On 31 August 2026, the Australian Financial Complaints Authority (AFCA) released a consultation paper on proposed changes to its Scheme Rules to support AFCA’s new dispute resolution jurisdiction for scam-related complaints under the Scams Prevention Framework (SPF).
The consultation is open for four weeks, closing on 28 September 2026. The new rules (Scam Rules) will need to be in place from 31 March 2027. The final Scam Rules are targeted for publication in early 2027, making strong and highly focussed engagement vital in this tight timeframe.
It comes at a time of heightened regulatory focus on scams, in the wake of the release of the new SPF as well as recent enforcement action (including the $35 million penalty imposed on HSBC in June 2026). ASIC has recently reported that scams accounted for nearly one in five of the 9,807 reports of misconduct it received in H1 2026, and signalled its intention to continue to prioritise scam disruption prioritised for assessment.
In this alert, we summarise the following:
- How AFCA’s new role fits into its current statutory functions
- Key features of the Scam Rules
- Key actions to consider
Regulated entities in the regulated sectors of banking, telecommunications and digital platforms should consider whether they want to make submissions on the Scam Rules.
Please let us know if you would like to discuss making a submission or if you have any queries about the SPF. We would be delighted to assist.
Background
The SPF, Australia’s landmark legislative framework designed to combat scams across the economy, is set to commence on 31 March 2027. On 2 June 2026, the Australian Government authorised AFCA as the single external dispute resolution (EDR) scheme for SPF complaints across the first three designated sectors: banking, telecommunications and digital platforms.
AFCA is now preparing to amend its Rules to establish the framework for handling these complaints. Complaints handling (both internal and external) supports the “Respond” pillar of the SPF, which requires accessible mechanisms for consumers to report and raise complaints about scam activities and related conduct.
Recent major highlights: In on our 28 August 2026 alert, we provided a summary of the overall timeline for implementation of the SPF, together with several other important updates, including to AFCA’s existing jurisdiction and recent regulatory enforcement cases.
AFCA’s existing and new roles – where do the Scam Rules fit in?
AFCA has existing important statutory functions, as financial sector participants are already well aware. It will continue to operate as a single dispute resolution , but will now need to cover two parallel jurisdictions, each governed by appropriate procedures and requirements.
These two jurisdictions will be addressed through the following, which will both fall within the “AFCA Scheme Rules”:
|
Rules
|
Status
|
Description
|
To whom do these apply?
|
|
Financial Firm Rules
The Government has signaled its intention to designate additional sectors in the future, |
Live
Certain provisions under consultation The Government has signaled its intention to designate additional sectors in the future, |
Existing AFCA rules for financial services complaints against financial firm members. The Government has signaled its intention to designate additional sectors in the future, |
Financial firm members only. AFCA’s search functionality to determine whether a financial firm is an AFCA member is available here. The Government has signaled its intention to designate additional sectors in the future, |
|
Scam Rules
The Government has signaled its intention to designate additional sectors in the future, |
Draft under consultation
The Government has signaled its intention to designate additional sectors in the future, |
A new set of rules for SPF complaints against regulated entity members. The Government has signaled its intention to designate additional sectors in the future, |
Initially, the three “regulated sectors” are as follows, with the precise scope set out in statute:[1]
AFCA’s guidance on membership is available here. The Government has signaled its intention to designate additional sectors in the future, |
An important corollary for banks is that they will be subject to both the Financial Sector Rules and Scam Rules. This impact may also expand to other firms if the regulated sectors under the SPF also expand over time.
Key features of the proposed Scam Rules
The Scam Rules are designed to be self-contained, but are similar to the current Financial Firm Rules in many respects. As foreshadowed above, one aspect of the scams jurisdiction is that telecommunications providers and digital platform providers, who have not previously been subject to AFCA dispute resolution, must now become AFCA members for the purposes of the Scam Rules (but not the Financial Firm Rules). As discussed in our 28 August 2026 alert, these entities were required to become AFCA members from 1 September 2026.
The Scam Rules are lengthy and technical. They are organised in the following way:
- Section 1 - Complaint resolution process for SPF complaints
- Section 2 - Types of complaints that are excluded
- Section 3 - Monetary limits that apply to SPF complaints
- Section 4 - Definitions relevant to SPF complaints
Some of the key aspects of the Scam Rules are discussed below.
Who can complain and how
A SPF complaint may be made by, or on behalf of, a person who is (or was at the relevant time) a SPF consumer of a regulated service in a regulated sector. This includes individuals and small business operators. Eligibility is assessed by reference to the complainant's status at the time of the relevant conduct.
The complaint must relate to:
- an activity that is or may be a “scam” (broadly defined in the SPF legislation) and relates to a regulated service; or
- a regulated entity's conduct relating to such an activity.
The relevant activity or conduct must have occurred on or after 31 March 2027 (or, for sectors designated later, the date of that designation).
Additional details of the SPF: A summary of other key aspects of the SPF, including the six key principles of governance, prevention, detection, reporting, disruption and response, are set out in our Guide to Doing Business in Australia.
AFCA has a discretion to refuse to consider complaints, similar to the Financial Firm Rules. However, there is also a new discretionary head of exclusion to address the risk of secondary scams and fraudulent complaints - AFCA can refuse a complaint where it has a reasonable basis to suspect a complaint has been submitted by a person falsely adopting the identity of a SPF consumer, or purporting to act without authority.
Complainants can submit SPF complaints through standard channels (online, in writing or by telephone) without needing representation. AFCA will assist complainants in identifying relevant regulated entities and clarifying issues, reflecting the information asymmetry that typically exists in scam matters. Like the Financial Firm Rules, the Scam Rules will continue to include the ability for “Paid Representatives” to submit complaints on behalf of consumers.
Where Internal Dispute Resolution (IDR) has already been completed, AFCA may start investigating a complaint immediately. Otherwise, AFCA will generally allow up to 30 days. This is a practical recognition that multi-party SPF complaints may have already been through a coordinated IDR process, but allows AFCA to move straight to investigation where appropriate.
Time limits
Unless AFCA considers that special circumstances apply, a SPF complaint must be submitted within the earlier of:
- six years from when the complainant first became aware (or should reasonably have become aware) of the loss or harm; and
- two years from the date of the regulated entity's IDR response.
These time limits are similar to the existing Financial Firm Rules.
Multi-party complaints
A central feature of the SPF is that it deals with scam ecosystems that may involve multiple regulated entities – which has long been a challenge in scam prevention. This means the Scam Rules need to deal with complaints where a number of regulated entities are involved.
To do this, the Scam Rules give AFCA broad discretion to:
- add regulated entities as parties to a complaint at any stage, including on AFCA's own volition;
- remove regulated entities as parties to a complaint at AFCA’s discretion; and
- request reasonable assistance and cooperation from any regulated entity that is an AFCA member, even where that entity is not a party to the complaint.
Once added, a regulated entity has the same rights and obligations under the Scam Rules, including the right to participate in IDR, respond to the complaint and make submissions.
As with the Financial Firm Rules, regulated entities must provide information and documents on request.
Key takeaway: Regulated entities should prepare for the possibility of being joined to complaints involving other entities in the scam chain and ensure information-sharing protocols support AFCA’s cooperative model.
Decision-making framework
The Scam Rules retain the traditional AFCA approach to determinations. The AFCA Decision Maker must do what they consider is fair in all the circumstances, having regard to:
- the Competition and Consumer Act, SPF Codes and SPF Rules;
- legal principles;
- applicable industry codes and guidance;
- good industry practice for the sector at the relevant time; and
- previous relevant AFCA determinations.
AFCA may apportion liability between two or more regulated entities having regard to the SPF Rules. The current draft SPF Rules are silent on apportionment, and so it is unclear how this will operate.
As with the Financial Firm Rules, an AFCA Determination is final and binding if accepted by the complainant. This means that generally AFCA Determinations cannot be appealed or subject to judicial review. While this is not unusual for Australian EDR schemes, it means that in practice AFCA will be the final authority on many scam complaints.
AFCA will publish its determinations, and the regulated entities involved will be named in those determinations.
Key takeaway: The combination of broad discretion over complaint resolution, a decision-making framework that includes consideration of fairness and good practice, and public naming of regulated entities in determinations, means that AFCA will exercise considerable power in relation to scams.
Jurisdiction and compensation limits
The Scam Rules apply the following jurisdiction and compensation monetary limits:
|
Type of claim
|
Compensation limit
|
Monetary limit on jurisdiction
|
|
Direct financial loss
|
$1,263,000 per scam
|
Claim must not exceed $1,263,000
|
|
Indirect financial loss
|
$6,300 per regulated entity
|
N/A
|
|
Non-financial loss
|
$12,600 per regulated entity
|
N/A
|
|
Legal/professional/travel costs
|
$5,000 per regulated entity
|
N/A
|
The most notable difference to the Financial Firm Rules is that the direct financial loss compensation limit equals the monetary jurisdiction limit at $1,263,000. Under the Financial Firm Rules, these are separate - AFCA can consider complaints up to $1,263,000 but can currently only award a maximum of $631,500 in compensation. The limit applies once per scam regardless of the number of regulated entities involved. Complainants cannot restructure or abandon part of a claim to bring it within jurisdiction.
The non-financial loss cap is proposed to double from $6,300 to $12,600, recognising the significant emotional distress, mental health impacts and other harm that scam victims may suffer.
All compensation limits will be subject to indexation from 1 January 2027.
Systemic issues and reporting to regulators
Where AFCA identifies a systemic issue (one likely to affect consumers beyond the individual complainant), it can require the regulated entity to do or refrain from doing any act AFCA considers reasonably necessary to facilitate investigation, improve industry practice, remedy loss (including for consumers who have not complained), prevent foreseeable loss, minimise recurrence or efficiently deal with multiple related complaints. AFCA must also report systemic issues and serious contraventions to the SPF regulators (ACCC, ACMA and ASIC).
These powers effectively give AFCA quasi-regulatory remediation powers beyond the individual complaint, with no defined limits on exercise. While this is not unusual for an Australian EDR scheme, it does add an additional level of regulation to what is already a multi-regulator area.
Key takeaway: AFCA’s systemic issues powers are very broad. The ability to require remediation for consumers who have not themselves complained, combined with the absence of defined limits, means regulated entities could face significant remediation obligations arising from a single complaint.
It is also important to recall that a multitude of other consequences beyond AFCA determinations may flow from a given scams scenario under other laws and regulatory frameworks, as demonstrated by recent ASIC and ACMA actions (as we summarised here). This amplifies the need for strong systemic controls and robust response.
What regulated entities should do now
The consultation window is narrow. Regulated entities should:
- Review the consultation package carefully, including the proposed Scam Rules (Attachment 1), the proposed amendments to the Financial Firm Rules (Attachments 2 and 4) and the comparative list of all changes (Attachment 3).
- Assess operational readiness particularly IDR processes, multi-party complaint handling capability, information-sharing protocols and document management systems.
- Consider the commercial exposure from the compensation limits.
- Engage with the consultation questions.
- Lodge a submission by 28 September 2026 to consultation@afca.org.au.
- Revisit internal policies, procedures and terms. There is now a significant body of material available to help shape practices and customer communications, at least in draft, as the Scam Rules unfold.
- Revisit third-party engagements, including third-party service providers engaged to provide support to implement SPF requirements and “on tap” support should a scams scenario unfold. For example, moving swiftly to identify and immobilise misappropriate assets both within and outside of Australia can make a significant difference to demonstrating compliance and mitigating harm.
Following the close of consultation, AFCA will evaluate submissions and seek approval from the AFCA Board and ASIC. The finalised Scam Rules and a consultation feedback report are expected in early 2027.
The authors also wish to acknowledge the valuable contributions of Michaela Maisner to this alert.
