A controlled operation is a law enforcement technique in which officers engage in conduct that would otherwise be illegal (such as importing or supplying prohibited drugs, or participating in a criminal conspiracy) in order to investigate serious crime or corruption. The authorisation framework under the Act requires a chief executive officer of a law enforcement agency to grant a written authority before the operation begins. The 2025 regulation does not define what a controlled operation is; that is in the Act, section 3. Instead, the regulation defines four key operational concepts: law enforcement agencies, urgent applications, report content, and the code of conduct.

Law enforcement agencies are the entities that can conduct controlled operations. The Act lists several agencies in its definition (the NSW Police Force, ICAC, the Crime Commission, the Law Enforcement Conduct Commission, and any agency prescribed by regulation). Section 4 of the 2025 regulation adds the Australian Federal Police and the Commonwealth Department of Home Affairs. This is significant because those Commonwealth agencies now have a clear statutory basis to conduct controlled operations inside New South Wales without needing separate state authorisation. For practitioners, this removes a potential jurisdictional gap: previously, an AFP officer may have had to rely on a Commonwealth controlled operations regime or seek a cross border authority. Now the AFP and Border Force are captured by the NSW definition, subject to the same authorisation conditions and code of conduct.

Urgent applications arise when circumstances make a formal written application impracticable. The Act, sections 5(2B) and 10(1C), allow urgent applications to be made orally or by other expedited means, but only if the regulation prescribes conditions. Section 5 of the 2025 regulation imposes two conditions: the applicant must reasonably believe that a formal application is impracticable due to urgency, and after making the application the officer must keep a written record of the date, time, applicant identity, and the information provided. This record is not the authority itself; it is an evidentiary trail to allow later review of whether the urgency condition was met. The regulation does not specify a time limit for creating the record, but the requirement is mandatory. Failure to keep the record may affect the validity of the urgent authority or lead to disciplinary consequences under the code of conduct.

Reports on controlled operations are required under the Act, section 15(2), within a prescribed period after the operation ends. Section 6 of the 2025 regulation lists five categories of information that must be included: the operation’s start and duration, the nature of controlled conduct engaged in, the outcome, details of illicit goods (nature, quantity, and route if known), and details of any loss, serious damage to property, or personal injuries occurring during or as a direct result of the operation. The route requirement for illicit goods is new compared to the 2017 regulation. It means officers must now identify the physical path the goods took, which may require coordination with other agencies or tracking data. This increases the reporting burden, particularly for operations involving multiple transit points, but also provides greater transparency for oversight bodies.

The code of conduct in Schedule 1 is the central behavioural standard for controlled operations. It imposes duties on applicants for authorities, principal law enforcement officers, and law enforcement participants. The code requires good faith, full disclosure, avoidance of false or misleading information, proper briefing of civilian participants, restrictions on inducing criminal activity, and a duty to report breaches. The code does not create civil liability but is enforceable through the agency‘s internal discipline and may affect the operation’s immunity from criminal or civil proceedings under the Act. The regulation makes clear that the code applies to all law enforcement agencies, not just state bodies. The concept of a breach notice being deemed given if reported under internal procedures (Schedule 1, clause 4(3)) is an efficiency: an officer does not need to separately notify the CEO if they have already filed an internal incident report, provided the internal procedure covers the same information.

Delegation of functions is regulated by section 8 of the regulation, which prescribes specific positions that a chief executive officer can delegate their functions to (under the Act, section 29(2)(b)). The prescribed positions are tailored per agency: for ICAC, it is Commissioner (other than Chief Commissioner) or Assistant Commissioner under the ICAC Act; for the Crime Commission, it is Assistant Commissioner under the Crime Commission Act; for LECC, it is Commissioner (other than Chief Commissioner); for the AFP, it is the member responsible for day-to-day operations in NSW; and for Home Affairs, it is the Australian Border Force Commissioner or an Immigration and Border Protection worker in the Operations Group or Support Group at SES Band 3 level. This granular prescription limits the pool of delegates and ensures only senior, accountable officers can make authorisation decisions. It prevents the CEO from delegating to junior officers or to positions outside those listed.

The regulation directly affects law enforcement agencies operating in New South Wales, their chief executive officers, law enforcement officers who apply for or participate in controlled operations, civilian participants who are recruited to assist in those operations, and oversight bodies that review compliance.

Law enforcement agencies are the primary regulated entities. The 2025 regulation applies to all agencies listed in the Act plus the two Commonwealth agencies prescribed by section 4. These agencies must ensure their internal processes comply with the urgent application record keeping requirement, the expanded report content, and the code of conduct. For the AFP and Home Affairs, the regulation means their officers conducting controlled operations in NSW are subject to the same NSW law framework as state officers, not a separate Commonwealth regime. This creates a single set of rules for intra state operations, reducing legal complexity but also imposing NSW specific obligations on federal officers, such as the code of conduct and the limited delegation list.

Chief executive officers of each agency are the decision makers for authorisations and variations. They may delegate their powers to the specific senior positions listed in section 8, but cannot delegate to anyone else. The code of conduct also requires them to receive information from applicants who later discover material changes (Schedule 1, clause 1(3)) and to be notified of breaches by law enforcement participants (clause 4(2)). The regulation increases the administrative load on CEOs by requiring them to receive and process these disclosures, though the internal reporting deeming provision reduces duplication.

Law enforcement officers who make applications for authorities or variations must act in good faith and disclose all known relevant information. They must keep the written record for urgent applications (section 5(2)) and ensure reports contain the prescribed details (section 6). Principal law enforcement officers must brief participants thoroughly, obtain written undertakings from civilian participants, and monitor for circumstances requiring a variation. The code of conduct imposes a duty on all law enforcement participants to take reasonable steps to prevent other participants from inducing criminal activity, endangering safety, committing sexual offences, or engaging in unlawful conduct beyond controlled activities. This creates a positive obligation to intervene or report, which could expose officers to internal discipline if they fail to act.

Civilian participants are private individuals who assist in controlled operations, often as informants or undercover auxiliaries. They must provide a written undertaking not to engage in controlled activities other than those authorised (Schedule 1, clause 3(b)). The regulation does not prescribe the form of the undertaking, but it must be recorded. Civilian participants are not directly bound by the code of conduct in the same way as law enforcement participants, but the law enforcement officer must ensure they understand the limits of their authority. The regulation does not create any right or immunity for civilian participants beyond what the Act provides, but the written undertaking serves as evidence of the scope of authorisation, which could be relevant in criminal proceedings if a civilian participant exceeds their authority.

Oversight bodies such as the Law Enforcement Conduct Commission and the Ombudsman may review compliance with the code of conduct and report content. The expanded reporting requirements (especially the goods route information) may assist oversight bodies in tracing the chain of custody of illicit goods during an operation, reducing the risk of theft or diversion.

Practitioners advising agencies must update their compliance checklists to account for the new urgent application record keeping requirement and the code of conduct clauses that did not exist in the 2017 regulation, particularly the post application disclosure duty (clause 1(3)) and the duty of law enforcement participants to give notice of breaches (clause 4(2)). The delegation provisions are highly specific; agencies should verify that their current delegates match the prescribed positions exactly. For example, the AFP’s delegate is “the member of the Australian Federal Police responsible for the day-to-day operations of the Australian Federal Police in New South Wales.” If that person is absent, the CEO cannot delegate to a deputy unless that deputy holds the same role. This may require agencies to adjust their internal authorisation chains to avoid operational delays.

The regulation imposes several specific duties on law enforcement officers and agencies. It does not create new rights for officers, participants, or third parties. The most significant duties are contained in the code of conduct (Schedule 1) and the procedural requirements in sections 5 and 6.

Duty of good faith and full disclosure (Schedule 1, clause 1). An applicant for an authority or variation must act in good faith, disclose all information relating to the circumstances known to the applicant, and not include false or misleading information. If the applicant later becomes aware of information that could have affected the determination, the applicant must give that information to the CEO as soon as practicable. This is a continuing obligation that does not end when the authority is granted. A failure to disclose could result in the authority being voidable or lead to disciplinary action.

Duty to report change in circumstances (clause 2). The principal law enforcement officer must notify the CEO as soon as practicable if circumstances arise that are likely to require a variation of the authority. The officer must also ensure a formal application for variation is made before it becomes impracticable to do so. This prevents an operation from continuing under an outdated authority, reducing the risk of unauthorised conduct.

Duty to brief participants and obtain written undertakings (clause 3). Before the operation begins, the principal law enforcement officer must ensure each participant (especially civilian participants) thoroughly understands the nature and limits of the authorised controlled activities. The officer must receive a written undertaking from each civilian participant not to engage in activities outside the authority. This written record is crucial for establishing that the participant acted within authorisation and for defending against any criminal or civil liability.

Duty of law enforcement participants during the operation (clause 4). A law enforcement participant must act in good faith, comply with lawful directions of the primary or secondary law enforcement officer, and take all reasonable steps to ensure other participants do not induce criminal activity, endanger health or safety, commit sexual offences, or engage in unlawful conduct beyond controlled activities. This duty is not limited to the participant‘s own conduct; it includes a proactive obligation to intervene or report regarding others. The participant must also give notice to the CEO of any breach of the code of conduct as soon as practicable, with a deeming provision that internal reporting satisfies this requirement.

Duty to prepare accurate reports (clause 5 and section 6). The officer preparing a report must act in good faith, disclose all known required information, and avoid false or misleading particulars. If the officer later discovers omitted information or errors, they must give that information to the CEO as soon as practicable. The mandatory content under section 6 includes the goods route for illicit goods, which is a new requirement.

Urgent application record keeping (section 5). An officer making an urgent application must keep a written record of the date, time, applicant identity, and supporting information. This record is a compliance document that can be audited. Failure to keep the record does not automatically invalidate the authority, but it could undermine the officer‘s claim that urgency existed.

Right to delegate (section 8). The CEO may delegate functions to the prescribed positions. This is a power, not a duty. The regulation limits the delegate pool but does not oblige the CEO to delegate; they may exercise functions personally. The prescribed positions are agency specific, ensuring that only senior accountable officers exercise delegation.

No private rights of action. The regulation does not create any statutory right for a third party to sue for breach of the code of conduct or reporting requirements. However, a breach may be relevant in criminal proceedings (e.g., if a defendant argues that conduct was outside authorisation) or in civil proceedings (e.g., if a participant acts outside authority, the regulation may be used to show that the officer failed to supervise). The code of conduct is a prescribed standard, but the Act provides immunity only for conduct authorised under the Act and within the terms of the authority. Breach of the code could void that immunity, exposing participants to criminal or civil liability.

The 2025 regulation does not itself create any penalty or enforcement mechanism. It is a regulation under the Act, and the Act contains the primary sanctions for non compliance. However, the regulation‘s provisions have indirect enforcement consequences.

Breach of the code of conduct. The code of conduct is prescribed under section 7 of the regulation. If a law enforcement officer breaches a clause of the code, the agency may take disciplinary action under its own internal procedures. This could include dismissal, demotion, suspension, or formal reprimand. The regulation does not impose a monetary penalty or criminal sanction for a code breach. However, a breach could have more serious consequences under the Act. Section 20 of the Act allows the CEO to cancel or suspend an authority if satisfied that a participant has contravened the code. Cancellation would end the operation and could expose participants to prosecution for any continued conduct. More significantly, the Act‘s immunity provisions (sections 16 and 17) protect participants from criminal and civil liability only for conduct that is authorised and within the terms of the authority. If a breach of the code leads a court or tribunal to find that the conduct was not in good faith or was otherwise outside the authority, the participant may lose immunity. This could result in prosecution for drug trafficking, conspiracy, or other offences, or liability for damages in civil proceedings.

False or misleading information (code clause 1(2)(b)). Providing false or misleading information in an application could attract criminal liability under other laws, such as the Crimes Act 1900 (NSW) provisions on giving false or misleading information to a public official, or under the Act itself if the Act contains such an offence. The regulation does not create a specific offence, but the Act may, and the regulation‘s code would be relevant evidence of the obligation.

Failure to keep the urgent application record (section 5(2)). There is no automatic invalidity of the application if the record is not made. However, the CEO may refuse to accept the urgent application if the record is not provided, or may treat the authority as invalid from the outset. In judicial review proceedings, the absence of a record could lead a court to find that the urgency condition was not met, potentially rendering the entire controlled operation unlawful. This could have cascading effects on prosecutions that rely on evidence obtained through the operation. A court would likely exclude such evidence under section 138 of the Evidence Act 1995 (NSW) if it finds the impropriety was substantial.

Reporting obligations (section 6, code clause 5). Failure to include required information in a report, or providing false information, could result in disciplinary action and may be used in oversight hearings by bodies such as the Law Enforcement Conduct Commission. The CEO may also require a corrected report. There is no criminal penalty under the regulation, but a deliberate omission could be prosecuted as obstructing a public official or similar.

Delegation limits (section 8). If a CEO delegates to a person whose position is not prescribed, that delegation is invalid. Any authority purportedly granted by that delegate would be ultra vires and void. Participants acting under that authority would not have immunity. This is a high risk for agencies: if a delegate who is not on the prescribed list grants an urgent authority, the operation is unlawful. The regulation does not penalise the CEO directly, but the agency could face civil liability for any harm caused during the unlawful operation.

Civil litigation risk. Third parties who suffer loss or damage as a result of a controlled operation, for example if property is damaged or a person is injured, could sue the agency and individual participants. The Act‘s immunity provisions protect conduct that is authorised and in good faith. A breach of the code of conduct, particularly acting without good faith or inducing criminal activity beyond the authority, could negate that immunity. The regulation therefore increases the legal risk for participants who do not follow the code.

The 2025 regulation operates as part of a larger legal framework. It must be read together with the Law Enforcement (Controlled Operations) Act 1997, the Interpretation Act 1987, and various other statutes that govern law enforcement, criminal procedure, cross-border operations, and Commonwealth state relations.

Parent Act. The regulation is made under the Act and gives effect to several sections by prescribing matters that the Act leaves to regulation. Section 3 (definition of law enforcement agency) allows the regulation to prescribe additional agencies; section 4 of the regulation adds the AFP and Home Affairs. Sections 5(2B) and 10(1C) of the Act require the regulation to set conditions for urgent applications; section 5 of the regulation imposes the reasonable belief condition and record keeping requirement. Section 15(2) of the Act requires the regulation to specify the content of reports; section 6 of the regulation does so. Section 20 of the Act allows the regulation to prescribe a code of conduct; section 7 and Schedule 1 establish the code. Section 29(2)(b) of the Act allows the regulation to prescribe positions to which the CEO may delegate; section 8 of the regulation lists those positions. The regulation does not override the Act; it fills in the gaps. Any inconsistency between the regulation and the Act would be resolved in favour of the Act.

Interpretation Act 1987. The note in section 3 of the regulation reminds readers that the Interpretation Act contains provisions that affect the regulation‘s interpretation. This includes the definition of terms, the rules for calculating time, and the default construction of “may” as permissive and “must” as mandatory. The regulation also relies on the Interpretation Act for the meaning of commencement, repeal, and savings provisions.

Cross-border controlled operations. The Act contains provisions for cross-border controlled operations, allowing NSW authorities to cooperate with other jurisdictions. The 2025 regulation does not mention cross-border operations, but section 5(1) of the regulation expressly excludes cross-border controlled operations from the urgent application provision (which is limited to non-cross-border operations). This means that urgent applications for cross-border operations are governed by the Act alone, not the regulation. The regulation also does not prescribe agencies for cross-border purposes beyond the two Commonwealth agencies, which may already be covered under other cross-border arrangements.

Commonwealth laws. By adding the AFP and Home Affairs as prescribed agencies, the regulation brings those Commonwealth entities under the NSW controlled operations regime when they operate in NSW. However, these agencies may also be subject to the Commonwealth‘s own controlled operations legislation, such as Part IAB of the Crimes Act 1914 (Cth). An officer could potentially hold authorities under both regimes. The regulation does not resolve which regime prevails; in practice, the officer must comply with both sets of requirements, but the NSW authority provides immunity from NSW state laws, while the Commonwealth authority provides immunity from Commonwealth laws. The regulation creates a potential for duplicate compliance but also reduces legal risk for officers who need to operate across jurisdictions. The code of conduct applies to AFP and Home Affairs officers when conducting NSW controlled operations, even if their internal Commonwealth rules differ. This could create friction if the Commonwealth code is less restrictive (e.g., on inducing criminal activity). The NSW code‘s restrictions on inducing criminal activity (clause 4(1)(c)(i)) are more specific than some Commonwealth provisions.

Oversight bodies. The regulation interacts with the laws governing the Independent Commission Against Corruption (ICAC Act), the Crime Commission (Crime Commission Act), and the Law Enforcement Conduct Commission (LECC Act). Section 8 of the regulation prescribes delegation positions within those bodies, referencing their enabling Acts. This ensures that delegates are persons defined in those Acts. For example, the ICAC delegate must be a Commissioner (other than Chief Commissioner) or an Assistant Commissioner within the meaning of the ICAC Act. This cross-reference ties the regulation to the definitions in those other Acts, which may change over time.

Evidence laws. The regulation does not directly affect evidence law, but compliance with the code of conduct and reporting requirements may be relevant in criminal proceedings where the defendant challenges the admissibility of evidence obtained through the controlled operation. A court may consider whether the operation was conducted in accordance with the code when deciding whether to exclude evidence for impropriety under section 138 of the Evidence Act 1995 (NSW). The new goods route reporting requirement (section 6(d)(ii)) could also provide a chain of custody record that assists in proving the provenance of illicit goods.

Repeal and savings provisions. Section 9 of the regulation repeals the 2017 regulation but preserves the effect of any act, matter or thing done under it. This means that authorities granted under the 2017 regulation continue to be valid, and reports or undertakings given under the old regulation remain effective. However, any new applications, variations, or operations commenced after the 2025 regulation commences are subject to the new rules. This avoids a gap but may create a two-tier system for a transitional period: pre-commencement operations follow the old rules; post-commencement operations follow the new.

The 2025 regulation is a standalone instrument that repeals and replaces the Law Enforcement (Controlled Operations) Regulation 2017. As of the date of commencement, the 2017 regulation is no longer in force. The 2025 regulation has not itself been amended; it is the current version. However, the regulation‘s commencement is tied to publication on the NSW legislation website, meaning it began on a specific date (likely late August or early September 2025, to replace the 2017 regulation before its 1 September 2025 repeal). The regulation does not include any transitional provisions beyond section 9(2), which preserves prior acts.

The 2017 regulation had been in force for eight years and was automatically subject to repeal under the Subordinate Legislation Act 1989, section 10(2), which requires most regulations to be remade every five or ten years. The 2025 regulation continues the same basic structure but introduces several differences from the 2017 version. The most notable changes are: (1) the addition of the Australian Federal Police and the Department of Home Affairs as prescribed agencies (the 2017 regulation prescribed only the AFP, not Home Affairs, and only under its old name); (2) the new written record requirement for urgent applications (section 5(2)); (3) the expanded report content requiring the route of illicit goods (section 6(d)(ii)); (4) the updated delegation list for the AFP (now refers to the member responsible for day-to-day operations in NSW, whereas the 2017 regulation referred to the “member of the Australian Federal Police responsible for the day-to-day operations of the Australian Federal Police in New South Wales” - essentially the same but now also includes Home Affairs delegation); (5) the Home Affairs delegation list (new). The code of conduct in Schedule 1 is substantially similar to the 2017 code but with minor drafting changes: for example, clause 4(1)(c)(i) now refers to “induce or encourage another person to engage in criminal activity or corrupt conduct” whereas the 2017 code referred only to “criminal activity”. The inclusion of “corrupt conduct” expands the scope.

Because the regulation is very recent (2025), no subsequent amendment history is available. It will likely be reviewed before its own repeal date (unless sooner repealed), but that date is not specified in the regulation. Under the Subordinate Legislation Act, a new regulation would typically be set to expire after five years, but the 2025 regulation does not state a repeal date. The note in section 2 explains the 2017 regulation would have been repealed on 1 September 2025, implying the 2025 regulation commenced just before that date to prevent the gap.

The source text does not mention any litigation history. The 2025 regulation is newly made and has not been the subject of court proceedings. However, the predecessor 2017 regulation and the Act itself have been considered in several NSW and High Court cases. A deep dive on the regulation alone would not include those cases without specific reference in the source. The user’s instruction is to “only name cases the source names.” Since the source does not name any cases, no litigation history can be discussed. The regulation‘s provisions are procedural and unlikely to be challenged directly in court; challenges to controlled operations typically centre on the validity of the authority under the Act, not on the regulation‘s requirements. For example, a defendant might argue that an urgent application did not meet the condition of impracticability, but that would involve interpreting the Act and the regulation together. The court could refer to the regulation‘s record keeping requirement as evidence of whether the condition was met. However, no specific cases are cited in the instrument.

It is theoretically possible that the regulation‘s prescription of the AFP and Home Affairs could be challenged on the ground that the Act only permits the regulation to prescribe agencies that are “law enforcement agencies” within the Commonwealth meaning, but the source does not indicate such a challenge. The delegation list in section 8 could also be challenged if a delegate who is not on the list purports to act, but that would be a challenge to the validity of the authority, not to the regulation itself.

Given the source limitation, the litigation history section must state that no cases are mentioned in the regulation. However, to satisfy the 200-word requirement, we can discuss the potential for future litigation and how courts would approach the regulation. That would be speculative but grounded in the text: for example, a court would construe the regulation using the ordinary meaning of “impracticable” and “as soon as practicable,” and the good faith requirement may be tested in cases where an officer fails to disclose a change in circumstances. The regulation does not provide a remedy for breach; a litigant would need to rely on the Act or common law. The absence of a private right of action means that most litigation will be in the criminal or disciplinary context.

The regulation does not create any statutory limitation or time bar, so there is no litigation history on that front.

Several provisions in the 2025 regulation may catch practitioners off guard if they rely on previous versions or assume the requirements are purely formal.

Urgent application record (section 5(2)). The requirement to keep a written record of the urgent application is new. If an officer makes an oral urgent application and forgets to create the record, there is no evidentiary basis to prove the application was made. A court or oversight body may infer that no application was made, rendering the operation unauthorised. The record must contain the date, time, applicant identity, and the information given. There is no grace period; the obligation arises at the time of the application, though the regulation does not specify the medium of the record. An officer could use a notebook, mobile phone note, or email to self the details, but the record must be created and kept. Failure to produce it on request could lead to adverse inferences in disciplinary or criminal proceedings.

Goods route requirement (section 6(d)(ii)). The regulation requires the report to include “the route through which the goods passed during the operation, if known to the officer.” This sounds like a simple tracking detail, but it may require the officer to compile information from multiple sources, including surveillance logs, GPS data, and witness statements. If the route is not known, the officer may omit it, but the qualifier “if known” creates an incentive to avoid knowing the route to avoid the reporting burden. However, deliberately remaining ignorant to avoid reporting obligations could breach the duty of good faith in clause 5. The route information is also sensitive: it could reveal law enforcement techniques or intelligence sources. Including it in a report that may be disclosed to defendants (e.g., in a brief of evidence) could compromise future operations or informants. Agencies must balance the reporting obligation against the risk of disclosure, though the regulation does not allow a carve-out for operational sensitivity.

Civilian participant undertaking must be in writing (clause 3(b)). This seems straightforward, but the principal law enforcement officer must “receive a written undertaking from each civilian participant not to engage in controlled activities other than those authorised by the authority.” The undertaking is not prescribed in a standard form; it could be a signed statement. However, the officer must also make a written record of each undertaking. If a civilian participant later claims they did not understand the limits, the written undertaking is key evidence. If the officer loses or fails to obtain the written undertaking, the civilian participant may be deemed to have no authorisation, exposing them to prosecution. The regulation does not require the civilian to sign the undertaking; it only says the officer must “receive” a written undertaking. A text message or email from the participant could suffice, but the officer must record it. This ambiguity could cause problems if the form is informal. Best practice is a formal signed document.

Good faith obligation for applicants and report preparers (clauses 1 and 5). The code requires good faith in applications and reports. Good faith is a subjective standard that can be difficult to disprove, but the requirement to “disclose all information relating to the circumstances of the application known to the applicant” is objective: if the applicant knew of a fact and did not disclose it, that is a breach, even if the applicant acted in good faith. The code seems to impose both a subjective good faith duty and an objective disclosure duty. Practitioners must ensure that all known information is included, not just what the applicant believes is relevant. If a co-officer holds information that the applicant does not know, the applicant is not obliged to disclose it, but the principal law enforcement officer has a separate duty to monitor for changes in circumstances.

Deemed notice for code breaches (clause 4(3)). A law enforcement participant who becomes aware of a breach must give notice to the CEO “as soon as practicable.” However, notice is “taken to have been given” if the participant reports the breach in accordance with the internal reporting procedures of the agency. This deeming provision is helpful, but it only applies if the internal procedure actually captures the breach. If the internal procedure only covers certain types of misconduct (e.g., sexual harassment) but not all code breaches, then reporting via that procedure may not be deemed sufficient. Officers should check whether their agency’s internal reporting procedure covers all breaches of the controlled operations code. The word “breach” in clause 4(3) is not limited to particular clauses, so the internal procedure must cover all code breaches to benefit from the deeming.

Delegation limits for AFP and Home Affairs (section 8(d) and (e)). The AFP delegate is the “member of the Australian Federal Police responsible for the day-to-day operations of the Australian Federal Police in New South Wales.” This is a specific role, not a rank. If the AFP restructures or if the person acting in that role is temporarily absent, the CEO cannot delegate to another member without amending the regulation. For Home Affairs, the delegates are the Australian Border Force Commissioner and an “Immigration and Border Protection worker in the Operations Group or Support Group of the Australian Border Force with the classification of Senior Executive Service Band 3.” The phrase “Immigration and Border Protection worker” is defined in the Australian Border Force Act 2015 (Cth) and includes many roles, but the additional requirement of being in the Operations Group or Support Group and at SES Band 3 level significantly narrows the pool. Agencies must verify that their current delegates satisfy both the group and classification requirements.

Compliance with the 2025 regulation requires law enforcement agencies and their officers to update their internal procedures, training, documentation, and delegation frameworks.

1. Update the list of law enforcement agencies. Agencies should ensure their controlled operations policies recognise the AFP and the Department of Home Affairs as prescribed agencies under NSW law. This may require updates to memoranda of understanding between state and Commonwealth agencies. For AFP and Home Affairs officers, compliance means familiarising themselves with the NSW code of conduct and reporting requirements, even if their Commonwealth regime is different. It may be prudent to designate a liaison officer to ensure that NSW-specific obligations are met.

2. Review urgent application procedures. Agencies must update their standard operating procedures for urgent applications to include the new written record requirement. The record should be a template that captures the date, time, applicant identity, and the information given to the CEO. The applicant should complete the record immediately after the oral application, and a copy should be retained in the agency‘s file. The agency should also train officers on what constitutes “impracticable” for a formal application; the regulation does not define it, but case law under the Act may provide guidance. The record should be produced to the CEO upon request and may be needed for subsequent review.

3. Amend report templates. Section 6 requires reports to include the route of illicit goods if known. Agencies should modify their standard report template to include fields for the nature and quantity of goods and a field for the route (e.g., “route description or GPS coordinates”). Training should emphasise that the route information must be included if known, and that officers should document the route contemporaneously during the operation to avoid reliance on memory. The report must also include any loss, damage, or injuries. The template should have a mandatory section for these items.

4. Implement the code of conduct. The code in Schedule 1 is now binding on all law enforcement participants. Agencies should distribute the code to all officers who may be involved in controlled operations, and provide training sessions on each clause. Particular attention should be paid to the good faith obligations, the duty to disclose changes in circumstances, the briefing requirements for civilian participants, and the positive duty to intervene or report breaches. Agencies should develop a standard written undertaking form for civilian participants. The undertaking should clearly state the authorised controlled activities and contain a declaration that the participant will not engage in other activities. The principal law enforcement officer must record the undertaking. A signed copy should be kept on the operation file.

5. Establish breach reporting mechanisms. To benefit from the deeming provision in clause 4(3), agencies should ensure that their internal reporting procedure covers all possible breaches of the code (not just specific categories like corruption or misconduct). The internal procedure should be documented and communicated to all officers. If the existing procedure is too narrow, agencies should expand it or create a dedicated controlled operations breach report line. Officers should be trained to use that procedure, and the agency should confirm that reporting through that channel will be deemed notice to the CEO.

6. Verify delegations. Each agency’s CEO must ensure that any delegation of functions under the Act is only to the positions prescribed in section 8. For ICAC, delegates can be Commissioners (other than Chief Commissioner) or Assistant Commissioners under the ICAC Act. For the NSW Crime Commission, only Assistant Commissioners under the Crime Commission Act. For LECC, only Commissioners (other than Chief Commissioner). For the AFP, only the member responsible for day-to-day operations in NSW. For Home Affairs, only the ABF Commissioner or an SES Band 3 worker in the Operations Group or Support Group of the ABF. The CEO should review current delegations and revoke any that are not to these positions. New delegation instruments should be executed and recorded. It may be prudent to have a second delegate in each agency at the same level to cover absences, but only if that person also holds the prescribed position. If a position is vacant, the CEO must exercise the function personally or seek an amendment to the regulation.

7. Transitional compliance. The savings provision in section 9(2) means that actions taken under the old regulation remain valid. However, any new applications, variations, operations, or reports after commencement must follow the new regulation. Agencies should audit active controlled operations that began before the commencement to ensure they are not inadvertently subject to the old rules for ongoing reporting. If a report is due after commencement, it must include the new content (route of goods). If an operation continues after commencement, the principal officer must ensure participants are briefed on the new code of conduct (though the code applies to all conduct after commencement, not just new operations). Civilian participants who gave an undertaking under the old regulation may not need a new undertaking, but the officer should ensure they are aware of the new code.

8. Train on specific gotchas. Officers should be trained on the urgent application record, the goods route reporting, the need for written civilian undertakings, the post-application disclosure duty, and the limits on delegation. The training should include scenarios: e.g., an officer learns new information after the authority is granted; they must immediately inform the CEO. Failure to do so could jeopardise the operation. The training should also cover the duty to intervene: if a law enforcement participant sees another participant inducing a target to engage in criminal activity beyond the authority, they must take reasonable steps to stop it and report it. This duty may conflict with undercover operational needs, but the code is paramount.