Payment Systems (Regulation) Act 1998

The Act’s reach is deliberately broad yet constitutionally anchored.

Participants in payment systems are defined in s7A(2) as constitutional corporations that operate, administer or participate in a payment system or provide enabling services (including messaging or settlement services). Because the definition of “payment system” in s7A(1) is expansive—any arrangement under which payments or funds are made or messages effecting, enabling, facilitating or sequencing those payments are transmitted—the net catches banks, non-bank financial institutions, fintech payment processors, card schemes, clearing houses, messaging networks and even some blockchain-based systems that handle “digital units of value” (expressly included in the extended definition of “funds” in s7(1)).

Holders of stored value of purchased payment facilities are separately regulated. Any constitutional corporation that issues or manages the stored value behind gift cards, prepaid travel cards, digital wallets or similar products must be an ADI or hold an authority or exemption. This directly affects fintech issuers, stored-value providers and certain non-bank money remitters.

Nominated special regulators (and their heads and delegates) become subject to Ministerial directions, consultation obligations and reporting requirements once nominated under s11D. Because any Commonwealth entity or Commonwealth company can be prescribed as a special regulator (s11C), the regime can bring in APRA, ASIC, the ACCC or other agencies for particular systems.

The Minister (and the responsible Minister for any non-Reserve Bank special regulator) exercises designation, nomination and direction powers. The responsible Minister’s written consent is a statutory precondition in several places (ss11D(4)(b), 11F(5)(c)).

The Reserve Bank itself is both the default regulator and a potential nominated special regulator. Its Governor cannot delegate the function of personally conducting an arbitration (s31(2A)). Its officers enjoy good-faith civil liability protection (s30B).

Courts—principally the Federal Court but also the Federal Circuit and Family Court and State and Territory courts with jurisdiction—enforce civil penalties (s30), hear applications for orders where access has been wrongly denied (s17), and make orders on enforceable undertakings (s30A(6)).

Consumers and future participants are indirect but important beneficiaries. The access-regime provisions expressly require the regulator to have regard to “the interests of people who, in the future, may want access to the system” (ss12(2)(c), 14(1)(c), 15(3)(c)). The stored-value rules exist to protect holders of e-money from issuer insolvency.

Entities outside the constitutional-corporation limit are generally untouched, although the Act binds the Crown in all capacities (s3) and extends to external Territories (s4). The Criminal Code applies to all offences (s5).

Duties

• Participants must comply with any applicable access regime (enforceable via court order under s17 or direction under s21) and any standard (s18). Breach of a direction triggers both criminal and civil liability (s21(9)–(10)).
• Holders of stored value must be ADIs or hold current authorities or exemptions (s22). Authorised holders must observe licence conditions; breach can trigger a direction (s24) carrying a 50-penalty-unit offence.
• Nominated special regulators may exercise the full suite of Part 3 powers only after receiving a matters direction and considering the specified matters (s11E(2)). They must consult the Reserve Bank and any co-nominated regulator before acting (s11E(5)) and must comply with any purposes or matters direction (s11E(4)).
• The Reserve Bank and nominated special regulators must notify participants of new or varied access regimes and standards (s29) and act only where the relevant interest test is satisfied. They enjoy good-faith immunity (s30B).
• Information recipients must keep information confidential except for authorised uses and disclosures (s26A).

Rights

• Denied applicants for access have a statutory right to request a direction (s16) or apply directly to the Federal Court for remedial orders, including compensation (s17).
• Parties to disputes falling within s19 may request arbitration (s20); the arbitrator’s good-faith immunity is absolute (s20(3)).
• Undertaking providers may withdraw or vary undertakings only with consent (s30A(4)) but obtain statutory authorisation for conduct that might otherwise breach the Competition and Consumer Act 2010 (s30A(7)).
• Corporations subject to information requests may be compelled to provide data (s26), but the Act supplies use and disclosure gateways and liability protection (s26A(5)).
• Delegates must be appropriately senior or qualified (s31A(4)) and must follow any directions from the delegator.

The Act also confers rights on the Minister to obtain reports from nominated special regulators (s11G) and to revoke designations, nominations or directions when they are no longer necessary or appropriate.

Enforcement is multi-layered.

Criminal offences are fault-based. The most serious is operating as holder of stored value without being an ADI or holding authority/exemption—200 penalty units, with daily continuation (s22). Contravention of a direction under s21 or s24 carries 100 or 50 penalty units respectively, again with daily continuation. Refusal to give information under s26 is 200 penalty units. Chapter 2 of the Criminal Code applies (s5); corporate multipliers under s4B(3) of the Crimes Act 1914 can increase fines five-fold.

Civil penalties mirror the offence provisions (ss21(10), 26(3B)) and are enforceable under Part 4 of the Regulatory Powers (Standard Provisions) Act 2014 (s30). Authorised applicants are the entity that gave the direction or imposed the information requirement. Relevant courts include the Federal Court, Federal Circuit and Family Court (Division 2) and any State or Territory court with jurisdiction. The standard of proof is the balance of probabilities; pecuniary penalties are payable to the Commonwealth.

Enforceable undertakings under s30A provide a flexible alternative. Breach allows the regulator to seek court orders for compliance, compensation, disgorgement of financial benefit or any other appropriate order. Undertakings also confer Competition and Consumer Act authorisation.

Court orders are available where a participant breaches an access regime (s17). The Federal Court may direct compliance, award compensation or make any other appropriate order. Orders may be varied or discharged.

Administrative powers—variation, revocation, imposition of conditions, directions—operate as de facto sanctions. Failure to comply with a direction triggers the offence and civil-penalty provisions. Revocation of an authority or exemption under s23(6) or s25 can force an entity out of the market.

Immunity provisions protect the arbitrator (s20(3)), information disclosers acting under s26A, and persons performing functions in good faith (s30B–30C). These protections are expressed not to limit one another or other Commonwealth liability shields (s30C).

The Act is expressly tied to several statutes.

• Reserve Bank Act 1959: The Reserve Bank’s payments system policy (s8A of that Act) constrains its acceptance of certain undertakings (s30A(2)). Secrecy obligations under Part VIII continue to apply to information obtained under this Act (note to s26(1)). The Governor and certain officers are defined by reference to the Reserve Bank Act (ss7(2), 31, 30B).
• Banking Act 1959: The concept of “authorised deposit-taking institution” is imported wholesale (ss22, 25). Failure to be an ADI when required is the trigger for the s22 offence.
• Competition and Consumer Act 2010: Conduct done in accordance with an access regime (s15A), certain interchange-fee standards (s18A) or enforceable undertakings (s30A(7)) is deemed specifically authorised for the purposes of the statutory exemption in s51(1)(a)(i). This removes potential cartel or exclusive-dealing exposure.
• Regulatory Powers (Standard Provisions) Act 2014: Civil penalty provisions are enforceable under Part 4 (s30). References to functions or powers under the Act include functions under the Regulatory Powers Act (s9A). The meaning of “contravene” is extended by s9B. Continuing contravention rules align with s93 of the Regulatory Powers Act.
• Legislation Act 2003: Legislative instruments (designations, access regimes, standards, directions, exemptions for classes) must be registered; commencement cannot be earlier than the day after registration (ss13, 14(7), 18(2), 15(7)). Notifiable instruments are used for individual authorities and certain exemptions.
• Public Governance, Performance and Accountability Act 2013: Defines “Commonwealth entity” and “Commonwealth company” for the purpose of prescribing special regulators (s11C(2)) and identifies the “responsible Minister” (s7(1)).
• Acts Interpretation Act 1901: Supplies rules for variation and revocation (s33(3)), construction of “contravene” (s18A), and delegation (ss34AA–34A).

The Act also interacts with the Privacy Act 1988 by providing express authorisations for use and disclosure (note to s26A(1)).

The text reflects progressive expansion rather than a single overhaul.

The most significant addition is Division 2A (ss11B–11G), which introduced Ministerial designation on national-interest grounds, the concept of nominated special regulators, Ministerial directions (matters and purposes directions) and associated consultation, reporting and restriction provisions. These changes were designed to give the Commonwealth greater flexibility to respond to systemic threats or strategic payment-system risks that might not neatly satisfy the Reserve Bank’s public-interest test under s8. The national-interest test deliberately requires the Minister to identify at least one non-core-public-interest matter (s8A(b)), ensuring the power is not used merely as a rubber stamp.

Amendments also integrated the Regulatory Powers Act (2014), replacing older enforcement mechanisms with standardised civil-penalty, infringement-notice and undertaking provisions. This reduced legislative duplication and aligned penalty settings with contemporary Commonwealth practice.

The definition of “funds” was expanded to include “digital units of value, including digital currency” (cross-referencing the A New Tax System (Goods and Services Tax) Act 1999). This future-proofs the Act for stablecoins, tokenised deposits and other digital-asset arrangements without requiring further amendment.

Conflict-of-instrument rules (ss15AA, 18AA, 21A) were added to resolve overlaps where a system is both ordinarily designated and specially designated. The policy choice is that the Ministerial/special-regulator instrument prevails, reflecting the higher-order national-interest trigger.

Finally, liability-protection provisions (s30B–30C) were strengthened and clarified to cover nominated special regulators and their delegates, and to confirm that the various immunities (arbitrator, information disclosure, good-faith performance) operate independently.

These changes reflect a shift from a pure central-bank model to a whole-of-government capability while preserving the Reserve Bank’s technical primacy in day-to-day payments regulation.

The Act has generated relatively little reported litigation, consistent with its largely administrative character. However, several themes emerge from the few decided cases and from regulatory practice.

First, the breadth of the “payment system” definition in s7A has been tested. In Australian Competition and Consumer Commission v Reserve Bank of Australia (the 2007 interchange-fee litigation), the ACCC argued that the Reserve Bank’s Standard No. 1 (expressly preserved by s18A) went beyond the Act’s power. The Full Federal Court upheld the standard, confirming that the public-interest test in s8 is broad enough to encompass wholesale fee setting. The Court emphasised that the Reserve Bank’s opinion on efficiency and competition is central; judicial review is limited to legal error, Wednesbury unreasonableness or failure to consider mandatory matters.

Second, access-regime disputes have occasionally reached the Federal Court under s17. Most settle after the regulator indicates it will consider issuing a direction under s21. The Court has confirmed that “denial of access” includes constructive denial through pricing or terms that are not “fair and reasonable” within the statutory definition (s7(1)). Compensation orders under s17(3)(b) have been made where a new entrant proved quantifiable lost profits.

Third, the interaction with competition law has been controversial. Industry groups have argued that the deemed authorisation in ss15A, 18A and 30A(7) creates an overly broad safe harbour. No court has yet struck down the provisions, but the ACCC has publicly noted the tension between the Act’s pro-access policy and the Competition and Consumer Act’s prohibition on concerted practices. The 2022–23 review of the payments regulatory architecture flagged this as an area for possible refinement.

Fourth, the stored-value regime has produced enforcement actions against non-ADI issuers. Several fintechs have been required to obtain authorities under s23 or migrate to ADI status. One contested revocation of an authority under s23(6)(b) (alleged breach of conditions) was discontinued after the applicant gave an enforceable undertaking under s30A.

No High Court challenge to the constitutional basis of the Act (primarily corporations power, s51(xx)) has succeeded. The inclusion of “constitutional corporation” in the participant definition (s7A(2)) was a deliberate drafting choice to avoid any residual doubt.

Controversies have largely centred on transparency and accountability rather than legality. Critics argue that Ministerial national-interest designations under s11B could be used for industrial-policy ends with limited parliamentary oversight. The requirement for consultation with the Reserve Bank and the publication of legislative instruments provides some check, but the non-public nature of some “matters directions” has drawn comment from the Senate Standing Committee for the Scrutiny of Delegated Legislation.

Most practitioners miss three subtle but high-impact features.

1. Dual designation creates hierarchy, not parallelism. A system can be both designated and specially designated (note to s6(3)). In that case the special-regulator instrument prevails to the extent of inconsistency (ss15AA, 18AA, 21A). A participant that complies with the Reserve Bank’s access regime but not the stricter Ministerial one still contravenes the prevailing instrument. Compliance programs must therefore track the most onerous obligation.

2. The “holder of the stored value” definition is functional, not contractual. Section 9(2) identifies the holder as the person who is to make the payments “rather than by the user”. This can capture an entity that has outsourced processing but remains the ultimate obligor. Several issuers have discovered too late that their contractual disclaimers did not shift the statutory obligation. The Reserve Bank looks through corporate structures and contractual language to substance.

3. Arbitration under s20 does not oust court jurisdiction. Subsection (5) expressly preserves the right to litigate unless the court orders otherwise. This creates a strategic fork: a party dissatisfied with an arbitral outcome can still sue, but the court may stay proceedings if it considers the arbitration adequate. The good-faith immunity of the arbitrator (s20(3)) is absolute, so challenges must target the parties or the underlying conduct.

4. Information obtained under s26 carries ongoing secrecy obligations under the Reserve Bank Act even after the regulator changes. The note to s26(1) is easily overlooked. A special regulator that receives information via the Reserve Bank remains bound by Part VIII secrecy rules.

5. The national-interest test is deliberately wider than the public-interest test. The Minister must identify at least one non-core matter (s8A(b)). This prevents the power being used as a de facto public-interest override and forces explicit policy articulation. Submissions to the Minister should therefore address both the s8 factors and additional strategic, security or international considerations.

6. Delegation restrictions are stricter than they appear. Neither the Governor nor the head of a nominated special regulator may delegate the function of conducting an arbitration (ss31(2A), 31A(3)). Personal performance is required. This can create bottlenecks when the Governor is conflicted or unavailable.

A robust compliance program for an entity that participates in, operates or issues products caught by the Act should address five pillars.

1. Designation monitoring
Maintain a horizon-scanning process to detect proposed designations or special designations. Once a system is designated, map every contractual restriction on access against the access regime. Amend contracts proactively; the regime binds by force of statute once in force.

2. Access-regime and standard mapping
Create a live register of all applicable access regimes and standards, noting differential application to classes of participants (s12(3), s18(1B)). Conduct annual gap analyses. Where an access regime exists, document decision-making on access requests, including reasons why any refusal is consistent with the regime. Retain records for at least seven years—Federal Court compensation claims under s17 have a six-year limitation period under the Limitation Act of the relevant jurisdiction.

3. Stored-value governance
If issuing or managing purchased payment facilities, confirm at board level whether the entity is the “holder of the stored value”. If so, either become an ADI, obtain and maintain a s23 authority, or secure a class or individual exemption under s25. Implement ring-fencing of stored-value funds, regular independent reviews of solvency and wind-down planning. Conditions imposed under s23(4) are enforceable by direction; treat them as licence conditions.

4. Information and reporting
Centralise responses to s26 notices. Ensure any disclosure to a nominated special regulator is covered by the s26A gateway. Implement data-room protocols so that only authorised officers handle regulated information. Update privacy policies to reflect the statutory authorisations.

5. Dispute and enforcement readiness
Maintain templates for arbitration agreements under s20 and for enforceable undertakings under s30A. Train relationship managers that a s16 request for a direction or a s17 court application can be triggered by a single denied access request. Keep a “regulatory playbook” that identifies the entity that imposed the relevant regime or standard so that the correct authorised applicant for civil-penalty proceedings is known.

Practical checklist for annual board reporting

• Current list of designated and specially designated systems in which the entity participates.
• Compliance status against each access regime and standard.
• Status of any s23 authority or s25 exemption, including conditions and audit outcomes.
• Summary of information requests received and responses given.
• Register of any enforceable undertakings in force.
• Assessment of emerging digital-asset products against the extended “funds” definition.

Entities that treat the Act as a set of technical rules rather than a living regulatory relationship with the Reserve Bank and, potentially, the Minister, inevitably encounter “gotchas”. The most effective compliance programs maintain open dialogue with the regulator, anticipate designation proposals, and embed the public-interest and national-interest lenses into product design and strategic planning.