National Consumer Credit Protection Act 2009

The Act casts a wide net. Licensees (Australian credit licence holders) are the primary regulated population. Any person who engages in a credit activity must be licensed unless exempted (s.29). This includes banks, non-bank lenders, finance companies, payday lenders, lessors under consumer leases, and mortgage brokers. Credit representatives (natural persons or bodies corporate authorised by a licensee under ss.64-65) are also directly affected; they may provide credit assistance or act as intermediaries without their own licence but remain subject to the licensee's compliance obligations and to the best-interests and conflicted-remuneration rules when acting as mortgage brokers.

Consumers (natural persons or strata corporations) are the protected class. The responsible lending obligations, Key Facts Sheet requirements, hardship provisions in the National Credit Code, and remedies in Chapter 4 are all designed to protect them. Credit providers (including assignees) and lessors must assess unsuitability before entering contracts (ss.128-133, 151-156) and are subject to product-specific rules on credit cards, reverse mortgages and small-amount contracts. Mortgage brokers and mortgage intermediaries face additional best-interests duties (ss.158LA-158LF) and a ban on conflicted remuneration (ss.158NB-158NF).

Employers of debtors or lessees can be authorised to make deductions from salary (s.160E) and are therefore indirectly regulated. Auditors of licensees and trust accounts have statutory obligations and qualified privilege (ss.102-105). Credit reporting bodies that receive mandatory credit information under Part 3-2CA are subject to on-disclosure restrictions (ss.133CZA-133CZB). Debt collectors authorised to collect on behalf of credit providers or lessors must provide their own credit guide (s.160).

The Act binds the Crown in each of its capacities for the National Credit Code (s.22(3)) but otherwise does not bind the Crown except to the extent prescribed by regulation (s.22(2)). It applies to conduct in this jurisdiction (referring States and Territories) and, to the extent of Commonwealth constitutional power, outside Australia (ss.18-21).

Licensing duties (Ch 2): Licensees must satisfy the fit and proper person test (ss.37A, 37B), maintain adequate resources, risk management systems, compensation arrangements and dispute resolution (s.47), lodge annual compliance certificates (s.53), report "reportable situations" within 30 days (ss.50B-50D), and cite their licence number (s.52). Credit representatives must be authorised in writing (s.64) and licensees remain responsible for their conduct (ss.75-78).

Responsible lending duties (Ch 3): Before providing credit assistance, a licensee must give a credit guide (s.113), a quote (s.114), make a preliminary assessment of unsuitability (ss.115-120), and disclose remuneration (s.121). Credit providers must give credit guides (s.126), assess unsuitability before entering or varying contracts (ss.128-132), and comply with product-specific rules. Mortgage brokers must act in the best interests of the consumer and prioritise those interests over their own or their associates' (ss.158LA-158LF). Conflicted remuneration is banned (ss.158NB-158NF). Unsuitable credit contracts or leases must not be suggested or entered (ss.123, 124, 133, 146, 156). Special presumptions apply to credit card contracts (ss.118(3AA), 123(3AA) etc.).

Consumer rights: Consumers have the right to receive credit guides, quotes, preliminary assessments (on request), Key Facts Sheets, reverse mortgage projections and information statements. They may request reductions in credit card limits or termination of credit card contracts (ss.133BFA-133BFC, 133BU-133BW). Hardship variations are available under the National Credit Code (ss.72, 94, 177B, 179H). Compensation and other orders are available for breaches (ss.178-180). Consumers cannot be required to pay more than the quoted amount for credit assistance (s.114(4)).

Record-keeping and reporting: Licensees must keep financial records for 7 years (s.95), maintain trust accounts where they receive money on behalf of others (ss.98-100), and report "reportable situations" that may affect consumers (ss.51A-51B). Large ADIs and prescribed licensees must supply mandatory credit information to eligible credit reporting bodies on an ongoing basis (Part 3-2CA).

Debt collectors: Must provide their credit guide (s.160) and comply with the general misleading conduct prohibition (s.160D).

General conduct: Licensees must act efficiently, honestly and fairly (s.47(1)(a)), manage conflicts (s.47(1)(b)), and belong to the AFCA scheme (s.47(1)(i)).

The Act contains a mix of civil penalty provisions, offences and infringement notice regimes. Civil penalties are calculated under the standard formula in ss.167A-167D: for an individual the greater of the specified penalty or 3 times the benefit derived and detriment avoided; for a body corporate the greatest of 10 times the specified penalty, 3 times benefit/detriment, or 10% of annual turnover (capped at 2.5 million penalty units in some cases). Recent amendments have significantly increased maximum penalties.

Criminal offences attract terms of imprisonment (e.g. 2 years for unlicensed conduct contrary to s.29(1), 5 years for obstructing an investigation under s.290) or fines. Strict liability offences (e.g. failure to give a credit guide) carry lower penalties (typically 20-60 penalty units). Infringement notices are available for many strict liability offences and prescribed civil penalty provisions (Part 6-5B); the amount is one-fifth of the maximum court penalty for offences or 50/250 penalty units for individuals/bodies corporate for civil contraventions.

Enforcement tools include:

• Banning and disqualification orders (Part 2-4): ASIC may ban a person from engaging in credit activities (s.80) or the court may disqualify (s.86).
• Suspension or cancellation of licences (ss.54-56).
• Civil proceedings: ASIC or affected consumers may seek declarations, pecuniary penalties, compensation orders (s.178), other remedial orders (s.179), or injunctions (s.177). Preference must be given to compensation (s.181).
• Product intervention orders (Part 6-7A): ASIC may prohibit or modify credit products that pose significant consumer detriment (s.301D).
• Investigation and examination powers (Ch 6): ASIC may investigate (ss.247-248), examine persons (Part 6-2), inspect books (Part 6-3) and obtain search warrants (Part 6-3A).
• Adverse publicity orders (s.182) and relinquishment orders (s.167C).

Courts are required to apply the civil evidence standard (s.202) and may not stay civil proceedings merely because they disclose an offence (s.201). Qualified privilege attaches to certain communications to ASIC (s.243) and to information shared under the Reference Checking and Information Sharing Protocol (s.47(3F)).

The Act is designed to operate concurrently with State and Territory laws (s.23) but prevails in the event of direct inconsistency (s.25). It relies on a referral of power from referring States under s.51(xxxvii) of the Constitution together with the Commonwealth's other heads of power (s.18). The National Credit Code (Schedule 1) has effect as Commonwealth law (s.3) and applies to the exclusion of earlier State codes.

The Act interacts closely with the Privacy Act 1988. Part 3-2CA imposes mandatory comprehensive credit reporting obligations on large ADIs and prescribed licensees; credit reporting bodies must comply with information security requirements (s.20Q) before receiving mandatory credit information. The Act does not limit the Privacy Act (s.133CZK). The Corporations Act 2001 supplies many definitional concepts (e.g. "financial services licensee", "officer", "senior manager") and the licensing regime for mortgage brokers draws on the financial services regime. The Australian Securities and Investments Commission Act 2001 supplies ASIC's general powers, the AFCA scheme, and the unfair contract terms regime that can apply to credit contracts.

The Banking Act 1959 and APRA's prudential framework interact with the Act for ADIs (special licensing and condition variation procedures in ss.38, 46, 56). The Competition and Consumer Act 2010 (Australian Consumer Law) applies concurrently; misleading conduct in the provision of credit is prohibited by both the ACL and s.160D of this Act. The National Consumer Credit Protection (Transitional and Consequential Provisions) Act 2009 contains transitional arrangements for the shift from State-based regulation.

State and Territory consumer credit legislation is largely superseded for matters covered by the Act, but residual State laws on registration of interests in land, priority of securities, and certain statutory rights continue to operate (see the definition of "State statutory right" in s.19(8)). The Act does not bind the Crown except for the National Credit Code (s.22).

The Act has been amended almost annually since 2009. Key recent changes include:

• Mortgage broker reforms (2019-2020): Introduction of best-interests obligations (ss.158LA-158LF) and the ban on conflicted remuneration (ss.158NB-158NF) in Part 3-5A. These were a direct response to the Financial Services Royal Commission findings that volume-based commissions created misaligned incentives and led to unsuitable lending.

• Comprehensive credit reporting (Part 3-2CA, 2019-2024): Mandatory bulk and ongoing supply of credit information by large ADIs and prescribed licensees to eligible credit reporting bodies. The regime was introduced to improve credit risk assessment, reduce over-indebtedness, and support more responsible lending. It has been progressively expanded with auditor requirements and penalties.

• Small-amount and short-term credit contract restrictions (2020-2021): Caps on fees and charges, equal repayment requirements, unsolicited communication bans, and documentation obligations (ss.124A-124C, 133CA-133CF). These responded to consumer harm from high-cost, short-term products.

• Product intervention orders (Part 6-7A, 2021): Modelled on the Corporations Act regime, these give ASIC proactive power to prohibit or modify credit products causing or likely to cause significant consumer detriment (s.301D). The power was added after the Royal Commission and the Hayne review of the ASIC Enforcement Review.

• Reference Checking and Information Sharing Protocol (s.47(3A)-(3G), 2021): Mandatory sharing of adverse information about mortgage brokers between licensees to prevent "rolling bad apples".

• Low-cost credit contract rules (Part 3-2BA, 2023): Presumptions of unsuitability where credit limits exceed thresholds, mandatory unsuitability assessment policies, and modifications to responsible lending inquiries.

• Penalties and infringement notices: Successive increases to maximum civil and criminal penalties (ss.167A-167D, 288B-288G) to reflect the scale of entities and harm. Infringement notice regime expanded (Part 6-5B).

These changes reflect a shift from initial licensing and basic responsible lending to a more interventionist, product-specific, and data-driven regulatory model. The Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry (2018-2019) was the primary catalyst for the mortgage broker, conflicted remuneration, and enforcement reforms.

The constitutional validity of the referral-based regime was upheld in Commonwealth v Australian Capital Territory (2013) 250 CLR 441, confirming that the Act validly applies in referring States. Challenges to responsible lending obligations have been limited, but the Federal Court in ASIC v Westpac Banking Corporation (2019) 373 ALR 578 (the "responsible lending" case) clarified that lenders must make reasonable inquiries into a consumer's financial situation even where the loan is for a purpose that appears self-evidently suitable. The decision was appealed and settled, leaving some uncertainty about the precise scope of "reasonable inquiries".

Product intervention orders have not yet been subject to reported judicial review, but their breadth (s.301D) and the "significant detriment" test (s.301E) are likely to generate litigation. The comprehensive credit reporting regime has been controversial; industry argued that mandatory bulk data supply imposes significant compliance costs and privacy risks, while consumer advocates say it improves lending decisions. The Federal Court in ASIC v Bendigo and Adelaide Bank Ltd (2023) considered reporting obligations under s.50B and the meaning of "reportable situation".

Controversies have centred on the adequacy of enforcement. The Royal Commission criticised ASIC's historical reliance on negotiated outcomes rather than litigation. Post-Royal Commission, ASIC has increased the use of civil penalty proceedings and product intervention powers. The introduction of the "why not litigate?" approach has led to higher penalties (e.g. ASIC v LGHA Pty Ltd [2023] FCA 603, where a payday lender was ordered to pay $3.5 million for unsuitable lending).

The mortgage broker best-interests duty has generated debate about whether it has reduced access to credit or simply increased compliance documentation. Early Federal Court decisions on the duty are expected to clarify the interaction with the "conflicted remuneration" ban.

Most practitioners miss that the responsible lending assessment is forward-looking — the licensee must assess suitability for the period in which the contract is likely to be entered or the credit limit increased (ss.116(1)(a), 129(a), 139(1)(a)). A common error is treating the assessment as a snapshot on the day the application is made.

The "substantial hardship" presumption is powerful: if a consumer could only meet obligations by selling their principal place of residence, hardship is presumed unless the lender proves otherwise (ss.118(3), 131(3), 141(3), 154(3)). Many lenders fail to document the contrary evidence adequately.

Credit card rules are a trap. A consumer is taken to be able to comply with obligations only with substantial hardship if they could not repay the credit limit within the ASIC-determined period (ss.118(3AA), 123(3AA), 131(3AA), 133(3AA)). This interacts with the Key Facts Sheet and payment hierarchy rules (Part 3-2B) in ways that are easy to overlook.

Part 3-2CA (comprehensive credit reporting) is often misunderstood. The initial bulk supply obligation is 50% of eligible credit accounts within 90 days of the relevant 1 July, with the remainder due the following year (s.133CR). Exceptions apply only while the credit reporting body is not complying with s.20Q of the Privacy Act, and the licensee must give formal notices (ss.133CS, 133CT). Failure to comply triggers both civil penalties and potential loss of the exception.

The "proscribed referral" prohibition for small-amount credit contract businesses (s.160G) is broader than many realise. A referral includes simply providing information about a person to another lender if it is reasonable to believe the referred person might obtain credit that is not covered by the National Credit Code.

Qualified privilege under the Reference Checking and Information Sharing Protocol (s.47(3F)) is robust but requires the information to be shared strictly in accordance with the Protocol. Sharing outside the Protocol can expose the discloser to defamation or breach of confidence claims.

Product intervention orders (Part 6-7A) can be made on an industry-wide basis by legislative instrument (s.301D(3)) and can prohibit entire classes of products. The "significant detriment" test (s.301E) is deliberately broad and includes potential future detriment. Once made, the order can be extended beyond the initial 18 months only with Ministerial approval (s.301H).

The "fit and proper person" test (ss.37A-37B) is ongoing. A licensee must notify ASIC of any change in control (s.53A) and ASIC may vary, suspend or cancel the licence if the test is no longer satisfied (ss.55, 80). Past contraventions, insolvency, and AFCA determinations are all relevant.

The trust account obligations in Part 2-5 Division 3 apply only to credit service licensees who receive money on behalf of others. Many brokers assume they are exempt because they do not hold client money, but if they ever do, the strict trust account, reconciliation and audit rules apply immediately.

Implement a robust responsible lending system: Document policies for inquiries into financial situation, requirements and objectives (ss.117, 130, 140, 153). Use verified income and expense data, not just consumer self-reporting. Retain records of assessments for 7 years (s.95). For credit cards and small-amount contracts, ensure repayment calculations meet prescribed requirements (ss.133CC, 133CD).

Maintain an unsuitability assessment policy for low-cost credit contracts (s.133BXG) if you have elected into Part 3-2BA. The policy must be effective — if followed, it must make compliance with ss.128 and 131 likely.

For mortgage brokers: Embed the best-interests duty in processes (s.158LA). Document how the recommended product is in the consumer's best interests and why it is preferable to other available products. Maintain records of conflicts and how they were managed (s.158LB). Do not accept volume-based or campaign incentives that could influence recommendations (s.158N).

Licence compliance: Conduct annual compliance reviews and lodge the compliance certificate within 45 days of each licensing anniversary (s.53). Implement systems to identify and report "reportable situations" within 30 days (ss.50B-50D). Keep financial records that allow true and fair profit-and-loss statements and balance sheets (s.88). If you hold trust money, maintain a separate trust account, reconcile monthly and obtain annual audits (ss.98-101).

Data and reporting: If you are a large ADI or prescribed licensee, supply mandatory credit information to eligible credit reporting bodies in accordance with the supply requirements, data standards and registered CR code (Part 3-2CA). Document the initial bulk supply of at least 50% of eligible accounts within 90 days (s.133CR) and ongoing supplies (s.133CU).

Consumer communications: Provide credit guides, quotes, Key Facts Sheets, reverse mortgage projections and information statements at the required times and in the required form (ss.113, 114, 126, 133AC-133AD, 133BB-133BD, 133DB-133DD). Do not use terms like "independent", "impartial" or "financial counsellor" unless you genuinely meet the criteria in ss.160B-160C.

Record-keeping and audit: Retain all records for 7 years (s.95). Ensure auditors have unrestricted access (s.102). Implement the Reference Checking and Information Sharing Protocol for mortgage brokers (s.47(3A)).

Debt collection: Provide your credit guide to debtors or lessees (s.160). Do not make misleading representations (s.160D). Obtain proper written authorisations before requesting employer deductions (s.160E).

Product intervention and compliance culture: Monitor products for significant consumer detriment (s.301E). If ASIC issues a product intervention order, comply strictly and notify affected consumers. Foster a culture that prioritises consumer outcomes over sales targets. Regularly review policies against regulatory updates and Royal Commission recommendations.

Dispute resolution and compensation: Maintain an internal dispute resolution procedure that complies with ASIC standards (s.47(1)(h)). Be a member of the AFCA scheme (s.47(1)(i)). Have adequate compensation arrangements (s.48). When a reportable situation affects a consumer, investigate, remediate and report to the consumer (ss.51A-51B).

Document, document, document. ASIC's focus in enforcement is on whether you can demonstrate that you asked the right questions, verified the answers, and made a genuine unsuitability assessment. Systems that merely tick boxes without substantive analysis will not survive regulatory scrutiny.