Who must comply with Stored Value Facility rules (banking exception)?

SVF providers must operate within APRA + Treasury rules on purchased payment facility regulation.

Currently regulated as Purchased Payment Facilities under the Banking Act 1959 (Cwlth). APRA regulates the larger SVF providers; smaller facilities operate under specific declarations. The PSP licensing reform is expected to replace the PPF framework.

Applies only if you provide payment or stored-value facilities. Whether it applies turns on a fact that no industry, structure or size settles on its own.

How the regulator frames it: Providers of stored value / purchased payment facilities.

What triggers it: Operating SVF/PPF in Australia.

Jurisdiction: Commonwealth law, so the test is the same in every state and territory.

Outcome across the 35 industries Rules Mate maps (1 of 35: only if a further fact applies; 34 of 35: no).

Structure does not change the answer in fintech (non-bank): for every structure the answer is "only if a further fact applies".

Size does not change the answer in fintech (non-bank): at every size band the answer is "only if a further fact applies".

Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:

• Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: does not apply. Requires a trigger outside this questionnaire.
• Pty Ltd company in fintech (non-bank) with 6–19 employees, turnover $1M–$3M: check whether it applies. applies only if you provide payment or stored-value facilities.

The engine shows this obligation as "check whether this applies" when a business has industry: Fintech (non-bank). It then applies only if you provide payment or stored-value facilities. That fact is not something Rules Mate can infer from industry, structure or size.

When due

Continuous; rules in transition.

Frequency

Ongoing

Evidence to keep

APRA registration (where applicable); customer fund segregation; AML/CTF + privacy compliance.

Status

Current

Priority

High

Maximum penalty: APRA enforcement + Banking Act civil penalties.

Rules Mate has not yet classified the audit or assurance level for this obligation. Any audit, review or certification requirement is set by the regulator source listed below.

If this obligation applies to you, so does this one: the engine uses the same rule for each.

• Payment Service Provider (PSP) licensing reform — implementation pending

• Comply with the ePayments Code: Voluntary but industry-standard code covering electronic transaction terms, mistaken internet payments, and unauthorised transactions.
• PCI DSS card data security (contractual, via your acquirer): Merchants that accept card payments must protect cardholder data to PCI DSS — a requirement of the card schemes, enforced through your merchant agreement, not an Australian statute.

Rules Mate tracks 5 published obligations tagged "payments", 0 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 0 of those apply outright. This obligation is rated high priority, and is an ongoing duty.

Regulated by Australian Prudential Regulation Authority and Australian Securities and Investments Commission.

APRA: Prudential regulator of banks (ADIs), insurers (general, life, private health), and superannuation funds. Sets and enforces CPS standards including CPS 234 (information security) and CPS 230 (operational risk).

ASIC: Corporate regulator administering the Corporations Act, financial services and credit licensing (AFSL/ACL), markets supervision, insolvency, and registries (ASIC and ABRS).

• Australian Prudential Regulation Authority
• Australian Securities and Investments Commission

Banking Act 1959: Authorises APRA to regulate authorised deposit-taking institutions (banks, building societies, credit unions).

• Banking Act 1959

Free tools that help with this obligation:

• Compliance calendar builder