Telecommunications (Industry Standard for Mobile Number Pre-Porting Additional Identity Verification) Direction 2019

The instrument is built around a small set of interlocking legal and operational concepts. First, “Port” or “Porting” is defined narrowly as the movement of mobile service numbers between mobile carriage service providers, or mobile carriage networks, using industry mobile number portability processes (s 4). The industry standard required by ACMA therefore targets transfers that are processed through existing industry portability mechanisms. Second, the role of the “Gaining CSP” is central: the standard must require the gaining provider to use an ACMA‑specified identity verification process before accepting the Port for a particular mobile service number (s 6(1)(c)-(d)). Third, the instrument defines the objectives ACMA must adopt in the standard: the prevention of unauthorised Porting of mobile service numbers and the reduction of harm to customers arising from unauthorised Porting (s 6(1)(b)(i)-(ii)). The objectives are expressed as minimums; the standard must state them but may include additional objectives.

Fourth, the selection criteria for verification processes are expressly legal and operational constraints. ACMA must specify processes it considers necessary to achieve the objectives and which are practicable, robust, technically feasible and do not impose undue financial and administrative burdens (s 6(2)(a)(i)-(iv)). ACMA must also have regard to existing or in‑progress CSP processes (s 6(2)(b)). These criteria frame ACMA’s discretion and create measurable policy trade‑offs: robustness and technical feasibility are balanced against practicability and burden. Fifth, the instrument identifies a menu of candidate verification processes that ACMA may specify, and instructs ACMA to identify which processes apply broadly and which are restricted to particular customer types (residential, SME, corporate, etc) (s 6(3)). The menu is diverse: possession‑based checks (SMS OTPs to the number to be Ported, email messages), in‑person retail callbacks, call centre callback checks for customers and authorised representatives, and biometric verification (s 6(3)(a)-(d)). Sixth, consumer awareness and safeguard information are optional elements the ACMA “may” include in the standard (s 7(1)). If included, the standard can set minimum requirements for information to help customers understand that verification will occur and to encourage reporting of suspected fraud to law enforcement and relevant government consumer services (s 7(1)(a)(i)-(ii)).

The instrument also engages institutional allocation of responsibilities: ACMA is directed to determine the industry standard (s 5(1)), and ACMA may, with consent, confer functions and powers on the Telecommunications Industry Ombudsman in respect of complaints about unauthorised Porting (s 5(3); note refers to s 114 of the Act). The Acts Interpretation Act 1901 paragraph 23(b) is cited as allowing ACMA to determine one or more industry standards (s 5 note). Finally, the direction sets a strict timetable for ACMA’s action,determination by 28 February 2020 and commencement by 30 April 2020 (s 5(2)),which compresses the window for consultation, drafting and operational design.

These concepts interact to deliver a rule‑making process that maps a set of high‑level public policy objectives onto a set of operational verification mechanisms, while constraining ACMA to account for practicability and burden and permitting targeted application by customer class. The instrument does not itself set penalties nor does it create technical specifications; those are left to the ACMA‑determined industry standard required by s 125AA(1) of the Act.

The direction and the subsequently required industry standard directly affect mobile carriage service providers and their agents, and indirectly affect customers, prospective customers, authorised representatives, the ACMA, and potentially the Telecommunications Industry Ombudsman. The instrument uses defined terms that allocate duties and responsibilities to specific actors.

• Mobile carriage service providers: The industry standard mandated by the direction must apply to “mobile carriage service providers who supply public mobile telecommunications services” (s 6(1)(a)). The statutory definition in the direction clarifies that this includes providers that supply or arrange for the supply of a public mobile telecommunications service and their authorised agents (s 4, definition of “mobile carriage service provider”). Those entities will therefore be subject to any identity verification rules ACMA prescribes and to any consumer awareness requirements ACMA includes under s 7(1).

• Gaining CSPs: The direction places the verification burden on the gaining provider. The industry standard must require Gaining CSPs, prior to accepting the Port of a particular mobile service number, to use one of the applicable identity verification processes specified in the industry standard (s 6(1)(c)). The industry standard must also require that mobile carriage service providers are not to proceed with a Port unless one of the applicable verification processes has been used by the Gaining CSP (s 6(1)(d)). In short, the immediate duty to verify rests with the gaining provider in a porting transaction.

• Customers and authorised representatives: The direction defines “customer” as a person who has a contractual relationship with a carriage service provider and to whom a mobile service number has been issued (s 4). The verification processes ACMA may specify include methods targeted at customers (SMS to the number, email) and authorised representatives (call centre and biometric checks for authorised representatives) (s 6(3)(a)-(d)). The standard must identify which processes apply to which customer types (residential, small to medium business, corporate) (s 6(3) preamble).

• ACMA: The instrument binds ACMA to determine an industry standard under s 125AA(1) of the Act that complies with Division 2 of the direction (s 5(1)). ACMA is the decision‑maker for the design, scope and operational detail of the verification regime, constrained by the timing and selection criteria in the direction (s 5(2); s 6(2)).

• Telecommunications Industry Ombudsman: ACMA is required to consider conferring functions and powers on the TIO in relation to customer complaints about unauthorised Porting (s 5(3)). Any conferral is subject to the TIO’s consent, and the instrument references s 114 of the Act which permits such conferral if consent is given. If conferred, the TIO would become a complaints avenue with specific functions or powers as agreed.

• Law enforcement and government consumer services: The standard may specify that providers inform customers that suspected fraudulent Porting should be reported to the Australian Federal Police, applicable State/Territory Police and relevant government consumer support services (s 7(1)(a)(ii)). This affects how CSPs communicate with customers and creates an expectation that reporting channels are signposted.

Indirectly, businesses that support CSP operations will be affected: call centre vendors, retail stores, IT suppliers that implement one‑time password (OTP) systems or biometric verification, and email/SMS delivery vendors will face operational changes. The direction requires ACMA to consider “undue financial and administrative burdens” in selecting processes (s 6(2)(a)(iv)), which acknowledges that obligations will carry costs for those regulated parties; the direction does not, however, make any specific funding or cost‑sharing provision.

Finally, the definition of “Port” as relating to industry mobile number portability processes (s 4) means that transfers that occur outside those processes (if any) may not fall within the scope of the ACMA standard. The instrument therefore primarily affects parties participating in recognised portability mechanisms.

The instrument itself directs ACMA to make an industry standard; it does not itself create a code of conduct for carriers, but it prescribes the substantive elements that the ACMA must include in that standard. The key duties and rights flowing from the direction can be framed as duties imposed on ACMA in designing the standard, and duties that the eventual industry standard must impose on market participants.

Duties imposed on ACMA in the direction

• Determine an industry standard under s 125AA(1) of the Act that complies with Division 2 of the direction (s 5(1)); ACMA may determine one or more industry standards (s 5 note referencing Acts Interpretation Act 1901 para 23(b)). ACMA must do this by 28 February 2020 and ensure the standard commences in whole by 30 April 2020 (s 5(2)).

• Consider conferring functions and powers on the Telecommunications Industry Ombudsman in respect of customer complaints about unauthorised Porting (s 5(3)); conferral requires TIO consent (note referencing s 114 of the Act).

• When specifying identity verification processes, ACMA must choose processes ACMA considers necessary to meet the stated objectives and which are practicable, robust, technically feasible and do not impose undue financial and administrative burdens (s 6(2)(a)(i)-(iv)). ACMA must also have regard to identity verification processes already implemented or being implemented by CSPs (s 6(2)(b)).

Duties that the industry standard must impose on providers (as required by the direction)

• Applicability: the standard must apply to mobile carriage service providers who supply public mobile telecommunications services (s 6(1)(a)).

• Objective statement: the standard must state that its objectives include, at minimum, preventing unauthorised Porting and reducing harm to customers arising from unauthorised Porting (s 6(1)(b)).

• Pre‑Porting verification duty: Gaining CSPs, prior to accepting the Port of a particular mobile service number, must use one of the applicable identity verification processes specified in the industry standard (s 6(1)(c)).

• Stopping rule for Ports: mobile carriage service providers must not proceed with a mobile service number Port unless one of the applicable identity verification processes specified in the industry standard has been used by the Gaining CSP (s 6(1)(d)).

Permissive elements ACMA may include in the industry standard

• ACMA “may” identify the specific verification processes that apply to different customer classes and “may consider” specifying any or all of the listed verification processes (s 6(3)); the list in s 6(3) is illustrative and ACMA is granted discretion to adopt any or all.

• Consumer awareness and safeguard information: ACMA may specify minimum requirements for information and advice that providers should give or make available to customers to assist them to understand that identification verification processes will apply and to encourage reporting of suspected Porting fraud to law enforcement and government consumer services. ACMA may also specify the manner in which such information is to be provided (s 7(1)(a)-(b)). Because these provisions are framed as permissive (“may”), ACMA retains discretion whether to include such obligations and how prescriptive they should be.

Rights and procedural expectations

• Providers have a procedural protection in the direction’s selection criteria: ACMA must not require processes that are impracticable, not technically feasible, or that impose undue financial and administrative burdens (s 6(2)(a)(i)-(iv)). This creates a constraint on ACMA’s rule‑making discretion that regulated parties can rely on in submissions or disputes.

• Customers have an expectation that the standard will include objective statements aiming to prevent unauthorised Porting and reduce harm (s 6(1)(b)). The direction also contemplates mechanisms for complaints handling via the TIO, if ACMA elects to confer functions and the TIO consents (s 5(3)).

What the instrument does not itself do

• The direction does not itself create offences, civil penalties, or enforcement processes against CSPs. Instead, it requires ACMA to make an industry standard which will set the operational duties and, depending on ACMA’s statutory powers and drafting choices, may specify enforcement or compliance mechanisms. The direction also does not itself provide privacy or data handling rules for biometric or other verification data; those matters would interact with other regulatory regimes outside the text of the direction.

In sum, the instrument imposes binding duties on ACMA in standard design and requires that the standard in turn impose on Gaining CSPs a pre‑acceptance verification duty and on all CSPs a principle that Ports must not proceed unless an ACMA‑specified verification process has been used (s 6(1)(c)-(d)). ACMA’s duty is constrained by practicability, robustness, technical feasibility and burdens considerations (s 6(2)(a)).

The direction itself does not establish specific penalties, sanctions or enforcement mechanisms against mobile carriage service providers. It is a directive to the ACMA to make an industry standard under subsection 125AA(1) of the Telecommunications Act 1997 (s 5(1)), and any enforcement tools, penalties or compliance mechanisms would derive from the industry standard ACMA is required to determine and from other provisions of the Act and related instruments. The instrument therefore separates rule‑making from enforcement: it prescribes content and constraints for the standard, but not the sanctioning regime.

What the text says about dispute resolution and complaints handling

• The direction instructs ACMA to consider conferring functions and powers on the Telecommunications Industry Ombudsman in respect of customer complaints about unauthorised Porting (s 5(3)). The direction notes that an industry standard may confer functions and powers on the TIO if the TIO consents (note referencing s 114 of the Act). That mechanism, if implemented by ACMA, would create an avenue for consumer complaints and potentially consumer dispute resolution, but the instrument leaves both the decision to confer and the content of any conferral to ACMA (conditional on TIO consent).

What to expect in practice

• Enforcement of Porting verification rules will depend on the content of the ACMA industry standard and on ACMA’s existing statutory powers to monitor and enforce compliance with industry standards under the Act. The direction does not itself expand or limit ACMA’s enforcement powers beyond prescribing the content and timing of the standard to be made. Because the direction emphasises that ACMA should not specify identity verification processes that impose undue financial and administrative burdens (s 6(2)(a)(iv)), ACMA may opt for standards that include graduated compliance expectations or transitional arrangements rather than immediate heavy sanctions; the direction leaves such design choices to ACMA.

Limitations and gaps in penalties/enforcement as enacted

• No immediate civil or criminal penalties flow directly from the direction. Any sanction for failing to follow the ACMA standard must be found either in the standard itself, in other provisions of the Telecommunications Act or in separate regulatory instruments. For compliance officers and lawyers advising CSPs, the practical enforcement risk therefore depends on the precise instrument ACMA later issues, and on ACMA’s enforcement policy under the Act.

• Similarly, the direction does not prescribe monitoring requirements, audit powers, reporting frequencies, or record‑keeping obligations. If ACMA desires enforceable obligations in those areas, it must include them in the industry standard (subject to the constraints and timelines in the direction).

In short, penalties and enforcement are not specified in the direction; the instrument compels ACMA to make a standard which may include enforceable obligations and may provide for TIO functions if consented, but the details of compliance monitoring and sanctions are matters for ACMA’s subsequent rule‑making under s 125AA(1) of the Act.

The direction is an instrument made under subsection 125AA(4) of the Telecommunications Act 1997 and therefore sits within the regulatory architecture created by that Act. The direction explicitly references other legal instruments and institutional players, which frames its interaction with surrounding law.

Statutory provenance and references

• The instrument is made under subsection 125AA(4) of the Telecommunications Act 1997 (s 3). That provision authorises the Minister (or relevant person) to direct ACMA to determine industry standards. The direction therefore triggers ACMA’s rule‑making power under s 125AA(1) of the Act (s 5(1)).

• The direction’s definitions cross‑refer to the Telecommunications Numbering Plan 2015 by adopting the phrase “digital mobile number has the same meaning as in section 15 of the Telecommunications Numbering Plan 2015” (s 4). This ties the direction to the numbering regime administered under other instruments; the ACMA standard must operate in the context of the numbering plan’s definitions.

• The instrument notes that ACMA may, with the Telecommunications Industry Ombudsman’s consent, confer functions and powers on the TIO, and references section 114 of the Act (s 5(3) and note). That cross‑reference shows an intended coordination between ACMA rule‑making and the TIO’s dispute resolution role if consented.

Interactions with privacy and data laws (cross‑statutory implications)

• The direction contemplates the use of biometric data as an identity verification option (s 6(3)(d)). Biometric data is personal information and, depending on how it is collected, stored, used and disclosed, its processing will intersect with the Privacy Act 1988 and other privacy‑related obligations. Although the direction does not mention privacy law, CSPs implementing biometric verification will need to consider compliance with applicable privacy obligations (collection, purpose limitation, security, credentials, data breach notification). The direction’s silence on privacy obligations means that compliance with privacy law remains a separate, parallel requirement.

• Similarly, the use of SMS one‑time passwords and email verification may implicate spam and electronic communications regulation, though the direction does not address that directly. Providers sending verification SMS or emails will nonetheless operate within the existing law governing electronic communications.

Interactions with criminal law and reporting obligations

• The industry standard “may” specify that CSPs provide information encouraging reporting of suspected fraudulent or unlawful activity related to unauthorised Porting to the Australian Federal Police and applicable State/Territory Police (s 7(1)(a)(ii)). This contemplates an interface between the telecommunications regulatory regime and law enforcement reporting, but it does not itself create reporting obligations to law enforcement agencies. Any mandatory reporting duties would have to be established by ACMA in the industry standard or elsewhere in law.

Administrative law and procedural obligations

• ACMA’s determination of the industry standard must be consistent with the direction’s constraints (practicable, robust, technically feasible, no undue burdens) and must be made within the statutory timeframes (s 5(2); s 6(2)). Administrative law principles (natural justice, reasoned decision‑making, consultation obligations applicable to ACMA under the Act or its own regulatory processes) will govern how ACMA exercises its discretion in determining the standard. The direction’s timeframe may constrain the depth of consultation ACMA undertakes, but ACMA remains subject to any procedural obligations under its governing statute and administrative law.

Contractual and commercial law interactions

• The direction targets industry porting processes. Operators’ contractual arrangements with customers and between carriers (inter‑carrier porting arrangements) will need to be adjusted to reflect any ACMA standard. For example, a standard that requires call centre callbacks as a precondition to acceptance of a Port will require changes to customer terms, staff scripts, internal authorisation protocols, and inter‑carrier notifications. These are private contract and commercial implementation matters but they will need to be aligned with ACMA’s technical and operational requirements.

In sum, the direction is narrowly focused on pre‑Porting verification and consumer awareness within the telecommunications regulatory framework established by the Telecommunications Act and numbering plans. It interacts with privacy, criminal reporting channels and contract law in practice, but does not displace those legal regimes; regulated parties must comply with those laws in parallel when implementing the verification measures the ACMA standard prescribes.

The instrument before you is the Telecommunications (Industry Standard for Mobile Number Pre‑Porting Additional Identity Verification) Direction 2019. The text provided contains the instrument’s provisions, commencement and authority clauses (ss 1-3), definitions (s 4) and the substantive directions to ACMA (ss 5-7). The instrument identifies its commencement as the day it is registered (s 2). The instrument names the enabling provision as subsection 125AA(4) of the Telecommunications Act 1997 (s 3).

The text as provided does not include any express amendments, revocations, schedules, transitional or savings provisions, or history of prior versions. No amendment dates, variation instruments or repeal clauses are included in the instrument text you supplied. Where an instrument has been amended, amending instruments and dates are typically recorded on the consolidated instrument or in the relevant legislative register; that information is not present in the supplied text.

What the text records about timeframes and variation powers

• The instrument imposes fixed deadlines for ACMA to act: the industry standard is to be determined by 28 February 2020 and to commence in whole by 30 April 2020 (s 5(2)). Those dates are operational constraints on ACMA and therefore form part of this instrument’s temporal structure.

• The instrument allows ACMA to determine one or more industry standards (s 5 note referencing Acts Interpretation Act 1901 para 23(b)). That drafting signals that ACMA may adopt segmented standards (for example, separate standards by customer class or technical approach) rather than a single monolithic standard. Such segmentation could effectively operate as de facto amendments over time if ACMA issues successive or multiple standards, but the direction itself does not provide an amendment procedure.

Absence of amendment record in the instrument

• Because the supplied instrument does not list amendments, one must treat it as the original Direction 2019 text without recorded subsequent variations in this document. If an estate of practice or consolidated legislative register shows later amendments, those are external to the instrument text provided.

Practical implication for compliance and advice

• Counsel, compliance officers and policy advisers should not assume amendment or transition relief unless expressly stated. The direction sets tight deadlines and leaves ACMA to determine the standard within those limits. If an ACMA standard is later amended, the amendment would be a separate instrument under ACMA’s powers or another direction; tracking ACMA publications and the Federal Register of Legislation is necessary to identify later variations.

In short, the instrument sets deadlines for creating and commencing an ACMA industry standard and includes no amendment history within the text supplied. Absent a separate amending instrument, the Direction 2019 stands as drafted and operationally binding on ACMA to proceed within the stated schedule.

The instrument text contains no references to judicial decisions, litigation, or legal challenges. It does not cite cases nor does it record any disputes, court orders or litigious history. The direction is an executive instrument placed in the regulatory architecture under subsection 125AA(4) of the Telecommunications Act 1997. Any litigation history that might arise from the direction would be external to the instrument and would involve disputes about ACMA’s exercise of s 125AA(1) rule‑making power, the content of any industry standard ACMA determines, or the application of that standard to particular carriers.

What the instrument provides as potential dispute mechanisms

• The direction contemplates the possibility that ACMA may confer functions and powers on the Telecommunications Industry Ombudsman for complaints about unauthorised Porting (s 5(3)). If so, consumer disputes about unauthorised Porting might be brought to the TIO, subject to the scope and procedural rules conferred. Any further litigation about legal questions (for example, administrative law challenges to ACMA’s standard, merits review of ACMA’s decisions, or judicial review of enforcement action) would proceed in the courts and is not addressed by the direction itself.

Potential litigation vectors (logical from the text, not recorded)

• Judicial review of ACMA’s industry standard determination: ACMA’s exercise of regulatory discretion under s 125AA(1), as constrained by this direction, could be subject to judicial review on public law grounds (procedural fairness, rationality, failure to comply with statutory constraints such as practicability and undue burden considerations in s 6(2)(a)). The direction requires ACMA to have regard to certain factors; failure to do so, or to act within the specified timetable, could be an argument in judicial review. The instrument itself, however, contains no record of such proceedings.

• Contractual disputes between CSPs or consumer claims: enforcement and remedies for harm caused by unauthorised Porting will depend on the content of any ACMA standard, the availability of TIO dispute resolution (if conferred), and existing contractual or tortious remedies. Again, none of that litigation history is recorded in the instrument.

Because the supplied text contains no litigation history, readers seeking records of any legal challenges must consult court databases, the ACMA’s publications and the Federal Register of Legislation for subsequent proceedings or decisions that reference this instrument or the ACMA’s industry standard that followed.

This instrument contains a number of operational and legal features that can produce unexpected compliance or implementation issues if read too cursorily. The following are concrete traps and points of friction drawn from the instrument’s text, with section citations and practical implications.

1. The direction targets industry portability processes only (s 4 definition of “Port”). If a number is transferred outside established industry portability mechanisms, the ACMA standard may not apply to that transfer. That means the standard’s coverage is functionally limited to recognised Porting channels.

2. The verification duty is placed on the Gaining CSP and operationalised as a pre‑acceptance requirement: the industry standard must require Gaining CSPs, prior to accepting the Port of a particular mobile service number, to use one of the applicable identity verification processes (s 6(1)(c)). The standard must also require that mobile carriage service providers not proceed with a Port unless one of the verification processes has been used by the Gaining CSP (s 6(1)(d)). Those two provisions together can create tight coordination demands between gaining and losing providers: the gaining provider must complete its verification before the Port is accepted, and the losing provider’s systems and personnel must comply with the “do not proceed” rule grounded on the gaining provider’s verification. Implementation protocols must ensure this inter‑party sequencing is reliable.

3. The SMS verification option contains an express technical constraint: the industry standard may include “the generation and sending by the mobile carriage service provider of a unique verification code by SMS message to the mobile service number that is to be Ported via a method that ensures it is transmitted to the mobile service number that is the subject of the Port request” (s 6(3)(a)(i)). The phrase “via a method that ensures it is transmitted to the mobile service number that is the subject of the Port request” is operationally demanding. CSPs must design delivery systems that demonstrate possession of the device/number; they may need to address scenarios where SMS delivery is rerouted, delayed, or intercepted.

4. Email verification is included as an option (s 6(3)(a)(ii)). Email addresses are often less secure than possession‑based checks and can belong to third parties or be stale in provider records. If ACMA includes email verification as an applicable process, CSPs must ensure record accuracy and secure transmission practices.

5. The instrument allows in‑store verification involving a live call to the customer’s device while the customer is identified in store (s 6(3)(b)). This requires retail staff training, private space to conduct calls, and systems to document the in‑store verification. Retail channels with franchisees or third‑party agents will need contractual alignment and audit trails.

6. Call centre callback procedures differ depending on whether the caller is the customer or an authorised representative (s 6(3)(c)(i)-(ii)). Providers must be able to verify not only that a callback reaches the device, but that the person initiating the request is authorised to act for the customer. Documentation and authorisation processes for representatives must be robust.

7. Biometric verification is explicitly contemplated (s 6(3)(d)). Use of biometrics triggers privacy, data security and potentially sensitive personal information obligations. The direction does not address retention limits, consent standards or cross‑border transfers for biometric data. Implementers must map biometrics to privacy law obligations outside the direction.

8. ACMA must avoid requiring processes that impose “undue financial and administrative burdens” (s 6(2)(a)(iv)). The term “undue” is subjective and will be a focal point in industry submissions. Providers should prepare costed impact statements to influence ACMA if certain methods are operationally or financially heavy for particular business models or customer classes.

9. The consumer awareness provisions are permissive: ACMA “may” specify minimum information requirements and the manner of provision (s 7(1)). This means consumer information obligations are discretionary for ACMA. Operators should not assume consumer awareness obligations will be mandated, but should be ready to comply if ACMA elects to include them.

10. Timelines are compressed: ACMA was directed to determine the standard by 28 February 2020 and commence the standard in whole by 30 April 2020 (s 5(2)). For regulated entities subject to transitional measures or system changes, those deadlines shorten implementation lead times and can affect supplier procurement cycles, staff training and testing windows.

11. The instrument contemplates conferral of functions to the TIO only with consent (s 5(3)). If the TIO declines, ACMA must design alternative complaint handling and remedies within its standard. Providers should prepare for both possibilities.

12. The direction does not itself prescribe enforcement mechanisms or record‑keeping requirements. If ACMA’s standard later imposes such obligations, those will be binding; until then, the immediate legal exposure is not fully specified in the direction.

These “gotchas” are concrete operational and legal frictions that compliance teams should address when planning implementation, stakeholder submissions to ACMA, or drafting internal policies. They arise directly from the instrument’s wording and the operational demands it places on ACMA and industry participants.

The direction requires ACMA to create an industry standard that will mandate certain verification steps before a Port can be accepted. For mobile carriage service providers (CSPs), especially Gaining CSPs, the practical compliance pathway is to prepare for the likely requirements the ACMA standard must impose under the direction. The following steps ground compliance planning in the instrument’s text (citations provided).

1. Understand the scope and timeline

• Note that the direction requires ACMA to determine the standard by 28 February 2020 and for the standard to commence in whole by 30 April 2020 (s 5(2)). Prepare to engage promptly with ACMA consultations and to implement changes within compressed timeframes.

2. Map existing Porting processes to the direction’s requirements

• Review your existing pre‑Porting workflows to identify current identity verification steps. ACMA must have regard to existing processes providers have already implemented or are implementing (s 6(2)(b)), so documenting what you already do will be valuable input in submissions and for internal compliance mapping.

3. Adopt or be ready to implement at least one ACMA‑specified verification process for Gaining CSPs

• The industry standard must require Gaining CSPs, prior to accepting the Port of a particular mobile service number, to use one of the applicable identity verification processes specified in the industry standard (s 6(1)(c)). ACMA may prescribe various processes listed in s 6(3): SMS OTPs to the number, email verification, in‑store callback, call centre callback for customers and authorised representatives, and biometric verification.

• Operationalise systems to generate and log unique verification codes and to verify delivery to the mobile service number that is the subject of the Port request, if ACMA includes SMS OTPs (s 6(3)(a)(i)). Ensure SMS gateway reliability and logging capability to demonstrate compliance.

4. Strengthen record‑keeping and audit trails

• Although the direction does not itself prescribe record‑keeping, the requirement that no Port proceed unless verification has been used (s 6(1)(d)) implies providers must be able to evidence that verification occurred. Implement audit trails that capture the verification method used, timestamp, responder, and outcome.

5. Update retail and call centre protocols

• If ACMA includes in‑store methods (s 6(3)(b)), ensure retail staff training, identity documents checks, in‑store call procedures and recording/confirmation practices are established. For call centre callbacks (s 6(3)(c)), design scripts and verification questions, and capability for callbacks to the device number to confirm possession.

6. Prepare for biometric verification if included

• Biometric verification (s 6(3)(d)) requires careful alignment with privacy obligations. Before deployment, map biometric data flows, obtain lawful bases for collection and processing, implement data minimisation and retention policies, and ensure secure storage and transmission. Consent mechanisms and data breach protocols should be in place.

7. Segment verification rules by customer type

• ACMA should identify which processes apply to which customer types and may specify different processes for residential, SME and corporate customers (s 6(3) preamble). Prepare differentiated procedures and exceptions policies, and cost estimates for implementing higher‑security checks for business or high‑value customers.

8. Prepare consumer awareness materials and complaint pathways

• The industry standard may specify minimum information and advice to be provided to customers about identification verification and how to report suspected fraudulent Porting to law enforcement and consumer services (s 7(1)(a)-(b)). Pre‑draft consumer notices, website pages, SMS templates and call centre scripts that explain verification steps and reporting channels (AFP, State/Territory Police, consumer support services).

• If the TIO is conferrred functions and powers (s 5(3)), ensure internal complaint escalation and data sharing arrangements with the TIO align with the TIO’s remit and any confidentiality requirements.

9. Perform impact and cost assessments

• The direction requires ACMA to avoid imposing undue financial and administrative burdens (s 6(2)(a)(iv)). Providers should quantify implementation costs (system upgrades, staffing, SMS/biometric supplier contracts, training) and prepare submissions to ACMA to influence design choices and transitional arrangements.

10. Revise customer contracts and internal policies

• Update terms and conditions and privacy notices (where necessary) to reflect verification processes and any biometric data collection. Ensure authorised representative authorisation procedures are documented and supported with evidence.

11. Test interoperability and sequencing with inter‑carrier porting processes

• Because the direction’s obligations create a pre‑acceptance verification step for Gaining CSPs and a “do not proceed” duty (s 6(1)(d)), test operational sequencing with losing carriers and the industry portability hub to ensure that verification completion can be reliably signalled and logged before Ports are executed.

12. Engage proactively with ACMA and industry bodies

• Submissions that document existing practices, costs and technical constraints will be relevant to ACMA because it must have regard to existing verification processes and avoid undue burdens (s 6(2)(a)(iv), s 6(2)(b)). Engage through ACMA consultation processes and industry forums to shape the standard.

13. Monitor for the final ACMA standard and implementation guidance

• Once ACMA issues the industry standard under s 125AA(1), read it closely for any enforcement, reporting, or transitional provisions that were not specified in the direction. Adjust implementation plans to meet any deadlines or certification tests ACMA requires.

14. Coordinate with third‑party vendors and retail partners

• SMS gateways, biometric service providers, call centre outsourcers and retail agents need contractual changes and SLAs aligned with the verification and logging requirements. Ensure vendors can meet the technical and evidentiary standards likely to be required.

15. Plan for incident response and reporting

• Even with verification, incidents may occur. Create processes for handling suspected unauthorised Porting events, including customer communication, preservation of logs, cooperation with any TIO process (if conferred), and signposting to law enforcement consistent with s 7(1)(a)(ii) if the standard includes such obligations.

These practical steps map directly to the direction’s text and to the likely contours of the ACMA standard the instrument mandates. They are designed to ensure that a Gaining CSP can demonstrate compliance with a requirement that Ports not proceed unless an ACMA‑specified pre‑Porting verification process has been used (s 6(1)(c)-(d)), while aligning with the direction’s constraints on practicability and burden (s 6(2)(a)(i)-(iv)).