Migration (Approval of Primary and Fall-back Reporting Systems—International Passenger Cruise Ships) Instrument 2025

The instrument introduces several concepts that structure the reporting regime for international passenger cruise ships. The core distinction is between “primary reporting systems” and “fall-back reporting systems”. A primary reporting system is the standard electronic system through which operators must transmit advance passenger information before the ship arrives in Australia. For both crew and passengers, that system is the Advance Passenger Processing System (APP), a commercial product provided by CPS Systems Pty Ltd. The instrument does not explain how operators gain access to APP, nor does it specify any costs or contractual terms; it merely designates it as the approved system. The fall-back systems are alternative reporting channels - telephone, email, SITATEX, and APPchat - that operators must use if the primary system is not functioning. The instrument does not define what triggers the fall-back, leaving operators to decide when the primary system is unavailable, which introduces some discretion and risk.

Another critical concept is the categorisation of travellers into “crew”, further divided into “Operating Crew” and “Positioning Crew” (noted in the Traveller Type field), and “passengers”. The reporting obligations differ between these categories. For crew, the instrument creates two regimes: one for crew holding Australian or New Zealand passports or a visa that permits travel to Australia, and another for crew who have obtained up-lift approval from ABOC. However, the data fields required under both regimes are identical for crew - only 11 fields, including a truncated family name (first four characters only). For passengers, the instrument creates two regimes as well: one for passport/visa holders (11 fields, but family name must be full, not truncated) and a second, more onerous regime for passengers eligible for a special purpose visa or who have obtained up-lift approval, requiring 14 fields including full given names, date of birth, and sex.

“Up-lift approval” and “special purpose visa” are terms used but not defined in the instrument; they draw meaning from the Migration Act and Regulations. Up-lift approval appears to be a case-by-case clearance from ABOC for travellers who do not hold a standard travel document or visa. The instrument also uses the “Lloyd’s Shipping Number” as a key identifier for the vessel, and “Check-in Port”, “Expected Port”, and “Trans-Border Port” to track the movement of persons. The “Transit Indicator” field identifies whether the person is transiting at origin or destination. The instrument imposes time-stamping by requiring the check-in date in Greenwich Mean Time.

The fall-back reporting system requires only three items of information: the Lloyd’s Shipping Number, port and expected arrival date; a confirmation that all travellers hold valid travel documents or visas (or Australian/New Zealand passports); and for those not confirmed, whether uplift approval has been obtained. This is far less granular than the primary reporting, but it still imposes a certification burden on operators.

The instrument directly affects operators of international passenger cruise ships that enter Australian ports. “International passenger cruise ship” is defined by reference to regulation 3.13 of the Migration Regulations 1994, which generally means a vessel carrying passengers for reward on an international voyage. The operator - likely the cruise line or its local agent - bears the legal obligation to use the approved reporting systems and to transmit the specified information for every crew member and passenger on board. This obligation applies at the point of check-in or uplift, and before the ship arrives in Australia.

Crew members and passengers are indirectly affected because their personal data - nationality code, passport number, family name, date of birth, sex, and travel document details - must be collected and transmitted to the Department. The instrument requires different levels of detail depending on the traveller’s status (crew vs passenger, and whether they hold a valid passport/visa or require uplift approval). Crew members’ family names are reported using only the first four characters, which may affect data matching and identification. Passengers who are eligible for a special purpose visa or require uplift approval have their full given names, date of birth, and sex reported, representing a greater privacy intrusion.

The Department of Home Affairs and the Australian Border Force are the recipients of this data, which is used for border clearance, security checks, and immigration enforcement. The instrument also names CPS Systems Pty Ltd as the provider of the primary reporting system; that company (part of SITA) has a commercial interest in being the approved provider, potentially creating a monopoly-like arrangement. Operators have no choice under the instrument but to use APP, which could mean paying for access, integration, and support. The instrument does not address whether any cost recovery applies.

The Australian Border Operations Centre (ABOC) is designated as the contact point for fall-back reporting. Fall-back systems include telephone numbers (1300 368 126 and 02 6264 1301), an email address, a SITATEX address, and an “APPchat” system. The instrument does not specify whether these fall-back channels are available 24/7 or whether there are any costs to operators for using them.

Finally, the instrument repeals the 2015 approvals, so any operator who had systems or procedures built around the old instruments must update them. This affects IT departments, data processors, shore-side staff, and shipping agents who handle passenger manifests.

The instrument imposes a duty on operators of international passenger cruise ships to use the approved primary reporting system (APP) for both crew and passengers, and to transmit the exact information specified in the tables for each category of traveller. This duty arises under sections 245J and 245K of the Migration Act 1958, which require the provision of advance passenger information. The instrument does not create any new duties beyond specifying the systems and data fields; the underlying Act already mandates reporting. However, by naming a particular system and provider, the instrument makes compliance more concrete: operators must integrate with APP and cannot use an alternative electronic system.

For crew, the duty includes reporting the 11 specified fields for all crew members regardless of whether they hold a passport or have uplift approval. For passengers, the duty splits: passengers with Australian or New Zealand passports or a valid visa require 11 fields (including full family name but not given names or date of birth). Passengers eligible for a special purpose visa or with uplift approval require 14 fields, including full given names, date of birth, and sex. Operators must correctly classify each passenger into one of these two categories and report accordingly. The instrument does not define “eligible for a special purpose visa”; operators must make that determination based on the Migration Act and Regulations, which adds a layer of legal risk if they misclassify.

A further duty arises under the fall-back provisions: if the primary system is unavailable, the operator must use one of the approved fall-back methods - telephone, email, SITATEX, or APPchat - and report the three items in the fall-back table. The instrument does not say when the fall-back must be used (e.g., upon system failure, or if the operator has not integrated APP), but the reference to “fall-back” implies it is a contingency for when the primary system cannot be used. Operators must ensure that fall-back procedures are in place and staff are trained to use them.

The instrument does not confer any rights on operators or travellers. It is a regulatory instrument imposing obligations only. Travellers have no right to opt out of data collection; the reporting is mandatory for border processing. Operators have no right to choose a different reporting system or to negotiate data fields. The only limited right is the ability to use fall-back channels if the primary system is not working, but that is a conditional permission, not a right to avoid reporting.

The instrument itself does not prescribe any penalties. It is made under sections 245J and 245K of the Migration Act 1958, which are not reproduced in the instrument. Those sections of the Act typically create offences for failing to provide advance passenger information or for providing false or misleading information. The instrument sets the standard for what constitutes compliance: using the approved system and reporting the specified data. Failure to meet that standard would likely be a breach of the Act, attracting civil penalty provisions or criminal offences depending on the nature and severity of the non-compliance.

Operators who use a system other than APP for primary reporting, or who report incomplete or incorrect data fields, may be found to have contravened section 245J. The Act provides for maximum penalties, which are not stated in this instrument but are generally significant - often hundreds of penalty units for corporations. For a large cruise line, non-compliance could also lead to operational consequences: the Department may delay or deny clearance for the ship to enter Australian waters, refuse to process crew or passengers, or impose conditions on future voyages. The instrument does not mention any specific enforcement actions, but the underlying regulatory framework gives the Department broad powers to manage border entry.

The fall-back provisions also carry enforcement risk. If an operator uses a fall-back system when the primary system is actually available, or fails to transmit even the minimal fall-back data, that too may be non-compliance. Conversely, if the primary system fails and the operator activates fall-back correctly, they are likely shielded from penalty for the failure of the electronic system, provided they report the required information.

The repeal of the 2015 instruments means that any practices developed under those older approvals no longer constitute compliance. Operators who continue to use the old data fields or different system configurations are at risk of enforcement, even if they were compliant before.

This instrument operates solely under the Migration Act 1958, specifically sections 245J and 245K. It does not amend or repeal any other legislation, but it sits within a broader framework of laws affecting cruise ship operations. The most immediate interaction is with the Migration Regulations 1994, which define “international passenger cruise ship” in regulation 3.13. Operators must ensure they correctly identify whether their vessel falls within that definition; if it does not, the instrument does not apply, and different reporting rules may apply under the general advance passenger information regime for aircraft and other vessels.

The instrument requires the collection and transmission of personal information such as full names, date of birth, sex, passport numbers, and nationality. This brings it into interaction with the Privacy Act 1988 (Cth), which regulates how Australian Government agencies and some private sector organisations handle personal information. The Department of Home Affairs must comply with the Australian Privacy Principles when using the data. The instrument does not mention privacy protections, but the Privacy Act would apply to the Department’s storage, use, and disclosure of the reported data. Operators who collect this data from passengers and crew to transmit to the Department are likely also subject to the Privacy Act, especially if they are Australian entities. They must have a lawful basis for collection and ensure data is handled securely. The instrument does not provide any exemption from privacy obligations.

The instrument may also interact with the Biosecurity Act 2015, which requires pre-arrival reporting for vessels to manage biosecurity risks. While the Migration instrument focuses on immigration control, the same data may be used by the Department of Agriculture, Fisheries and Forestry for biosecurity purposes. Additionally, the Maritime Transport and Office of Transport Security (MOTS) may have separate reporting requirements under the Maritime Transport and Security Act 2003 for vessel movements and security. Operators must navigate multiple overlapping reporting obligations, which the instrument does not coordinate.

The instrument designates a private provider (CPS Systems) for the primary system. This raises possible interaction with competition and procurement laws, but the instrument does not require a competitive tender; it simply names the provider. If operators must pay CPS Systems for access, that cost is a private contractual matter, but the instrument effectively mandates that cost as a condition of compliance. There is no provision allowing operators to use an alternative system that achieves the same outcome.

Finally, the instrument repeals three 2015 instruments. Those instruments were legislative instruments in their own right, and their repeal means any savings or transitional provisions in them are also repealed. The 2025 instrument contains no transitional provisions, so operators must comply from the date of commencement without grace.

The instrument is a new legislative instrument that replaces three earlier instruments from 2015: the Instrument of Approval of Primary Reporting Systems (International Passenger Cruise Ship - Crew) 2015, the Instrument of Approval of Primary Reporting Systems (International Passenger Cruise Ship - Passengers) 2015, and the Instrument of Approval of Fall-back Reporting Systems (International Passenger Cruise Ship - Passengers and Crew) 2015. These are repealed in full by Schedule 1 of the 2025 instrument.

The instrument does not provide a comparison between the old and new requirements. However, based on the text of the 2025 instrument, some differences are apparent. First, the 2025 instrument consolidates crew and passenger approvals into a single instrument rather than separate instruments. Second, it updates the phone numbers for ABOC fall-back contact. The 2025 instrument includes a new fall-back method: APPchat, which was not listed in the repealed 2015 instrument (or at least not in the three instruments mentioned). Third, the data fields appear to have been revised: for crew, the old 2015 instrument likely had different field specifications; the 2025 instrument now requires only the first four characters of family name for crew, and for passengers the full name in some cases and additional fields for those with special purpose visas or uplift approval. Fourth, the 2025 instrument explicitly references the Australian Border Operations Centre (ABOC), a term that may have been used in the 2015 instruments as well, but the 2025 instrument formalises its role as the contact for fall-back reporting. Fifth, the 2025 instrument adds the “Transit Indicator” field, which was not present in the 2015 tables (based on the 2015 instruments not being reproduced; however the 2025 includes it in all tables). This is a notable change as it requires operators to indicate whether a traveller is transiting, adding complexity to data capture.

Because the 2015 instruments are not reproduced, operators cannot simply compare tables; they must assume the 2025 instrument imposes new or changed obligations. There is no saving provision for actions taken under the repealed instruments. Any system configurations, data mappings, or training built around the 2015 approvals must be updated to meet the 2025 specifications. The instrument does not provide a transition period; it commences the day after registration, which implies immediate effect.

The instrument has not been amended since its making (as it is new). No amendment history is available beyond the repeal of predecessors.

There is no litigation history for this specific instrument, as it was made on 15 September 2025 and has only just commenced. However, the underlying provisions of the Migration Act (sections 245J and 245K) have been the subject of administrative review and some litigation, particularly around the scope of advance passenger information obligations and penalties for non-compliance. Cases have considered what constitutes a “reporting system” and whether regulations and instruments must be properly gazetted. The 2015 instruments were not the subject of reported litigation, but their successor may attract challenge if operators consider the data fields to be ultra vires the Act, or if the requirement to use a specific commercial system (without an alternative) is seen as an improper delegation of governmental power to a private entity. The instrument does not itself provide for a merits review mechanism; any challenge would likely be in the Federal Court under administrative law grounds, such as jurisdictional error or failure to take into account relevant considerations.

The requirement to report full family names for passengers but only four characters for crew could be challenged as arbitrary or discriminatory, but no such challenge has occurred. The fall-back provisions may also be tested if operators argue that the approved fall-back methods are inadequate (for example, if telephone lines are not answered). The instrument does not guarantee availability of fall-back channels, so a litigant could argue that the instrument effectively imposes a duty that cannot be complied with if ABOC does not answer the phone or respond to email. However, that would require evidence of systemic failure.

Given the instrument is new, litigation is hypothetical. Practitioners should monitor for any Federal Court or Administrative Appeals Tribunal decisions that interpret the reporting obligations or challenge the validity of the instrument.

Several aspects of the instrument could catch operators off guard. First, the distinction between crew and passenger reporting is not purely based on the traveller’s role; it depends on the traveller’s document status. For crew, the second reporting regime (for those with uplift approval) requires the exact same fields as the first regime - only 11 fields including a truncated family name. But for passengers, the second regime (special purpose visa or uplift approval) requires three extra fields: full given names, date of birth, and sex. This means a passenger who requires uplift approval must have far more personal data reported than a passenger with a standard passport. Operators must correctly identify which passengers meet the special purpose visa criteria or have obtained uplift approval. Misclassification - reporting a passenger under the simpler schedule when they should be under the detailed schedule - could be a breach. The instrument does not define “eligible for a special purpose visa”, leaving operators to interpret the Act and Regulations without guidance.

Second, the family name field for crew is limited to the first four characters. This is unusual and may cause data matching problems, especially for crew with short names (e.g., “Li” - three characters, fine; “Smith” - five characters, only “Smit”). The instrument explicitly says “first four characters of the person’s family name”. It does not permit full names. Operators who report the full name for crew may be providing non-compliant data. Conversely, the fall-back system does not require any names, only confirmation of documents.

Third, the fall-back reporting systems are listed as primary alternatives, but the instrument does not specify how operators must choose among telephone, email, SITATEX, and APPchat. It also does not indicate whether the operator must attempt the primary system first and only use fall-back upon failure, or whether fall-back can be used proactively. The safer interpretation is that fall-back is only for when the primary system is unavailable, but the instrument does not say that. Operators might inadvertently use fall-back when they could have used APP, risking non-compliance.

Fourth, the instrument does not include any provisions for testing or transitional relief. The day-after-commencement start date means operators must have APP integration and fall-back procedures in place immediately. Any operator who was relying on the 2015 instruments and has not yet updated systems is non-compliant from day one.

Fifth, the instrument uses “up-lift approval” from ABOC as a category trigger. This approval process is not described in the instrument. Operators must know how to obtain such approval and must be able to prove it was obtained for each traveller reported under the uplift approval category. Failure to have the approval, but reporting under that schedule anyway, could be misleading.

Sixth, the instrument requires the Lloyd’s Shipping Number for every traveller. This is a unique seven-digit number assigned by Lloyd’s Register. Not all vessels may have such a number, especially very small or non-convention vessels. If a ship cannot be assigned a Lloyd’s number, the operator may be unable to comply with the field. The instrument does not provide an alternative.

Seventh, the primary system provider is named and is a private company. The instrument does not guarantee that CPS Systems will offer access to all operators, nor does it cap pricing. An operator who is refused access or cannot afford the fees may have no compliant way to report, potentially forcing reliance on fall-back systems indefinitely - which may not satisfy the primary reporting obligation.

Operators of international passenger cruise ships should take several steps to ensure compliance with the instrument from its commencement date. First, they must secure access to the Advance Passenger Processing System (APP) provided by CPS Systems Pty Ltd. This likely requires entering into a service agreement with CPS Systems, paying any applicable fees, and integrating the system with the operator’s passenger manifest and crew management software. Operators should test the data transmission ahead of the first voyage after commencement to ensure the system accepts the specified fields and returns a confirmation.

Second, operators must map their existing data collection processes to the exact fields required by the instrument. For crew, they need to collect and transmit: Traveller Type (Operating Crew or Positioning Crew), Document Type, Document Number, Nationality Code, Family Name (first four characters only), Lloyd’s Shipping Number, Check-In Port, Expected Port, Check-In Date (GMT), Trans-Border Port, and Transit Indicator. For passengers on the standard schedule, they need full family name and the same other fields except that family name is not truncated. For passengers on the special schedule (special purpose visa or uplift approval), they additionally need full given names, date of birth, and sex. Operators must create business rules to determine which schedule applies to each passenger. This may involve checking visa status or obtaining uplift approval from ABOC before reporting. The operator should maintain a clear audit trail showing how each passenger was classified.

Third, operators must prepare fall-back procedures. They must train staff on how to contact ABOC via telephone (1300 368 126 or 02 6264 1301), email (ABOC@abf.gov.au), SITATEX (CBRIXCR), or APPchat. The fall-back data is minimal, but the operator must be ready to confirm that each person holds a valid travel document or visa, or that uplift approval has been obtained. This requires having that information available even if the primary system is down.

Fourth, operators should review and update their privacy policies and data handling practices. The collection of personal information must comply with the Privacy Act 1988, including notifying individuals about the purpose of collection and securing the data. The instrument does not exempt operators from these obligations.

Fifth, operators should document their compliance procedures in case of an audit or enforcement action. This includes records of APP transmissions and confirmations, records of fall-back communications, and logs of uplift approvals. The instrument does not require record-keeping, but it is prudent given the potential for disputes.

Sixth, because the instrument repeals the 2015 instruments, operators must discard any procedures, data mapping documents, or training materials that reference the old field specifications. All staff involved in passenger processing must be briefed on the new requirements.

Finally, operators should monitor the Department of Home Affairs website for any guidance notes or frequently asked questions that may clarify ambiguous terms such as “eligible for a special purpose visa” or “up-lift approval”. If uncertainty remains, operators may seek a private ruling or contact ABOC for clarification before their first affected voyage. The cost of compliance - including system integration, training, and potential fees to CPS Systems - should be budgeted for, as the instrument provides no flexibility to use alternative systems.