Background

Last week, the Commonwealth Government issued a consultation paper concerning proposed new mandatory industry codes which will outline the responsibilities of the private sector in relation to scam activity, with a focus on banks, digital communications platforms and telecommunications providers: Scams – mandatory industry codes | Treasury.gov.au

This consultation paper will assist the Commonwealth in implementing a new ‘Scams Code Framework’. 

Submissions are due by 29 January 2024.

Key features of the proposed Scam Code Framework

The proposed Framework will be established by introducing a new overarching regime into the Competition and Consumer Act 2010 (CCA), with bank-specific codes and standards to be overseen by ASIC. 

It is intended that the CCA would set out clear and enforceable principles-based obligations. These obligations would require all businesses subject to the Framework to take a consistently proactive approach to combatting scams. In addition to the legislated principles-based obligations, the Framework would also include mandatory sector-specific codes and standards, setting out further obligations tailored to the banking sector.

Under this multi-regulator oversight and enforcement model, the ACCC would be responsible for monitoring compliance and enforcing the principles-based obligations, while ASIC would have expanded powers to enforce the bank-specific code.

Who will the Framework apply to?

The proposed Framework will apply to (amongst other entities) ADIs, as defined under section 9 of the Banking Act 1959 (Cth). 

Adopting this definition would mean that the scope of the Framework would extend to small and large banks, building societies, credit unions and restricted ADIs.

However, we note that other bodies, such as AFCA, consider similar industry specific codes when assessing best practices. 

So regardless of whether your business is captured by the new Framework, it’s likely that the Framework will impose additional obligations which need to be considered.

What type of ‘scam’ will be covered under the Framework?

The proposed Framework defines a Scam as “a dishonest invitation, request, notification or offer, designed to obtain personal information or financial benefit by deceptive means”. 

The Framework will not address unauthorised transactions, which are governed by the ePayments Code.

New bank-specific obligations 

Under the proposed Framework, processes are required to: 

• confirm the identity of a payee;

• verify if a transaction is legitimate;

• identify customers at a higher risk of being targeted by scammers, and implement appropriate protection mechanisms;

• detect high risk transactions;

• share relevant information with other banks;

• provide user-friendly and accessible methods for customers to mitigate scam risk;

• assist the customer in tracing and recovering transferred funds; and

• promptly respond to an information request from ASIC within the timeframe specified.

Penalties for non-compliance 

Failure to comply with obligations under the Framework, in addition to redress options available through applicable dispute resolution mechanisms, could result in penalties. 

Next steps

Submissions concerning the consultation paper close on 29 January 2024.