Australia Scams Prevention Framework Guide: Obligations, Deadlines and Penalties for Banks, Telcos and Platforms

Australia has moved scam losses from a consumer problem to a legal duty: banks, telecommunications providers and key digital platforms must now take reasonable steps to prevent, detect, report, disrupt and respond to scams, or face civil penalties and customer redress claims. The Scams Prevention Framework (SPF) is set out in a new Part IVF of the Competition and Consumer Act 2010, inserted by the Scams Prevention Framework Act 2025, with sectors designated and rules made by legislative instrument in 2026. This guide explains who is covered, the six principles, the timeline as it stands on 8 November 2026, the regulators and penalties, and the practical steps compliance, fraud and security teams should take before the main obligations start. It is written for executives, compliance leads and fraud and security practitioners in the designated sectors and their suppliers. For the wider international picture, see the Online Fraud Regulation Map.

Key takeaways

• Three sectors are designated first. Banking, telecommunications and key digital platforms (social media, internet search and instant messaging services) were designated by an instrument dated 28 May 2026; the Minister can add sectors later.
• Six principles, two penalty tiers. Governance, prevent, detect, report, disrupt and respond; breaches of prevent, detect, disrupt and respond carry the higher tier, up to 159,745 penalty units or 30% of adjusted turnover for a body corporate.
• Most obligations start on 31 March 2027. AFCA membership was required from 1 September 2026, and further obligations, including bank reporting of actionable scam intelligence, are expected by the end of 2027.
• Sector codes define "reasonable steps". Compliance with the relevant SPF code is the primary consideration when a regulator or AFCA judges whether an entity did enough; codes were still being finalised when this guide was checked.
• Intelligence must be acted on within set times. An entity with reasonable grounds to suspect a scam has actionable scam intelligence and must investigate it, report it and disrupt it, with a 28-day investigation window and a 28-day safe harbour for disruptive action.

Scope: who and what is covered

The Act creates the framework but does not itself name the regulated sectors. Section 58AC lets the Minister designate sectors by legislative instrument, and the Act gives banking, insurance and communications as examples. The first designation is the Competition and Consumer (Scams Prevention Framework, Regulated Sectors) Designation 2026 (F2026L00627), dated 28 May 2026 and in force.

The ACCC is also the SPF general regulator for the principles themselves (s 58EB). Where no sector regulator is designated, the ACCC fills that role by default (s 58ED(2)). The Competition and Consumer (Scams Prevention Framework) Rules 2026 (F2026L01140), dated 31 August 2026 and in force, add exceptions to each of the three designations, so an entity in a designated sector should read the rules to confirm which of its services are caught.

• Scam: a direct or indirect attempt, successful or not, to engage an SPF consumer through deception that would cause loss or harm if it succeeded (s 58AG).
• SPF consumer: broadly defined in the Act; the draft rules proposed narrowing it for banks to direct customers, or customers of the paying or receiving bank.
• Who it is not aimed at: the proposed rules exclude misleading conduct by legitimate businesses themselves, but impersonation of those businesses is still a scam.

Key obligations

Division 2 of Part IVF sets six principles that apply to every regulated entity. Sector codes then add sector-specific detail for principles 1, 2, 3, 5 and 6 (ss 58CA to 58CC).

Actionable scam intelligence

Under s 58AI an entity has actionable scam intelligence when there are reasonable grounds to suspect that a communication, transaction or other activity relating to its regulated service is a scam. The test is objective: what the entity should have suspected, not only what it did suspect. Relying solely on tip-offs from others is not enough to meet the detect principle (s 58BK(1)). In practice this means fraud signals, abuse reports, takedown requests and inbound intelligence from other sectors all need a recorded triage decision and a clock.

Reasonable steps and the codes

Section 58BB lists factors for judging reasonable steps: the entity's size, the kind of services, its consumer base, its scam risks and its compliance with the relevant SPF code, which is the primary consideration. Draft bank code measures reported in the Treasury consultation package included confirmation of payee, targeted warnings, limits on high-risk transactions, scam transaction identification, account blocking and payment recall. Draft codes are minimum standards; larger or higher-risk entities may be expected to do more. See the Confirmation of Payee and Payee Verification Guide and the Authorised Push Payment (APP) Fraud Guide.

Redress

The Australian Financial Complaints Authority (AFCA) is the single external dispute resolution scheme for SPF complaints against banks, telcos and digital platforms. Alongside the designation, the government published a position paper proposing that verified losses under $3,000 be reimbursed automatically and that liability between several entities in breach be shared, generally equally. These were proposals at the time of checking, not final rules.

Timeline and current status

Status as checked on 8 November 2026. Dates can move as codes and instruments are finalised: confirm against the Federal Register of Legislation and the regulators' pages before relying on them.

Telecommunications providers already work under ACMA-enforced rules to identify, trace and block scam calls and SMS; the government reported that telcos blocked about 109.9 million scam calls and 41.1 million scam SMS between October and December 2025. The SPF layers a cross-sector duty on top of those existing rules. See the Scam Prevention in Telecoms Guide.

Enforcement and penalties

Penalties are set in Commonwealth penalty units (ss 58FK and 58FL), so the dollar figure follows the penalty unit value in force at the time of the contravention.

• Who enforces: the ACCC as general regulator for the principles; ASIC, ACMA and the ACCC as sector regulators for code compliance in banking, telecommunications and digital platforms respectively.
• Consumer route: internal dispute resolution first, then AFCA. Draft settings require each entity in a multi-party complaint to assess its own compliance, and banks to give IDR complainants a statement of compliance.
• Evidence matters: because code compliance is the primary test of reasonable steps, the records of what was detected, when, and what was done are the core of any defence.

What it means for AI agents and non-human identities

The SPF is about consumers, but much of the work it demands runs through automated systems and machine identities, and scammers increasingly use them too.

• Automated scam traffic: bulk messaging, fake advertiser accounts and bot-driven account creation on platforms depend on API keys, OAuth applications and automated accounts. Detecting and disrupting these is part of the prevent and disrupt principles for platforms. See the Bot Management Buyer's Guide.
• Machine-speed disruption: fraud engines and agents that block payments, suspend accounts or take down content act as non-human identities with powerful permissions. Give them least privilege, owners, logging and a human review path, because a wrongful block is also a consumer harm and a dispute.
• Intelligence pipelines: reporting actionable scam intelligence to the regulator and sharing it across sectors will rely on service accounts and API credentials. Treat those credentials as sensitive, rotate them and monitor their use.
• AI agents making payments: where customers or businesses delegate payments to AI agents, banks will need to tell legitimate delegated activity from a scammer's automation when applying warnings, limits and confirmation of payee. See the AI Agent Identity Security Buyer's Guide.

Compliance steps

1. Confirm scope. Map each service against the designation and the 2026 rules exceptions; record which services are regulated and why others are not.
2. Appoint accountable owners. Name a senior officer for annual certification under the governance principle and owners for each of the other five principles.
3. Write the scam prevention framework document. Policies, procedures, metrics and targets, mapped to each code obligation once the code is final; track changes from the draft.
4. Build the intelligence clock. One intake for all scam signals (customer reports, internal detections, cross-sector tip-offs) with timestamps, triage decisions, 28-day investigation tracking and regulator reporting.
5. Test disruption actions. Define proportionate actions (warnings, holds, blocking, takedown), who can authorise them, how the safe harbour conditions are recorded, and how wrongful actions are reversed.
6. Prepare complaints handling. Update IDR for scam complaints, multi-party cooperation and statements of compliance; confirm AFCA membership and contacts.
7. Run a readiness test before 31 March 2027. Walk end-to-end scenarios (impersonation SMS, investment scam ad, mule account) through detection, reporting, disruption and complaint, and fix gaps.

Scaling the response

Because reasonable steps depend on size, services and risk (s 58BB), a regional bank, a small telco reseller and a global platform will not be judged by the same yardstick. Smaller entities can lean on the code as the baseline, buy detection and confirmation of payee capability as a service, and keep one owner across several principles. Large entities should expect to go beyond the code minimum, run scam analytics in-house, staff a dedicated intelligence and disruption function and test it regularly.

Common failure patterns

• Waiting for final codes: the principles already apply from commencement; code detail refines, not replaces, them.
• Tip-off dependence: acting only on reports from other organisations does not meet the detect principle.
• No clock on intelligence: signals sit in separate queues (fraud, abuse, complaints) and the 28-day window is missed.
• Unrecorded disruption decisions: without records, the safe harbour and the reasonable steps defence are hard to show.
• Unowned automation: fraud models and bots with broad permissions and no named owner or review path.

Useful measures: median time from signal to triage decision; share of actionable intelligence investigated within 28 days; scam losses per 10,000 customers or accounts; share of scam reports with disruption action taken; complaint volumes and AFCA outcomes; wrongful block reversals.

Practitioner checklist

• Services mapped against the 2026 designation and rules exceptions, with the reasoning recorded.
• Senior officer named for annual governance certification.
• Scam prevention policies, metrics and targets documented and mapped to the final sector code.
• Single intake for scam signals with timestamps and a 28-day investigation tracker.
• Regulator reporting process for actionable scam intelligence designed and tested.
• Disruption actions defined with authorisers, safe harbour records and reversal steps.
• AFCA membership confirmed and IDR updated for scam and multi-party complaints.
• Credentials and permissions of fraud engines, bots and intelligence-sharing integrations inventoried and owned.
• Readiness exercise completed before 31 March 2027.

Standards and references

• Federal Register of Legislation: Scams Prevention Framework Act 2025
• Federal Register of Legislation: Scams Prevention Framework Regulated Sectors Designation 2026
• Federal Register of Legislation: Competition and Consumer (Scams Prevention Framework) Rules 2026
• ASIC: Scams Prevention Framework
• Treasury Ministers: Government steps up industry protections to stop scams
• Herbert Smith Freehills Kramer: Stage 1 of the Scams Prevention Framework

Related NHI Mgmt Group resources: Online Fraud Regulation Map · Scam Prevention in Telecoms Guide · Money Mule Detection Guide · Australian Privacy and Cyber Rules Guide. This guide summarises the Australian Scams Prevention Framework as checked on 8 November 2026 and is not legal advice.