- 18 Nov 2026 UK Have your directors and PSCs verified with Companies House?
- 1 Dec 2026 AU Will your onboarding accept private-sector Digital IDs?
- 10 Dec 2026 AU Does your privacy policy explain your automated KYC decisions?
- End 2026 EU Is your ID verification ready for EUDI Wallets?
- 1 Jan 2027 US Can your age checks keep up state by state?
- 1 Apr 2027 JP Is your eKYC ready for the IC-chip mandate?
- 10 Jul 2027 EU Is your CDD flow ready for the AMLR?
- 1 Jan 2028 US Are your adviser clients ready for FinCEN’s AML rule?
- 31 Mar 2029 AU Is your initial CDD on the new AUSTRAC model?
- Now AU Tranche 2 is live. Is your AML/CTF program running?
The Scams Prevention Framework: what it requires, who it covers, and what it means for professional firms
The Scams Prevention Framework makes banks, telcos and digital platforms prevent, detect, report, disrupt and respond to scams. Most obligations start on 31 March 2027. Accountants, lawyers and real estate firms are not designated sectors, but they will feel the effects.
- The Scams Prevention Framework Act 2025 (Act No. 15, 2025) received assent on 20 February 2025 and inserted Part IVF into the Competition and Consumer Act 2010.
- The Framework applies only to designated sectors, and the first are banking, telecommunications and digital platforms providing regulated services.
- Regulated entities had to be members of the Australian Financial Complaints Authority (AFCA) by 1 September 2026, and most SPF obligations start on 31 March 2027.
- The ACCC is the general regulator and the sector regulator for digital platforms; ASIC regulates banks and ACMA regulates telcos under their sector codes.
- Accountants, lawyers, conveyancers and real estate agents are not designated sectors, though the Minister can designate further sectors by legislative instrument.
What it is
The Scams Prevention Framework Act 2025 sets up an economy-wide framework for protecting consumers and small businesses from scams. Its object, in section 58AA of the Competition and Consumer Act, is to prevent and respond to scams that relate to, connect with or use certain services.
It works in layers. Overarching SPF principles apply to every regulated entity: governance, prevent, detect, report, disrupt and respond. The Minister can then make SPF codes with sector-specific requirements, and SPF rules fill in further detail. Complaints go to an authorised external dispute resolution scheme, which is AFCA.
The Act itself imposes nothing on a business until its sector is designated. Under section 58AC the Minister designates sectors by legislative instrument. ASIC says the Framework applies initially to banking, telecommunications and digital platforms. Treasury consulted on draft sector codes and the first SPF rules in 2026, and ASIC's page says the codes and rules are still being developed.
Who it applies to
Only regulated entities in designated sectors, for the regulated services they provide.
- Banks
- Telecommunications providers
- Digital platforms providing designated services, such as social media
Accountants, lawyers, conveyancers, real estate agents, financial advisers and trust and company service providers are not designated sectors. They have no SPF obligations of their own. The Act lists other classes the Minister could designate in future, such as insurance, and section 58AE requires the Minister to consider set matters and consult first.
What regulated entities have to do
These duties fall on banks, telcos and digital platforms. They are listed here so professional firms understand what their banks and providers are now doing, and why. The detail will sit in the final sector codes and rules.
- Governance
SPF principle 1 requires documented and implemented governance policies, procedures, metrics and targets for combating scams, reviewed and certified by a senior officer at least annually.
Governance - Prevent
SPF principle 2 requires reasonable steps to prevent another person from committing a scam relating to, connected with or using the entity's regulated services.
Sector code - Detect
SPF principle 3 requires reasonable steps to detect scams, including investigating actionable scam intelligence in a timely way and identifying consumers who may have been affected.
- Report
SPF principle 4 requires reports of actionable scam intelligence to the ACCC as the SPF general regulator, in the form the SPF rules set, and reports to any SPF regulator on request.
Report to regulator - Disrupt
SPF principle 5 requires reasonable steps, within a reasonable time, to disrupt activity that is the subject of actionable scam intelligence and to prevent losses from it.
Sector code - Respond
SPF principle 6 requires an accessible way for consumers to report scams and an accessible, transparent internal dispute resolution process. ASIC says regulated entities also had to join AFCA, the external scheme, by 1 September 2026.
Complaints
What firms get wrong
The Framework is new, sector based and still being filled in by codes and rules.
Professional firms are not designated sectors. The Act binds regulated entities only, and ASIC's guidance names banking, telecommunications and digital platforms as the initial sectors.
ASIC says AFCA membership was due by 1 September 2026, most obligations start on 31 March 2027, and further obligations are expected by the end of 2027.
It sits in the Competition and Consumer Act 2010, separate from the AML/CTF Act. A firm's AUSTRAC duties under Tranche 2 are unchanged by it.
Treasury consulted on draft sector codes and the first SPF rules in 2026. ASIC's page says the codes and rules are still being developed by government.
What happens when
- In force
Scams Prevention Framework Act 2025 receives assent Source
- Proposed
Treasury releases draft sector codes and first SPF rules for consultation Source
Confirmed by secondary sources; the regulator has not published the exact date.
- In force
Regulated entities must be AFCA members Source
- Commencing
Most SPF obligations commence Source
- By end 2027Proposed
Further SPF obligations expected to commence Source
Not yet confirmed. We will update this when the date is set.
Also on the regulatory timeline.
Related guides
Questions people ask
What is the Scams Prevention Framework?
A law that requires businesses in designated sectors to prevent, detect, report, disrupt and respond to scams, and to have governance in place for it. It was created by the Scams Prevention Framework Act 2025 and sits in Part IVF of the Competition and Consumer Act 2010.
Who does the Scams Prevention Framework apply to?
Initially, banks, telecommunications providers and digital platforms that provide regulated services. Other sectors can only be added by a ministerial designation after consultation.
When does the Scams Prevention Framework start?
The Act has been in force since February 2025. Regulated entities had to join AFCA by 1 September 2026, most obligations start on 31 March 2027, and more are expected by the end of 2027.
What are the six SPF principles?
Governance, prevent, detect, report, disrupt and respond. The ACCC enforces the principles, and sector regulators enforce the sector codes.
Does the Scams Prevention Framework apply to accountants, lawyers or real estate agents?
No. They are not designated sectors. Their identity and due diligence duties come from other laws, such as AML/CTF Tranche 2 and, for e-conveyancing, the Verification of Identity Standard.
Why does it matter to professional firms?
In our view, firms should expect more questions from their own banks about payees and payments, and clients who are used to stronger identity checks from banks and telcos. Firms that handle client money, such as conveyancers and real estate agents, may see this first. See identity verification for property buyers.
Primary sources
Checked 5 Nov 2026. We review this page every 90 days and when the rules change.
- Federal Register of Legislation, Scams Prevention Framework Act 2025 (No. 15, 2025)
- Federal Register of Legislation, Scams Prevention Framework Act 2025, text as made (sections 58AA to 58AE, SPF principles 1 to 6)
- ASIC, Scams Prevention Framework
- Herbert Smith Freehills Kramer, Stage 1 of the Scams Prevention Framework (secondary)
Where StackGo fits
IdentityCheck is not built to help banks, telcos or platforms comply with the SPF. For professional firms, which the SPF does not cover, it handles the identity and screening checks clients increasingly expect, and that AML/CTF law already requires for many of them.
- Biometric identity checks: a photo of a government ID document plus a live selfie with liveness, covering 12,500 document types from 230+ countries and territories
- PEP, sanctions and adverse media screening, with ongoing monitoring of screened clients
- Onboarding forms, including multi-entity forms that collect each person and entity on a structure
- It does not provide SPF compliance, scam reporting to the ACCC or AFCA complaint handling
- It does not verify payees or bank account details, or monitor payments or transactions
- It does not give legal advice
Ready to make onboarding minutes, not hours?
Start free and run your first check today, or book a demo and we will walk you through it.