SCAMAssist helps people and organisations understand the digital evidence behind a scam: what happened, what records exist and what can be shown to a bank, regulator or decision maker. If you would like us to look at your circumstances, start with a free case review.
From today, 1 September 2026, an Australian business that provides a regulated service in the banking, telecommunications or digital platforms sectors is required to hold membership of the external dispute resolution scheme operated by the Australian Financial Complaints Authority. The Australian Competition and Consumer Commission states the obligation in plain terms: "Entities must be members of the Australian Financial Complaints Authority dispute resolution scheme from 1 September 2026" (https://www.accc.gov.au/about-us/scams-prevention-framework). The same page records what follows from missing it: "If an entity does not meet the AFCA membership obligation from 1 September, they may face enforcement action, including civil penalties" (https://www.accc.gov.au/about-us/scams-prevention-framework).
The obligation comes from the Scams Prevention Framework Act 2025, which is Act No. 15 of 2025, assented to on 20 February 2025, administered by the Department of the Treasury and in force (https://www.legislation.gov.au/C2025A00015/asmade/text). The Act works by amending the Competition and Consumer Act 2010 rather than by standing alone, which matters in practice because it places the scams obligations inside the consumer law framework Australian businesses already answer to. The framework itself sits in that Act as "Part IVF Scams Prevention Framework" (https://www.legislation.gov.au/C2004A00109/latest/text).
THE RULES ARE NO LONGER IN DRAFT, AND THIS IS THE PART MOST COMMENTARY HAS NOT CAUGHT UP WITH. The Federal Register of Legislation records the "Competition and Consumer (Scams Prevention Framework) Rules 2026" with a making date of 31 August 2026, registered at 13:42:12 on 31 August 2026, and a status of "InForce" (https://api.prod.legislation.gov.au/v1/titles/F2026L01140). The instrument is published at https://www.legislation.gov.au/F2026L01140/asmade/text and its table of contents carries a preliminary Part, a Part 3 headed "Sector-specific provisions for the Scams Prevention Framework" containing sections headed "Banking designation, complete exceptions", "Telecommunications designation, complete exception" and "Digital platforms designation, complete exceptions", and a miscellaneous Part. Anyone still describing the first set of rules as pending is describing the position as it stood on 30 August.
The sectors themselves were designated earlier in the year, and the instrument that did it is worth naming, because it is the document that answers the only question a business actually has, which is whether it is caught. The "Competition and Consumer (Scams Prevention Framework, Regulated Sectors) Designation 2026" has a making date of 22 May 2026 and is in force (https://api.prod.legislation.gov.au/v1/titles/F2026L00627). Its table of contents shows a Part 2 headed "Designation of regulated sector, banking", a Part 3 headed "Designation of regulated sector, telecommunications" and a Part 4 headed "Designation of regulated sector, digital platforms", together with sections designating the sector regulator for banking and for telecommunications, and definitional sections headed "Designated instant messaging service", "Designated internet search service" and "Designated social media service" (https://www.legislation.gov.au/F2026L00627/asmade/text). A business that has been waiting to be told whether it is in scope should be reading that instrument rather than waiting for a letter.
The external dispute resolution scheme has also been authorised by instrument rather than left to practice. The "Competition and Consumer (Scams Prevention Framework, External Dispute Resolution) Authorisation 2026" has a making date of 2 June 2026 and is in force (https://api.prod.legislation.gov.au/v1/titles/F2026L00685), and its table of contents carries a section headed "Authorisation of external dispute resolution scheme for banking, digital platforms and telecommunications sectors" (https://www.legislation.gov.au/F2026L00685/asmade/text). The power being exercised is the one the Act creates at section 58DB, "Minister may authorise external dispute resolution schemes for a regulated sector" (https://www.legislation.gov.au/C2004A00109/latest/text). For who operates that scheme, the ACCC is explicit: "The Australian Financial Complaints Authority (AFCA) is the external dispute resolution service under the framework. AFCA will handle eligible scam-related complaints not resolved through a business internal dispute resolution process from 31 March 2027" (https://www.accc.gov.au/about-us/scams-prevention-framework).
Membership is the first obligation to commence rather than the last. The ACCC records a staged introduction, and says that "Most obligations will apply from 31 March 2027, when regulated banks, telecommunications providers and digital platforms must comply with the framework to prevent, detect, disrupt, report, and respond to scams" (https://www.accc.gov.au/about-us/scams-prevention-framework). A business reading today date as the whole of the compliance task will find it has six months rather than none, with the substantive prevention, detection, disruption, reporting and response obligations arriving together at the end of that period. So the membership obligation that starts today and the complaints jurisdiction that starts on 31 March 2027 are two different dates doing two different things, and a business that joins AFCA in March has already been in breach for six months.
Four bodies share the work and it is worth knowing which one is yours. The ACCC records that "the ACCC is the framework general regulator, as well as the sector regulator for digital platforms", that "the Australian Securities and Investments Commission is the sector regulator for banks", and that "the Australian Communications and Media Authority is the sector regulator for telecommunications providers" (https://www.accc.gov.au/about-us/scams-prevention-framework). The Act carries the same architecture in its own words, with sections headed "General regulator of the Scams Prevention Framework" and "Regulator of a regulated sector", and separate monitoring and investigation sections headed "Monitoring or investigating, the ACMA" and "Monitoring or investigating, ASIC" (https://www.legislation.gov.au/C2004A00109/latest/text).
THE SIX PRINCIPLES HAVE STATUTORY NAMES AND EACH ONE CARRIES CIVIL PENALTIES. Division 2 of Part IVF is headed "Overarching principles of the Scams Prevention Framework" and its subdivisions are headed "SPF principle 1: Governance", "SPF principle 2: Prevent", "SPF principle 3: Detect", "SPF principle 4: Report", "SPF principle 5: Disrupt" and "SPF principle 6: Respond" (https://www.legislation.gov.au/C2004A00109/latest/text). These are not slogans. Under Governance sit sections headed "Documenting and implementing governance policies and procedures, civil penalty provision", "Annual certification about SPF governance policies, procedures, metrics and targets, civil penalty provision" and "Record keeping of compliance with SPF provisions, civil penalty provision". Under Detect sit "Taking reasonable steps to detect scams, civil penalty provision", "Investigating actionable scam intelligence, civil penalty provision" and "Identifying impacted SPF consumers, civil penalty provision". Under Disrupt sits "Taking reasonable steps to disrupt activities that are the subjects of actionable scam intelligence, civil penalty provision", and beside it a section headed "Safe harbour for taking actions to disrupt an activity while investigating whether the activity is a scam" (https://www.legislation.gov.au/C2004A00109/latest/text). A framework that gives a business a safe harbour for acting is a framework that expects it to act.
The consequences of getting the substantive obligations wrong are not modest. On the passage of the legislation the ACCC recorded that "Businesses that do not meet their obligations under the Framework can face fines up to $50 million" (https://www.accc.gov.au/media-release/accc-welcomes-passage-of-world-first-scams-prevention-laws), and described the reason for the design in the words of Deputy Chair Catriona Lowe: "Individuals have been bearing the brunt of the responsibility to combat scammers for too long" (https://www.accc.gov.au/media-release/accc-welcomes-passage-of-world-first-scams-prevention-laws). That sentence is the policy of the whole framework in one line. The burden of anticipating and absorbing scam loss moves from the customer to the regulated business, and the redress route moves with it. The penalty structure is two tiered on the face of the Act, which carries sections headed "Maximum penalty for tier 1 contraventions" and "Maximum penalty for tier 2 contraventions" (https://www.legislation.gov.au/C2004A00109/latest/text).
What is still genuinely unsettled is the sector codes, and any adviser saying the whole rulebook is finished is ahead of the record. The Act provides for them in a Division headed "Sector-specific codes for the Scams Prevention Framework" with a section headed "Sector-specific codes (SPF codes)" (https://www.legislation.gov.au/C2004A00109/latest/text), and the shape of that work was set out when consultation opened, in the Assistant Treasurer statement that "Mandatory industry codes of conduct will be introduced that set out specific obligations that lift the bar for each sector. Each sector will have its own code because each has unique vulnerabilities that scammers seek to exploit" (https://ministers.treasury.gov.au/ministers/daniel-mulino-2025/media-releases/consulting-industry-codes-and-rules-protect-consumers). So the position on 1 September 2026 is that the Act is in force, the sectors are designated, the external dispute resolution scheme is authorised, the first rules were made yesterday, and the sector codes are the piece still to land.
AFCA own consultation material on the Scams Prevention Framework rules is published at https://www.afca.org.au/news/consultation/afca-scams-prevention-framework-rules-consultation.
SOURCES
Scams Prevention Framework Act 2025, No. 15 of 2025, C2025A00015, made 20 February 2025, in force, administered by the Department of the Treasury: https://www.legislation.gov.au/C2025A00015/asmade/text
Competition and Consumer Act 2010, current compilation, Part IVF Scams Prevention Framework, table of contents: https://www.legislation.gov.au/C2004A00109/latest/text
Competition and Consumer (Scams Prevention Framework) Rules 2026, F2026L01140, made 31 August 2026, registered 31/08/2026 13:42:12, in force: https://www.legislation.gov.au/F2026L01140/asmade/text https://api.prod.legislation.gov.au/v1/titles/F2026L01140
Competition and Consumer (Scams Prevention Framework, Regulated Sectors) Designation 2026, F2026L00627, made 22 May 2026, in force: https://www.legislation.gov.au/F2026L00627/asmade/text https://api.prod.legislation.gov.au/v1/titles/F2026L00627
Competition and Consumer (Scams Prevention Framework, External Dispute Resolution) Authorisation 2026, F2026L00685, made 2 June 2026, in force: https://www.legislation.gov.au/F2026L00685/asmade/text https://api.prod.legislation.gov.au/v1/titles/F2026L00685
Competition and Consumer (Scams Prevention Framework, Code) Delegations 2026, F2026N00391, made 2 June 2026, in force: https://api.prod.legislation.gov.au/v1/titles/F2026N00391
Australian Competition and Consumer Commission, Scams Prevention Framework: https://www.accc.gov.au/about-us/scams-prevention-framework
Australian Competition and Consumer Commission media release, 13 February 2025, ACCC welcomes passage of world-first scams prevention laws: https://www.accc.gov.au/media-release/accc-welcomes-passage-of-world-first-scams-prevention-laws
The Hon Dr Daniel Mulino MP, Assistant Treasurer, media release, Consulting on industry codes and rules to protect consumers from scams: https://ministers.treasury.gov.au/ministers/daniel-mulino-2025/media-releases/consulting-industry-codes-and-rules-protect-consumers
Australian Financial Complaints Authority, Scams Prevention Framework rules consultation: https://www.afca.org.au/news/consultation/afca-scams-prevention-framework-rules-consultation