Security Industry Regulation 2016

The Regulation primarily affects three groups.

First, individual security operatives. Any person who carries on a “security activity” listed in s 4(1) of the Act or prescribed by cl 5 (manipulation of security equipment, locksmithing, sale/installation/advice on security equipment) must hold a class 1 or class 2 licence (cl 12(1)). Class 2E is now the vehicle for private investigators following the 2016 amendments. Holders must comply with notification obligations (cll 18, 19), fingerprint conditions (cl 24), uniform requirements (cl 40(5)), and sign-on register duties (cl 35(3)).

Second, master licensees (companies and individuals). Any person or corporation that provides others to carry on security activities, or carries on such activities on their own behalf, requires a master licence (classes MA–ME according to scale). They are subject to the most onerous obligations: close-associate disclosures and notifications (cll 12(3)–(5), 30), public liability insurance (cl 31), comprehensive record-keeping (cll 32–35), incident registers (cl 34), vehicle specifications for cash-in-transit (cl 36), display and advertising rules (cll 27–29), and higher penalty notice amounts in several instances (Sch 3 Column 2). Government agencies and public authorities face slightly lighter disclosure requirements (cl 12(5)).

Third, exempt persons and organisations. Schedule 1 lists 40 categories of persons who do not need a licence when acting in the specified capacity. These range from Rail Corporation, Sydney Trains and NSW Trains employees (item 1), Fire and Rescue NSW officers (item 2), sheriffs (item 3), casino and gaming inspectors (items 4–5), detention centre staff (item 6), in-house security advisers and installers (item 7), liquor licensees performing exclusion functions (item 8), ticket scanners at events (item 9, provided they do not restrain or eject), builders installing basic locks (item 10), architects giving incidental advice (item 11), telemarketers (item 12), wholesalers of security equipment (item 13), national security agency staff (items 14–15), education department control-room staff (item 16), Transport Service revenue protection and monitoring staff (items 17–18), internal trainers (item 19), non-operational security business employees (item 20), crime prevention advisers in Justice and local councils (items 21–22), Commonwealth agency security advisers (item 23), retail bag-check staff following ARA guidelines (item 24), supervised apprentices/trainees (item 25), aviation security screeners (item 26), firearms dealers selling gun safes (item 27), correctional centre management companies (items 28–29), RSA supervisors (item 30), persons supplying exempt persons (item 31), and a detailed list of professionals acting as private investigators (items 32–39A: public servants, lawyers, auditors, insurers, loss adjusters, bank officers, government investigators, employment placement services, hospital medical practitioners, qualified accountants and their corporations). Clause 5A further exempts all health screening.

The Regulation also affects training providers (must be on the Commissioner’s published list – cl 43), applicants for visitor permits or temporary excess permits (Parts 4–5), and members of the public who interact with security personnel (indirectly protected by the fit-and-proper, insurance and conduct standards).

Duties of licensees are predominantly framed as licence conditions. Tier 1 conditions (breach attracts higher penalties) include notification of changes (cl 18), display of master licence and number (cll 27–28), advertising requirements (cl 29), and uniform compliance (cl 40(5)–(6)). Tier 2 conditions cover close-associate notification (cl 30), insurance (cl 31), record-keeping (cl 32), incident registers (cl 34), sign-on registers (cl 35), and fingerprint consent (cl 24). Tier 3 conditions are the most prescriptive vehicle-equipment standards for cash-in-transit (cl 36). Master licensees must keep records for at least 3 years (cll 32(3), 34(5)) and ensure class 1 licensees complete sign-on registers (cl 35(4)). Interference with security recordings that could found proceedings is a strict stand-alone offence (cl 41). Impersonation carries the highest penalty (cl 42 – 250 penalty units).

Rights are largely procedural. Applicants may lodge training evidence up to 42 days after the application (cl 12(2)), obtain replacement licences for $65 (cl 20), apply to vary licence subclass or amend particulars (cll 21–23), seek exemptions (cl 7), request destruction of fingerprints after ceasing to hold a licence (cl 24(3)–(4)), and receive refunds of non-processing components of fees on withdrawal or refusal (cl 11(5)). The Commissioner must maintain a public register (cl 44) and publish approved training providers (cl 43) and uniform/vehicle determinations (cl 40(3)). Exempt persons enjoy a statutory carve-out provided they stay within the terms of Sch 1. Transitional provisions in Sch 4 grandfathered certain pre-2016 and pre-2023 licences and applications, preserving their term and conditions.

Commissioner’s powers are extensive: discretion to refuse on public-interest grounds based on criminal intelligence (cl 25), power to require additional information (cl 12(6)), power to authorise non-compliant signage (cl 36(3)), and power to determine uniforms and markings (cl 40).

The Act’s offence provisions are supplemented by the Regulation’s own offences and by Sch 3 penalty notices. Key Regulation offences include failure to notify lost licence (cl 19: 40/10 penalty units), non-compliant uniforms (cl 40(5)–(6): 10/100/50 penalty units), failure to correct non-compliant uniform or vehicle after notice (cl 40(8): 200/100 penalty units), tampering with security recordings (cl 41: 100 penalty units) and impersonation (cl 42: 250 penalty units). Master licence conditions are enforced through the Act’s s 30 offence, with Sch 3 prescribing differentiated penalty notice amounts according to whether the offender is a class MA/MB master licensee or not, and according to the Tier of the condition breached. For example, a Tier 3 breach by a corporation that is not a MA/MB licensee attracts $5,500, while an individual MA/MB licensee pays $1,375 for the same breach.

The Commissioner may revoke or suspend licences on additional grounds (cl 25) or via court order (cl 26). Criminal intelligence is protected from disclosure (cl 25(3)). Penalty notices are issued under s 45A of the Act; the amounts in Sch 3 have been updated by 2023 amendments to reflect inflation and policy settings. Enforcement is centralised through SLED, which also maintains the register and approves training providers.

The Regulation is expressly linked to the Security Industry Act 1997 (defined as “the Act” in cl 3) and must be read with it. It cross-references the Interpretation Act 1987, the Subordinate Legislation Act 1989 (repeal of 2007 Regulation), the A New Tax System (Australian Business Number) Act 1999 (Cth), the Business Names Registration Act 2011 (Cth), the Firearms Act 1996, the Drug Misuse and Trafficking Act 1985, the Poisons and Therapeutic Goods Regulation 2008, the Industrial Relations Act 1996, the Crimes Act 1900 (ss 93B, 93C, 93T, 351A, Part 6B), the Work Health and Safety Act 2011 (s 31), the Australian Consumer Law, the Fair Work Act 2009 (Cth), the Surveillance Devices Act 2007, the Telecommunications (Interception and Access) Act 1979 (Cth), the Corporations Act 2001 (Cth), the Insurance Act 1973 (Cth), the Government Sector Employment Act 2013, the Fair Trading Act 1987, the Liquor Act 2007, the Casino Control Act 1992, the Children (Detention Centres) Act 1987, the Crimes (Administration of Sentences) Act 1999, the Apprenticeship and Traineeship Act 2001, the Aviation Transport Security Regulations 2005 (Cth), and various Australian/New Zealand Standards.

Transitional provisions in Sch 4 link the Regulation to the Commercial Agents and Private Inquiry Agents Act 2004 (repealed) and the Security Industry Amendment (Private Investigators) Act 2016 and Security Industry Amendment Act 2022. Criminal intelligence provisions in cl 25 interact with common-law principles of procedural fairness; the Regulation expressly authorises non-disclosure. Fingerprint data may be used for “any purpose the Commissioner sees fit” (cl 24(2)), raising privacy considerations under the Privacy and Personal Information Protection Act 1998 (NSW) and the Privacy Act 1988 (Cth), although the Regulation itself provides the statutory authority.

The Regulation has been amended multiple times, most significantly in 2022. The Security Industry Amendment Act 2022 and associated regulations (2022 (338), 2022 No 52, 2022 (816)) introduced cl 5A (health screening is not a security activity), amended the exemptions schedule to add qualified accountants (Sch 1 item 39A) and clarify private investigator exemptions (items 32–39), altered several master-licence conditions from Tier 1 to Tier 2 or vice versa (cll 18, 24, 27–35, 40–42), updated fees, expanded the incident register to cover additional firearm-related events (cl 34), and inserted comprehensive transitional provisions in Sch 4 Part 2 for cash-in-transit and class 1F/1C licence conversions. The 2023 (682) and 2025 (60) amendments fine-tuned exemption categories, updated penalty notice amounts, and made minor wording changes to cl 7 and cl 12.

These changes reflect policy decisions to reduce regulatory burden on low-risk activities (health screening, in-house accountants), tighten controls on firearms and cash-in-transit after operational incidents, align private-investigator regulation with the 2016 reforms, and update monetary amounts for inflation. The shift of some conditions between Tiers adjusts the balance between strict liability and administrative flexibility.

The source text does not contain reported court decisions; however, the structure of cl 25 (public interest revocation on the basis of undisclosed criminal intelligence) mirrors provisions upheld in Commissioner of Police v Tanos [2018] NSWCA 1 and similar cases concerning the Firearms Act 1996. The non-disclosure clause (cl 25(3)) is designed to survive procedural fairness challenges by providing a statutory exception. Controversy has surrounded the breadth of “close associate” definitions and the practical burden of the record-keeping and dual-register (incident and sign-on) requirements on small master licensees. The 2022 expansion of Sch 1 exemptions for legal practitioners, auditors and loss adjusters acting as private investigators was welcomed by professional bodies but criticised by some industry participants as creating an uneven playing field. No specific judicial challenges to the Regulation’s validity are recorded in the provided text.

Most practitioners miss that cl 12(2) permits competency and training evidence to be lodged up to 42 days after the initial application; many applications are refused under cl 12(6) for incompleteness when early lodgement is not strictly required. The distinction between Tier 1, 2 and 3 conditions is critical because Sch 3 penalty notice amounts differ markedly; what appears to be a minor administrative breach (e.g. failure to keep an incident register at every required premises – cl 34(3)) can attract a $5,500 corporate penalty notice if it is a Tier 3 obligation. Clause 5(c) brings the offering to sell or advise on security equipment within the class 2C regime even if no physical installation occurs; many hardware retailers are unaware they may need licensed staff. The Sch 1 item 39A exemption for “qualified accountants … while acting as an accountant” is narrower than it appears; once the accountant steps outside pure accounting into, say, fraud investigation, the class 2E licence is required. Cash-in-transit operators frequently overlook that cl 36(1)(f) imposes additional features on two-person armoured vehicles (remote central locking, partitioning, portable duress alarms) that are not required for single-crew operations. The criminal-intelligence revocation power in cl 25 cannot be challenged on natural justice grounds because the Commissioner is statutorily excused from giving reasons; this is a classic “gotcha” for licensees who assume they will always see the case against them. Finally, the transitional provisions in Sch 4 cl 10 allow existing class 1A cash-in-transit operators a six-month grace period, but only if they actually carried on those activities before 1 June 2023; new entrants do not qualify.

Compliance begins with a gap analysis: determine exactly which security activities are performed (cl 5 and s 4 of the Act) and whether any Sch 1 exemption applies. If a licence is required, lodge a complete cl 12 application (or use the online SLED portal) including all identity, citizenship, training and insurance evidence; remember the 42-day grace period for training certificates. Master licensees must immediately map their operations against the Tiered conditions: implement approved incident and sign-on registers (cll 34–35), ensure vehicles meet the exact cl 36 specifications (or obtain a written signage exemption), maintain $10 m public liability insurance where required (cl 31), and keep records for the full three years. Policies should require staff to complete sign-on registers before commencing and after finishing every shift at covered premises. Uniforms and vehicle markings must be checked against the latest Gazette determination (cl 40); any Commissioner notice under cl 40(7) must be actioned immediately to avoid the escalated 200-penalty-unit offence.

Annual compliance calendars should diarise notification obligations (14 days for changes – cl 18; 7 days for lost licences – cl 19), insurance renewals, and register audits. Internal audit checklists should verify that every forcible-contact, ejection, dog-attack or firearm incident is recorded before shift end and that firearm discharges are notified to the Firearms Registry within 24 hours. Training must be delivered only by providers listed on the SLED website (cl 43). Close-associate changes must be notified within 14 days (cl 30); failure to do so is a Tier 2 breach that can ground discretionary refusal or revocation. For exempt entities, maintain documentary evidence that activities remain strictly within the Sch 1 carve-out; crossing the line (e.g. a lawyer performing surveillance outside legal professional work) immediately triggers the licensing requirement and potential cl 42 impersonation risk if the person holds themselves out as licensed.

Organisations should designate a compliance officer to monitor SLED website notices, Gazette determinations, and amendments to Sch 3 penalty amounts. When in doubt, seek a written ruling from the Commissioner rather than risk a penalty notice or revocation on public-interest grounds. Regular mock audits of the incident register and vehicle equipment will minimise the risk of the “most people don’t realise” breaches that attract the highest Sch 3 figures.