Compliance for Credit licensees & mortgage brokers
ACL holders and mortgage brokers under the NCCP Act.
Published obligations that apply to credit licensees & mortgage brokers (14)
- criticalCWLTHNotifiable Data Breach (NDB) scheme
Under the NDB scheme, APP entities must notify the OAIC and affected individuals of an eligible data breach likely to cause serious harm — assessed within 30 days.
- criticalCWLTHComply with NCCP responsible lending obligations
Credit licensees must not enter into credit contracts unsuitable for the consumer.
- criticalCWLTHComply with Design and Distribution Obligations (DDO)
Issuers and distributors of retail financial products must have a Target Market Determination (TMD) and distribute consistently with it.
- criticalCWLTHMortgage broker best interests duty
Brokers must act in the consumer's best interests when providing credit assistance.
- criticalCWLTHBNPL providers — credit licensing from 10 June 2025
BNPL captured by the NCCP Act as a regulated credit product from 10 June 2025.
- criticalCWLTHSmall Amount Credit Contract + Consumer Lease caps (post-SACC reforms)
SACC + consumer lease fee caps + responsible lending tightened post-Royal Commission.
- highCWLTHAvoid unfair contract terms in standard form consumer & small business contracts
From November 2023, unfair contract terms carry pecuniary penalties — up to $100M per term (from 28 March 2026).
- highCWLTHPublish a Privacy Policy that meets APP 1
Every APP entity needs a clearly-expressed Privacy Policy covering APP 1.4 requirements.
- highCWLTHComply with the Spam Act 2003 (consent, identify, unsubscribe)
All commercial electronic messages must have consent, identify the sender, and offer a working unsubscribe.
- highCWLTHComply with credit reporting obligations (Part IIIA Privacy Act)
Credit providers and CRBs must adhere to the CR Code on collection, use, disclosure, hardship and dispute resolution.
- highCWLTHRespond to hardship notices within statutory timeframe
Credit providers must consider hardship notices within 21 days under s 72 NCC.
- highCWLTHWash outbound marketing lists against the Do Not Call Register
Lists must be washed within 30 days of the call/SMS unless valid consent.
- highCWLTHPre-2025 ban on unsolicited credit limit increase invitations
Credit card limit increase offers cannot be sent without prior written consent.
- highCWLTHDisplay comparison rate on credit product advertising
Annual percentage + comparison rate must accompany credit product ads under NCCP Regulations.