58BSReporting scams to SPF regulators—civil penalty provisions

58BS Reporting scams to SPF regulators—civil penalty provisions

(1) This section applies if an SPF regulator gives a written request to a regulated entity for the entity to give the SPF regulator a report about a scam relating to, connected with, or using a regulated service of the entity.

Civil penalty provision

(2) The entity contravenes this subsection if the entity fails to give a report about the scam:

(a) to the SPF regulator within the period, and in the manner and form, set out in the request; and

(b) that contains the kinds of information set out in the request.

(3) Subsection (2) is a civil penalty provision.

Note: This means subsection (2) is a civil penalty provision of an SPF principle for the purposes of section 58FJ (about civil penalties).

(4) For the purposes of (but without limiting) subsection (2), the SPF regulator’s request may:

(a) provide that the report may be given via access to a specified data gateway, portal or website; and

(b) ask that the report set out:

(i) what loss or harm may have resulted from the scam, what disruptive actions the entity has taken and whether any of those actions have been reversed; and

(ii) what steps the entity is taking to disrupt similar scams, and to prevent loss or harm resulting from similar scams.

Note: For more about the data gateways, portals or websites referred to in paragraph (a), see section 58BT.

(5) The request may ask for the report to include SPF personal information. If so, the request must require the entity to de‑identify the information unless the SPF regulator reasonably believes that doing so would not achieve the object of this Part.

(6) If:

(a) a regulated entity gives a scam report to an SPF regulator under this section; and

(b) another SPF regulator later requests a scam report under this section from the regulated entity about the same matters;

then, despite subsection (2), the later scam report need only state that an earlier scam report about those matters was given to the first‑mentioned SPF regulator on a specified date and time.

Note: The SPF regulators can share the earlier scam report under Subdivision C of Division 5.