ASIC Corporations (Internal Dispute Resolution Data Reporting) Instrument 2022/205

The instrument rests on a small set of interlocking defined concepts. Those concepts determine the reporting population, the universe of reportable complaints, the data items to be submitted, and the mechanics of submission.

• Financial services licensee and retail client scope: The instrument applies to a financial services licensee that provides financial services covered by its licence to retail clients, consistent with paragraph 912A(1)(g)(ii) of the Corporations Act (note to s 6; see also the definitions in s 4). The notes to s 6 list additional persons treated the same as a financial services licensee for reporting purposes, including certain persons captured by provisions in the Corporations Act, credit licensees under the Credit Act, trustees of regulated superannuation funds or approved deposit funds under the SIS Act, and RSA providers under the RSA Act (s 6, Note 2). Those cross‑references mean that entities regulated under related statutes are within scope when they provide IDR services to retail clients.

• Tranches and timing: The instrument divides the reporting population into an initial (first) tranche, a second tranche (Schedule 1), and all others. Reporting commencement differs by cohort (s 6). Reporting periods are six months long (ending 30 June or 31 December) (s 4, definition of reporting period). The reporting deadline is within two months after the end of each reporting period (s 5(1)).

• Reportable complaints: Reportable complaints are those required to be covered by the licensee’s IDR procedure and either made during the reporting period or made after the start of the licensee’s initial reporting period and not closed for the whole of the current reporting period (s 5(1)(a)-(b)). The instrument imports the phrase “closed” and defines it: a complaint is closed if the licensee has provided an IDR response, resolved the complaint to the complainant’s satisfaction, or given the complainant an explanation or apology when no further reasonable action is available, and the complaint has not been reopened since that handling (s 4, definition of closed). The definition of “IDR response” is imported by reference from Regulatory Guide 271 (RG 271) paragraphs 53 and 54 (s 4, definition of IDR response; note to definition of closed cites RG 271 paragraphs 53, 54 and 71).

• Data specification and format: The instrument does not itself set out the data elements. Instead it requires the IDR information for a complaint for each data element name specified in tables 4-6 of the IDR data dictionary (s 4, definition of IDR information for a complaint). Permissible values, completion requirements and code sets are those in the dictionary. Filing must occur through ASIC’s Regulatory Portal in CSV format in accordance with Appendices 1 and 2 of the IDR data reporting handbook (s 5(2)).

• Personal information carve‑out: The instrument expressly states it does not require provision of personal information as defined in the Privacy Act 1988 (s 7). The practical effect is that data submissions must be prepared to avoid disclosing personal information, subject to the data dictionary’s own definitions of reportable fields.

• Temporal scope and repeal: The instrument is time‑limited and will be repealed on 1 April 2027 (s 8).

These concepts show the instrument’s structure: statutory power supplies the authority (s 3), the IDR handbook supplies the content of returns (definitions, tables and appendices), the Regulatory Portal supplies the delivery channel, and the Corporations Act and linked statutes supply the coverage universe via cross references in s 6 notes and the definitions section.

The instrument names the persons who must report, sets staggered cohorts, and clarifies equivalent entities under other Acts.

• Directly required reporters: A “financial services licensee” that provides services covered by its licence to retail clients is the primary class required to report (s 6, Note 1; s 4 definitions). That phrase picks up licence holders under the Corporations Act who distribute financial products or provide financial services to retail clients.

• First tranche firms: A defined list of very large financial institutions and superannuation entities appears in the instrument’s definitions as “first tranche firm” (s 4). The first tranche includes Commonwealth Bank, ANZ, NAB, Westpac, AMP, Dai‑Ichi Life Holdings Inc, Insignia Financial, several superannuation trustees (e.g. United Super, Unisuper, Retail Employees Superannuation Pty. Limited, AustralianSuper) (s 4). Entities and their subsidiaries are captured.

• Second tranche firms: Schedule 1 lists 262 further licensees across banks, credit unions, insurers, super funds, trustee companies, specialist lenders, and fintechs (Schedule 1). Those licensees are designated “second tranche firm” in s 4 and accordingly have the earlier commencement date in s 6(b). The schedule explicitly names each licensee by AFSL number and legal name.

• Equivalents under related Acts: The instrument’s notes to s 6 make explicit that certain non‑AFSL entities must provide the same information “as if they were a financial services licensee”: persons to whom paragraph 1017G(1)(d) of the Corporations Act applies; credit licensees under paragraph 47(1)(ha) of the Credit Act; trustees of regulated superannuation funds or approved deposit funds where paragraph 101(c) of the SIS Act applies; and RSA providers under paragraph 47(1)(d) of the RSA Act (s 6, Note 2). Practically, that captures trustees of APRA‑regulated superannuation entities and entities licensed under the National Consumer Credit Protection regime where those instruments create equivalent reporting obligations.

• Who does not have to provide personal information: Section 7 carves out an explicit exclusion: nothing in the instrument requires a licensee to give ASIC personal information within the meaning of the Privacy Act 1988. That affects how reporting firms package and de‑identify complaint data.

• Who decides and files: The licensee, or the person within the entity responsible for regulatory reporting, must prepare the CSV and submit it through ASIC’s Regulatory Portal within the two‑month deadline (s 5(2), (4)). The instrument does not create an external third‑party filing route beyond ASIC’s portal and prescribes CSV in accordance with the handbook.

• Time horizon: The obligation is not indefinite; the instrument is scheduled to lapse on 1 April 2027 (s 8), so firms will have reporting duties only while the instrument remains in force.

In summary: the instrument affects a broad cross‑section of AFSL holders, credit licensees, superannuation trustees and RSA providers who provide retail services. First and second tranche lists identify many major banks, insurers and superannuation trustees; the remainder of the AFSL population falls into the “otherwise” cohort with later commencement.

Duties:

• Duty to report IDR information: S 5(1) imposes the primary duty. Within two months after each six‑month reporting period, the licensee must give ASIC the IDR information for each complaint meeting the scope conditions (s 5(1)-(2)). This duty includes both new complaints made during the reporting period and certain carryover matters (s 5(1)(b)(ii)).

• Duty to use the Regulatory Portal and specified file format: S 5(2) requires submission via ASIC’s Regulatory Portal in CSV format and in accordance with Appendices 1 and 2 of the IDR data reporting handbook. The handbook and its appendices therefore form part of a licensee’s compliance obligations.

• Duty to confirm nil activity: If there are no reportable complaints for the period, the licensee must give ASIC a confirmation that it did not have any complaints for that reporting period (s 5(3)-(4)), again via the Regulatory Portal and within two months of the period end.

• Duty to apply the “closed” and “IDR response” definitions: The instrument requires licensees to determine whether a complaint is “closed” according to its definition in s 4 (which cross‑references RG 271) and to determine whether a matter requires reporting based on whether it is covered by the licensee’s IDR procedure (s 5(1)(a); s 4 definition of closed; s 4 definition of IDR response citing RG 271).

• Duty to observe Privacy Act limits: Section 7 provides that the instrument does not require the disclosure of personal information as defined in the Privacy Act; licensees must therefore ensure submissions do not include personal information, which effectively imposes an obligation to de‑identify or omit personally identifiable fields consistent with privacy law.

Rights and procedural features:

• Specification by handbook: The instrument delegates substantial specification to the IDR data reporting handbook and its IDR data dictionary (s 4 definitions). Licensees therefore have the right to rely on the publicly‑published handbook and dictionary for the granular coding lists, permissible values and CSV layout (s 5(2)). The instrument does not itself set those detailed fields.

• Timebound nature: The instrument is scheduled for repeal on 1 April 2027 (s 8). Licensees can plan compliance with a defined end date, subject to changes or extension by future instruments or legislation.

• Application equivalence rights: Licensees captured under other statutes are told they must give the same information “as if they were a financial services licensee” (s 6, Note 2). That gives equivalent legal footing to entities covered under the Credit Act, SIS Act, RSA Act, and certain Corporations Act provisions.

• No requirement to provide personal information: Section 7 gives a clear right that the instrument will not require personal information disclosures. However, the instrument does not itself define how licence‑holders must anonymise or aggregate information; that detail is left to the handbook and privacy practice.

Operational implications of these duties:

• Firms must map their complaint records to the IDR data dictionary’s data elements and code sets; this requires data‑mapping work, system changes and potentially manual processes, especially where legacy complaint systems do not capture the required fields.

• Firms must monitor the timing of their initial reporting period to know which complaints to include (s 4 definition of initial reporting period; s 5(1)(b)(ii) on carryovers).

• The duty to submit a nil report in the absence of complaints imposes a minimal positive administrative task every reporting period (s 5(3)-(4)).

The instrument itself does not specify penalties or set out enforcement procedures or monetary fines for non‑compliance. It is an instrument made under subsection 912A(2A) of the Corporations Act 2001 (s 3). That statutory pedigree matters for enforcement because it identifies the enabling power but does not, in the legislative instrument, specify sanctions.

Practical enforcement implications drawn from the instrument’s form and authority:

• Statutory basis for compulsion: Making the instrument under s 912A(2A) indicates ASIC’s use of a statutory power to require information from financial services licensees; the instrument imposes a legal obligation to give information to ASIC (s 5). Where a licensee fails to comply with a statutory information obligation imposed under the Corporations Act, ASIC’s enforcement toolkit under the Corporations Act (including directions, notices and proceedings) would ordinarily be relevant. The instrument, however, does not itself list which of ASIC’s enforcement powers will be used in the event of breach.

• Administrative compliance expectations: The instrument prescribes the submission medium (Regulatory Portal) and format (CSV in accordance with the handbook) and sets deadlines (two months after period end) (s 5(1)-(2), (4)). Non‑submission, late submission, or submissions inconsistent with the handbook will likely be considered non‑compliance with the instrument, exposing the licensee to ASIC follow‑up.

• No separate criminal penalties in the instrument: The legislative instrument does not create criminal offences or pecuniary penalties by its text. Any sanctions for failure to comply would therefore rest on the enforcement provisions available to ASIC under the Corporations Act and other statutes, and on ASIC’s administrative responses such as inquiry, directions, notices to produce documents, or escalation to civil proceedings. Those powers are not repeated in the instrument and must be located in the Corporations Act.

• Practical enforcement pathways: In practice, enforcement could include compliance requests, administrative sanctions (such as rebuttable presumptions in enforcement contexts), and referral to civil or criminal processes where other statutory contraventions are implicated. The instrument itself does not list these routes.

• Repeal does not retroactively excuse non‑compliance: The instrument is repealed on 1 April 2027 (s 8). The instrument does not address saving or transitional enforcement provisions; standard principles of statutory interpretation and the Corporations Act’s enforcement machinery would determine whether contraventions occurring before repeal remain actionable after repeal. The instrument’s Endnotes do not state transitional enforcement provisions.

For compliance officers and counsel, the key point is that the instrument creates a clear mandatory reporting duty without specifying penalties. Compliance risk therefore turns on ASIC’s general enforcement power under the Corporations Act and associated regulatory responses to non‑compliance with statutory information requests. Firms should treat the reporting duty as legally binding and maintain records of submissions and communications through the Regulatory Portal.

The instrument is short and expressly links to multiple other instruments and statutes. Its operation depends on cross‑references and external documents.

• Corporations Act 2001: The instrument is made under subsection 912A(2A) of the Corporations Act (s 3). The primary coverage concept , “financial services licensee” providing services to retail clients , is grounded in the Corporations Act (see note to s 6 and the reference to paragraph 912A(1)(g)(ii)). Enforceability and any penalties for failure to comply will therefore interact with the Corporations Act’s enforcement and compliance regime. The instrument itself does not restate those enforcement powers.

• Credit Act (National Consumer Credit Protection Act 2009): The instrument’s notes to s 6 explicitly bring credit licensees within the reporting ambit “as if they were a financial services licensee” by referencing paragraph 47(1)(ha) of the Credit Act. That means entities licensed under the Credit Act that meet the note’s conditions must report to ASIC in the same way as AFSL holders.

• SIS Act and approved deposit funds: Trustees of regulated superannuation funds and approved deposit funds are included by virtue of paragraph 101(c) of the SIS Act (s 4, definition of approved deposit fund and regulated superannuation fund; s 6 note 2). The instrument therefore captures those trustees for IDR reporting in circumstances where the SIS Act’s referenced paragraph applies.

• RSA Act: RSA providers under the Retirement Savings Account Act 1997 are included by reference where paragraph 47(1)(d) of the RSA Act applies (s 6, Note 2). This extends the instrument beyond AFSL holders to certain RSA providers.

• Regulatory Guide 271: The instrument imports definitions and interpretive material from ASIC’s Regulatory Guide 271 - Internal Dispute Resolution. The definition of IDR response is “the same meaning as in paragraphs 53 and 54 of Regulatory Guide 271” and the note to the definition of closed directs attention to paragraphs 53, 54 and 71 of RG 271 (s 4). Therefore, firms must consult RG 271 to apply the statutory definitions of what constitutes an IDR response and a closed complaint for the purposes of deciding reportability.

• ASIC IDR data reporting handbook and IDR data dictionary: The instrument delegates the precise data elements, permissible values, completion requirements and coding to the IDR data reporting handbook (defined in s 4) and the IDR data dictionary (Section B of the handbook). The instrument therefore interacts operationally with those administrative documents, and changes to the handbook will affect reporting content and format.

• Privacy Act 1988: Section 7 states that nothing in this instrument requires a licensee to give ASIC any information that is personal information within the meaning of the Privacy Act 1988. That creates an explicit intersection with privacy law: licensees must consider the Privacy Act when preparing data, and the instrument implicitly requires de‑identification or aggregation where fields would otherwise be personal information. The instrument does not prescribe a method for de‑identification; that is a matter for licensees’ privacy compliance and the handbook.

• ASIC’s Regulatory Portal: The instrument requires use of ASIC’s Regulatory Portal as the submission channel (s 5(2), (4)). Firms must therefore comply with any portal‑specific terms of use, security protocols or authentication processes. Those portal requirements are external to the instrument but operationally essential.

• Interaction with internal law and procedures: The instrument requires reporting only for complaints required to be covered by the licensee’s IDR procedure (s 5(1)(a)). Firms’ internal IDR procedures, which must align with RG 271 and relevant legislation, therefore determine the subset of complaints that are reportable. Discrepancies between a firm’s IDR procedure and RG 271 or other statutes may generate interpretive issues when applying the instrument.

In short, the instrument is a narrow statutory instrument that relies on external statutes and ASIC administrative instruments (RG 271, the IDR handbook and portal rules) to determine its substantive operation. Compliance therefore demands coordinated attention to the Corporations Act, related statutory regimes (Credit Act, SIS Act, RSA Act), RG 271, the IDR handbook and the Privacy Act.

The instrument includes an endnote setting out instrument history and subsequent amendments up to the compilation date. The Endnote 1 table records that Instrument 2022/205 was registered for FRL on 30 March 2022 and commenced 31 March 2022. A subsequent instrument, 2023/282, was registered 1 May 2023 and commenced 2 May 2023 (Endnote 1).

Endnote 2 provides a concise amendment history, listing the provisions affected by instrument 2023/282 and summarising how they were changed. The recorded amendments (as described in Endnote 2) include:

• Replacement of Section 2 (note: the Endnote records “Section 2 rep. s48D LA”).
• Amendments to the definition of “closed” in Section 4 (rs.2023/282).
• Amendment to the definition of “IDR data reporting handbook” in s 4 (am. 2023/282).
• Amendment to the definition of “initial cohort” in s 4 (am. 2023/282).
• Addition of the definition of “second tranche firm” in s 4 (ad. 2023/282).
• Amendments to s 5(1) including paragraph 5(1)(a) and subparagraph 5(1)(b)(ii) (am. 2023/282).
• Addition of subsections 5(3) and 5(4) (ad. 2023/282), which require a confirmation where there are no complaints and set the route and timing for that confirmation.
• Replacement of paragraphs 6(a) and (b) (rs. 2023/282).
• Addition of Schedule 1 listing the second tranche firms (ad. 2023/282).

The Endnotes therefore show that the instrument has already been subject to amendment, including additions that introduced the second tranche firms and added the nil‑report confirmation obligations. Those amendments indicate ASIC’s use of the instrument to phase in cohorts and to refine reporting mechanics.

Practical consequences of the amendment history:

• Tranche additions: The addition of a second tranche and the insertion of Schedule 1 changed the reporting population and timing; firms must monitor amendments to determine precisely when they are brought into scope.

• Definition changes: Amendments to the definition of “closed” and references to the handbook mean that the interpretive frame for determining reportability has evolved. Firms must keep their IDR procedures aligned with RG 271 and the IDR handbook as amended.

• Handbook dependence: Because the IDR data reporting handbook is a defined external source, changes to that handbook (amended by ASIC) will alter the data elements and technical formats that firms must provide. The instrument’s amendment history demonstrates that ASIC will refine cohort lists and technical requirements by instrument and by handbook amendment.

Endnote 2 is the only provided record of amendment in this instrument compilation; no later amendments are shown in the compilation as in force on 2 May 2023. Firms must therefore treat the instrument and the handbook as dynamic and monitor ASIC publications and legislative registers for further changes.

The instrument and its endnotes do not record any litigation or judicial determinations about the instrument. Endnote 1 records instrument registration and commencement dates and Endnote 2 records amendment history, but neither endnote cites court decisions or administrative tribunal determinations. There are no case names or judicial citations in the text of the instrument or accompanying endnotes.

That absence of recorded litigation in the instrument does not preclude subsequent litigation or administrative review. Areas likely to generate interpretive disputes, were litigation to arise, include:

• The meaning and application of “closed”: The instrument defines “closed” by reference to actions a licensee may take (provide an IDR response; resolve to complainant’s satisfaction; give an explanation/apology where no further reasonable action is available) and requires that the complaint has not been reopened since dealing (s 4, definition of closed). Disputes may occur over what constitutes an IDR response and when reopening has occurred, and the instrument points to RG 271 paragraphs 53, 54 and 71 as relevant interpretive material (s 4). Any legal challenge over the reporting of a particular matter would likely engage interpretation of those cross‑referenced paragraphs.

• The scope of “required to be covered” by the IDR procedure: S 5(1)(a) ties reportability to complaints that are required to be covered by the licensee’s internal dispute resolution procedure. Disagreement could arise where a firm treats an internal grievance or a dispute as outside its IDR procedure while ASIC views it as within scope. Resolution of such disputes would engage RG 271 and statutory definitions of retail clients and covered services.

• Privacy and personal information boundaries: Section 7 excludes personal information within the meaning of the Privacy Act from the instrument’s requirements. Litigation or disputes might test whether particular data fields in the IDR data dictionary are “personal information” in particular contexts and whether the firm complied with s 7 when preparing its submission.

• Procedural compliance and portal submissions: If a submission fails to conform to the CSV and Appendix specifications in the handbook, disputes could arise about whether a submission was timely or compliant. That would be a matter of administrative fact and process rather than novel legal principle.

Because the instrument delegates substantial specification to the IDR data reporting handbook and RG 271, disputes could also focus on the status of these materials: whether they can be read as binding technical prescriptions for the purposes of s 5(2), and how they interact with the instrument. Any litigation would need to situate the handbook and RG 271 in relation to the instrument’s statutory authority (s 3). The instrument compilation does not record any adjudication on these points.

For practitioners tracking potential litigation exposure, the compilation shows no litigation history as at 2 May 2023; assessment of litigation risk therefore rests on the statutory text, the external documents the instrument imports, and likely enforcement pathways under the Corporations Act.

Practical traps and interpretive wrinkles are evident in the instrument and its reliance on external documents. The following “gotchas” derive directly from the instrument’s text and structure.

• Carryover complaints are reportable: S 5(1)(b)(ii) requires reporting not only of complaints made during the reporting period but also of complaints made after the licensee’s initial reporting period that were not closed for the whole of the current reporting period. That means firms must track complaint lifecycle dates relative to their initial reporting period and include legacy matters that were still open during the reporting window. Misunderstanding this carryover rule could lead to under‑reporting.

• “Closed” is defined by reference to RG 271: The instrument’s definition of “closed” cross‑refers to Regulatory Guide 271 (s 4). Firms that use internal, idiosyncratic closure definitions must align to RG 271’s criteria (IDR response, resolution to complainant’s satisfaction, explanation/apology when further action is unavailable, and absence of reopening). If internal systems mark a file “closed” for operational reasons but the complainant subsequently reopens the matter, the complaint may not be considered closed for reporting purposes. This can complicate automated exports from legacy complaint systems.

• Heavy reliance on the handbook and data dictionary: The instrument does not contain the field list; the IDR data reporting handbook and Section B IDR data dictionary contain the reportable elements, permissible values and mandatory/optional flags (s 4). Failure to consult the handbook (and Appendices 1 and 2 for CSV layout) will result in incorrectly structured returns. These are external documents that may be updated, so ongoing monitoring is required.

• Nil report obligation: Even where no complaints exist, firms must submit a confirmation of nil activity through the Regulatory Portal within the two‑month deadline (s 5(3)-(4)). Some firms might assume silence equals compliance; the instrument requires an affirmative nil confirmation. Missing that confirmation is non‑compliance.

• Portal and CSV technicalities: The instrument mandates use of ASIC’s Regulatory Portal and CSV format in accordance with handbook appendices (s 5(2)). Common technical pitfalls include character encoding mismatches, date format differences, improper use of code values, and mismatches between field ordering in legacy systems and the required CSV structure. The instrument does not provide remedy procedures for rejected files, which are likely handled by portal protocols or the handbook.

• Privacy carve‑out requires active handling: S 7 prevents the instrument from requiring the disclosure of personal information. However, the IDR data dictionary may include fields that, if populated, could constitute personal information. Firms must therefore implement de‑identification or aggregation workflows that are consistent with the Privacy Act; merely assuming that the absence of a personal information requirement absolves them of privacy obligations is a risk.

• Staggered commencement dates and cohort monitoring: S 6 sets different start dates for first tranche, second tranche (Schedule 1), and others. Firms at the margins must confirm their initial reporting period and cohort classification. The Schedule 1 list is explicit; a firm that acquires or reorganises (e.g. changes its corporate name or AFSL number) must check whether it remains on Schedule 1 or moves between cohorts.

• Instrument expiry: The instrument is repealed on 1 April 2027 (s 8). Firms that build compliance programs for an indefinite regime may over‑invest; conversely, firms that delay system changes because of the time‑limited nature of the instrument risk non‑compliance during the instrument’s operative window.

• Drafting anomalies and reliance on subsidiary material: The definitions section contains drafting irregularities in the first tranche list (s 4 lists two subparagraphs labelled (e)). While this is unlikely to change substantive coverage, it is an indicator that firms must avoid over‑reliance on textual perfection and instead check substantive coverage, including whether subsidiaries are captured. The instrument’s substantive operation depends on RG 271 and the IDR handbook; lack of clarity in the instrument text increases dependence on those instruments and on ASIC’s administrative guidance.

These gotchas indicate that compliance is not limited to simply exporting complaints data. Firms must map legal definitions to operational data, ensure CSV and portal compliance, handle privacy constraints, and maintain oversight of amendments and cohort status.

Compliance requires legal, governance, data and operational steps. The instrument prescribes legal obligations; the IDR data reporting handbook supplies the technical specifics. The steps below are practical, framed by the instrument’s text.

1. Determine whether the instrument applies to you.

   • Confirm whether your entity is a “financial services licensee” providing services to retail clients (s 6, Note 1; s 4).
   • If you are a credit licensee, trustee of a regulated superannuation or approved deposit fund, or an RSA provider, confirm whether the cross‑references in s 6 Note 2 bring you within scope.

2. Identify your tranche and initial reporting period.

   • Check whether your organisation is listed as a first tranche firm (s 4) or in Schedule 1 as a second tranche firm. If neither, your commencement is the “otherwise” date in s 6(c).
   • Determine your initial reporting period to apply the carryover rule for complaints made after that date but open during reporting windows (s 4, definition of initial reporting period; s 5(1)(b)(ii)).

3. Map your complaint data to the IDR data dictionary.

   • Obtain the ASIC IDR data reporting handbook (defined in s 4) and Section B, the IDR data dictionary.
   • For each complaint, identify the data elements in tables 4-6 of the IDR data dictionary and map your internal fields to those elements.
   • Apply the permissible values, completion requirements and codes listed in the dictionary for each element (s 4, definition of IDR information for a complaint).

4. Align definitions and IDR procedures.

   • Ensure your internal definition of an IDR complaint and closure process aligns with RG 271 as referenced in the instrument. The instrument’s definition of “closed” points to paragraphs 53, 54 and 71 of RG 271; adopt those criteria for closure and IDR response (s 4).
   • Amend IDR procedures, staff training materials and systems to capture the metadata required by the handbook.

5. Implement privacy controls.

   • Because s 7 prohibits requiring personal information, implement data de‑identification or pseudonymisation workflows so that no fields that constitute personal information under the Privacy Act are submitted.
   • Document the privacy assessment showing that submitted fields are not personal information or are sufficiently de‑identified.

6. Build CSV extraction and validation processes.

   • Use Appendices 1 and 2 of the IDR data reporting handbook to design the CSV layout, field ordering, encoding and technical validations (s 5(2)).
   • Implement data validation routines to ensure permissible values and codes are used for each field and mandatory fields are populated as required by the dictionary.

7. Prepare submission workflows through ASIC’s Regulatory Portal.

   • Register and maintain access to ASIC’s Regulatory Portal as required for submissions (s 5(2)).
   • Test the portal upload process and error handling, including resubmission procedures in case of rejection or parsing errors.

8. Establish governance, audit trail and recordkeeping.

   • Maintain contemporaneous records of submitted files, portal confirmations, and the internal mapping between complaints and submitted IDR data.
   • Log decisions about whether a complaint meets the “required to be covered” threshold and the dates used to determine whether a complaint was closed.

9. Operationalise deadlines and nil reporting.

   • Calendar reporting deadlines for each six‑month reporting period (ending 30 June and 31 December) and the two‑month submission window (s 5(1), (4)).
   • Create a nil‑report workflow: if there are no reportable complaints for a period, submit the required confirmation through the Regulatory Portal within two months after the end of the period (s 5(3)-(4)).

10. Test and monitor compliance.

    • Run pilot submissions and reconcile a sample of complaints from case management systems to the CSV output.
    • Monitor ASIC publications and the IDR data reporting handbook for changes; Endnote 2 shows the instrument may be amended (Endnote 2).

11. Allocate resources and responsibility.

    • Designate an accountable officer (compliance or legal) responsible for final sign‑off of each period’s submission.
    • Ensure IT resources are available for mapping, extraction, validation and portal uploading within the two‑month window.

12. Plan for the instrument’s finite life.

    • The instrument is repealed on 1 April 2027 (s 8). Plan system updates and budget for compliance only for the instrument’s operative horizon unless legislative extensions are signalled.

Practical checklist for the first reporting cycle:

• Confirm cohort status and initial reporting period date.
• Obtain the latest IDR data reporting handbook and IDR data dictionary.
• Map internal complaint data to dictionary fields and permissible codes.
• Ensure de‑identification consistent with Privacy Act obligations and s 7.
• Generate and validate CSV in accordance with appendices.
• Test portal submission and obtain upload receipt.
• File the submission within two months of reporting period end.
• If no complaints, submit a nil confirmation via the portal within the deadline.
• Retain logs, mapping documentation and privacy assessments.

Following these steps aligns with the instrument’s duties (s 5), the handbook requirements (s 4 and s 5(2)), the Privacy Act carve‑out (s 7), and the reporting cadence and deadlines (s 4 definition of reporting period; s 5(1)-(4)).