Payment Systems (Regulation) Regulations 2006

There are a small number of recurring legal devices in the Regulations: incorporation by reference, specification of roles and categories, authorisation under another statute, and declaratory prescription of immunity and information‑use rights. Each is used narrowly and by reference to other Commonwealth legislation.

Incorporation by reference appears in s 5 and s 6. Section 5 specifies that two Reserve Bank standards, Standard No. 1 of 2016 and Standard No. 2 of 2016, are the standards to be used for the specific purpose identified in paragraph 18A(2)(b) of the Payment Systems (Regulation) Act 1998. The standards are identified by name and the date on which the Reserve Bank determined them. The Regulations do not reproduce the standards. Section 6 similarly designates "anything that is done in accordance with the Access Regime for the ATM System, imposed by the Reserve Bank on 3 March 2009" as specified and specifically authorised for the purposes of subparagraph 51(1)(a)(ii) of the Competition and Consumer Act 2010. Both devices mean that obligations, permissions or authorisations under the Act or the Competition and Consumer Act will be tied to the content of separate Reserve Bank instruments.

Prescription of institutional roles is the major content of ss 7-9. The Regulations use tabular schedules to: (a) prescribe which entities count as "special regulators" under the Act and which person is the head of each special regulator, and which categories of persons may be eligible delegates in relation to a nominated special regulator (s 7); (b) prescribe which persons within a nominated special regulator are authorised to use or disclose information (s 8); and (c) prescribe which persons within a nominated special regulator are protected from civil liability (s 9). The tables cross‑refer to definitions and personnel categories in other statutes. For example, the ACCC entries repeatedly reference a "member of the Commission (within the meaning of the Competition and Consumer Act 2010)" (ss 7 and 8 and 9 tables). APRA entries reference members and staff under the Australian Prudential Regulation Authority Act 1998. ASIC entries reference members and staff under the Australian Securities and Investments Commission Act 2001. AUSTRAC entries reference the definition of AUSTRAC and "AUSTRAC entrusted person" in the Anti‑Money Laundering and Counter‑Terrorism Financing Act 2006 (s 4 defines AUSTRAC by reference).

The Regulations create asymmetries between the regulators. The ACCC, APRA, ASIC and AUSTRAC are all prescribed as special regulators in s 7. However the specific persons who may be eligible delegates, authorised to use or disclose information, or protected from civil liability differ across regulators. For example, the APRA entries in s 8 exclude the Chair of APRA from the prescribed authorised persons list, while s 7 prescribes the Chair of APRA as the head of APRA. AUSTRAC entries are tied to the statutory concept of an "AUSTRAC entrusted person", subject to specified exceptions.

The Regulations tie their prescriptions to particular paragraphs in the Act. They operate only to the extent the Act makes a regulatory question contingent on such prescriptions, for example paragraph 18A(2)(b), paragraph 26A(4)(d) and paragraph 30B(4)(d).

Finally, the Regulations include an express authorisation under the Competition and Consumer Act 2010 for conduct under the RBA ATM Access Regime (s 6). That authorisation is narrow, applying "for subparagraph 51(1)(a)(ii) of the Competition and Consumer Act 2010" and limited to "anything that is done in accordance with the Access Regime for the ATM System, imposed by the Reserve Bank on 3 March 2009" (s 6).

Practitioners should be attentive to how these devices mean that the practical content of regulatory duties and permissions sits largely outside the Regulations themselves, in the Reserve Bank standards and the ATM Access Regime, and in definitions and personnel categories in other Commonwealth Acts.

The Regulations identify a set of institutions and categories of individuals who are directly affected for specified purposes under the Payment Systems (Regulation) Act 1998 and cross‑referenced provisions in other legislation. The primary institutional actors named are the Australian Competition and Consumer Commission (the Commission or ACCC), the Australian Prudential Regulation Authority (APRA), the Australian Securities and Investments Commission (ASIC) and AUSTRAC (s 7 table). The Reserve Bank of Australia also features indirectly as the author or determiner of standards and regimes that are incorporated by reference (ss 5-6).

From a practical standpoint, the following classes of actor are affected:

• Card schemes, card issuers, merchants and participants in the designated card schemes addressed by the Reserve Bank standards. Section 5 specifies Standard No. 1 of 2016 (designated credit card schemes) and Standard No. 2 of 2016 (designated debit and prepaid card schemes) as the standards for paragraph 18A(2)(b) of the Act. Entities in those schemes will be affected because the standards form part of the regulatory framework referred to by the Act. The Regulations do not state the contents of those standards, but they make those standards the operative references.

• Operators and participants in the ATM system. Section 6 specifies that conduct done in accordance with the Reserve Bank's Access Regime for the ATM System (imposed on 3 March 2009) is specifically authorised under subparagraph 51(1)(a)(ii) of the Competition and Consumer Act 2010. Any person whose conduct is governed by that Access Regime will be affected insofar as the Access Regime's requirements and permissions are given statutory authorisation under the Competition and Consumer Act through this Regulation.

• Employees, delegates and office‑holders within the ACCC, APRA, ASIC and AUSTRAC. Sections 7-9 identify which office‑holders are treated as heads, eligible delegates, persons authorised to use or disclose information, and persons protected from civil liability. The categories include members of commissions or boards, associate members, Chairpersons, SES employees or acting SES employees, senior staff, and specific categories of AUSTRAC entrusted persons (ss 7-9 tables). Those individuals are affected because the Act conditions functions, information‑use rights and civil liability protections on being within the prescribed classes.

• The Reserve Bank, insofar as its standards and regimes (the 2016 interchange fee standards and the 2009 ATM Access Regime) are incorporated. The Regulations make the content of those external instruments consequential for the Act's operation.

• Counsel, compliance officers and records staff in the prescribed regulators and in private entities interacting with the designated payment systems. Those roles will need to map internal positions against the prescribed categories before relying on the information‑use or immunity provisions in ss 8-9.

The Regulations also affect the allocation of decision rights and legal risk. By prescribing heads and eligible delegates (s 7), the text defines who may exercise statutory functions delegated under the Act. By prescribing persons authorised to use or disclose information (s 8) and persons protected from civil liability (s 9) for nominated special regulators, the Regulations change who may lawfully handle payment system information for specific statutory purposes and who may rely on immunity from civil suits under the Act. Those legal effects matter to institutions that might be subject to compulsory information requests, to regulators that may be designated as nominated special regulators, and to individuals who handle or receive confidential material.

Finally, the Regulations affect the need for each regulated party to consult external instruments. Because s 5 and s 6 operate by reference, entities in relevant payment systems must obtain and comply with the Reserve Bank standards and the ATM Access Regime if they wish to know their practical obligations and entitlements under the Act as linked by these Regulations.

The Regulations do not create broad new duties on private firms directly in their text. Instead they instantiate duties and rights that are defined in other instruments and Acts by specifying which external standards apply, which conduct is authorised, and which persons within prescribed regulators have particular powers, access and immunities.

Incorporated standards and authorisations create duties for participants in card schemes and the ATM system. Section 5 makes Reserve Bank Standard No. 1 of 2016 and Standard No. 2 of 2016 the specified standards for paragraph 18A(2)(b) of the Payment Systems (Regulation) Act 1998. Whatever duties and rights the Act and paragraph 18A(2)(b) create will be operationalised using those specified Reserve Bank standards. Practitioners should therefore read paragraph 18A(2)(b) of the Act in combination with s 5 and with the two Reserve Bank standards in order to know the substantive duties or limits that will apply to participants in designated card schemes. The Regulations themselves do not restate the substantive content of those duties or limits.

Section 6 authorises, for the purposes of subparagraph 51(1)(a)(ii) of the Competition and Consumer Act 2010, any conduct that complies with the Reserve Bank’s Access Regime for the ATM System imposed on 3 March 2009. The legal mechanism is an express specification and authorisation. That means that parties who act in accordance with the Access Regime will have that conduct recognised as specified and authorised under the Competition and Consumer Act provision cited. The Competition and Consumer Act provision cited concerns authorisations for conduct that may otherwise engage competition law restrictions, so s 6 effectively ties a Reserve Bank technical access regime to a competition law authorisation. The Regulations include a note directing users to the RBA website for an electronic version of the Access Regime.

Sections 7-9 create legal rights and limits applicable to regulators and their staff. Section 7 prescribes which entities are special regulators, who is the head of each special regulator, and which categories of persons are eligible delegates in relation to a nominated special regulator (s 7). The practical legal effect is that where the Act permits a special regulator to exercise functions, or permits delegation to eligible delegates, the persons and offices identified in s 7 will be the ones who can validly take those actions. For example, s 7 prescribes the Chairperson of the Commission as the head of the ACCC, and prescribes members of the Commission and certain SES employees or equivalent positions as eligible delegates.

Section 8 prescribes, for each nominated special regulator, the persons who are authorised to use or disclose information for the purposes of paragraph 26A(4)(d) of the Act. The permitted classes differ by regulator. For the ACCC, the list is broad and includes members, associate members and persons engaged under particular sections of the Competition and Consumer Act 2010. For APRA, the list includes APRA members other than the Chair, and APRA staff members. For ASIC, the list includes ASIC members and staff. For AUSTRAC, the list is an "AUSTRAC entrusted person" as defined in the AML/CTF Act. The right to use or disclose information is thus tied to being within a prescribed class.

Section 9 prescribes, for each nominated special regulator, persons who are protected from civil liability for the purposes of paragraph 30B(4)(d) of the Act. The lists in s 9 mirror s 8 in structure and in several particulars, but they are not word‑for‑word identical in all respects. The practical legal consequence is that persons within the prescribed classes can claim statutory protection from civil liability in the situations covered by paragraph 30B(4)(d) of the Act.

Two further features are relevant to duties and rights. First, the Regulations rely heavily on definitions and personnel categories in other Acts. For instance, the AUSTRAC entries use the AML/CTF Act definition of "AUSTRAC entrusted person" (s 4 defines AUSTRAC with reference to the AML/CTF Act). That means that a change in those other Acts changes who falls within the prescribed classes here. Second, the Regulations do not quantify or set procedural standards for exercising delegated powers, using or disclosing information, or obtaining immunity. The Act provisions to which they refer will set those procedural requirements. In practice, a person or regulator must satisfy the Act's preconditions and then confirm their status against the categories in the Regulations to determine whether they have the right to act and whether they will be protected from civil liability.

The Regulations themselves do not create or specify new monetary penalties, criminal offences, or explicit enforcement mechanisms in their text. Their function is enabling and prescriptive, and enforcement will typically be through the primary Acts and the external standards or regimes they incorporate.

There are three enforcement‑related observations grounded in the Regulations' text. First, the authorisation in s 6 operates by reference to subparagraph 51(1)(a)(ii) of the Competition and Consumer Act 2010. That provision in the Competition and Consumer Act concerns authorisations for conduct otherwise restricted under Part IV of that Act. The Regulation’s effect is to specify that conduct complying with the Reserve Bank’s ATM Access Regime is authorised for the purposes of that competition law provision. Enforcement in that area will therefore depend on the competition law framework and on whether conduct complies with the Access Regime; specifically, disputes about whether conduct falls within the Access Regime will determine whether the s 6 authorisation applies.

Second, ss 8 and 9 create conditions under which particular persons may use or disclose information and may be protected from civil liability under provisions of the Act (paragraphs 26A(4)(d) and 30B(4)(d) respectively). The Regulations do not themselves create civil liability or immunity, rather they identify which persons fall within the statutory categories that attract those rights. Enforcement of any prohibition on unlawful disclosure or of causes of action for misuse of information will depend on the Act, and on any relevant civil remedies, criminal offences, administrative sanctions, or professional disciplinary regimes that are established elsewhere.

Third, s 5 attaches the Reserve Bank standards to a provision of the Act. Compliance with those standards will be enforced pursuant to the Act and the Reserve Bank’s supervisory powers where relevant. The Regulations do not set penalties for breach of the encapsulated standards; instead, any sanctioning role arises from the Act or from the powers given to the Reserve Bank or other statutory bodies.

Practically, the Regulations create areas where legal uncertainty and disputes will be resolved by reference to other instruments. When enforcement is contemplated , for example by a regulator seeking to rely on a civil immunity or by a private party seeking to challenge conduct authorised under s 6 , the court or tribunal will need to consider the interplay between the Act, the Regulations’ prescriptions and the external, incorporated documents. The Regulations do not provide administrative enforcement machinery, they allocate legal character to certain documents and persons which then triggers enforcement rights and duties under other laws.

The Regulations are a connective instrument. They interact with several named statutes and with external Reserve Bank instruments, by specifying standards, authorising conduct under other statutory schemes and by referencing personnel definitions in other legislation.

Key statutory cross‑references in the text are:

• The Payment Systems (Regulation) Act 1998, referenced throughout as "the Act". The Regulations exist under that Act and repeatedly refer to specific paragraphs in it, for example paragraph 18A(2)(b) (s 5), paragraph 11C(1)(b), paragraph 7(2)(b), paragraph 31A(1)(b) and subsection 31A(2) (s 7), paragraph 26A(4)(d) (s 8) and paragraph 30B(4)(d) (s 9).

• The Competition and Consumer Act 2010. Section 6 of the Regulations operates for the purposes of subparagraph 51(1)(a)(ii) of that Act, expressly specifying as authorised anything done in accordance with the Reserve Bank’s Access Regime for the ATM System.

• The Anti‑Money Laundering and Counter‑Terrorism Financing Act 2006 (AML/CTF Act). The Regulations adopt AUSTRAC as defined in the AML/CTF Act (s 4), and several provisions in the tables reference the statutory concept of an "AUSTRAC entrusted person" defined in s 5 of the AML/CTF Act. The AUSTRAC entries in ss 7-9 therefore import the AML/CTF Act’s personnel structure and definitions.

• The Australian Prudential Regulation Authority Act 1998 and the Australian Securities and Investments Commission Act 2001. The APRA and ASIC entries in ss 7-9 reference personnel categories such as APRA members and APRA staff members under the APRA Act, and ASIC members and staff under the ASIC Act.

• The Reserve Bank's own instruments. Section 5 incorporates Reserve Bank standards by name and date. Section 6 incorporates the Reserve Bank’s Access Regime for the ATM System by date. Those Reserve Bank instruments sit outside the Regulations but are made operative for specified legal purposes by reference in the Regulations.

The interaction occurs in three concrete ways. First, the Regulations make the content of external Reserve Bank instruments legally consequential under specified paragraphs of the Payment Systems Act. For example, the two interchange fee standards are specified for paragraph 18A(2)(b), meaning that the substantive effect of that paragraph will be determined using those standards. Second, the Regulations supply legal recognition under the Competition and Consumer Act for conduct that complies with the RBA’s ATM Access Regime. That recognition interacts with competition law by effectively immunising or authorising specified conduct if it complies with the Access Regime. Third, the Regulations rely on personnel definitions in other Acts to determine who may exercise statutory functions, who may use or disclose information, and who may be protected from civil liability. Because those personnel definitions are drawn from other statutes, any change to those definitions in the originating Acts will alter the scope of persons captured by ss 7-9.

Because the Regulations repeatedly cross‑refer to other Acts and to Reserve Bank instruments, practitioners must consult all referenced instruments in combination to understand the total legal effect. The Regulations provide the linking declarations; the substantive legal duties, prohibitions, protections and enforcement mechanisms are in the primary Acts and the Reserve Bank instruments they incorporate.

The instrument identifies itself as the Payment Systems (Regulation) Regulations 2006 (s 1). Within the text, the Regulations reference external instruments dated later than 2006, specifically Reserve Bank standards determined on 26 May 2016 (s 5) and an Access Regime imposed by the Reserve Bank on 3 March 2009 (s 6). The Regulations as presented do not include an internal schedule of amendments, commencement dates for the specific provisions listed, or an express consolidated amendment history within their text.

The text therefore reflects at least two later incorporations by the executive or by legislative instrumenting practice: the naming in s 5 of the 2016 Reserve Bank standards and the s 6 reference to the 2009 Access Regime. The presence of those later‑dated materials in a Regulations instrument called 2006 implies that the Regulations were, at some point after 2006, modified or updated to incorporate later RBA instruments. The Regulations text itself does not publish the dates of any amending instruments, or the legislative instruments that effected those changes. It also does not specify whether the prescriptions in ss 7-9 are the original 2006 text or are the result of later amendments.

For practical purposes, a user of these Regulations must therefore consult the official legislative database or the Federal Register of Legislation to obtain the formal amendment history and the dates on which each provision took effect. The Regulations as provided to you do not contain that metadata. Because the Regulations rely on definitions and personnel categories in other Acts and on external Reserve Bank instruments, changes in those other instruments or Acts could alter the effect of these Regulations without changes in the Regulations themselves.

If precise historical timing matters, for example to determine which version of an incorporated Reserve Bank standard applied at a given time, that inquiry must be conducted against the Reserve Bank’s instrument record and against the legislative amendment record. The Regulations as supplied name the specific Reserve Bank standards and the date the Reserve Bank determined them (26 May 2016 for both interchange fee standards), and they name the date on which the ATM Access Regime was imposed (3 March 2009), but they do not provide a legislative amendment trail for when those items were incorporated into the Regulations.

The Regulations do not record any litigation history in their text. No cases, judgments or tribunal decisions are cited or reproduced in the instrument. The only references are to other statutes and to Reserve Bank instruments. Therefore the Regulations themselves do not disclose whether any court or tribunal has considered their operation, the operation of the Reserve Bank standards they incorporate, or the Access Regime they authorise.

From a practitioner’s perspective, this absence in the instrument requires external research to discover whether any litigation has interpreted:

• the Reserve Bank’s interchange fee standards (Standard No. 1 of 2016 and Standard No. 2 of 2016) in the context of the Payment Systems Act or in private disputes,

• the Reserve Bank’s Access Regime for the ATM System (3 March 2009) in relation to competition law questions (subparagraph 51(1)(a)(ii) of the Competition and Consumer Act 2010), or

• the scope of the information‑use authorisations and civil liability protections that ss 8 and 9 describe when applied by nominated special regulators under the Act.

Because the Regulations themselves generate legal status for certain external documents, any litigation that challenges the content of those external documents, or the lawfulness of actions taken under them, will necessarily involve the primary instruments rather than the Regulations as the locus of substantive legal content. That said, courts may be asked to interpret the Regulations’ prescriptions , for example, the meaning of "eligible delegate" as used in s 7 or the interplay between the Regulations’ prescriptions and the procedural preconditions in the Act , but the Regulations as written give no internal account of any such adjudications.

If litigation history is material to an analysis or advice, the user must search case law databases and tribunal decisions for matters citing the Payment Systems (Regulation) Regulations 2006, the relevant sections of the Payment Systems (Regulation) Act 1998, the Reserve Bank standards named in s 5, and the Access Regime named in s 6. The Regulations themselves do not supply that judicial context.

The Regulations are compact, but their design creates specific practical pitfalls that a practitioner should check before relying on them.

1. Incorporation by reference creates an externality risk. Sections 5 and 6 do not reproduce the Reserve Bank standards or the ATM Access Regime. Anyone relying on the legal status created by these Regulations must obtain and read the full text of Standard No. 1 of 2016, Standard No. 2 of 2016 and the 3 March 2009 Access Regime. The Regulations provide the names and dates but not the content. Failure to consult the external documents will leave a practitioner unaware of operative obligations or the scope of authorisation. The Regulations include a note with a URL for the Access Regime; there is no text in the Regulations furnishing the content of the standards.

2. Differences between authorised users and immunity recipients are subtle and regulator‑specific. The persons authorised to use or disclose information under s 8 and the persons protected from civil liability under s 9 are listed in parallel tables, but they are not identical across regulators. For instance, the APRA entry in s 8 expressly excludes the Chair of APRA from the list of prescribed authorised persons (see s 8 table, APRA item), while s 7 prescribes the Chair of APRA as the head of the special regulator. Practitioners should not assume the head of a regulator automatically appears in the authorised users list or in the immunity list. Each table should be read carefully and cross‑checked with the definitions in the other Acts the tables reference.

3. Reliance on personnel categories depends on external statutory definitions. The AUSTRAC entries in ss 7-9 depend on the AML/CTF Act definition of "AUSTRAC entrusted person" and exclude some paragraphs of that definition in s 7. That means an individual’s status under these Regulations can change if the AML/CTF Act’s definitions change, including by amendment or reinterpretation by a court. The Regulations themselves do not freeze those external definitions.

4. Delegation and eligible delegate categories have exceptions. The categories of eligible delegates for APRA and AUSTRAC exclude certain consultant or contractor positions engaged under specific sections of those Acts. For example, APRA eligible delegates are APRA staff members "other than a person engaged under section 47 of that Act" (see s 7 table for APRA). Practitioners must verify whether an individual is engaged as a staff member or under a specific engagement clause before assuming eligibility.

5. The authorisation under competition law is narrow. Section 6 authorises only "anything that is done in accordance with the Access Regime for the ATM System" for the purposes of subparagraph 51(1)(a)(ii) of the Competition and Consumer Act 2010. It does not purport to give blanket protection for conduct outside that regime. Parties should not assume a broad competition law exemption exists merely because the Access Regime is referenced; compliance with the regime’s terms will be the determinative condition.

6. No procedural specs for information handling are contained in the Regulations. Sections 8 and 9 identify who may use or disclose information and who is protected from civil liability, but they do not set procedures for how information is to be requested, stored, disclosed, or protected. The Act’s provisions likely set procedural safeguards; the Regulations do not, which can create operational uncertainty for regulated entities and nominated special regulators.

7. The Regulations do not state commencement of particular inclusions or provide an amendment ledger. The Regulations name a 2006 instrument but incorporate documents dated 2009 and 2016. Practitioners should not assume these references are contemporaneous with the Regulations’ enactment. Always confirm the current text and history from the official legislative database.

8. The Regulations supply labels but not the substantive statutory thresholds. For example, being an "eligible delegate" is necessary for delegations under the Act, but the Act will set the conditions under which delegations are permitted. The Regulations do not alter or add to the Act’s substantive standards, they only say who counts for delegated exercise.

In short, treat these Regulations as a map of where operative norms sit rather than as the operative norms themselves. The real obligations, permissions and procedural rules are in the Act and in the Reserve Bank material the Regulations incorporate by reference.

Compliance with the legal effects produced by these Regulations requires actions directed at two types of item: (a) the external instruments they incorporate or authorise, and (b) the personnel and governance mappings they create. Steps below follow directly from the text.

1. Obtain and read the incorporated Reserve Bank instruments. Section 5 specifies Standard No. 1 of 2016 and Standard No. 2 of 2016 as the standards for paragraph 18A(2)(b) of the Act. Section 6 specifies the Access Regime for the ATM System imposed by the Reserve Bank on 3 March 2009. Compliance with the Act as linked by these Regulations therefore requires a full review of those RBA instruments. Make sure to check the exact versions named (dates are provided in the Regulations), because the Regulations link to specific determinations.

2. Map internal roles to the prescribed classes in ss 7-9. Each regulator’s table lists who is the head, who may be an eligible delegate, who is authorised to use or disclose information, and who is protected from civil liability. Organisations that will interact with nominated special regulators should:

   • Identify whether a regulator has been nominated as a "nominated special regulator" in relation to any special designated payment system, because ss 8-9 apply in that contingent circumstance.

   • Map each internal role against the statutory categories used in the Regulations (for example, "member of the Commission", "APRA staff member", "an AUSTRAC entrusted person") and verify those roles against the definitions in the source Acts (Competition and Consumer Act, APRA Act, ASIC Act, AML/CTF Act).

   • Check exclusion clauses in the tables. For example, APRA’s authorised persons list expressly excludes the Chair of APRA in s 8, while the Chair is the head under s 7; consult both tables carefully.

3. Document delegations and authorisations. If a regulator proposes to rely on delegated powers under the Act, verify that the delegate is within the eligible delegate categories in s 7. Create formal delegation instruments that reference the relevant Act provision and the Regulations’ prescription, and retain records showing the delegate’s status at the time of delegation.

4. Prepare information‑handling protocols. For nominated special regulators, only prescribed persons may use or disclose information under paragraph 26A(4)(d) (s 8). Draft or amend internal policies to:

   • Limit access to payment‑system information to the listed classes.

   • Record the statutory basis for disclosure or use by referencing the Act and the Regulations’ table.

   • Implement checklists to confirm the recipient is within the prescribed class at the time of disclosure.

5. Review civil liability protections before relying on them. Section 9 prescribes which persons are protected from civil liability for the purposes of paragraph 30B(4)(d) of the Act. Before an officer relies on that protection when deciding to disclose information or to act pursuant to a delegated power, confirm in writing that the act is within the statutory circumstances that give rise to the immunity, and that the person is categorically captured by s 9.

6. Coordinate with the Reserve Bank and primary regulator where appropriate. Because the substantive content in ss 5-6 is in Reserve Bank instruments, regulated entities should engage with the Reserve Bank where interpretation or clarification of standards is needed. Also, check whether the relevant special regulator has issued guidance about how it will apply its powers, delegate functions or handle disclosures under the Act.

7. Keep an amendment watch. Because the Regulations rely on external Acts for personnel definitions and on Reserve Bank instruments for substantive content, maintain systems to monitor amendments to the APRA Act, ASIC Act, Competition and Consumer Act, AML/CTF Act and the named Reserve Bank instruments. Changes in those sources will affect who is captured by the Regulations and what the operational rules are.

8. Legal audit and training. Conduct an initial legal audit mapping every instance where the organisation receives or discloses payment‑system‑related information or relies on delegated functions. Provide role‑specific training for persons listed in ss 7-9 so that they understand the limits of their authorisations and the conditions attached to the civil liability protections.

9. Records and provenance. Given that ss 5-6 rely on external instruments, maintain versioned copies of the Reserve Bank standards and the ATM Access Regime, and record the specific version relied upon in any decision memorandum that invokes these Regulations. This will be important if a dispute arises about which version of an external instrument was in force at the time of the conduct.

10. Seek legal advice for edge cases. If there is any doubt about whether an individual is an "AUSTRAC entrusted person" as used in the tables, whether conduct complies with the Access Regime for the ATM System, or whether an action falls under paragraph 18A(2)(b) read with Standard No. 1 or No. 2 of 2016, obtain advice and contemporaneous records. The Regulations create entitlement by classification and by reference; classification disputes and interpretation of the referenced instruments will be the common sources of uncertainty.

Following these steps aligns an organisation’s practices with the mechanistic effects of the Regulations: they make specific documents operative and they designate which persons within specified regulators can perform certain acts and be shielded from civil liability. The substance of duties, protections and authorisations remains in the Act and in the Reserve Bank documents the Regulations reference, so compliance requires attention to those external texts.