Financial Accountability Regime Act (Information for register) Regulator Rules 2024

The central concept is the register established under section 40 of the Financial Accountability Regime Act 2023. The Rules do not create the register; they prescribe what information must be placed on it. The register is a repository of data about each individual who is an accountable person under the Act. The Act defines ‘accountable entity’, ‘accountable person’, and the various entity types (ADI, authorised NOHC of an ADI, general insurer, authorised NOHC of a general insurer, life company, registered NOHC of a life company, private health insurer, RSE licensee). The Rules build on those definitions by creating three sets of conditional key functions: ADI Key Functions, Insurance Key Functions, and RSE licensee Key Functions. Each list contains between 15 and 17 specific functions, such as capital management, conduct risk management, data management, technology management, and whistleblower policy and process. Critically, a function is only a relevant key function for a particular accountable person if two requirements are met: the entity must be of the specified type (for example, an ADI or an authorised NOHC of an ADI for ADI Key Functions), and the accountable person must have actual or effective senior executive responsibility for management or control of the whole of, or a significant or substantial part or aspect of, the key function. This is a deliberately high threshold. It means that not every function listed will apply to every entity or every person. Entities must assess whether a function is ‘key’ in their structure and whether the individual’s responsibility meets the ‘significant or substantial part or aspect’ test. The Rules also define ‘commencement date’ as the date the person becomes an accountable person, and require the register to show start and end dates for the position title, employment, each key function, and the reporting line to a superior position. Suspension is only recorded if it results from a failure to comply with one or more of the person’s accountability obligations under section 21 of the Act, not for other forms of suspension such as pending investigation or procedural leave. This selective reporting creates a stigma risk: a suspension entry on the register publicly marks the individual as having failed accountability obligations, even if the failure is later disproven or resolved. The instrument also requires recording the date of any change to personal identification details (date of birth, direct phone number, direct email address) or to the accountable person’s name, effectively obliging entities to maintain a running log of updates.

The Rules directly affect every entity that is an accountable entity under the FAR Act. This includes authorised deposit-taking institutions (banks, building societies, credit unions), authorised non-operating holding companies of ADIs, general insurers and their authorised NOHCs, life companies and their registered NOHCs, private health insurers, and RSE licensees (registrable superannuation entity licensees). For each such entity, the compliance burden falls on the human resources, legal, compliance, and board governance functions. The individuals most directly affected are the accountable persons themselves: senior executives who hold positions such as chief executive officer, chief financial officer, chief risk officer, chief operating officer, head of technology, head of compliance, and other roles that carry senior executive responsibility over one or more of the prescribed key functions. Their personal data (date of birth, direct phone number, direct email address) must be reported to the regulator and stored on the register. Any change to that data must also be recorded, generating a perpetual administrative obligation. The reporting lines requirement means that the regulator will know not only who reports to whom, but the exact dates of reporting relationships, potentially creating an internal organisational map that could be used in enforcement actions. The suspension reporting requirement affects only those accountable persons who are suspended because they have failed to meet accountability obligations under section 21 of the Act. This is a narrow category, but the reputational consequences of such an entry are severe. The Rules also affect the regulators (APRA and ASIC), who must maintain the register and ensure its accuracy and completeness. While the instrument does not itself impose penalties, non-compliance with the underlying obligation to provide correct information to the register could expose entities and officers to civil or criminal consequences under the FAR Act. Smaller entities, such as smaller private health insurers or smaller RSE licensees, will bear disproportionately higher compliance costs because the data collection and monitoring infrastructure required is largely fixed, regardless of entity size. The definitions of key functions are entity-type specific, meaning a diversified financial group may need to report under multiple categories for different parts of its business, multiplying the complexity.

The Rules do not themselves create duties; they operate under the FAR Act, which imposes accountability obligations on accountable persons and accountable entities. However, the Rules create a de facto duty on entities to collect, verify, and submit the prescribed information to the regulator. Under section 40 of the Act, the register must contain the information required by the regulations and the regulator rules. Therefore, an entity that fails to supply the prescribed information, or supplies inaccurate information, may be in breach of its obligations under the Act. The duty includes ensuring that the information is current: changes to personal identification details, name, key functions, reporting lines, employment, and position must be recorded with the dates of change. The entity must also identify which key functions apply to each accountable person based on the conditional tests in section 4 of the Rules. This is a non-trivial legal assessment. The duty to report suspensions only applies where the suspension is due specifically to a failure of accountability obligations under section 21 of the Act, requiring the entity to characterise the reason for suspension correctly. The rights of accountable persons under the Rules are limited. The instrument does not confer any right to be consulted before information is submitted, to inspect the register entry, or to request correction. Privacy rights are governed by other legislation, such as the Privacy Act 1988, but the Rules override some privacy expectations by requiring collection and reporting of date of birth, direct phone number, and direct email address. An accountable person whose suspension is reported may have a right to challenge the underlying determination of an accountability failure under the Act, but the Rules do not provide any mechanism to expunge or annotate the register entry if the suspension is later overturned. The reporting lines and key function start/end dates provide a biographical timeline that could be used in investigations or litigation, effectively putting the individual’s career progression under regulatory scrutiny. There is no right to have the register entry deleted after the person ceases to be an accountable person; the Act may provide for retention periods, but the Rules are silent on this point.

The Rules themselves do not specify penalties. They are a legislative instrument that prescribes information for inclusion in the register; enforcement flows from the parent Act. Under the Financial Accountability Regime Act 2023, failure to comply with obligations relating to the register may attract civil penalties, or in serious cases criminal penalties for providing false or misleading information. The maximum penalties under the Act are not stated in the Rules, but the FAR Act at Part 6 provides for civil penalty provisions with penalties up to the greater of a specified dollar amount or benefit derived, and criminal offences with imprisonment. Because the register is a statutory record, knowingly entering false information could also constitute an offence under the Criminal Code (e.g., false statements to a Commonwealth official). APRA and ASIC are the co-regulators responsible for enforcing the FAR Act. They have broad information-gathering powers and can require production of documents, conduct onsite inspections, and issue directions. The suspension reporting requirement is particularly significant: if an entity fails to report a suspension that is due to an accountability obligation failure, or incorrectly characterises a suspension as not being due to such a failure, it may face enforcement action. The regulators can also use the register data to identify patterns of non-compliance across an industry or within a group, making information quality a compliance risk. The amendment history shows that the Rules were amended soon after commencement to include reporting lines and suspension fields, indicating that the initial version was considered incomplete by the regulators. Entities that relied on the original version may have had to update their compliance systems quickly, creating a retrospective compliance burden. The practical risk for entities is that inaccuracies in the register (e.g., missing a key function, incorrect employment dates, failure to log a change of email) are discovered during a routine APRA or ASIC review, leading to a breach notice or enforcement undertaking. For accountable persons, an incorrect suspension entry could harm their professional reputation and employability, even if the entry is later corrected; the Rules provide no accelerated correction mechanism.

These Rules are made under subsection 105(1) of the Financial Accountability Regime Act 2023, which is the primary law. The Rules supplement section 40 of that Act, which establishes the register and lists certain information that must be included (such as the accountable person’s name and the entity’s name). The Rules add the extra fields detailed in section 5. The FAR Act itself sits alongside the Banking Act 1959 (which contains the Banking Executive Accountability Regime or BEAR), the Insurance Act 1973, the Life Insurance Act 1995, the Private Health Insurance Act 2007, and the Superannuation Industry (Supervision) Act 1993. For ADIs currently under BEAR, the FAR Act will eventually replace BEAR, but the transitional arrangements are not addressed in these Rules. Entities subject to multiple regulatory regimes may find that the same individual occupies roles that trigger reporting under this Rules instrument and under other reporting obligations (such as director appointments under the Corporations Act, or fit and proper assessments under APRA prudential standards). The collection of date of birth and direct contact details interacts with the Privacy Act 1988, including the Australian Privacy Principles. The Fair Work Act 2009 may also be relevant if employment-related information is used by regulators in a manner that affects an individual’s employment rights. The rules on reporting lines may intersect with corporate governance requirements under the ASX Corporate Governance Council Principles and Recommendations for listed entities. The inclusion of product design and distribution obligations as key functions for all three entity categories ties into obligations under the Corporations Act 2001 (Part 7.8A) and ASIC regulatory guides. The suspension reporting requirement interacts with employment law and any contractual suspension provisions; an entity must determine whether the suspension is ‘because of a failure to comply with accountability obligations’ under section 21 of the FAR Act, which is a legal conclusion, not just a factual description of leave status. There is no specific interaction with the Freedom of Information Act 1982 mentioned in the Rules, but if the register is held by APRA or ASIC, it may be subject to FOI requests unless an exemption applies. The instrument does not override any other law, but it imposes additional record-keeping and reporting obligations that may duplicate or conflict with existing reporting frameworks.

The instrument was first registered on 7 March 2024 as F2024L00285 and commenced on 8 March 2024. It was then amended by the Financial Accountability Regime Regulator Rules Amendment Instrument No. 1 of 2024, registered on 11 July 2024 as F2024L00874, which commenced on 12 July 2024. The amendment affected section 4 and section 5. In section 4, the notes were amended: the original Note 1 listed terms defined in the Act, but the amendment adjusted the note structure (the compilation shows two Notes under the definitions, with Note 1 listing the Act-defined terms and Note 2 apparently removed or restructured). In section 5, the amendment added new paragraphs (l), (m), (n), (o), (p), (q), and (r). These paragraphs relate to insurance key functions (l), the dates for insurance key functions (m), RSE licensee key functions (n), RSE licensee key function dates (o), reporting lines position title (p), reporting lines dates (q), and suspension start and end dates (r). The original version of section 5 apparently lacked these fields; they were considered necessary within a few months of commencement. This rapid amendment history indicates that the original instrument was incomplete or that stakeholder feedback or regulator experience demonstrated the need for additional information. The fact that reporting lines and suspension were not originally prescribed is noteworthy because those fields go to the core of accountability: who reports to whom, and whether a person has been suspended for failing accountability duties. The amendment also added the definition of ‘register’ in section 4, linking it to section 40 of the Act. The endnotes confirm that the compilation includes amendments up to F2024L00874, with no further amendments as of the compilation date (12 July 2024). The instrument remains subject to possible future amendments as the FAR Act’s phased implementation proceeds (the FAR Act applies to ADIs from March 2024, with insurers and superannuation entities from March 2025). The amendment history shows that the regulators are willing to iterate regulation quickly, which creates compliance uncertainty for entities that must build systems and processes around a moving target.

There is no known litigation concerning these Regulator Rules as of the compilation date. The instrument is a relatively narrow legislative rule that came into force in March 2024 and was amended in July 2024. The parent FAR Act has not yet been subject to significant judicial interpretation. Because the Rules prescribe information rather than impose duties, any challenge would likely arise from an underlying enforcement action under the FAR Act, such as a dispute over whether a particular function is an ADI Key Function, or whether a suspension was correctly categorised. A person whose date of birth or contact details are published on a public register (if the register is public) could potentially bring a privacy-based challenge under the Privacy Act or the general law, but that would depend on how the regulators administer the register. The instrument itself is unlikely to be the subject of a direct legal challenge because it is made under a specific delegation from Parliament, and the information requirements are within the scope of the enabling enactment. However, if an entity or individual wishes to challenge the inclusion of a particular data field (for example, direct phone number) as exceeding the scope of subsection 105(1) or paragraph 40(4)(g) of the Act, they could seek judicial review under the Administrative Decisions (Judicial Review) Act 1977 or the Constitution. As of the compilation date, no such applications have been reported. The amendment history shows the regulators responded to practical gaps, which may have pre-empted potential disputes over the completeness of the register. The litigation history of the predecessor regime (BEAR) includes some cases on the definition of ‘accountable person’ and enforcement, but those are not directly applicable to these Rules. The absence of litigation to date does not mean the instrument is uncontroversial; it may simply reflect the early stage of implementation.

Several traps exist for the unwary. First, the definition of key functions is conditional. A function is only a key function for a particular accountable person if both the entity-type requirement and the senior executive responsibility requirement are satisfied. This means that if an entity mistakenly lists a function that does not meet the test, or omits one that does, it risks a compliance breach. The test uses the phrase ‘actual or effective senior executive responsibility for management or control of the whole of, or a significant or substantial part or aspect of, the key function’. This is a broad and inherently ambiguous standard. An entity might assume that a manager who runs a small team within a function does not have ‘significant or substantial’ responsibility, but a regulator may disagree. Second, the suspension reporting requirement is narrow. Only suspensions resulting from a failure to comply with one or more accountability obligations under section 21 of the Act must be reported. If an entity suspends an accountable person for operational reasons, pending investigation, or for misconduct unrelated to accountability obligations, that suspension does not go on the register. However, the entity must determine the underlying reason, which may not be clear at the suspension decision date. Mistakenly failing to report a suspension that later is found to be due to an accountability failure could attract penalties. Third, personal identification details must include direct phone number and direct email address. These are often considered private and may change frequently. The entity must track every change and record the date of change. This ongoing administrative burden is easy to overlook in a large organisation. Fourth, the reporting lines requirement captures the position title of the person the accountable person reports to, plus the start and end dates of that reporting relationship. If reporting lines change (for example, a new CEO or a restructuring), the entity must record the cessation and new start dates. Regulators could use this data to build an organisational chart for enforcement purposes, making it essential to keep the data accurate. Fifth, the instrument does not specify a retention period or a process for removing old entries. Once data is on the register, it may remain indefinitely, potentially causing reputational harm long after a person leaves the role. Sixth, the amendment history shows that the original instrument omitted reporting lines and suspension fields; entities that built compliance systems based on the original version had to update them within four months, incurring unanticipated costs. Seventh, the definitions of ADI Key Function, Insurance Key Function, and RSE licensee Key Function are not identical. Each list includes some unique items (for example, underwriting and reinsurance management for insurance; investment management and member outcomes for RSE licensees). Entities that operate across sectors must maintain separate assessments. Eighth, the instrument does not address how to handle joint appointments or shared responsibility for a key function. If two people share senior executive responsibility for the same function, the entity must report both, but the rules on dates may become ambiguous.

To comply with these Regulator Rules, an accountable entity must first identify all individuals who are accountable persons under the FAR Act. This requires a thorough mapping of the organisation’s governance structure, identifying who has senior executive responsibility for management or control of whole or significant parts of the entity, using the Act’s definitions. For each such person, the entity must then assess whether any of the listed ADI Key Functions, Insurance Key Functions, or RSE licensee Key Functions apply, based on the entity type and the individual’s actual responsibilities. This assessment should be documented, as it will be relevant if the regulators challenge the selection. Once the population of accountable persons and their key functions is determined, the entity must collect the prescribed data for each person: commencement date, date of birth, direct phone number, direct email address, position title, start and end dates for that position, employer name, employment start and end dates, each applicable key function and the dates the person assumed and ceased responsibility for it, the position title of the person they report to and the start and end dates of that reporting relationship, and any suspension that is due to a failure of accountability obligations under section 21 of the Act, including the suspension start and end dates. The entity must also record the date of any change to personal identification details or name. To manage this, the entity should implement a centralised register system, likely an HR or compliance database, with automated triggers for updates when an accountable person’s role changes, employment ends, or a suspension occurs. Regular audits should verify that the data matches the actual organisational structure. The entity should train relevant staff (HR, legal, compliance, senior management) on the definitions, especially the conditional nature of key functions and the narrow scope of reportable suspensions. A written policy for determining whether a suspension is due to an accountability obligation failure is advisable, to ensure consistent treatment across the organisation. Given the privacy sensitivity of date of birth and direct contact details, the entity should ensure that data transmission to the regulator is secure and that internal access is restricted on a need-to-know basis. The entity should also consider whether any privacy notices are required under the Privacy Act. Because the Rules are subject to amendment (as the July 2024 amendment shows), the entity should monitor the Federal Register of Legislation for changes and adjust its compliance systems promptly. Engaging external legal or compliance consultants to conduct an initial gap analysis is a prudent investment, especially for smaller entities that may lack in-house expertise. Finally, the entity should maintain a complete audit trail of all information submitted to the register, including copies of source documents, to defend against any future allegations of inaccuracy or omission.