence within two years. During the RADI licence phase, RADIs are subject to FCS-eligible deposit limits of no more than A$250,000 per account holder and no more than A$2 million in aggregate.


The NCCP Act and NCC generally regulate overdraft facilities, as they are credit provided to a consumer for personal, household or domestic purposes and for which a charge is imposed. However, the NCCP Act and NCC do not apply to 'the provision of credit if, before the credit was provided, there was no express agreement between the credit provider and the debtor for the provision of credit'.89 Deposit account terms should allow the ADI, in its absolute discretion, to choose to honour or decline a transaction for which the account has insufficient credit balance, with the terms of any credit provided being those notified on its website at the time the transaction is made. This will ensure that any incidental overdraft credit provided is not subject to the NCCP Act and the NCC, as it is not expressly agreed in advance.

ii Recent developments

Consumer data right – open banking

Following the lead of the United Kingdom, Australian introduced an 'open banking' regime in 2019.90 The Treasury Laws Amendment (Consumer Data Right) Act 2019 amended the Competition and Consumer Act 2010 (and, incidentally, other legislation) to create a consumer data right framework in which data holders in designated sectors will be required to provide a consumer with certain data about him or her in a machine-readable format or to transfer that data to an accredited data recipient, at the consumer's direction. In December 2020, the ACCC made further amendments to the Consumer Data Right Rules, which expand the types of consumers who can use the Consumer Data Right to include more business customers. From 1 November 2021, Australia's major banks will enable these customers to share their data with accredited data recipients when shopping around for better services.

The objective of introducing an open banking regime is to increase competition in consumer financial services markets, leading to better outcomes for consumers. It is expected to improve competition by reducing switching costs for consumers and by reducing barriers to entry for providers of financial services that rely on account data (such as credit providers, who will be able to use the newly available data to better assess credit risk).

Revolving credit


Continuing credit contracts

The NCC defines a 'continuing credit contract' as a credit contract in which multiple advances of credit are contemplated, and the amount of available credit ordinarily increases as the amount of credit is reduced.91 This definition covers the consumer line of credit facilities, regardless of whether they are for a fixed or indefinite term.

The NCCP Act and NCC apply to all continuing credit contracts on which interest is charged. They do not regulate continuing credit contracts for which the only charge is a fixed periodic fee that does not vary according to the amount of credit provided. However, the fixed fee must be no more than A$200 for the first 12 months of the contract and no more than A$125 for any subsequent 12-month period while the contract is on foot. If the consumer is already party to a continuing credit contract with the credit provider or an associate of the credit provider, then the imposition of any periodic fee brings the continuing credit contract within the scope of the NCCP Act and NCC.92

Continuing credit contracts are subject to largely the same obligations as ordinary principal and interest repayment contracts, with some modifications to suit the nature of continuing credit contracts. This includes contract documents and pre-contractual disclosure requirements discussed in Section VI.i below, under the subheading 'Contract documents and pre-contractual disclosure'.

Continuing credit contracts do not require disclosure in the credit contract93 of the total number of repayments, frequency of repayments and the total amount of repayments, even if these amounts are ascertainable.

When calculating the annual cost rate (a measure of the effective interest rate) of a continuing credit contract, it must be assumed that the consumer at the commencement of the contract will draw down the entire credit limit of the contract.94 The maximum period for a statement of account for a credit card contract is 40 days.95

The NCC requires statements of account to be given no less frequently than every three months for a continuing credit contract, or every 40 days if there is no express agreement about statement frequency between the credit provider and debtor.96 However, if a continuing credit contract is a 'reverse mortgage' credit contract – a credit contract secured by a mortgage over real property for which there is no obligation on the debtor to make repayments97 – then statements of account need to be given only every 12 months. In addition, a statement of account need not be given for a continuing credit contract if:

the debtor was in default . . . during the preceding 120 days, or during the statement period and the two immediately preceding statement periods, whichever is the shorter time, and the credit provider has, before the commencement of the statement period, exercised a right not to provide further credit under the contract and has not provided further credit during the period.98

A guarantee in relation to a continuing credit contract subject to the NCC cannot be irrevocable, even if consideration was given for it to not be revoked. Section 60(4) of the NCC allows a guarantor, at any time, to limit his or her liability to credit previously provided to the debtor by providing written notice to the credit provider.

The credit limit of a continuing credit contract (other than a credit card contract) can only be increased at the request of or with the written consent of the debtor.99 This prevents a credit provider from making unsolicited credit limit increase offers. However, before providing any increase in the credit limit of a continuing credit contract, the credit provider must undertake responsible lending enquiries to determine whether the increase is unsuitable for the debtor.100

Continuing credit contracts may not be secured over all goods supplied under the contract (if the credit is provided by supplying goods rather than advancing money). Rather, they may only be secured over specifically identified goods.101

The NCC provides that a credit provider may not take possession of mortgaged goods if the amount owing under the credit contract is less than 25 per cent of the initial amount of credit provided or A$10,000, whichever is the lesser.102 This is to protect debtors so that if they have substantially repaid their debt, the right to repossess mortgaged goods can only be exercised with court consent. However, this debtor protection does not apply to continuing credit contracts.103

The NCC requires that a credit advertisement104 that contains an annual percentage rate (APR) must also contain the relevant comparison rate, and an advertisement that does not contain an APR may also contain the relevant comparison rate. A comparison rate is a tool intended to help consumers identify the true cost of credit arising from interest charges and other fees and charges. It is to enable consumers to compare the costs of competing loan products.105 However, advertisements for continuing credit contracts need not provide a comparison rate.106

Credit cards

The NCCP Act imposes additional regulations on credit card contracts. It defines a credit card contract as 'a continuing credit contract under which credit is ordinarily obtained only by use of a credit card'.107 Credit card contracts are a type of continuing credit contract and are subject to the following additional requirements:

  1. an application form for a credit card contract must be accompanied by a key facts sheet setting out key information about the contract in a standardised table format;108
  2. a credit provider must not enter into a credit card contract unless a key facts sheet has been provided to the prospective debtor;109
  3. a credit provider must not invite a debtor to request an increase in the credit limit of a credit card contract;110 the credit limit can only be increased pursuant to a request made on the debtor's own motion;
  4. a credit provider must not enter into a credit card contract unless the contract allows the credit limit to be reduced and the credit provider must provide an online facility for the debtor to request a reduction of his or her credit limit;111
  5. a credit provider must not suggest to a consumer that they not reduce the credit limit of his or her credit card contract or reduce it by a smaller amount than the consumer requested;112
  6. if a debtor uses his or her credit card in a transaction that results in him or her exceeding the credit limit on their credit card contract, the credit provider must notify the debtor that they have exceeded their credit limit within two business days of becoming aware of that fact;113
  7. a credit provider may not impose any fees or a higher rate of interest on the debtor for exceeding the credit limit of a continuing credit contract, unless it has obtained the debtor's express consent in advance of charging the fees or imposing the higher rate of interest114 (this is best done by including those fees and interest in the contract document provided to the debtor);
  8. repayments made by a debtor must be applied first to the part of the amount owing to which the highest rate of interest applies, then to the part of the amount owing with the next highest rate of interest, and so on, unless the debtor requests that a repayment be applied to a specific part of the amount owing.115
  9. a credit provider must not enter into a credit card contract unless the contract allows the contract to be terminated by the debtor and the credit provider must provide an online facility for the debtor to request termination of their contract;116
  10. a credit provider must not suggest to a consumer that they refrain from terminating their credit contract; and
  11. a credit card contract will be unsuitable for a consumer, and therefore unable to be provided to the consumer, if the consumer will not be able to repay the fully drawn down credit limit within a prescribed period of three years.117

Instalment credit

i Overview

Instalment credit contracts under the NCCP Act and NCC are regulated credit contracts other than continuing credit contracts.118 They are contracts with repayment obligations, where the amount of available credit does not increase as the amount of credit is reduced. They may require periodic payments of principal and interest, interest only, or interest only for a period followed by principal and interest.

Contract documents and pre-contractual disclosure

The NCC requires credit contracts to be in the form of a written document signed by at least the credit provider.119 The contract document must contain the following information:120

  1. the amount of credit to be provided or the credit limit;
  2. the interest rates that apply under the contract, or their method of calculation;
  3. the method of calculating interest;
  4. the total amount of interest payable, if ascertainable and if the loan is to be fully repaid within seven years;
  5. the number and total amount of repayments over the life of the contract;
  6. credit fees and charges that are payable or may be payable;
  7. if the interest rate and any fees or charges can be changed during the life of the contract, a statement of that fact;
  8. the frequency with which statements of account are given;
  9. any default interest rate that may become payable;
  10. if enforcement expenses are payable on breach of the contract, a statement of that fact;
  11. if there is any mortgage or guarantee securing obligations under the contract, a statement of that fact;
  12. a description of any property subject to a security interest securing obligations under the credit contract;
  13. information about any ascertainable commissions to be received or paid by the credit provider for the introduction of credit business or business financed by the contract (including insurance);
  14. information about any insurance financed by the credit contract and any commissions payable; and
  15. warnings prescribed by the NCCP Regulations.

The NCC also requires the matters required to be disclosed in the credit contract to be provided to the debtor prior to entry into the credit contract.121 The NCCP Regulations require select items of the information to be provided in the form of a table (the financial table) at the beginning of the pre-contractual disclosure.122 It is common practice for the pre-contractual disclosure to be incorporated into the contract document, which is given to the debtor prior to their entry into the contract.

Interest charges

The NCC prescribes the maximum amount of interest that may be charged under a credit contract. It introduces the concept of 'annual cost rate', which is the effective interest rate taking into account ascertainable interest charges and non-interest fees and charges. The annual cost rate does not take into account interest rates and fees that are contingent on the occurrence of an event other than the passage of time (e.g., default or a late payment), as they are not ascertainable at the time of contract formation.123 The annual cost rate is a point in time calculation as at the time of contract formation.

The maximum annual cost rate for a credit contract is 48 per cent per annum. A credit provider is forbidden from entering into a credit contract if its annual cost rate exceeds 48 per cent per annum, or varying a contract in a manner that causes its annual cost rate to exceed 48 per cent per annum.

Calculating interest

Generally, interest must be calculated by applying a daily percentage rate to the unpaid balance.124 For all contracts where only one annual percentage rate (APR) applies to the unpaid balances, interest charged for each day must not be more than:125

The unpaid daily balance for a day under a credit contract is the unpaid balance under the contract at the end of that day.126 A credit contract may specify, for the purposes of payments or any other purposes under the contract, when a day ends. Different times of the day may be specified for different purposes.127

If more than one APR applies to the unpaid balances, interest charges must not be more than the sum of each amount determined by applying:128

Interest can be calculated at monthly, quarterly or biannual rests using the average daily balance during the period.129

Interest must not be debited before the end of the day to which the interest relates (except for the first payment of interest under the contract, if it is for a period of less than the normal interest period under the contract; i.e., there is a broken first interest period).130

However, on the last day of an interest period, interest can be debited to an account provided that it is not included in the balance for the interest calculations on that day.

The prohibition that interest cannot be debited before the end of the day to which it applies does not apply to credit provided to purchase, renovate or improve residential investment property; or to refinance credit if, at the time the credit contract was entered into, the residential property was used for investment purposes.131

Unpaid interest charges for a period may be added to the unpaid daily balance immediately after the end of that period.132 The NCC thus permits a credit provider to capitalise interest daily (or at another longer interval such as weekly or monthly). However, every debit for interest charges must be separately itemised on the account statement so that the debtor can see the effects of the capitalisation.133

Default interest

Default interest cannot be charged unless the debtor defaults in payment and can be charged only on the amount in default and while the default continues. There are limited circumstances in which the balance of the amount owing may be accelerated and default interest charged on that accelerated amount.134

The default method is by dividing the annual percentage rate (the quoted or nominal interest rate) by 365 to obtain the 'daily percentage rate' and applying that daily percentage rate to the unpaid daily balance each day.135 This results in daily compounding of interest, but the NCC allows for interest to be compounded monthly, quarterly or biannually using the same principle of calculation.136

A higher rate of interest may be imposed in the event of default, but only in respect of the amount in default and not the entire amount owing under the credit contract.137 Default interest may only be imposed if the contract permits, if the debtor defaults in payment, on the amount in default, and while the default continues. This applies to both a default in paying an instalment and an accelerated amount.

Additional provisions apply before a credit provider can accelerate any part of the debt and, consequently, before default interest can become payable on the accelerated amount. In particular, an acceleration clause can only operate if a default notice explaining the effect of the acceleration clause is given and the default is not remedied within the time (at least 30 days) specified in the notice. There are limited exceptions.138

Security interests

The NCC defines 'mortgage' to include any interest in, or power over, property to secure obligations under a credit contract.139 The interest must be in the form of a written document signed by the consumer, unless the interest involves the credit provider being lawfully in possession of the goods (i.e., by way of pledge).140

Security interests in personal property (i.e., not land) must be perfected either by registration of a financing statement on the Personal Property Securities Register or by the secured party having possession or control of the property in order to obtain the maximum level of enforceability and priority.141 The NCC imposes additional requirements for security interests in personal property to be enforceable; it does not displace the Personal Property Securities Act 2009 (Cth) in this respect.

Security interests securing credit subject to the NCC must be in respect of specific property. A purported charge over all assets of a person to secure credit subject to the NCC is void.142 Further, security interests in property to be owned by the provider of the security interest are void unless the property in question is acquired with the credit it secures, relates to the property or class of property described in the document creating the security interest or relates to goods acquired in replacement of specific goods subject to the security interest.143

Third-party security interests – that is, security interests provided by persons who are neither the debtor nor a guarantor of a debtor's obligations – are not permitted in respect of credit subject to the NCCP Act and NCC. A person providing a security interest must either be the debtor or a guarantor of the debtor's obligations. A purported third-party security interest with respect to credit regulated by the NCC is unenforceable.144

Security interests may not be taken over the following types of property:

  1. employees' remuneration or employment benefits;
  2. superannuation benefits;
  3. essential household property;
  4. goods used by the person granting the security interest in earning income from personal exertion, if the goods are worth less than a prescribed amount; and
  5. a cheque, bill of exchange or promissory note endorsed or issued by the debtor or guarantor.145

The NCC also imposes additional obligations on credit providers when enforcing security interests securing credit subject to the NCC. In summary, a credit provider is required to provide a default notice and allow the debtor or guarantor 30 days to remedy the default, and to keep the debtor or guarantor informed throughout the process of disposing of the secured goods and realising their value.146

Home mortgage loans

The requirements described above with respect to security interests apply to a mortgage over real estate securing a loan to purchase that real estate.

Credit providers under standard form home loan contracts must provide prospective debtors with a key facts sheet setting out material features of the credit contract in a table format specified by the NCCP Regulations.147 If a credit provider's website enables a consumer to enquire about or apply for a standard form home loan, the credit provider must also provide functionality on their website for the consumer to be able to generate a key facts sheet for the home loan products offered by the credit provider.

Further, mortgages over real estate are subject to state and territory real property legislation. This means that the mortgage should be registered on the relevant state or territory land titles register to enjoy priority over unregistered and later registered security interests. Some state and territory real property legislation requires a longer grace period for a debtor to remedy a default.148

Ending credit contracts

A debtor under a credit contract has a right to be given a payout figure at any time and to end a credit contract by paying to the credit provider the amount owing under the credit contract.149

In the event of a default, a credit provider must provide the debtor with a notice in respect of the default and allow a 30-day period to remedy the default before the credit provider can commence court proceedings to enforce the credit contract.150 If the credit contract contains an acceleration clause, the default notice must set out how the debtor's liabilities will be affected by any acceleration clause enlivened by the default in order for that acceleration clause to be enforceable.151

Loan serviceability

Before entering into a credit contract or increasing the credit limit of a credit contract, a credit provider must make reasonable inquiries into the consumer's financial situation (among other things), verify information about it and assess whether the credit contract will be unsuitable for the consumer. A credit contract is unsuitable for a consumer if the consumer is unable to comply with his or her obligations under the contract, or could only comply with substantial hardship. A credit provider is prohibited from entering into a credit contract with a consumer if that contract is unsuitable for the consumer.152

Student loans

For Australian citizens,153 the government makes available the Higher Education Loan Program,154 under which students in eligible courses of study can borrow the cost of their tuition fees from the government. The loans are income-contingent and repaid through the income tax system once the borrower earns a minimum level of income (A$46,620 at the time of writing) and at a rate increasing with the borrower's income.

Private loans taken out to finance one's own education are for personal, household or domestic purposes and therefore subject to the NCCP Act and NCC. However, such loans are not afforded any special status under the NCC or any other legislation.

ii Recent developments

Buy now, pay later arrangements

One of the requirements for credit to be regulated by the NCCP Act and NCC is that a charge is or may be made for providing the credit. Recently, there has been a proliferation of providers offering short-term finance for the purchase of goods or services at the point of sale with no charge made for providing the credit. Instead, revenue is derived from retailers who are charged a fee for purchases financed by such credit or from exception fees charged when consumers fail to make a scheduled repayment. Other providers offer continuing credit contracts with only a periodic account charge within limits that qualify for the exemption in Section 6(5) of the NCC, or offer credit that is limited to a total period that does not exceed 62 days and charge fees within limits that qualify for the exemption in Section 6(1) of the NCC.155 As there is no charge for providing the credit, or the charge is less than the amount prescribed by the NCCP Regulations, such credit is not regulated by the NCCP Act and NCC.

This has led to concerns that consumers are being denied key protections in relation to credit and are at a greater risk of being provided credit that is unsuitable for them (as responsible lending obligations do not apply to credit that is not regulated by the NCCP Act). Throughout 2018, ASIC conducted a review of buy now, pay later arrangements and reported its findings in November 2018.156 ASIC's report found that users of such arrangements are overwhelmingly young people (18–34 years old) and flagged a number of risks inherent in such products, including the lack of consumer protections under the NCCP Act, overcommitment and higher total indebtedness, potentially unfair contract terms, and hidden costs in the form of higher prices charged by merchants for goods or services to cover the fees paid to the providers of these arrangements.

ASIC has conducted subsequent reviews into the industry and released a subsequent report in 2020, but has not taken any further regulatory action in the industry.

In March 2021, the Australian Finance Industry Association (AFIA) and its buy now, pay later members (Afterpay, Brighte, flexigroup, Klarna, Latitude, Openpay, Payright and Zip Co) collaborated to enact a Code of Practice for the buy now, pay later industry. The objectives of this code are to:157

  1. promote a customer-centric approach to the design, marketing and distribution of a BNPL product or service;
  2. promote high industry standards of service for customers and build best practices across the BNPL industry; and
  3. support compliance with legal and industry obligations.

Other areas

The NCCP Act and the NCC were amended with effect from 2013 to introduce the concepts of small amount credit contracts (SACCs),158 medium amount credit contracts (MACCs)159 and reverse mortgages.160 SACCs are credit contracts that are:

  1. not provided by an ADI;
  2. for an amount or credit limit not more than A$2,000 (plus the establishment fee and first monthly fee) or less
  3. for a term of at least 16 days but not longer than one year; and
  4. unsecured.161

MACCs are credit contracts that are:

  1. not provided by an ADI;
  2. for an amount of credit limit of at least A$2,001 and not more than A$5,000; and
  3. for a term of at least 16 days but not longer than two years.162

A reverse mortgage163 is a financial instrument aimed at seniors to allow them to access equity in their home and remain living there. The key difference from a traditional real property mortgage is that, generally, there are no principal or interest payments required to be made by the debtor while he or she continues to live in his or her home. The NCCP Act and the NCC prescribed different requirements for reserve mortgages in relation to pre-contractual conduct, contract disclosures and procedures during the loan term.164

SACCs differ from other credit contracts as the NCC tightly defines their terms. Notionally, interest cannot be charged on SACCs. Rather, a permitted monthly fee equal to 4 per cent of the first amount of credit provided (excluding fees capitalised in that amount) may be charged each month on a SACC.165 Apart from the monthly fee, a permitted establishment fee not exceeding 20 per cent of the first amount of credit provided (excluding fees capitalised in that amount) may be charged in relation to a credit contract. The effect of these fees is to allow for an effective interest rate greater than 48 per cent per annum – SACCs are excluded from the annual cost rate cap in the NCC.166 Default fees may be charged in relation to a SACC, but total default fees charged cannot exceed twice the first amount of credit provided (excluding fees capitalised in that amount).167

Additionally, for responsible lending purposes, it is presumed that a SACC will be unsuitable for a consumer if he or she:

  1. receives at least 50 per cent of his or her gross income from social security payments, and repayments under all SACCs entered into by the consumer would exceed 20 per cent of the consumer's gross income for a payment cycle during the life of the loan;168
  2. has been a debtor under two or more SACCs within the 90 days preceding the preliminary responsible lending assessment;169 or
  3. is in default under another SACC.170

The NCCP Regulations prevent credit providers from providing credit to consumers by a series of SACCs or MACCs. If a consumer's requirements are to obtain a particular amount of credit, a credit contract is deemed to be unsuitable for a consumer if it forms part of an arrangement under which that amount of credit is provided by two or more SACCs or MACCs.171

i Linked credit providers and tied credit contracts

A credit provider is a linked credit provider of a supplier of goods or services if, pursuant to an agreement or arrangement between the credit provider and the supplier:

  1. the credit provider finances consumers' purchases of goods or services from the supplier;
  2. the supplier regularly refers consumers to the credit provider to obtain credit;
  3. the credit provider's contract documents or application forms are made available to consumers at the supplier's premises; or
  4. the contract documents, applications or offers for credit from the credit provider may be signed by consumers at the supplier's premises.172

A credit contract provided by a linked credit provider of a supplier to finance the purchase of goods or services from the supplier is termed either a tied loan contract or tied continuing credit contract, depending on whether it is an instalment loan or line of credit.

A linked credit provider is vicariously liable for the following misconduct on the part of the supplier of goods or services financed by a tied credit contract: misrepresentations in relation to the tied credit contract; and misrepresentation, breach of contract or failure of consideration in relation to the contract for sale of the goods or services financed by the tied credit contract that results in loss or damage for the debtor.173

A linked credit provider's liability does not diminish the supplier's direct liability for the above misconduct, and proceedings must be brought jointly against both the supplier and linked credit provider unless the supplier is insolvent or a court is satisfied that it would not be able to satisfy any judgment ordered against it.174 A linked credit provider is entitled to be indemnified by the supplier in respect of its liability for the supplier's misconduct and to be subrogated to the consumer's rights against the supplier.175 Therefore, in effect, the NCC puts a linked credit provider in the position of a guarantor of the supplier's obligations in relation to the sale of goods or services to be financed by credit.

ii Related insurance contracts

A credit provider may require a consumer to take out insurance in relation to the consumer debtor's capacity to repay the loan or over property that secures the loan. The NCC regulates credit providers' actions in relation to that insurance. Care must be taken to ensure that any insurance is of benefit to the debtor (e.g., they satisfy any preconditions, such as not being unemployed).176

The NCC limits a credit provider's ability to require a consumer debtor or guarantor to pay for insurance arranged by it, require a debtor or guarantor to obtain insurance from a particular insurer or make unreasonable requirements as to the terms on which the debtor or guarantor is required to obtain insurance.177 It also prevents a credit provider from financing insurance premiums for more than one year at a time.178

If a credit contract is terminated (such as by being repaid early), any insurance contract insuring the debtor's capacity to repay the loan automatically terminates and the credit provider is liable to provide to the debtor a proportionate refund of any premiums paid. The credit provider's liability exists regardless of the term of the insurance contract. The credit provider may recover from the insurer any amount paid to the debtor.179

iii Facilitating innovation in consumer finance

ASIC has issued two legislative instruments180 providing limited exemptions from the need to hold an ACL or AFSL to test new credit activities or financial services. Under those legislative instruments, eligible persons – persons who do not hold an AFSL or ACL and are not a related body corporate or authorised representative of the holder of an AFSL or ACL – may, on giving written notice to ASIC about their intention to rely on the exemption, provide eligible credit activities and financial services for a period of up to 12 months without holding an ACL or AFSL or being an authorised representative of a holder of an ACL or AFSL. This exemption has been colloquially termed the 'regulatory sandbox exemption'.

The regulatory sandbox exemption is only available in respect of:

  1. providing credit services in respect of credit contracts not exceeding A$25,000 in amount, 24 per cent per annum interest rate and other conditions set out in the instrument; and
  2. providing financial product advice about or dealing in:
    • a non-cash payment facility issued by an ADI;
    • a home contents insurance product where the sum insured under the product does not exceed A$50,000;
    • a personal and domestic property insurance product where the sum insured under the product does not exceed A$50,000
    • a managed investment product in relation to a simple managed investment scheme
    • a quoted security; or
    • Commonwealth (federal) government securities (i.e., bonds).

Additionally, a person relying on the regulatory sandbox exemption may only provide the credit services or financial services to no more than 100 consumers or retail clients and, in the case of financial services, the value of all financial products in relation to which financial services have been provided does not exceed A$5 million.

iv Product intervention power

The Treasury Laws Amendment (Design and Distribution Obligations and Product Intervention Powers) Act 2019 (Cth) also amended the Corporations Act and the NCCP Act to grant a power to ASIC. This power is in relation to credit products regulated by the NCCP Act and financial products available for acquisition by issue to retail clients, to order persons to do something or refrain from doing something in order to prevent significant detriment to consumers or retail clients (product intervention order). ASIC is only able to exercise the power if it considers that a credit or financial product has resulted in, or will or is likely to result in, significant detriment to consumers or retail clients, and will not be able to make product intervention orders against consumers and retail clients in that capacity. 'Financial product' is defined broadly so as to include credit products that are not subject to the NCCP Act.

ASIC is required to consult before making a product intervention order, though failure to consult does not invalidate a product intervention order. Product intervention orders can remain in force for a maximum of 18 months, unless extended by the Minister (including for an indefinite period of time). At the time of writing, ASIC has made product intervention orders in relation to short-term credit and the issue and distribution of contracts for difference to retail clients and sale of add-on motor vehicle financial risk products.

v Financial product design and distribution obligations

The Treasury Laws Amendment (Design and Distribution Obligations and Product Intervention Powers) Act 2019 (Cth) also contained amendments to the Corporations Act imposing design and distribution obligations on issuers of financial products. These obligations commenced on 5 October 2021. They will require issuers of financial products under a disclosure document (essentially financial products issued to retail clients) to, among other things:

  1. determine the target market for the financial product;
  2. supervise distribution channels to ensure that the financial product is issued or sold only to persons within the target market; and
  3. design the financial product so that it is reasonably likely to be consistent with the likely objectives, financial situation and needs of a retail client in the target market.

As with the product intervention power discussed above, 'financial product' is defined broadly to include credit facilities that are not otherwise regulated by the Corporations Act.

vi Mortgage broker best interests duty and conflicted remuneration

After the findings of the Banking Royal Commission, the Australian government passed the Financial Sector Reform (Hayne Royal Commission Response – Protecting Consumers (2019 Measures)) Act 2020 (the Reform Act), which among other things introduces a best interests duty for mortgage brokers. The Reform Act received Royal Assent on 17 February 2020, inserting Part 3-5A into the NCCP Act. The best interests obligations can be found under Part 3-5A Division 2 of the NCCP Act and applies in relation to credit assistance provided by a licensee to a consumer in relation to any credit contract, if the licensee is a mortgage broker. Owing to the impact of covid-19, the original implementation date of 1 July 2020 was given a six-month application deferral.

The Reform Act also imposes obligations on mortgage brokers and mortgage intermediaries to not accept conflicted remuneration. Conflicted remuneration is defined in the Reform Act as any benefit, monetary or non-monetary provided to a licensee that could reasonably be expected to influence whether they act as a credit assistance provider or as an intermediary. It is proposed that these obligations will be extended to apply to all credit assistance providers.

vii Review of the Privacy Act

On 12 December 2019, the Australian government announced that they would be conducting a review of the Privacy Act 1988 (Cth) to ensure that the regulatory framework can be adapted to the new and current challenges in the digital age. On 30 October 2020, the Attorney-General's Department released its Terms of Reference and timeline for review, along with an issues paper.

In accordance with the Terms of Reference, the matters to be considered for review include:

  1. the scope and application of the Privacy Act;
  2. whether the Privacy Act effectively protects personal information;
  3. whether individuals should have a direct right of action to enforce privacy obligations under the Privacy Act;
  4. whether a statutory tort for serious invasions of privacy should be introduced;
  5. the effectiveness of the notifiable data breach scheme;
  6. the effectiveness of enforcement powers under the Privacy Act; and
  7. the desirability and feasibility of an independent certification scheme to monitor compliance with Australian privacy laws.

On 25 October 2021, the Attorney-General's Department released a discussion paper as part of its review of the Privacy Act. In parallel with the discussion paper, the Department is also seeking feedback on the Privacy Legislation Amendment (Enhancing Online Privacy) Bill 2021.

Unfair practices

Please see the other sections for details on unfair practices.

Recent cases


Australian Securities and Investments Commission v. Westpac Banking Corporation [2020] FCAFC 111; Australian Securities and Investments Commission v. Westpac Banking Corporation (Liability Trial) [2019] FCA 1244

This case concerned alleged breaches of responsible lending laws by Westpac in its home loan approval process. While Westpac did collect information about customers' living expenses, a particular serviceability calculation within its credit assessment process used a statistical benchmark value in place of the amount for living expenses that the applicant declared in their loan application in determining whether the applicant could afford repayments on the loan. Also, for interest-only loans, Westpac determined serviceability by amortising the principal amount over the entire term of the loan rather than only the residual term after the expiry of the interest-only period. ASIC commenced civil penalty proceedings, alleging a failure to assess whether or not a credit contract was unsuitable before entering into the credit contract.

After a A$35 million penalty agreed between ASIC and Westpac was rejected by the Federal Court as the proposed orders did not disclose any contravention of the NCCP Act,181 the case was argued on its merits and the Federal Court held that Westpac did not contravene the NCCP Act. It was held that the obligation to assess whether or not a credit contract will be unsuitable for a consumer simply requires the credit provider to turn their mind to the criteria for unsuitability; it does not prescribe the manner in which the assessment must be carried out, what information must be used and how it must be used, or the decision rules that must be followed. How the assessment is carried out is left to the credit provider's discretion. Hence, Westpac did assess whether or not the credit contract would be unsuitable for each applicant and therefore discharged its obligation in this respect.

The decision is significant as it is the first contested litigation concerning the responsible lending obligations in the NCCP Act. It also represents a construction of the NCCP Act more favourable to credit providers than the prevailing industry sentiment was at the time the litigation was commenced. Material to the outcome in this case was that ASIC did not allege that any of the credit contracts entered into were unsuitable; only that Westpac's assessments were defective and therefore invalid. The case is also significant for the judge's comments that consumers can be expected to reduce discretionary expenditure in order to make loan repayments, with the implication that a cash-flow deficit based on the consumer's current income and expenditure levels does not necessarily mean that a consumer will be unable to afford to repay the loan.

ASIC's appeal to the Full Federal Court was dismissed, confirming the primary judge's finding in the Federal Court that Westpac had not failed to make the assessment of unsuitability required during the responsible lending process.

D H Flinders Pty Ltd v. Australian Financial Complaints Authority Limited [2020] NSWSC 1690

This case concerned Equitable Financial Solutions Pty Ltd (EFSOL) (in liquidation), a corporate authorised representative operating under the D H Flinders' Australian financial services licence (ASFL) for a wholesale managed fund. In holding this ASFL, D H Flinders was also required to be a member of AFCA. Outside the scope of its authority, EFSOL issued a retail product to customers. Complaints were then received by D H Flinders in AFCA in relation to the retail products provided by EFSOL, including representations made and the failure to return funds. Despite the absence of any authority or a customer relationship, AFCA reasoned that due to EFSOL being an authorised representative of D H Flinders, it had the power to determine complaints brought against D H Flinders relating to EFSOL's conduct. D H Flinders challenged the contractual authority of AFCA to determine complaints brought against it by EFSOL and asserted that the manner in which AFCA conducted the complaints breached its contractual obligation of procedural fairness and impartiality.182 The court ultimately held that AFCA did not have this power. While EFSOL was found to be acting outside its authority, AFCA too did not have the authority to resolve the complaints against the conduct of EFSOL. Justice Stevenson determined that the AFCA rules were drafted in a manner that provided AFCA ample jurisdiction to hear complaints against a licensee in respect of conduct of a representative acting within its authority, not outside its authority.183 In additional obiter, his Honour was critical of how AFCA's officers assisted and directed claimants to bring their claims against licence holders who were not previously in the claims. His Honour commented that AFCA had 'entered the fray', and was acting in an advisory relationship with the complainants, which was not consistent with AFCA's obligation to be independent and impartial to all parties.184


The Australian regulatory framework for consumer financial services is complex. The NCCP and the NCC regulate credit. Financial products (excluding credit) are regulated under the Corporations Act. The Corporations Act, the Payment Systems Act and the ePayments Code regulate payment systems and electronic payments. In addition, further obligations are set out in various pieces of legislation, including the AML/CTF Act, the ASIC Act, the Consumer Law and the Privacy Act. In addition, much guidance is published by the regulators, including APRA, the RBA, ASIC, the ACCC, the OAIC and AUSTRAC. Following the 2018/19 Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry (the Royal Commission), there continues to be law reform to implement the Royal Commission's recommendations and regulators will adopt a more litigious approach to enforcing the laws regulating consumer financial services.

Over the past two years, the covid-19 pandemic has continued to inflict economic damage on the Australian economy. Despite the government's intention to overhaul responsible lending and reform facets of the Australia credit law framework, meaningful change has been difficult to attain owing to persistent political deadlock. However, credit laws have been amended to accommodate financial hardship and, from July 2022, financial hardship reporting will be permitted within the credit reporting system. Consequently, it is clear that the credit law system in Australia will continue to propel the recovery of the economy above and beyond the covid-19 pandemic.


1 Andrea Beatty is a partner at Piper Alderman. This chapter was written with the assistance of Chelsea Payne, associate, and Shannon Hatheier and Tom Murdoch, law clerks, at Piper Alderman. The author thanks Gabor Papdi and Chloe Kim for their contribution to previous editions.

2 NCC Section 5(1).

3 However, reg. 65C of the NCCP Regulations excludes credit provided to purchase, renovate or improve residential property for investment purposes (or to refinance credit provided for such purposes), where it is provided for the purpose of investment in more than one residence and is more than A$5 million in amount.

4 NCC Section 32A(1).

5 NCC Section 170(1).

6 Unless a specific exemption in the NCCP Regulations applies.

7 NCCP Act Sections 6–10.

8 NCCP Act Section 29(3).

9 NCCP Regulations reg. 25(3).

10 NCCP Regulations reg. 25(3).

11 NCCP Regulations regs. 25 and 24(6).

12 NCCP Regulations reg. 23D.

13 NCCP Regulations reg. 24(9). We note that the Final Report of the Banking Royal Commission recommended removing this exemption; however, no legislation has been introduced to do so at the time of writing.

14 NCC Section 32A.

15 NCC Section 72.

16 NCC Sections 76 and 77.

17 NCC Section 78.

18 NCCP Act Chapter 3.

19 Australian Securities and Investments Commission v. Channic Pty Ltd [No 4] [2016] FCA 1174 (Channic) at [1725].

20 Australian Securities and Investments Commission v. Westpac Banking Corporation [2020] FCAFC 111.

21 NCC Section 47.

22 Corporations Act Section 766A. Other activities that amount to providing a financial service, such as providing a custodial or depository service, operating a registered managed investment scheme and providing a crowdfunding platform, exclusively concern investment activities and are therefore beyond the scope of this chapter.

23 Corporations Act Section 763A.

24 Corporations Act Section 764A(1).

25 Corporations Act Section 765A(1)(h).

26 Corporations Act Section 761G.

27 Corporations Act Part 7.7 Division 2.

28 Corporations Act Part 7.7 Division 3.

29 Corporations Act Part 7.7A.

30 Corporations Act Part 7.9 Division 2.

31 Corporations Act Section 912A.

32 Banking Act Section 5.

33 Banking Act Section 7.

34 APRA, 'Discussion Paper – Licensing: A phased approach to authorising new entrants to the banking industry', 15 August 2017,, at p.18.

35 James Frost, 'Xinja pulls the pin, returns money', Australian Financial Review, (online at 16 December 2020),

36 See for links to the instruments designating, setting standards and imposing access regimes on the payment systems.

37 RBA, Standard No. 3 of 2016: Scheme Rules Relating to Merchant Pricing for Credit, Debit and Prepaid Card Transactions, Clause 4.

39 The Australian Privacy Principles (APP) apply to agencies and organisations: Privacy Act Section 6. The definition of an agency is in Section 6 of the Privacy Act and the definition of an organisation is in Section 6C of the Privacy Act. The definition of organisation excludes small business operators, who are operators of a business that have an annual turnover of A$3 million or less in a financial year: Privacy Act Section 6D.

40 Privacy Act Schedule 1.

41 Privacy Act Sections 6Q and 21D, the Privacy (Credit Reporting) Code 2014 Clause 9.3.

42 Privacy Act Part IIIC.

43 AML/CTF Act Section 6.

44 AML/CTF Act Section 51B.

45 AML/CTF Act Section 81.

46 AML/CTF Rules Parts 8.4 and 9.4.

47 AML/CTF Act Section 32.

48 AML/CTF Act Section 47.

49 AML/CTF Act Section 45.

50 AML/CTF Act Section 43.

51 AML/CTF Act Section 41.

52 AML/CTF Rules Parts 8.5 and 9.5.

53 AML/CTF Rules Parts 8.3 and 9.3.

54 ASIC Act Section 12A(3).

55 ASIC Act Section 13; NCCP Act Section 248.

56 ASIC Act Section 33; NCCP Act Section 267.

57 ASIC Act Sections 19, 21; NCCP Act Sections 253, 255.

58 Section 114 of the NCC states that for proceedings commenced on the application of the debtor or guarantor, a court may impose a penalty not exceeding the amount of interest charges payable. Section 118 of the NCC permits a court to order compensation for any loss suffered by a debtor or guarantor.

59 NCCP Act Section 47(1)(i); Corporations Act Sections 912A(1)(g) and 912A(2)(b).

60 Australian Financial Complaints Authority Complaint Resolution Scheme Rules – 1 November 2018, rule A14.2 (

62 Chief Executive Officer of the Australian Transaction Reports and Analysis Centre v.Westpac Banking Corporation [2020] FCA 1538.

66 See for more information about the NPP.

67 Corporations Act Section 763D(2).

68 ASIC Corporations (Non-cash Payment Facilities) Instrument 2016/211.

69 Corporations Regulations 2001 (Cth) regulation 7.1.07G.

70 PSR Act Section 11.

72 Standard No. 1 of 2016: The Setting of Interchange Fees in the Designated Credit Card Schemes and Net Payments to Issuers Clause 4.1.

73 Standard No. 2 of 2016: The Setting of Interchange Fees in the Designated Debit and Prepaid Card Schemes and Net Payments to Issuers Clause 4.1.

74 Standard No. 3 of 2016: Scheme Rules Relating to Merchant Pricing for Credit, Debit and Prepaid Card Transactions Clause 4.1.

75 See Section 5 of the Banking Act and reg. 6 of the Banking Regulations.

76 PSR Act Section 9(1)(c).

77 PSR Act Section 22.

78 Payment Systems (Regulation) Act 1998 (Cth) (PSR Act) Section 9.

79 Banking Regulations reg. 6.

80 See Section II.ii above for further information.

81 ePayments Code Clause 4.11.

82 ePayments Code Clause 10.1(e).

83 ePayments Code Clauses 24 to 34.

84 AML/CTF Act Section 6, Table 1 Items 1 and 3.

85 Banking Act Section 16AF.

86 Banking Act Section 16AG; Banking Regulation 2016 (Cth) regulation 11.

87 Banking Act Section 16AI.

88 See Section IV.i under the heading 'Deposit guarantee'.

89 NCC Section 6(4).

90 Commonwealth Treasurer, media release, 9 May 2017,

91 NCC Section 204.

92 NCC Section 6(5); NCCP Regulations regulation 51.

93 NCC Section 17(7).

94 NCC Section 32B(8).

95 NCC Section 33(2)(a).

96 NCC Section 33(2).

97 NCC Section 13A.

98 NCC Section 33(3).

99 NCC Section 67(4).

100 See NCCP Act Part 3-2.

101 NCC Section 46.

102 NCC Section 91. See [91.05] of Annotated National Credit Code by Andrea Beatty and Andrew Smith, LexisNexis, 6th edition, 2019.

103 NCC Section 91(2)(a).

104 As defined in NCC Section 159.

105 See [157.10] of Annotated National Credit Code by Andrea Beatty and Andrew Smith, LexisNexis, 6th edition, 2019.

106 NCC Section 158.

107 NCCP Act Section 133BA.

108 NCCP Act Section 133BC; NCCP Regulations Schedule 6.

109 NCCP Act Section 133BD.

110 NCCP Act Sections 133BE.

111 NCCP Act Sections 133BF and 133BFA.

112 NCCP Act Section 133BFB.

113 NCCP Act Section 133BH.

114 NCCP Act Section 133BI.

115 NCCP Act Section 133BQ.

116 NCCP Act Sections 133BT and 133BU.

117 NCCP Act Sections 131(3AA), 133(3AA) and 160F; ASIC Credit (Unsuitability – Credit Cards) Instrument 2018/753.

118 See definition of 'continuing credit contract' in NCC Section 204.

119 NCC Section 14.

120 NCC Section 17; NCCP Regulations regulation 74, Forms 6 and 7.

121 NCCP Act Section 16; NCCP Regulations.

122 NCCP Regulations reg. 72.

123 NCC Section 32B.

124 NCC Section 28.

125 NCC Section 28(1)(a).

126 NCC Section 27.

127 NCC Section 27.

128 NCC Section 28(1)(b).

129 NCC Section 28(2).

130 NCC Section 29.

131 NCCP Regulations reg. 78.

132 NCC Section 29.

133 NCC Section 34(6)(a).

134 NCC Section 30.

135 NCC Section 28(1).

136 NCC Section 28(2).

137 NCC Section 30.

138 NCC Section 93.

139 NCC Section 204.

140 NCC Section 42.

141 See Personal Property Securities Act 2009 (Cth) Part 2.2.

142 NCC Section 44.

143 NCC Section 45.

144 NCC Section 48.

145 NCC Section 50.

146 See NCC Part 5 Division 4.

147 NCCP Act Section 133AD; NCCP Regulations regulation 28LB, Schedule 5.

148 For example, Section 57(3)(d) of the Real Property Act 1900 (NSW) requires one month's notice to be allowed.

149 NCC Sections 82–83.

150 NCC Section 88.

151 NCC Section 93.

152 NCCP Act Part 3-2.

153 As well as holders of a New Zealand Special Category Visa or permanent humanitarian visa.

154 Under the Higher Education Support Act 2003 (Cth).

155 NCC Section 6(1).

156 ASIC, 'Report 600: Review of buy now pay later arrangements' (November 2018).

157 ASIC Corporations (Product Intervention Order – Short-Term Credit) Instrument 2019/917.

158 NCCP Act Section 5(1).

159 NCC Section 204.

160 NCC Section 13A.

161 NCCP Act Section 5(1); NCCP Regulations regulation 4D.

162 NCC Section 204.

163 NCC Section 13A. See [13A.05] to [13A.80] of Annotated National Credit Code by Andrea Beatty and Andrew Smith, LexisNexis, 6th edition, 2019.

164 See [13A.30] to [13A.45] of Annotated National Credit Code by Andrea Beatty and Andrew Smith, LexisNexis, 6th edition, 2019.

165 Section 31A(3).

166 NCC Section 32A(4).

167 NCC Section 39B.

168 NCCP Regulations regulation 28S.

169 NCCP Act Sections 118(3A)(b), 119(3A)(b), 131(3A)(b).

170 NCCP Act Sections 118(3A)(a), 119(3A)(a), 131(3A)(a).

171 NCCP Regulations regulation 28XXF.

172 NCC Section 127.

173 NCC Sections 128 and 129.

174 NCC Section 130.

175 NCC Sections 131 and 133.

176 See ASIC Report 492, 'A market that is failing consumers: The sale of add-on insurance through car dealers' (September 2016).

177 NCC Section 133.

178 NCC Section 144.

179 NCC Section 148.

180 ASIC Corporations (Concept Validation Licensing Exemption) Instrument 2016/1175 and ASIC Credit (Concept Validation Licensing Exemption) Instrument 2016/1176.

181 Australian Securities and Investments Commission v. Westpac Banking Corporation [2018] FCA 1733.

182 D H Flinders Pty Ltd v. Australian Financial Complaints Authority Limited [2020] NSWSC 1690.

183 ibid.

184 ibid.

The Law Reviews content