Who must comply with the ePayments Code?
The applicability test for Comply with the ePayments Code (ASIC), computed across 35 industries, 9 business structures and 6 size bands.
Short answer: Some businesses
Applies when the business has industry: Banks & ADIs. Where the business has industry: Fintech (non-bank), check whether you subscribe to the ePayments Code (payment facilities).
What the obligation is
Voluntary but industry-standard code covering electronic transaction terms, mistaken internet payments, and unauthorised transactions.
The ePayments Code is a voluntary code that ADIs, payment system operators and many fintechs subscribe to. Covers Terms and Conditions disclosure, statements, mistaken internet payment recovery, and unauthorised transaction liability allocation. ASIC administers; subscribers report compliance.
The applicability test
Applies when the business has industry: Banks & ADIs. Where the business has industry: Fintech (non-bank), check whether you subscribe to the ePayments Code (payment facilities).
How the regulator frames it: Subscribers (most ADIs and many fintechs).
What triggers it: Subscribing to the Code; providing covered electronic transactions to consumers.
Jurisdiction: Commonwealth law, so the test is the same in every state and territory.
Which industries are in or out
Outcome across the 35 industries Rules Mate maps (1 of 35: yes; 1 of 35: only if a further fact applies; 33 of 35: no).
| Industry | Answer |
|---|---|
| Banks & ADIs | Yes |
| Fintech (non-bank) | Only if a further fact applies |
| No | 33 other industries |
Business structure and size
Structure does not change the answer in the 2 industries it can reach: for every structure the answer is "depends on size or structure".
Size does not change the answer in the 2 industries it can reach: at every size band the answer is "depends on size or structure".
Worked examples
Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:
- Pty Ltd company in banks & adis with 6–19 employees, turnover $1M–$3M: applies. Industry: Banks & ADIs.
- Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: does not apply. Requires industry: Banks & ADIs.
- Pty Ltd company in fintech (non-bank) with 6–19 employees, turnover $1M–$3M: check whether it applies. applies only if you subscribe to the ePayments Code (payment facilities)
When you need to check further
The engine shows this obligation as "check whether this applies" when a business has industry: Fintech (non-bank). It then applies only if you subscribe to the ePayments Code (payment facilities). That fact is not something Rules Mate can infer from industry, structure or size.
What you must do, and when
- When due
- Continuous; compliance reporting per ASIC schedule.
- Frequency
- Ongoing
- Evidence to keep
- Code subscriber documentation, T&C compliance, complaint handling records, ASIC reporting.
- Status
- Current
- Priority
- Medium
Penalty for not complying
Maximum penalty: Code-based; reputational + ASIC oversight.
Audit or assurance level
Rules Mate has not yet classified the audit or assurance level for this obligation. Any audit, review or certification requirement is set by the regulator source listed below.
What usually applies alongside it
Across the 1,890 business profiles Rules Mate evaluates, these obligations apply to most of the businesses this one applies to, and are far more common among them than among businesses generally:
- Banking Code of Practice 2025: applies to 100% of the same businesses (35.0× the overall rate)
- Banking Executive Accountability Regime (BEAR) — pre-FAR: applies to 100% of the same businesses (35.0× the overall rate)
- Consumer Data Right (CDR) participant accreditation + compliance: applies to 100% of the same businesses (35.0× the overall rate)
- Comply with CDR Banking (Open Banking) — major + non-major ADIs: applies to 100% of the same businesses (35.0× the overall rate)
- Major banks must provide CDR Banking + Action Initiation (2026): applies to 100% of the same businesses (35.0× the overall rate)
- Consumer Credit Hardship Notice (NCC ss 72-73): applies to 100% of the same businesses (17.5× the overall rate)
Where it sits in the corpus
Rules Mate tracks 5 published obligations tagged "payments", 0 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 0 of those apply outright. This obligation is rated medium priority, and is an ongoing duty.
Regulator, legislation and tools
Regulated by Australian Securities and Investments Commission.
ASIC: Corporate regulator administering the Corporations Act, financial services and credit licensing (AFSL/ACL), markets supervision, insolvency, and registries (ASIC and ABRS).
Free tools that help with this obligation:
Questions
- Who must comply with the ePayments Code?
- Applies when the business has industry: Banks & ADIs. Where the business has industry: Fintech (non-bank), check whether you subscribe to the ePayments Code (payment facilities).
- Do sole traders need to comply with the ePayments Code?
- Depends on size or structure. Looking in the 2 industries it can reach and every size band, the engine's answer for a sole trader is: depends on size or structure.
- Do businesses with 1–5 employees need to comply with the ePayments Code?
- Depends on size or structure (1–5 employees, turnover $100K–$1M).
- When is "Comply with the ePayments Code" due?
- Continuous; compliance reporting per ASIC schedule.
Related
Sources
Computed by the Rules Mate applicability engine from the published obligation corpus; facts last checked 3 October 2026. Rules Mate is not a law firm and this is general information, not legal advice. Confirm your position with the regulator source or a qualified adviser before acting.