Superannuation Industry (Supervision) Tax File Number approval No. 1 of 2017

The Approval is procedural and definitional in scope. It sets out core concepts and the manner for handling TFNs in relation to trustees, beneficiaries and superannuation providers. The instrument itself defines some terms and refers to statutory definitions for others.

Key defined or referenced concepts in the text:

• Trustee: used throughout to mean the trustee of the eligible superannuation entity or regulated exempt public sector superannuation scheme to which the approval applies (Schedule, Interpretation para 9). The Approval also uses the term when referring to trustees of RSA providers and trustees of other eligible entities.
• Beneficiary / applicant to become a beneficiary: persons from whom a TFN may be requested or who may quote a TFN (Schedule, paras 1 and 6).
• Eligible superannuation entity: the Approval uses the term and expressly states that the meaning is in s 10 of the Act (main body, Interpretation). The Approval differentiates eligible superannuation entities that are SMSFs, with several approvals explicitly excluding SMSFs for certain operations (opening paragraphs (a), (c), (e)).
• Regulated exempt public sector superannuation scheme: a category referenced multiple times; its meaning is in s 299W of the Act (Interpretation).
• RSA provider: defined by reference to s 10 of the Act and the Retirement Savings Accounts Act 1997 s 16 (Schedule, Interpretation para 9 and opening paragraphs).
• Tax file number (TFN): used with its statutory meaning (the Approval refers to the definition in s 299W of the Act; Interpretation).
• Superannuation provider: defined in the Schedule as the trustee of an eligible superannuation entity or regulated exempt public sector superannuation scheme, or an RSA provider (para 9).
• "In writing": expressly includes electronic and digital transfer of information (Schedule, para 9).

Operational concepts the Approval imposes or clarifies:

• Pre-condition information: trustees must make specific information available to the beneficiary or applicant free of charge and in an appropriate form before the TFN is provided (para 1). The content is prescribed: authority to collect/use/disclose TFN under the Act, ability to disclose to another provider when transferring benefits unless the beneficiary requests otherwise in writing, the fact that declining to quote a TFN is not an offence, and three specified advantages of giving a TFN (para 1(a)-(b)(i)-(iii)).
• Modes of communication: the Approval recognises oral and written modes for the giving of the prescribed information and for the provision of TFNs, and explicitly allows electronic transfer to satisfy "in writing" (paras 2, 5, 9).
• Transfer disclosure obligation: when a trustee informs another superannuation provider of a TFN, it must do so in writing and provide all information in its possession that could reasonably help locate or identify the beneficiary and which the beneficiary would reasonably expect to be disclosed, subject to the beneficiary’s written instructions not to divulge (paras 7-8).
• Interaction with other obligations: trustees must also observe Part 25A of the Act and the Privacy (Tax File Number) Rule 2015 (note to para 8).

The Approval is framed as an “approval” of particular manners (under the Act’s various TFN-related sections). It is therefore not framed as legislative amendment: it sets out the approved practices trustees must follow for lawful collection, use and disclosure of TFNs under the existing statutory powers. The Approval supplies a standard script trustees may adopt (para 4) and permits additional information so long as it is not inconsistent with the prescribed material (para 3).

The Approval targets a defined set of participants in the superannuation system and, through mandatory disclosure practices, imposes informational obligations that have consequences for administrators, beneficiaries and receiving providers.

Primary actors affected:

• Trustees of eligible superannuation entities (other than SMSFs) and trustees of regulated exempt public sector superannuation schemes: the approval expressly authorises the manner in which those trustees may request TFNs from beneficiaries or applicants and the manner in which they disclose TFNs to other superannuation providers (opening paragraphs (a), (b), (c), (e), Schedule paras 1-3, 7-8). Trustees are the principal duty-holders under the Schedule duties.
• Trustees of SMSFs: the Approval treats SMSFs differently. Some approvals (for requesting TFNs from beneficiaries) expressly apply to eligible superannuation entities other than SMSFs (opening paragraphs (a), (c), (e)), while the approval relating to an applicant setting out a TFN in an application for payment of a benefit includes an eligible superannuation entity including an SMSF (opening paragraph (d)). Therefore trustees of SMSFs are directly affected for benefit-payment applications, but the approved manner for trustees requesting TFNs may not apply to SMSFs in some contexts.
• RSA providers and trustees of other eligible superannuation entities: the Approval contemplates that trustees will inform RSA providers and trustees of other eligible entities of TFNs when benefits are transferred and regulates the manner of that notification (opening paragraphs (e)-(f); Schedule paras 7-8).
• Beneficiaries and applicants to become beneficiaries: they are the subjects from whom TFNs are requested and who may quote or set out TFNs orally or in writing subject to the trustee having complied with paras 1-5 (Schedule para 6). Beneficiaries also have an express right to request in writing that their TFN not be disclosed to any other superannuation provider (para 1(a)).

Secondary or consequentially affected parties:

• Receiving superannuation providers: when they receive TFNs from transferring trustees they will receive accompanying identifying information that the transferring trustee must provide (para 8). That affects their account matching and portability processes.
• Administrators handling records and communications: because the Approval prescribes the manner, format and content of communications , and treats electronic/digital transfer as "in writing" , administrators must support specified modes and retain records sufficient to demonstrate compliance with the prescribed manner (paras 2, 5, 9).
• Beneficiaries who decline to quote a TFN: although not a "party" in the administrative sense, the instrument explicitly informs beneficiaries that declining to quote a TFN is not an offence but lists practical disadvantages (para 1(b)(i)-(iii)), thereby affecting their choices.

Who pays:

• Trustees bear the administrative burden and costs of making the prescribed information available free of charge and of ensuring that when TFNs are transferred they provide the requisite identifying information in writing (paras 1, 7-8).
• Receiving providers may incur costs in processing and matching TFNs together with the additional identifying material they must be given (para 8).
• Beneficiaries may bear indirect costs if they decline to provide TFNs , the Approval identifies consequences (inability to accept all permitted contributions and possible higher tax) rather than monetary fines (para 1(b)(i)-(ii)).

Who decides:

• APRA (delegate) makes the approval and determines the prescribed manner; trustees decide whether to request TFNs but must do so using the approved manner if they seek to rely on the statutory permissions referred to in the Act (instrument header; opening paragraphs).

The Approval imposes specific procedural duties on trustees and preserves certain rights for beneficiaries. These duties and rights are narrowly prescribed and are procedural rather than substantive.

Trustee duties (Schedule):

• Pre-request information duty: Before a beneficiary, or applicant to become a beneficiary, provides their TFN, the trustee must make available free of charge and in an appropriate form the specified information in para 1. The content required is: trustee’s authority to collect/use/disclose TFNs under the Act; the trustee may disclose TFNs to another superannuation provider when benefits are transferred unless the beneficiary requests non-disclosure in writing; declining to quote a TFN is not an offence and the enumerated advantages of providing a TFN (para 1(a) and (b)(i)-(iii)).
• Mode of disclosure: The prescribed information may be provided orally or in writing (para 2). The trustee may use the exact script set out in para 4, or provide information in additional terms so long as it is not inconsistent with para 1 (para 3).
• Treatment of TFN provision: Nothing in the Approval prevents TFNs being requested or provided orally or in writing, including by electronic transfer (para 5). Trustees must accept TFNs quoted or set out orally or in writing if they have complied with paras 1-5 (para 6).
• Disclosure to another provider: When informing a superannuation provider of a beneficiary’s TFN, the trustee must do so in writing, though oral clarification may follow a written communication (para 7). The trustee must provide all information in its possession that could reasonably help locate or identify the beneficiary and which the beneficiary would reasonably expect to be disclosed, except for information the beneficiary has asked the trustee not to divulge (para 8).

Beneficiary rights and options (Schedule):

• Right to receive prescribed information: Beneficiaries/applicants are entitled to receive the information set out in para 1, free of charge and in an appropriate form, before providing their TFN (para 1, para 2).
• Right to decline: Beneficiaries are informed that declining to quote a TFN is not an offence (para 1(b)), preserving the legal right not to supply a TFN.
• Right to request non-disclosure: Beneficiaries may request the trustee in writing that their TFN not be disclosed to any other superannuation provider, which prevents the trustee from disclosing the TFN in the transfer context (para 1(a); para 8 clarifies the trustee’s obligations where the beneficiary has asked not to divulge).
• Mode flexibility: Beneficiaries may quote TFNs orally or in writing provided the trustee complied with paras 1-5 (para 6), and nothing prevents TFNs being provided via electronic transfer (para 5; para 9).

Interaction rights/duties and limitations:

• The trustee is not obliged to give information it has been asked by the beneficiary not to divulge (para 8), which creates a tension when the trustee must provide all information reasonably needed to locate the beneficiary; the Approval resolves this by prioritising the beneficiary’s written instruction not to divulge.
• Trustees must comply with broader TFN obligations in Part 25A of the Act and with the Privacy (Tax File Number) Rule 2015; those other obligations remain in force and may create additional duties beyond this Approval (note to para 8).

Record and procedural obligations implied by the Schedule:

• The Approval requires trustees to have procedures to ensure prescribed information is given before a TFN is accepted and to be able to demonstrate that a TFN was collected in the approved manner (paras 1-6). While the Approval does not expressly mandate record-keeping, compliance practically requires records of the information provided and of whether a beneficiary requested non-disclosure.

Limits of duties and rights in this instrument:

• The Approval prescribes manner and content, but does not create new criminal sanctions or monetary penalties in itself. Enforcement and penalty mechanisms, if any, must be derived from the underlying Act, Part 25A obligations, or other instruments referenced in the Approval (note to para 8).

The Approval itself does not create explicit criminal penalties, civil fines or administrative sanctions. It is an instrument that approves the manner in which trustees and beneficiaries may exercise existing statutory powers and obligations under the Superannuation Industry (Supervision) Act 1993. The text should be read as procedural guidance authorised by the Act rather than as a standalone penalty regime.

What the Approval does say about enforcement-relevant matters:

• The instrument is made under the authority of provisions of the Act (ss 299E, 299G, 299P, 299S, 299M and 299N) and subsection 33(3) of the Acts Interpretation Act 1901 (opening paragraphs). Those references indicate the Approval sits within the statutory TFN framework, and compliance with the approved manner will be relevant to the lawful exercise of statutory powers under the Act.
• The Approval contains a note that trustees must also comply with any other TFN obligations in Part 25A of the Act and with the Privacy (Tax File Number) Rule 2015 issued by the Privacy Commissioner under s 17 of the Privacy Act 1988 (note to para 8). Any penalties or enforcement powers associated with failure to comply with those provisions or rules are not set out in this Approval; they remain in the referenced legislation and instruments.

Practical enforcement implications:

• Administrative consequence: trustees who do not adopt the approved manner may be unable to rely on the statutory permissions for collecting, using or disclosing TFNs in the specific contexts covered by the Act. The Approval is the instrument by which APRA authorises particular manners of requesting/handling TFNs; non-compliance could therefore expose trustees to regulatory scrutiny under the Act, but the Approval itself does not state the sanctioning mechanism.
• Interaction with privacy law and Part 25A: the explicit cross-reference to the Privacy (Tax File Number) Rule 2015 and Part 25A indicates that trustees’ handling of TFNs can also trigger enforcement under privacy or tax-related provisions. Any penalties or remedies for breaches of those instruments would be the mechanisms by which non-compliance is enforced, not this Approval directly.
• Record-keeping and evidentiary issues: because the Approval prescribes the required pre-information and manner of transfer, trustees will need to demonstrate compliance to regulators or in dispute contexts. Failure to demonstrate compliance may have regulatory consequences under the Act or related instruments.

What the Approval does not provide:

• It does not include specific fines, criminal offences, or a schedule of penalties against trustees or beneficiaries for non-compliance with the manner prescribed here.
• It does not set out APRA’s enforcement processes, discretion for administrative sanctions, or appeal mechanisms.

Consequent legal reading:

• To determine concrete penalty exposure for a factual non-compliance, one must look to the underlying Act (including Part 25A) and to the Privacy (Tax File Number) Rule 2015. This Approval must be read together with those statutory and rule-based obligations for a full enforcement picture; the Approval sets procedural requirements that support compliance assessments but does not itself prescribe sanctions.

The Approval explicitly situates itself within and alongside other statutory and regulatory obligations. It is an instrument of procedural authorisation under the Act and creates cross-references to privacy and TFN-specific rules.

Direct statutory interaction stated in the instrument:

• Superannuation Industry (Supervision) Act 1993: The Approval is made under ss 299E, 299G, 299P, 299S, 299M and 299N of the Act and relates to the collection, use and disclosure of TFNs under those sections (opening paragraphs). These references indicate the Approval governs the manner in which powers conferred by those provisions may be exercised.
• Part 25A of the Act: The Schedule contains a note that trustees must comply with Part 25A of the Act. Part 25A is identified as a distinct source of TFN obligations and remains applicable in addition to this Approval (note to para 8).
• Privacy (Tax File Number) Rule 2015: The instrument expressly requires trustees also to comply with the Privacy (Tax File Number) Rule 2015 issued by the Privacy Commissioner under s 17 of the Privacy Act 1988 (note to para 8). That rule imposes privacy obligations concerning TFNs which operate alongside the procedural prescriptions of this Approval.
• Acts Interpretation Act 1901: The Approval is made under subsection 33(3) of the Acts Interpretation Act 1901 (opening paragraphs), which is APRA’s delegated making-power mechanism as exercised by the delegate of APRA.
• Retirement Savings Accounts Act 1997: The Schedule defines "superannuation provider" to include an RSA provider within the meaning of s 16 of the Retirement Savings Accounts Act 1997 (para 9). This cross-reference brings RSAs into the approved communication chain.
• Definitions in the Act: Several terms used in the Approval are defined by reference to the Act: e.g., eligible superannuation entity (s 10), regulated exempt public sector superannuation scheme and TFN (s 299W) (Interpretation).

Practical interactions and potential overlap:

• Regulatory layering: trustees must follow this Approval’s procedural requirements (what to say and how to accept a TFN) while also observing the privacy protections and data-handling rules in the Privacy (Tax File Number) Rule 2015. That creates overlapping compliance duties: one instrument prescribes the manner of collection and disclosure; the other prescribes how TFNs must be protected and handled from a privacy perspective.
• Transfer and portability processes: para 8 requires trustees to provide all information in their possession that could reasonably help a receiving provider locate or identify the beneficiary, unless the beneficiary asked not to divulge. That obligation intersects with privacy considerations in the Privacy (TFN) Rule 2015 and with any tax rules in Part 25A addressing permitted uses of TFNs.
• SMSF differentiation: the Approval’s cover for SMSFs varies by provision. Certain approvals apply to eligible superannuation entities other than SMSFs while some explicitly include SMSFs (opening paragraphs). Practitioners should therefore consult the Act (s 10 and related provisions) to determine whether a particular procedure permitted by this Approval applies to an SMSF in a given context.
• Electronic communications law: the Approval’s inclusion of electronic and digital transfer within the meaning of "in writing" (Schedule para 9) interacts with electronic transactions laws and trustees’ internal obligations around electronic record-keeping, authentication and security. Those legal regimes are not reproduced in the Approval but are triggered operationally.

Limits of interaction stated in the instrument:

• The Approval does not displace other legal obligations; it is an approving instrument within the statutory TFN framework. The Approval requires compliance with other TFN and privacy obligations rather than supplanting them (note to para 8).

Implication for compliance planning:

• Trustees must operate with a multi-instrument compliance architecture. They need to ensure the manner approved here is implemented in ways that also satisfy the privacy, record-keeping and permitted-use constraints of Part 25A and the Privacy (TFN) Rule 2015.

The Approval is short and records a limited amendment history within the instrument itself.

Express amendment/revocation:

• The instrument revokes Superannuation Industry (Supervision) Tax File Number approval No. 1 of 2007 dated 27 June 2007, including the Schedule made under that Approval (opening paragraph, revocation clause). The revocation is immediate upon this instrument coming into force.

Dates and commencement:

• The instrument is dated 20 September 2017 (signature block) and expressly commences on 1 October 2017 (final line before date). That means the 2007 approval was superseded from 1 October 2017 by this 2017 approval.

Making authority and signatory:

• The instrument states it is made by Helen Rowell, a delegate of APRA, under subsection 33(3) of the Acts Interpretation Act 1901 and under the listed sections of the SIS Act (opening paragraphs). The signature block identifies Helen Rowell as Deputy Chairman, APRA (opening and signature).

No other amendments recorded:

• The instrument contains no further amendment history, changes to other instruments, or transitional provisions beyond the revocation of the 2007 approval and its own commencement date.
• There are no references in the text to subsequent variations, expiry dates, sunset clauses, or staged implementation steps beyond the commencement date.

Interpretive implication:

• Because the Approval explicitly revokes the 2007 instrument and replaces it as of 1 October 2017, trustees and providers were expected to adopt the practices set out in this Approval from that date forward. Any historical compliance under the 2007 approval would have been superseded.

Where to look for subsequent amendments:

• This instrument does not record any later amendments. To determine whether this Approval has been subsequently varied or revoked after the date printed here, one must consult APRA’s register of legislative instruments or the Federal Register of Legislation. The Approval itself contains no subsequent amendment history.

The Approval text contains no references to litigation, judicial decisions, case law, or disputes. It does not cite or rely on any court or tribunal determinations, nor does it record any legal challenges to its terms. Consequently, the instrument itself provides no litigation history for the manner it approves.

Implications of absence of litigation history in the instrument:

• There is no judicial interpretation embodied within the Approval text to guide questions of ambiguity, such as what constitutes information a beneficiary would "reasonably expect to be disclosed" under para 8, or how the trustee should balance the duty to provide identifying information with a beneficiary’s instruction not to divulge.
• Practitioners seeking precedential guidance on contested factual or legal questions arising under the Approval (for example, the scope of "appropriate form" in para 1 or the standard for what is "reasonably helpful" in para 8) will need to rely on the statutory text, regulatory guidance outside this instrument, or any later case law not referenced here.

Practical consequence for advisers:

• Because the Approval does not include litigation or appellate history, trustees and advisers should document compliance conservatively and be prepared to explain why particular choices satisfy the Approval’s standards in the absence of judicial gloss. This includes maintaining records of what was provided to beneficiaries, how written non-disclosure requests were captured, and how identifying information provided to receiving providers was selected.

What the Approval does not do in litigation terms:

• It does not create private rights of action in its own text nor does it set out remedies. Any civil or administrative remedies for breach would derive from the Act, Part 25A, the Privacy (Tax File Number) Rule 2015, or other laws and contractual contexts, none of which the Approval itself elaborates upon.

This Approval contains several operational and legal points that can trap trustees, administrators and advisers if not carefully implemented. The instrument is short, but its phrasing creates discretion and some subjective standards; those are the principal sources of risk.

1. Different treatment of SMSFs

• Several approvals in the instrument explicitly apply to eligible superannuation entities other than SMSFs (opening paragraphs (a), (c), (e)), while the approval for setting out a TFN in an application for payment of a benefit expressly includes an eligible superannuation entity including an SMSF (opening paragraph (d)). Practitioners must not assume the same approved manner applies to SMSFs in all contexts. Check the exact approval paragraph before applying the approved manner to an SMSF.

2. “Free of charge” pre-request information

• Trustees must make the prescribed information available "free of charge and in such form as is appropriate" before the TFN is provided (Schedule para 1). The approval does not define "such form as is appropriate", so trustees must document an objective basis for chosen forms (e.g., letter, email, website, phone script) to demonstrate compliance.

3. Oral vs written modes and later clarifications

• The Approval allows TFNs to be requested or provided orally or in writing, including electronically (paras 2, 5, 6, 9). However, when informing another superannuation provider of a TFN, the trustee must do so in writing (para 7). This creates potential process mismatches: an oral TFN given by a beneficiary must be captured and converted into a compliant written disclosure for transfers. Trustees must ensure systems to accurately capture, record and validate orally-provided TFNs.

4. Tension between disclosure obligation and beneficiary non-disclosure request

• Para 8 requires trustees to give "all information in the possession of the trustee that could reasonably help the superannuation provider to locate or identify the beneficiary and which the beneficiary would reasonably expect to be disclosed", but immediately excepts information the beneficiary has asked the trustee not to divulge. The phrase "which the beneficiary would reasonably expect to be disclosed" is subjective and can create disputes about what must be provided on transfer. Trustees must adopt a conservative approach to documenting beneficiary expectations and any non-disclosure instructions.

5. Proof of compliance

• The Approval prescribes pre-request information but does not mandate record-keeping. However, in any regulatory review or dispute, trustees will need documentary proof that the required information was made available prior to collection of the TFN and that the method complied with paras 1-5. Relying on oral provision without contemporaneous records invites evidentiary risk.

6. Interplay with Part 25A and the Privacy (TFN) Rule

• The Approval explicitly requires compliance with Part 25A and the Privacy (Tax File Number) Rule 2015 (note to para 8). These instruments may impose additional restrictions (for example, security, permitted use, retention, destruction) that interact with the Approval’s disclosure permissions. Trustees must not treat this Approval as a standalone authorisation to share TFNs without checking the privacy and TFN-specific rules.

7. Use of the model wording

• Para 4 supplies a form of words trustees may use. Using that exact script is permitted, but para 3 allows additional information provided it is not inconsistent with para 1. Trustees who alter the script must ensure no inconsistency with the prescribed statements. Discrepancies could be criticised in compliance checks.

8. Electronic transmission classified as "in writing"

• The inclusive definition of "in writing" (para 9) brings electronic and digital transfers into the written obligations. Trustees must consider electronic signature, authentication, and retention requirements for such communications. The Approval does not specify security standards for electronic transmission; those obligations may be covered by privacy rules or other laws.

9. Beneficiary choices have practical consequences, not penalties

• The Approval states declining to quote a TFN is not an offence (para 1(b)), but it also states practical disadvantages: inability to accept all permitted contribution types, potential to pay more tax than necessary on contributions or benefits, and difficulty in locating and consolidating accounts (para 1(b)(i)-(iii)). Trustees must ensure beneficiaries are clearly informed and that staff can explain practical consequences without suggesting criminality.

10. Scope of “superannuation provider”

• The Schedule defines "superannuation provider" broadly to include trustees of eligible entities and regulated exempt public sector schemes and RSA providers (para 9). When transferring TFNs, trustees must map accurately which entities qualify as receiving providers under the definition to ensure compliance with paras 7-8.

11. No penalties set out in the Approval

• Because the instrument does not state penalties, trustees may underestimate regulatory exposure. Non-compliance will be assessed against the Act and the Privacy (TFN) Rule; trustees must therefore integrate this Approval into a broader compliance programme rather than treat it as the whole obligation set.

This section sets out a pragmatic checklist and record-keeping suggestions strictly based on the Approval’s text. The Approval prescribes manner and content; compliance requires operational steps aligning with those prescriptions and with the cross-referenced obligations in Part 25A and the Privacy (Tax File Number) Rule 2015.

Preliminary organisational steps

• Identify which trustee roles in your organisation are affected (trustee of eligible superannuation entity, regulated exempt public sector superannuation scheme trustee, RSA provider) and whether the fund is an SMSF for particular procedures (opening paragraphs; Schedule para 9).
• Map all processes that collect or transmit TFNs: new member intake, contribution channels, rollovers/transfers, benefit payment applications.
• Ensure staff and systems know that the prescribed information must be given before a TFN is provided (Schedule para 1).

Script and information delivery

• Adopt the approved script verbatim if practical (Schedule para 4). The Approval permits this exact text. If you add any additional information, ensure it is not inconsistent with the required statements in para 1 (para 3).
• Provide the prescribed information free of charge, and in a form appropriate to the interaction (oral, paper, email, portal). Paras 1 and 2 require the information be free and may be given orally or in writing.

Modes of collection and evidence

• When TFNs are collected orally, simultaneously record (in writing/electronically) the fact that the beneficiary was provided with the required information, the date and time, the name of the recipient, and the TFN as quoted. Paras 2 and 5 permit oral provision, but para 6 conditions beneficiary quoting on the trustee having complied with paras 1-5; therefore contemporaneous evidence helps demonstrate compliance.
• Make clear in membership forms and online onboarding that "in writing" includes electronic and digital transfers (Schedule para 9).
• For applicants who quote TFNs orally, create a verification step before relying on the TFN for contribution acceptance or matching.

Handling non-disclosure requests

• Implement a clear written process for beneficiaries to request that their TFN not be disclosed to other superannuation providers (para 1(a)). The Approval requires this request to be in writing.
• Log the date and content of written non-disclosure requests and ensure they are flagged in the member record to prevent inappropriate disclosure during transfers.

Transfers and disclosures to receiving providers

• When informing a receiving superannuation provider of a beneficiary’s TFN, do so in writing (para 7). Ensure the written transfer includes all information in the trustee’s possession that could reasonably help locate or identify the beneficiary and which the beneficiary would reasonably expect to be disclosed (para 8).
• Before sending transfer information, check whether the beneficiary has asked the trustee in writing not to divulge any particular information. If such a request exists, do not include that information in the transfer bundle (para 8).

Privacy and TFN-rule compliance

• Align TFN collection/disclosure processes with Part 25A of the Act and the Privacy (Tax File Number) Rule 2015 (note to para 8). Document how your TFN handling complies with the privacy rule’s permitted uses, security obligations and retention periods even though those sources are outside the Approval text.
• Ensure secure transmission methods for written electronic transfers and maintain an audit trail for what was provided and to whom, consistent with privacy obligations.

Records and audit trail

• Maintain a record that the prescribed information (para 1) was provided prior to TFN receipt. This record should include the form of the information (oral, written; if oral, who provided it and when), the script used (if applicable), and the beneficiary’s response.
• Keep copies of written non-disclosure requests and evidence they were actioned.
• Retain written transfer communications that include TFNs and the associated identifying information provided to receiving providers, and log the date, recipient and method of transfer (para 7-8).
• Because "in writing" covers electronic transfers (para 9), records of electronic transmissions should be retained with the same evidentiary standards as paper.

Operational controls and training

• Train staff on the required pre-TFN information, the permitted script (para 4), how to capture oral TFNs reliably, and how to handle written non-disclosure instructions.
• Implement system controls to prevent accidental disclosure of TFNs where a beneficiary has requested non-disclosure in writing.
• Institute a quality assurance process to check that transfer bundles include the required locating information and that exemptions requested by beneficiaries are respected (para 8).

Checklist for trustees before accepting or transmitting a TFN

• Has the beneficiary/applicant been given the prescribed information free of charge in an appropriate form prior to the TFN being provided (paras 1-2)?
• Was the provided information consistent with para 1 and not inconsistent with any additional material supplied by the trustee (para 3)?
• Was the TFN quoted in a manner permitted by the Approval (oral or in writing, including electronic transfer) (paras 5-6)?
• Is there a written instruction from the beneficiary prohibiting disclosure to other providers? If yes, ensure it is recorded and actioned (para 1(a), para 8).
• For transfers, is the disclosure to the receiving provider in writing and does it include all reasonably helpful locating information the beneficiary would reasonably expect to be disclosed, subject to any valid non-disclosure request (paras 7-8)?
• Have you complied with Part 25A of the Act and the Privacy (Tax File Number) Rule 2015 in how the TFN is stored, used and transmitted (note to para 8)?

By following these steps and retaining contemporaneous, auditable records of the pre-provision information, non-disclosure requests, and written transfers, trustees will demonstrate alignment with the manner approved by APRA and will be able to show how the Approval was implemented alongside the Act’s other TFN and privacy obligations.