Telecommunications (Mobile Number Pre-Porting Additional Identity Verification) Industry Standard 2020

The instrument rests on a small set of interlocking legal and operational concepts, each defined in the standard and used to limit the scope and form of the verification requirement (s 6, Schedule 1).

• Rights of use holder and mobile service number. The central legal subject is the rights of use holder of a mobile service number. That term references the Rights of Use of Numbers Industry Code (ACIF C566:2005) (s 6). A mobile service number is defined as a digital mobile number issued by a mobile carriage service provider in connection with a public mobile telecommunications service (s 6). The standard therefore targets portability of numbers used in mainstream mobile services (satellite services are excluded by definition) (s 6).

• Gaining and losing carriage service providers. The procedural duties fall on the gaining carriage service provider,the CSP to which a number has been or is to be ported (s 6). The losing CSP (from which the number departs) is referenced in definitions but the explicit verification duties are on the gaining CSP (see s 8).

• Additional identity verification processes. Section 8(2) sets out primary processes: (a) confirmation of direct and immediate access to the device associated with the number (with practical examples for retail, call‑centre and online environments), (b) a unique verification code via SMS with immediate receipt confirmation, (c) biometric data, and (d) a defined approach for large business customers (s 8(2)). Subsection 8(3) provides fallbacks where those processes cannot confirm identity: document sighting per Schedule 1 (category A and B documents) or use of a government online verification service (s 8(3), Schedule 1).

• Documentary tiers and rules. Schedule 1 structures documentary verification into Category A and Category B documents. The Schedule sets combinations that will satisfy a sighted‑document verification (either two Category A documents or one Category A and two Category B documents), prohibits using the same type of document twice, and imposes currency and matching requirements (Schedule 1 cl 3-5, Table 1 and Table 2).

• Government online verification. Verification via a government online verification service requires the requester to supply identifying numbers for at least two unique government documents, the issuing State or Territory (or Commonwealth), and, if required, further date information; the provider must verify the information against the issuing agency’s databases for both documents (s 8(4)).

• Large business customers. A distinct route applies where a large business customer ports numbers under contract: the gaining CSP must confirm the requester is the authorised representative and that they have direct and immediate access to the primary number associated with the large business customer (s 8(2)(d); s 6 defines “large business customer” with a $40,000 annual spend threshold and negotiability criteria).

• Publication and complaint handling. Providers must publish information advising customers about the additional verification and steps to take if they suspect fraud (s 9). The Telecommunications Industry Ombudsman is given a clear mandate to handle complaints relating to the standard (s 10).

• Privacy and other legal limits. The instrument includes a statutory reminder that it does not derogate from Privacy Act requirements (s 4 Note 2) and cross‑references definitions and instruments (s 7, s 6), which shapes what verification technologies and data practices can lawfully be adopted.

These concepts together produce a compliance architecture: before a port is initiated, gaining CSPs must undertake specified real‑world actions (device access, SMS exchange, biometrics, document sighting, or government verification) and be satisfied of the requester’s status; they must also publish certain consumer information and handle complaints via the TIO framework.

The standard affects several distinct groups differently: gaining mobile carriage service providers, customers (including large business customers and authorised representatives), losing carriage service providers indirectly, consumers of mobile services, and the Telecommunications Industry Ombudsman.

• Gaining carriage service providers. The primary legal addressee is the gaining CSP. Section 8 expressly imposes the verification obligation “prior to initiating the port” and “for all customers” (s 8(1)-(2)). Gaining CSPs must deploy one or more of the specified verification mechanisms (device access confirmation, unique SMS code with immediate confirmation, biometric data, or the large business rule) and, where necessary, fall back to document‑based or government online verification (s 8(2)-(3), Schedule 1). They must ensure that no port proceeds unless they are satisfied the requester is the customer or authorised representative (s 8(6)-(7)). They must also publish the specified website notices (s 9) and must not charge for SMS messages used in verification (s 8(8)). Practically, these duties require operational changes to call‑centre and retail procedures, IT systems to send and detect SMS confirmations, identity‑verification workflows, staff training, and policy documents to evidence satisfaction decisions.

• Customers (individual consumers). Every customer whose mobile service number may be ported is affected by an added verification step. For typical consumer ports, the gaining CSP must confirm direct and immediate access to the device or send a unique verification code to the mobile number to be ported (s 8(2)(a)-(b)). If the customer does not have the device (lost, stolen), CSPs may require additional documentary proof or a government online verification (s 8(3)), with Schedule 1 prescribing acceptable documents and currency/matching rules. The standard states providers may indicate what to do if an SMS is received but a port was not requested, which has consumer safety implications (s 8(2)(b) Note).

• Customers (authorised representatives). The standard contemplates authorised representatives acting on behalf of customers. A gaining CSP must be satisfied that the requester is either the customer or the authorised representative (s 8(6)). For authorised representatives, the same verification processes apply, including call‑back to the number, unique SMS, or document/government verification where appropriate (s 8(2)(a)(b), s 8(3)).

• Large business customers. The instrument defines “large business customer” by reference to negotiability and an annual spend threshold of $40,000 (s 6). For ports of mobile service numbers under contract with a large business customer, the gaining CSP may verify the requester by confirming they are the authorised representative and have direct and immediate access to the primary number associated with the large business customer (s 8(2)(d)). The definition includes that a primary number is nominated by the large business customer to be associated with the authorised representative (s 6).

• Losing carriage service providers. Losing CSPs are not given the primary verification duty by the standard; however, they are affected indirectly. The standard’s aim to block unauthorised ports may reduce dispute volumes and interactions between losing and gaining CSPs under existing porting procedures (s 5). The losing CSP is also referenced in the definitions (s 6), and operationally will still process ports as per existing portability processes outside the additional verification that the gaining CSP must undertake.

• Telecommunications Industry Ombudsman. The standard expressly confers functions and powers on the TIO to receive, investigate, facilitate resolution of, make determinations, give directions in relation to, and report on customer complaints about matters under the industry standard (s 10). That expands the TIO’s formal remit for disputes arising from application of this standard.

• Third parties and government agencies. Government online verification services and the agencies that maintain identity databases feature in the verification fallback. Schedule 1 and s 8(4) require interaction with government databases where online verification is used. Defence entities are engaged by reference to access‑controlled defence sites where certain documents (foreign military ID) are involved (Schedule 1 cl 5(b)).

Who pays and who decides. The gaining CSP bears implementation and operational costs to establish and run verification processes, maintain web publication, and handle TIO complaints. Customers bear frictional costs in providing access to devices, documents or participating in verification; the standard forbids charging for SMS verification but does not prohibit other charges. The gaining CSP ultimately decides whether it is satisfied under s 8(6) and hence whether to proceed with the port.

This section summarises the legal obligations imposed on gaining carriage service providers and associated rights or protections that appear in the instrument. Each obligation is grounded in the statutory text.

Duties on gaining carriage service providers

• Use an additional identity verification process prior to initiating any port. For all customers, a gaining CSP must use at least one of the processes listed in s 8(2) before initiating the port (s 8(2), s 8(5)). The list in s 8(2) is exhaustive for the primary processes, with an explicit fallback in s 8(3).

• Be satisfied of requester status before proceeding. After completing the verification process, the gaining CSP must be satisfied that the requester is the customer or the authorised representative before proceeding with a port (s 8(6)-(7)). The standard makes satisfaction a prerequisite to proceeding.

• No fee for SMS verification. A gaining CSP must not charge a fee to a customer or the customer’s authorised representative for an SMS message used to complete an additional identity verification process (s 8(8)).

• Publication obligations. Providers must publish on their websites that an additional identity verification process will be used and that customers who suspect fraudulent porting should report to the Australian Federal Police or state/territory police and relevant government support services (s 9(a)-(b)). The standard suggests examples of such services (Scamwatch and IDCARE) but these are illustrative (s 9 Note).

• Documentary verification rules. If using document‑based verification, gaining CSPs must follow Schedule 1: accept two Category A documents, or one A plus two B documents; not use the same type of document twice; ensure documents are current or reasonably recent as required; match names or accept name change evidence; and meet special rules for foreign military ID and expiry (Schedule 1 cl 3-5, Tables 1 and 2).

• Government online verification rules. If using a government online verification service, the gaining CSP must collect identifying numbers for at least two unique government documents, identifying issuing State/Territory or Commonwealth, and any additional date information required by the service, and must verify each of the two documents on the service (s 8(4)). The standard describes the matching outcome as accepted or rejected (s 8(4) Note).

• Complaints handling and TIO engagement. The standard confers functions on the Telecommunications Industry Ombudsman to handle complaints falling within this instrument (s 10). Providers must facilitate access to complaint resolution through the TIO framework.

Rights and constraints

• Right to choose among verification methods. Gaining CSPs may use any one of the prescribed primary verification processes (device access confirmation, SMS code with immediate confirmation, biometrics, or the large business rule) for any customer port (s 8(2)). Where those are insufficient, they may choose between Schedule 1 documentary verification or government online verification (s 8(3)).

• Discretion to be satisfied. The standard requires the gaining CSP to be satisfied the requester is the customer or authorised representative (s 8(6)). That gives carriers a degree of operational discretion: they choose which permissible verification process to rely on and must reach a satisfaction decision before proceeding (s 8(7)). The standard does not prescribe detailed evidentiary thresholds beyond the document and online verification rules.

• Privacy constraints. The instrument provides that it does not derogate from the Privacy Act 1988 (s 4 Note 2). Consequently, any processing of biometric data or identity document details will remain subject to privacy law and associated limits even where permitted by the standard.

Interplay with existing porting rules

• Additional obligations. The standard emphasises the pre‑porting identity verification obligations are in addition to existing customer authorisation requirements in the Mobile Number Portability Code and Customer Authorisation Industry Guideline (s 4 Note 1). It does not replace existing porting rules but layers further obligations on the gaining CSP.

Operational implications of duties

• Recordkeeping and evidence. Although the standard does not specify record‑retention periods or formats, gaining CSPs will need to document the verification steps taken, the evidence relied upon (SMS confirmation records, biometric capture logs, document checks, or government verification results), and the decision to be satisfied, both for internal audit and for TIO complaint resolution (s 8(5)-(7), s 10).

• Special cases. The Schedule includes special handling for foreign military ID shown only in access‑controlled defence sites and currency and matching rules for documents with or without expiry dates (Schedule 1 cl 5(a)-(b), (c)). Gaining CSPs must adopt procedures to deal with such cases.

The instrument itself is an industry standard made under subsection 125AA(1) of the Telecommunications Act 1997 (s 3). It imposes mandatory duties on gaining CSPs but does not, within its text, set out specific monetary penalties or criminal sanctions for non‑compliance. Instead, the enforcement architecture visible within the instrument is administrative and complaint‑based, centring on the Telecommunications Industry Ombudsman and the underlying regulatory powers in the Telecommunications Act.

Enforcement mechanisms present in the instrument

• Telecommunications Industry Ombudsman powers. Section 10 confers on the TIO the functions and powers to receive, investigate, facilitate resolution of, make determinations in relation to, give directions in relation to, and report on customer complaints about matters referred to in the industry standard (s 10). That provides a grievance and dispute resolution pathway for customers and a regulatory compliance signal: the TIO can make determinations and give directions in respect of complaints under the standard.

• Regulatory base: Act and Direction. The standard is made under the Telecommunications Act, and compliance with it is expected as an industry standard under that statutory regime (s 3). Non‑compliance with an industry standard may, depending on broader Telecommunications Act enforcement provisions and any applicable Directions, expose a provider to regulatory action by the Australian Communications and Media Authority or other powers under the Act; however, this instrument does not itself cite specific enforcement sanctions or penalties, and the text does not create direct monetary penalties.

• Complaints and consumer protection. The requirement to publish information about reporting to the Australian Federal Police and state or territory police (s 9) signals that criminal investigations may be relevant for unauthorised porting detected as wrongdoing, but the industry standard does not itself create criminal offences. The instrument also notes government support services but does not create enforceable private rights beyond the TIO complaint machinery.

Practical enforcement consequences for providers

• TIO determinations and directions. Where a customer complains that a gaining CSP failed to follow required additional verification steps, the TIO is empowered to investigate and make determinations and give directions (s 10). Those determinations may require remedial action, customer redress, operational changes, or other remedies authorised by the TIO’s statutory powers as applied to matters referred by or under this industry standard.

• Regulatory escalation. Although not specified in the text, non‑compliance with industry standards ordinarily places a provider at increased regulatory risk under the Telecommunications Act. The standard being made under s 125AA(1) situates it within the Act’s enforcement framework; providers should assume regulators and industry dispute resolution mechanisms may treat non‑compliance seriously.

Limitations in the instrument

• No express monetary fines or criminal penalties within the standard. The instrument does not specify fines, infringement notices, or criminal sanctions for breach of the standard itself. Any financial or other regulatory consequences must therefore arise under the Telecommunications Act or separate enforcement instruments, not from express provisions in this standard.

• Reliance on complaint mechanisms. Enforcement visibility in the standard is primarily through the TIO’s functions and through police reporting for suspected criminal conduct (s 9, s 10), rather than a detailed enforcement schedule in the standard itself.

For practitioners advising clients, note that the instrument creates operational obligations that, if not met, can result in customer complaints and TIO directions. Providers should therefore treat the standard as binding operational law under the Telecommunications Act and factor potential regulatory follow‑up and reputational risk into compliance planning.

The industry standard intersects with a number of statutory instruments and bodies of law, and the text both cross‑references other instruments and contains notes reminding providers of constraints. The instrument itself defines many terms by reference to other instruments or Acts, and it inserts obligations that sit alongside pre‑existing industry codes.

Direct statutory and instrument cross‑references

• Telecommunications Act 1997. The industry standard is made under subsection 125AA(1) of the Telecommunications Act 1997 and in accordance with a 2019 Direction (s 3). The Act is therefore the parent statute authorising the standard. Several expressions used in the standard are defined in the Act (s 6 Note), including “carriage service”, “carriage service provider”, “carrier”, and “public mobile telecommunications service”.

• Privacy Act 1988. The instrument explicitly states that neither an industry code nor an industry standard derogates from a requirement made by or under the Privacy Act 1988 (s 4 Note 2). This is a direct legal constraint on verification measures, particularly where biometric data or personal identity document information is collected and processed. Providers must therefore ensure biometric capture, storage, disclosure, automated matching, or use of government online verification services complies with the Privacy Act and any applicable Australian Privacy Principles.

• Mobile Number Portability Code and Customer Authorisation Industry Guideline. The standard is expressly additional to customer authorisation requirements in the Mobile Number Portability Code (C570:2009) and the Customer Authorisation Industry Guideline (G651:2017) (s 4 Note 1). It therefore layers additional pre‑port steps on top of prior code obligations; providers must continue to comply with existing porting codes even as they adopt the new verification practices.

• Rights of Use of Numbers Industry Code (ACIF C566:2005). The term “rights of use holder” is given the meaning in ACIF C566:2005 (s 6). That code remains relevant to determine who is the legal rights holder for the number and thus who should be the subject of verification.

• Defence Act 1903. Several terms relating to defence premises and access control are drawn from s 71A of the Defence Act 1903 (s 6). Schedule 1 requires that a foreign military ID be shown in an access‑controlled defence site to be accepted as a Category A document (Schedule 1 cl 5(b)). That cross‑reference creates a practical interaction where certain documents can only be validly checked in particular physical environments subject to defence law.

• Telecommunications Numbering Plan 2015. Definitions for “digital mobile number” and “special services number” reference Schedule 5 and section 31 of the Numbering Plan respectively (s 6). This ties the instrument to existing numbering rules and boundaries.

• Government online verification services. The standard anticipates use of government online verification services that match information against issuing agency databases (s 8(3)(b), s 8(4) Note). Providers must rely on those services only in ways authorised by the relevant government agencies and ensure the data exchange complies with any agreements or statutory rules governing those services.

Operational and legal interactions to note

• Privacy compliance when using biometrics. The standard permits use of biometric data (s 8(2)(c)), but any collection and processing of biometric identifiers will be regulated by the Privacy Act. The instrument’s non‑derogation note (s 4 Note 2) means that adoption of biometrics must be assessed against privacy obligations, including purpose limitation, security, and notice requirements.

• Contractual and consumer law. The standard applies to customer contracts and standard form contracts (s 6 definition of customer contract). Providers must ensure that contractual terms, customer onboarding processes, and any charges (except for SMS verification) align with consumer law and the standard’s rules. The prohibition on charging for SMS verification is an express contractual constraint on what providers may bill for (s 8(8)).

• Criminal law and police reporting. The standard directs providers to advise customers to report suspected fraudulent ports to the Australian Federal Police or relevant State/Territory police (s 9(b)(i)). That positions criminal investigation as a complementary enforcement route where an unauthorised port involves fraud or other criminality.

• Industry and regulatory codes. Because the instrument is additional to existing codes (s 4 Note 1), providers must coordinate compliance across multiple industry obligations: the Mobile Number Portability Code, Rights of Use Code, the industry standard, and any specific directions from the Australian Communications and Media Authority or other regulators.

• TIO jurisdiction and remedies. Section 10 confers complaint‑handling functions on the TIO for matters under this standard, integrating the instrument into the TIO’s statutory dispute resolution system and possibly into its published determinations and guidance.

In short, the standard modifies the pre‑existing porting framework by imposing verification duties and sits alongside and within the broader web of privacy, numbering, defence and industry code obligations. Practitioners advising clients should map operational processes to these intersecting rules, including contractual terms, privacy compliance for identity data (particularly biometrics), and the appropriate use and contractualisation of government online verification services.

The instrument itself contains limited historical data. The key points that appear in the text are:

• Instrument title and year. The industry standard is titled the Telecommunications (Mobile Number Pre‑Porting Additional Identity Verification) Industry Standard 2020 (see s 1, repeated across the instrument).

• Commencement date. The standard commenced on 30 April 2020 (s 2).

• Authority. The standard was made under subsection 125AA(1) of the Telecommunications Act 1997 and in accordance with the Telecommunications (Industry Standard for Mobile Number Pre‑Porting Additional Identity Verification) Direction 2019 (s 3). That locates the instrument in the 2019 policy process that led to a 2020 instrument.

• References to other instruments as amended. Section 7 states that a reference to any other legislative instrument is to that instrument as in force from time to time and that references to non‑legislative instruments are likewise to those instruments as in force from time to time (s 7(a)-(b)). This clause operates as a static drafting rule ensuring cross‑references track later amendments to the other instruments named (for example, the Mobile Number Portability Code or Rights of Use Code).

What the instrument does not record

• No internal amendment record is included in the text. The instrument does not include a history of amendments within the body of the text provided. There is no schedule describing prior versions or subsequent amendments. The only temporal details are the 2020 date and the commencement date.

• No repeals or supersessions listed. The standard does not state that it repeals or replaces any prior industry standard; instead it states it is additional to certain codes (s 4 Note 1). There is no in‑instrument record of replacement.

How to check amendment history in practice

• Federal Register of Legislation. Section 7 Note 3 points to the Federal Register of Legislation as the repository for Commonwealth Acts and legislative instruments. For a full amendment history or to confirm whether the industry standard has been superseded or amended since commencement, practitioners must consult the Federal Register of Legislation, which records registration, commencement, and subsequent amendments.

• Associated Direction and legislative context. Because the instrument was made in accordance with a Direction dated 2019, practitioners should also check the Direction itself for any conditions or amendment history and for related instruments that may have been issued under the Telecommunications Act to change or reinforce the standard.

Short summary for advisers: the instrument is a 2020 standard that commenced 30 April 2020, made under s 125AA(1) of the Telecommunications Act and in accordance with a 2019 Direction. The text does not record later amendments; verify currentness and any amendments or revocations on the Federal Register of Legislation and review the Direction 2019 and relevant industry codes for subsequent changes.

The text of this industry standard does not record any litigation history. It contains no references to judicial decisions, appeals, or matters concluded through courts. It also does not reference prior administrative determinations or tribunal decisions that test its provisions.

Practical advice for checking litigation history

• Search court and tribunal records. Because the instrument is silent on litigation, practitioners seeking to understand whether the standard has been subject to judicial challenge, whether its obligations have been litigated in disputes between providers and customers, or whether regulators have taken enforcement action that reached judicial review should search relevant Australian court databases (Federal Court, state Supreme Courts) and tribunal records.

• Telecommunications Industry Ombudsman determinations. The instrument confers functions on the TIO (s 10). Many disputes under industry standards will be resolved in TIO determinations rather than courts. To capture the body of decisions applying or interpreting the standard, review TIO complaint determinations and published reports for matters relating to pre‑porting verification and unauthorised porting.

• Administrative and regulatory action. Enforcement or regulatory action under the Telecommunications Act may be pursued by the Australian Communications and Media Authority or other regulators. Check ACMA publications, enforcement records, and public notices for any actions concerning compliance with this standard.

What can be inferred from the instrument about litigation risk

• Dispute resolution via TIO. The instrument’s explicit conferral of powers on the TIO (s 10) suggests the drafters expected many disputes arising under the standard to be channelled through industry dispute resolution rather than immediate court litigation.

• Potential for administrative review. Because the standard imposes duties under the Telecommunications Act, providers may have administrative remedies if regulators or the TIO impose directions or determinations; those remedies could, in principle, give rise to judicial review litigation. The instrument itself makes no mention of such cases.

In sum, the instrument contains no internal record of litigation; for an authoritative update on litigation or contested interpretations of the standard, consult case law databases, TIO determinations, and regulator records.

This industry standard contains numerous specific rules and practical traps that can catch providers or advisers who rely on general understanding of identity verification. The following items are concrete, textual “gotchas” drawn from the instrument and Schedule 1.

1. The verification obligation applies to every port and all customers. Section 8(2) requires gaining CSPs to use at least one additional identity verification process “for all customers” prior to initiating the port. It is not limited to high‑risk ports or particular customer segments. That means processes and systems must be applied comprehensively.

2. You must be satisfied before proceeding. A gaining CSP cannot proceed with a port unless it is satisfied that the requester is the customer or the authorised representative (s 8(6)-(7)). Satisfaction is a decision point; the standard does not prescribe a precise legal standard of proof, but it does prescribe specific acceptable methods and documentary rules. Operationally, carriers must record the basis for their satisfaction to defend against complaints.

3. SMS verification cannot be charged. Providers must not charge customers or their authorised representatives for an SMS message used to complete the additional identity verification process (s 8(8)). This is an express billing constraint and prohibits a fee irrespective of contract terms.

4. Immediate confirmation requirement for SMS codes. The unique verification code mechanism requires not only that the provider sends a code by SMS to the number to be ported but that the provider receives immediate confirmation via SMS that the recipient received the code (s 8(2)(b)(i)-(ii)). The word “immediate” implies operational expectations about monitoring and confirmation windows; providers should retain logs that show the timestamped send and receipt.

5. Device access examples are prescriptive. Section 8(2)(a) provides specific examples in retail and call centre environments of calling back the number to confirm receipt. These examples are operationally instructive. In a retail store, calling the mobile service number while the requester is present and visually confirming the call is received is an example. In a call centre, calling back to the number to confirm rights‑holder status or authorised representative status is an example (s 8(2)(a) examples).

6. Government online verification requires two documents. If the gaining CSP uses a government online verification service under s 8(3)(b), s 8(4) requires the requester to provide identifying numbers for at least two unique government documents and the provider must verify information for each of those two documents on the service. Single‑document online verification is not sufficient under this standard.

7. Documentary combinations and restrictions. Schedule 1 requires either two Category A documents or one Category A plus two Category B documents (Schedule 1 cl 3). The same type of document may not be used twice in the identity verification process (Schedule 1 cl 4). Providers must ensure they do not accept, for example, two different driver licences of the same type or two of the same document type repeated.

8. Currency and matching of documents. If a document (other than an Australian passport) includes an expiry date, it must not be expired (Schedule 1 cl 5(a)). Documents without expiry must be reasonably recent (Schedule 1 cl 5(c)). The name in the Category A or B document generally must match the name of the requester unless satisfactory documentary evidence of a name change is produced (Schedule 1 cl 5(d)-(e)). Failure to apply these tests could invalidate the verification.

9. Limits on foreign documents and financial documents. Schedule 1 Table 2 excludes documents from foreign banks or institutions in its Category B Item 1 (Table 2(1) notes that documents from foreign banks or institutions are not acceptable). Category A includes certain foreign passports but requires a valid entry stamp or visa issued by the Australian government (Table 1 Item 5). Practitioners must check the origin and content of documents, not assume foreign documents are acceptable.

10. Foreign military ID and defence access. A foreign military ID is a Category A document (Table 1 Item 4) but Schedule 1 cl 5(b) requires it to be shown in an access‑controlled defence site. That means a foreign military ID cannot be accepted by a retail store or call centre unless the document was sighted at an access‑controlled defence site, which limits practicality.

11. Large business exception is narrow. For large business customers (as defined in s 6), the gaining CSP may verify by confirming the requester is the authorised representative and has direct and immediate access to the primary number associated with the large business customer (s 8(2)(d)). The definition of “large business customer” includes an annual spend threshold and negotiability of contract terms, which may exclude mid‑sized organisations; providers must carefully check whether a customer meets that definition before applying the simplified large business route.

12. Publication obligations are precise. The website content must advise that additional verification will be used and direct customers to report suspected fraudulent ports to police and relevant government support services (s 9). Failure to publish this specific advice could form the basis of TIO complaints.

13. Biometric data is allowed but privacy constrained. Section 8(2)(c) permits use of biometric data. However, the instrument’s note that it does not derogate from the Privacy Act 1988 (s 4 Note 2) means biometric capture and retention must be compliant with privacy law. The standard does not itself set data retention or security rules for biometric data.

14. No express penalty in the standard. The instrument does not specify fines or sanctions for non‑compliance within its text; enforcement is routed through complaint mechanisms (s 10) and underlying Act powers. Providers should not assume the absence of express monetary penalties eliminates enforcement risk.

15. Records and proof for TIO. Given the TIO’s functions under s 10, providers should expect to produce proof of the verification steps taken if a complaint is raised. The standard’s multiple procedural details (SMS timestamps, document sighting records, government online verification results) become evidentiary materials in disputes.

These textual “gotchas” are concrete, actionable items that carriers and advisers must address in policy, training and systems design to avoid compliance failure and to be able to demonstrate compliance when complaints arise.

Complying with the industry standard requires a combination of policy, operational controls, documentation, technical systems and staff training. The following practical checklist maps the standard’s textual requirements (cited) to discrete compliance actions.

1. Implement mandatory pre‑port verification workflows covering all customers (s 8(2), s 8(5)).

   • Ensure every port request triggers a verification workflow before the port is initiated.
   • Make the workflow mandatory for all customer types and not dependent on risk profiling, because the text requires these processes “for all customers” (s 8(2)).

2. Adopt at least one primary verification method and record the choice (s 8(2)).

   • Device access confirmation: establish retail and call‑centre procedures to call back the number and confirm receipt while the requester is present (s 8(2)(a) examples). Log call timestamps, employee IDs, and any customer acknowledgements.
   • SMS unique verification code: implement secure SMS code generation, immediate receipt detection and logging. Ensure the system logs the outgoing code, the incoming confirmation, and associated timestamps (s 8(2)(b)(i)-(ii)). Keep these logs to evidence “immediate confirmation”.
   • Biometric verification: if used, deploy biometric capture with consent, documented privacy notices and secure storage in compliance with the Privacy Act (s 8(2)(c); s 4 Note 2).
   • Large business customers: for customers meeting the large business definition (s 6), implement a process to confirm the requester is an authorised representative and has direct access to the nominated primary number (s 8(2)(d)). Maintain written records of the large business customer’s nominated primary number.

3. Maintain fallback document and government online verification processes (s 8(3), Schedule 1).

   • Document‑based verification: implement a document‑sighting process matching Schedule 1 requirements,accept two Category A documents or one A plus two B documents, do not accept the same document type twice, check expiry where required, and verify name matches or acceptable name change evidence (Schedule 1 cl 3-5, Tables 1-2). Train staff to identify acceptable documents and to refuse non‑compliant combinations.
   • Government online verification: establish contractual or technical access to authorised government online verification services. Ensure the intake process collects identifying numbers for at least two government documents, the State/Territory of issue (or Commonwealth confirmation), and any additional date information required by the service; log successful matches for both documents (s 8(4)).

4. Ensure billing and pricing comply with the SMS prohibition (s 8(8)).

   • Remove charges for SMS messages used in verification workflows. Update billing systems, price lists, customer contracts and staff training to prevent inadvertent charging for those SMS messages.

5. Update customer communications and website content (s 9).

   • Publish the required advice on the provider’s website: (a) that additional identity verification will be used to verify porting requesters, and (b) that customers who suspect fraudulent ports should report to the AFP or relevant police and to government support services (s 9). Include clear instructions for customers who receive an unsolicited SMS verification code.

6. Prepare TIO complaint response processes (s 10).

   • Document internal escalation and evidence collation procedures for any customer complaints concerning ports and verification steps.
   • Ensure staff know how to respond to TIO enquiries and how to provide logs, call recordings, document sighting checklists, government verification results and biometric consent records.

7. Privacy impact and data governance.

   • Conduct privacy impact assessments for any biometric systems or where identity documents/details are collected, consistent with the Privacy Act (s 4 Note 2).
   • Implement minimum necessary data collection, retention schedules, encryption and access controls for identity data and SMS logs. If using government online verification services, ensure data exchange adheres to agency terms and privacy requirements.

8. Operational training and audit.

   • Train retail, field and call‑centre staff on the examples and required steps in s 8(2)(a) and on documentary rules in Schedule 1.
   • Maintain audit trails for verification activities and periodically audit compliance against the standard, recording corrective actions where gaps are found.

9. Special case handling.

   • If a foreign military ID is presented, ensure it is sighted in an access‑controlled defence site as required by Schedule 1 cl 5(b).
   • For documents without expiry dates, ensure staff are trained to assess recency (Schedule 1 cl 5(c)) and to ask for additional evidence where appropriate.
   • For customers who report their device as lost or stolen, move to the Schedule 1 documentary route or government online verification per s 8(3) and document the rationale.

10. Contract and policy updates.

• Update standard form customer contracts where necessary to reflect that the provider will use additional verification processes and to document the provider’s procedures (s 6 definition of customer contract acknowledges standard form contracts).
• Update internal policies defining what constitutes being “satisfied” under s 8(6) and keep those policies consistent with Schedule 1 and government online verification rules.

11. Evidence retention for dispute resolution.

• Keep structured, timestamped logs of SMS sends and receipts, call callbacks, document sighting checklists with employee attestations, government verification matching results and biometric consents, for a period aligned with regulatory guidance or internal policy. While the standard does not prescribe retention periods, these records will be needed if the TIO investigates (s 10).

12. Review cross‑reference obligations.

• Ensure practices are consistent with the Mobile Number Portability Code and Customer Authorisation Industry Guideline (s 4 Note 1), with the Rights of Use Code for determining rights holders, and with the Privacy Act (s 4 Note 2). Where reliance on a government online verification service is used, ensure service terms are complied with.

This practical checklist maps directly to the text of the instrument (s 8, s 9, s 10, Schedule 1) and provides concrete operational steps that a gaining CSP should implement to meet the industry standard and to prepare for TIO investigations or customer complaints.