Fintech (non-bank) compliance obligations in Australian Capital Territory: 6–19 employees, turnover $3M–$10M
Computed by the Rules Mate applicability engine for a Pty Ltd company with 6–19 employees, turnover $3M–$10M, in fintech (non-bank), operating in Australian Capital Territory and selling to consumers and small businesses.
Short answer: 49 obligations
49 obligations apply (17 critical) across 24 regulators, plus 18 to check. Risk rating: medium. No licensed regime, but you employ staff (WHS, Fair Work, super and payroll duties); you are an APP entity under the Privacy Act; 17 critical obligations apply.
Turnover $3M–$10M instead of $1M–$3M: what changes
Compared with a Pty Ltd company with 6–19 employees, turnover $1M–$3M in Australian Capital Territory, 8 obligations apply that did not, and 1 drops away.
- Applies: Notifiable Data Breach (NDB) scheme
- Applies: Publish a Privacy Policy that meets APP 1
- Applies: Provide an APP 5 collection notice at or before collection
- Applies: APP 12 & APP 13 access and correction requests
- Applies: APP 7 direct marketing: consent, opt-out & when you can't message (2026)
- Applies: Privacy Act Reform — information controllers regime (proposed Tranche 2)
- Applies: Report ransomware and cyber extortion payments within 72 hours
- Applies: APP 2 — anonymity + pseudonymity for individuals
Australian Capital Territory law that applies
3 Australian Capital Territory obligations apply on these facts, and 1 more is worth checking:
| Obligation | Why it applies |
|---|---|
| PCBU primary duty of care (ACT WHS Act s 19) | Every business is a PCBU — the primary duty of care applies whether or not you employ anyone · ACT law |
| Industrial manslaughter offence (ACT WHS Act s 34A) | Applies to every PCBU and its officers — a death caused by reckless or negligent breach of a WHS duty is a crime · ACT law |
| Comply with Workplace Privacy Act 2011 (ACT) | You have employees (6–19) · ACT law |
| Pay ACT payroll tax when threshold met | Check: applies only if your annual Australian wages (grouped) exceed $1.75M |
Payroll tax in Australian Capital Territory (FY2026-27)
ACT: 6.75% on Australian wages above the $1.75 million tax-free threshold (FY2026-27). On these facts it may apply: 6–19 employees in ACT — enter annual payroll to confirm; it applies only if your annual Australian wages (grouped) exceed $1.75M.
- How the threshold works
- Flat tax-free threshold, apportioned by days employed and the ACT share of Australia-wide wages.
- Returns
- Monthly by the 7th of the following month; annual reconciliation by 28 July
- Administered by
- ACT Revenue Office
Australian Capital Territory regulators
Where the obligations sit
| Area | Obligations |
|---|---|
| Privacy | 9 |
| Tax | 7 |
| Workplace | 7 |
| Directors | 4 |
| Whs | 4 |
| Super | 2 |
| Migration | 2 |
| Corporations | 2 |
| Consumer law | 2 |
| Wages | 1 |
Critical obligations on this profile
- Notifiable Data Breach (NDB) scheme (Annual turnover over $3M — an APP entity under the Privacy Act (s 6D))
- Apply for a Director Identification Number (Director ID) (Incorporated company (Corporations Act))
- Comply with directors' general law and statutory duties (Incorporated company (Corporations Act))
- Prevent insolvent trading (s 588G) (Incorporated company (Corporations Act))
- Pay superannuation on every payday (Payday Super) (You have employees (6–19))
- Pay employees in accordance with the applicable modern award (You have employees (6–19))
- Manage psychosocial hazards at work (You have employees (6–19))
- Take reasonable and proportionate measures to prevent sex discrimination, sexual (You have employees (6–19))
Check whether these apply
- Major banks must provide CDR Banking + Action Initiation (2026): only if you are an accredited CDR data recipient
- Lodge an FBT return and pay FBT by 21 May: only if you provide fringe benefits (cars, entertainment, loans) to employees
- Wash outbound marketing lists against the Do Not Call Register: only if you make outbound telemarketing calls
- Pay ACT payroll tax when threshold met: only if your annual Australian wages (grouped) exceed $1.75M
- Consumer Data Right (CDR) participant accreditation + compliance: only if you are an accredited CDR data recipient
- Register R&D activities for the R&D Tax Incentive: only if you claim the R&D Tax Incentive
- Payment Service Provider (PSP) licensing reform — implementation pending: only if you provide payment or stored-value facilities
- Comply with Stored Value Facility rules (banking exception): only if you provide payment or stored-value facilities
Questions
- How many compliance obligations apply to fintech (non-bank) businesses in Australian Capital Territory with 6–19 employees, turnover $3M–$10M?
- 49 obligations apply (17 critical) across 24 regulators, plus 18 to check. Risk rating: medium. No licensed regime, but you employ staff (WHS, Fair Work, super and payroll duties); you are an APP entity under the Privacy Act; 17 critical obligations apply.
- Which Australian Capital Territory laws apply?
- PCBU primary duty of care (ACT WHS Act s 19), Industrial manslaughter offence (ACT WHS Act s 34A) and Comply with Workplace Privacy Act 2011 (ACT)
Related
- Fintech (non-bank) compliance in Australian Capital Territory
- Fintech (non-bank): all obligations
- Compliance obligations by industry, state and size
- Fintech (non-bank) in ACT: sole trader
- Fintech (non-bank) in ACT: sole trader with employees
- Fintech (non-bank) in ACT: partnership
- Fintech (non-bank) in ACT: trading trust
- Fintech (non-bank) in ACT: no employees
- Fintech (non-bank) in ACT: 1–5 employees
- Fintech (non-bank) in ACT: 20–99 employees
- Fintech (non-bank) in ACT: 100–499 employees
- Fintech (non-bank) in ACT: 20–99 employees, turnover $1M–$3M
- Fintech (non-bank) in ACT: 100–499 employees, turnover $100M–$1B
- Fintech (non-bank) in ACT: 500+ employees, turnover $1B+
- Fintech (non-bank) in New South Wales: 6–19 employees, turnover $3M–$10M
- Fintech (non-bank) in Victoria: 6–19 employees, turnover $3M–$10M
- Fintech (non-bank) in Queensland: 6–19 employees, turnover $3M–$10M
- Fintech (non-bank) in Western Australia: 6–19 employees, turnover $3M–$10M
- Fintech (non-bank) in South Australia: 6–19 employees, turnover $3M–$10M
- Fintech (non-bank) in Tasmania: 6–19 employees, turnover $3M–$10M
- Fintech (non-bank) in Northern Territory: 6–19 employees, turnover $3M–$10M
- Major banks must provide CDR Banking + Action Initiation (2026): does it apply to fintech (non-bank)?
- Consumer Data Right (CDR) participant accreditation + compliance: does it apply to fintech (non-bank)?
- Register R&D activities for the R&D Tax Incentive: does it apply to fintech (non-bank)?
- Payment Service Provider (PSP) licensing reform — implementation pending: does it apply to fintech (non-bank)?
Sources
- ACT Revenue Office: payroll tax thresholds and rates
- PCBU primary duty of care (ACT WHS Act s 19)
- Industrial manslaughter offence (ACT WHS Act s 34A)
- Comply with Workplace Privacy Act 2011 (ACT)
- Notifiable Data Breach (NDB) scheme
- Apply for a Director Identification Number (Director ID)
- Comply with directors' general law and statutory duties
- Prevent insolvent trading (s 588G)
Computed by the Rules Mate applicability engine from the published obligation corpus; facts last checked 3 October 2026. Rules Mate is not a law firm and this is general information, not legal advice. Confirm your position with the regulator source or a qualified adviser before acting.