Australia’s attempt to make the businesses that sit along the scam “chain” legally responsible for stopping fraud has moved from legislation to implementation. Banks, telecommunications providers and major digital platforms now have five months until most obligations under the Scams Prevention Framework (SPF) take effect on 31 March 2027, with penalties for the most serious breaches running into tens of millions of dollars.

How we got here

The Scams Prevention Framework Act 2025 inserted a principles-based regime into the Competition and Consumer Act 2010 in February 2025. On its own, it applied to nobody: sectors had to be designated, and rules and codes written.

That process is now well advanced. A ministerial designation that took effect on 23 May 2026 named the first three sectors: banking services provided by authorised deposit-taking institutions, voice call and messaging services provided by telcos, and certain digital platforms, namely social media, internet search and instant messaging services. The first set of SPF Rules commenced on 1 September 2026. Among other things, they limit the digital platforms sector to entities that meet a revenue test and services that meet an active Australian user test, and carve out some providers, such as foreign ADIs and banks whose only business is purchased payment facilities.

Regulation is shared among several agencies. The ACCC is the general regulator and also oversees digital platforms, ASIC covers banks, and the Australian Communications and Media Authority covers telcos. The Australian Financial Complaints Authority (AFCA) will be the single external dispute resolution scheme.

The deadlines that matter

  • 1 September 2026: entities providing regulated services had to be AFCA members. The ACCC has warned that failing to meet this obligation can lead to enforcement action, including civil penalties.
  • 31 March 2027: most SPF obligations commence, and AFCA starts handling eligible scam complaints that are not resolved internally.
  • By the end of 2027: further obligations, including the rules on reporting and sharing “actionable scam intelligence”, are expected to start.

What banks will have to do

The Act sets out six principles: governance, prevent, detect, report, disrupt and respond. Sector codes will spell out what “reasonable steps” means in practice. Treasury released exposure drafts of the codes and rules on 28 May 2026, and consultation closed on 25 June.

For banks, the draft code includes confirmation of payee, systems to identify high-risk transactions and give targeted warnings, transaction and account monitoring, payment recall requests between sending and receiving banks, and blocking accounts associated with scams. Analysis by Herbert Smith Freehills Kramer notes that complying with the code is intended to be the primary factor in deciding whether a bank has taken reasonable steps, but that the codes set a minimum. Larger or higher-risk institutions may need to do more.

Governance is not a box-ticking exercise either. Each regulated entity must document and implement anti-scam policies, procedures, metrics and targets, and have them certified annually by a senior officer. That puts scam controls squarely on the board risk committee’s agenda.

Penalties and redress

The stakes are high. For the most serious category of breach, a failure to meet the prevent, detect, disrupt or respond principles, the maximum civil penalty for a company is the greater of 159,745 penalty units (about $52.7 million when the Act passed), three times the benefit obtained, or 30% of adjusted turnover during the breach period.

On consumer redress, the government has set out its view that verified scam losses below $3,000 should be reimbursed automatically, to avoid costly investigations of small claims. Where more than one regulated business has breached its obligations, the government’s current proposal is that liability be shared equally, with room to adjust it in exceptional cases. Those settings are still being finalised.

Why it matters beyond the three sectors

The framework is designed to grow. The government has said it will continue to monitor scam activity and will not hesitate to bring more sectors into scope. Telcos are already blocking scam traffic at scale: the Communications Minister said around 109.9 million scam calls and 41.1 million scam SMS were blocked between October and December 2025 alone.

For corporate treasurers and CFOs outside the regulated sectors, the immediate effect will be felt in banking. Expect more friction on payments to new payees, more confirmation-of-payee mismatches flagged in business banking platforms, and banks scrutinising unusual transfers more closely. Businesses should make sure their supplier master files and account names are accurate, and remind accounts payable teams that invoice and payment-redirection fraud is exactly what the new regime targets.

What to do now

  • Regulated entities should confirm their AFCA membership and map their services against the designation and the SPF Rules.
  • Boards should ask management for a gap analysis against the draft codes, with particular attention to the annual senior-officer certification.
  • Businesses outside the regime should tighten payment controls now. The banks will be doing the same.

This article is general information only and is not legal advice. Readers should seek advice specific to their circumstances.