Telecommunications Service Provider (Customer Identity Authentication) Determination 2022

The Determination revolves around several defined concepts that determine coverage and trigger obligations. The first central concept is "high‑risk customer interaction", which is an interaction during which one or more "high‑risk customer transactions" are requested (section 6). A "high‑risk customer transaction" is defined broadly to include actions that may result in loss of access to a telecommunications service, changes to personal or account security information, addition or removal of authorised representatives, disclosure of customer personal or business information, or imposition of additional ongoing or large one‑off charges (section 6). The definition also provides examples and carve outs, for instance excluding certain transfers of title in the context of domestic or family violence and excluding ports covered by the Mobile Number Pre‑Porting Identity Verification standard (section 6).

"Identity authentication process" is a core operational construct. Sections 9 to 12 prescribe a menu of allowed processes. Where the high‑risk interaction is initiated by the requesting person, the carrier must use multi‑factor authentication in one of three configurations: two account information authenticators, two personal information authenticators, or one of each (section 9(1)). If the provider initiates the interaction by calling the public number listed, a lesser requirement applies: at least one personal information authenticator (section 9(2)). In all cases, carriers must also use at least one of the processes listed in subsection 9(3) to confirm the requesting person has direct and immediate access to the service or public number, or by using a unique verification code/secure hyperlink sent to a validated contact point, biometric data, category A documents (Schedule 1), or a cryptographic key (section 9(3)). The Determination places particular emphasis on validated contact points, defined in section 6(2), and requires message content for verification codes to include explicit statements and guidance (section 9(3)(c)(ii)).

"Person in vulnerable circumstances" is another defined technical concept (section 6). If an employee or agent who has completed fraud mitigation training reasonably believes the requesting person is in such circumstances, a modified authentication route applies: the employee must use multi‑factor authentication (two account or two personal authenticators, or one of each) but the employee must document the basis for that belief and any supporting material, and a notification must be sent to validated contact points subject to limited exceptions (section 11).

"Unlisted authorised representative" is handled specifically in Part 3. If a requesting person claims to be an unlisted authorised representative, the provider must have an employee or agent who has completed fraud mitigation training satisfied on documentary evidence (for example enduring power of attorney) before conducting the first high‑risk customer transaction (section 12). The provider must keep records of the basis for satisfaction and supporting evidence and send notifications to validated contact points, with exceptions for domestic or family violence opt‑outs (section 12).

"Fraud mitigation protections" is an operational duty requiring carriers to identify at‑risk customers and offer or apply measures such as account "flagging", use of MFA in specific sales channels, pausing transactions, or notifying authorised representatives, see section 13. This concept creates an ongoing obligation to maintain systems that identify risk and to provide measures tailored to individual customers. The Determination also requires carriers to publish website materials advising customers about authentication processes and reporting steps in suspected fraud cases (section 14).

Finally, the Determination defines who is in and who is out. "Account managed customer" and "integrated customer" are excluded from application (section 4). "Validated" contact points are defined non‑prescriptively as those for which the customer has undertaken a security process required by the carrier in relation to the contact point (section 6(2)). The instrument also cross‑references external instruments (section 7), including the Mobile Number Pre‑Porting Industry Standard 2020, the Telecommunications Numbering Plan 2015 (for the definition of digital mobile numbers), and the Defence Act 1903, where relevant.

These concepts collectively determine when higher authentication thresholds apply, what authentication techniques are permissible or required, the staff training and documentation requirements attached to particular authentication paths, and the required customer notification and remediation steps when an interaction is disputed.

The Determination applies directly to carriage service providers engaged in supplying a telecommunications service and conducting a high‑risk customer interaction, see section 4. The term "carriage service provider" is used in the Act; the Determination does not redefine it, therefore providers captured by the Telecommunications Act 1997 are the regulated entities. The obligations are triggered when such a provider is involved in a "high‑risk customer interaction" with respect to a "customer" as defined in section 6. The Determination's definition of "customer" differentiates between individual consumers (personal/domestic use, not for resale) and small business or non‑profit customers whose contracts were not genuinely negotiable and whose annual spend is, or is estimated on reasonable grounds to be, no greater than $40,000 at the time they enter the customer contract (section 6). Thus, small businesses under the $40,000 threshold are within the scope where they meet the defined criteria and have entered into a customer contract.

Two categories are excluded from the Determination's application: "account managed customers" and "integrated customers" (section 4). An "account managed customer" is one where the provider assigns designated contact employees or agents for all matters relating to the customer's telecommunications services (section 6). An "integrated customer" is one who uses a tailored integrated service desk or has a business‑to‑business service request system with the provider (section 6). Accordingly, businesses receiving dedicated account management or purpose‑built integration are outside the Determination. That exclusion narrows application to customers operating through general retail, standard online, or call centre channels, and to small business customers that are not account‑managed or integrated.

The Determination imposes duties on carrier personnel and assigns decision‑making responsibilities to employees or agents in particular contexts. For example, when higher level checks are used under sections 10, 11 and 12, the employee or agent must have completed "fraud mitigation training" (see sections 10(2), 11(1) and 12(2)). In practice, that means providers must identify and train staff who will carry out heightened verification processes and who must make "reasonable grounds" assessments (for example, whether a requesting person is a person in vulnerable circumstances, section 11(1)). The Determination therefore affects internal staffing, training, and operational policies of carriage service providers.

Customers who are "persons in vulnerable circumstances" are a specifically protected cohort, but they are also affected in that the Determination requires providers to adopt a multi‑factor authentication regimen and to keep records explaining the basis for reasonable belief and supporting material when transactions proceed (section 11(3)). Customers who are impacted by domestic or family violence receive a limited protective carve out: notification requirements can be suppressed where the provider has reasonable grounds to believe the customer is affected by domestic or family violence and the customer has requested notifications not be sent (see subsections 10(7), 11(6) and 12(6)). The instrument therefore alters the interaction flow for vulnerable customers and those who seek to avoid notifications for safety reasons.

The Determination also affects authorised representatives. An "authorised representative" who is listed on the customer account is dealt with under the standard identity authentication paths, but an "unlisted authorised representative" is subject to documentary verification and additional record keeping before a provider may proceed with high‑risk transactions (Part 3 and section 12). Finally, carriage service providers who must comply with the Telecommunications (Mobile Number Pre‑Porting Identity Verification) Industry Standard 2020 are not required to comply with this Determination in relation to a port, per the high‑risk customer transaction definition and Note 2 in section 6.

In short, the Determination primarily regulates carriage service providers, but it affects customers (individuals and qualifying small business customers), authorised representatives, provider employees, and business units responsible for customer authentication, training, notifications, remediation, and record management.

The Determination sets out a series of affirmative duties on carriage service providers with respect to identity authentication, notifications, training, fraud mitigation, publication of customer advice, and record keeping. It does not, in the provided text, create novel private rights of action for customers, nor does it specify monetary penalties; it instead prescribes operational obligations that providers must meet.

Primary identity authentication duty: Prior to undertaking the first high‑risk customer transaction in a high‑risk customer interaction, the provider must confirm the requesting person's authority as the customer or the customer's authorised representative by using the identity authentication process(es) set out in sections 9, 10 or 11 as applicable (section 8). The default multi‑factor requirement is set out in section 9(1) where interactions are initiated by the requesting person, with alternative requirements where the provider initiates the interaction using the public number listed (section 9(2)). Subsection 9(3) lists permitted confirmation techniques, including demonstrating direct and immediate access to the telecommunications service or public number, unique verification codes sent to validated contact points (and accompanying message content requirements), biometric data, documentary verification using category A documents (Schedule 1) and cryptographic keys.

Additional authentication duty when primary processes fail: If the provider takes reasonable steps to use the subsection 9(3) processes but cannot confirm identity, then authorised staff who have completed fraud mitigation training must use one of the higher assurance processes in section 10(2), namely documentary checks using category A/B documents via Schedule 1, a government online document verification service, or a government‑accredited digital identity service. Section 10(3) and (4) set out the specific evidence required when using government verification or government‑accredited digital identity services, including the requirement that at least two unique government documents be identified and verified.

Duties tied to vulnerable persons and unlisted authorised representatives: When staff reasonably believe the requesting person is a person in vulnerable circumstances, the employee or agent who has completed fraud mitigation training must use multi‑factor authentication as prescribed in section 11(2) and must keep records of the authentication used and the basis for belief and supporting material (section 11(3)). For unlisted authorised representatives, section 12 mandates documentary evidence demonstrating power to act (for example enduring power of attorney) before proceeding, records of the basis for satisfaction, and notification obligations.

Notification duties and remediation: Several provisions require immediate notifications to validated contact points once specific authentication processes are used, and they define required notification content (sections 9(3)(c)(ii), 10(5), 11(4) and 12(4)). If, in response, the customer or authorised representative reports that the interaction was unauthorised, the provider must, where transactions have been completed, take steps to immediately reverse or remediate any completed transactions and notify the relevant person of the steps taken and what they can do, see subsections 9(5)(a), 10(8)(a), 11(7)(a) and 12(7)(c). Where no transaction has yet been undertaken, the provider must refrain from undertaking the transaction and notify the relevant person accordingly (see the parallel provisions).

Fraud mitigation duties: Carriers must have systems in place to identify customers at risk of fraud and must offer fraud mitigation protections to customers who reasonably request them, see section 13(1)-(2). The Determination gives examples of such protections, including flagging accounts, multi‑factor authentication in particular sales channels, pausing high‑risk transactions, or notifying authorised representatives (section 13(3)).

Publication and customer awareness duties: Providers must publish information on their websites advising customers that identity authentication processes will be used to protect against unauthorised high‑risk interactions, and what to do if they suspect their account has been compromised, including reporting to the carriage service provider and to their financial services provider, see section 14.

No fee duty: Providers must not charge customers or their authorised representatives for any message or notification sent under specific provisions of the Determination, or for taking an action described in section 13, subject to a limited exception where a customer uses a telecommunications service to initiate a high‑risk interaction that is not associated with the customer’s account (section 15).

Record keeping duty: Providers must keep records sufficient to demonstrate compliance with Parts 2 to 5 and retain the records required under paragraph 16(a) and subsections 11(3) and 12(3) for a minimum of one year (section 16).

Decision makers and discretion: The Determination places several decision points in the hands of provider employees or agents, and in some cases requires those employees or agents to have completed fraud mitigation training. Those decision points include assessing whether a requesting person is a person in vulnerable circumstances (section 11(1)), whether documentary evidence establishes an unlisted authorised representative (section 12(2)), and when providers have "reasonable grounds" to believe a customer is affected by domestic or family violence and has requested that notifications be suppressed (sections 10(7), 11(6) and 12(6)). Those are expressed standards that invite the provider’s operational judgment.

Rights of customers: The Determination grants customers the right to request fraud mitigation protections (section 13(2)), and gives customers avenues to trigger remedial steps via notification responses when they did not authorise an interaction (sections 9(5), 10(8), 11(7), 12(7)). The Determination further protects customers from being charged for required notifications and messages (section 15).

Collectively, the Determination sets operational duties affecting authentication design, staff training, notification and remediation processes, record keeping, and public information obligations, while setting out customer rights to request protections and to receive notifications without charge.

The Determination itself does not contain express penalty amounts, specific civil or criminal sanctions, or a detailed enforcement regime within its text. It is made under subsection 99(1) of the Telecommunications Act 1997 (section 3), which is the statutory authority for the instrument. Regulatory enforcement, compliance monitoring and any sanctions arising from non‑compliance would therefore operate through the framework of the Telecommunications Act and the broader regulatory architecture that applies to carriage service providers, rather than through penalties embedded directly in the Determination. The Determination prescribes obligations that a carriage service provider must meet, however it does not, in the provided text, list penalty provisions or specify enforcement mechanisms.

Operationally, the Determination increases the compliance record burden on providers, because section 16 requires carriers to keep records sufficient to demonstrate compliance with Parts 2 through 5, and to retain certain records for a minimum of one year. Those records will be the primary evidence a regulator would examine to determine whether a provider met the identity authentication, notification, training and fraud mitigation requirements. Section 11(3) and section 12(3) require additional specific records where higher‑risk pathways are used, including the basis on which an employee had reasonable grounds to believe a requesting person was a person in vulnerable circumstances, and the basis for satisfying that an unlisted authorised representative had authority. These record keeping requirements create a compliance trail that can be used by supervising agencies.

Enforcement in practice will depend on the regulatory authorities that oversee telecommunications providers under the Act, their powers, and any rules and processes under the Act for handling breaches of legislative instruments made under its authority. The Determination itself does not identify a particular enforcement body or set out investigative powers, infringement notices or civil penalties. The absence of express penalties in the Determination means that determinations of breach and any consequent sanctions, remedies or directions would need to rely on powers available under the Telecommunications Act or other applicable Commonwealth law.

For providers, the risk of regulatory scrutiny is concrete because the Determination establishes clear, auditable duties: use of particular authentication processes, training requirements for staff who use the higher assurance pathways, notification content and timing, remediation steps where customers report unauthorised contact, and minimum retention of records. Failures to act in accordance with those duties would be visible in an audit of operational logs and retained records. The Determination also contains operational exceptions and discretions (for example, the domestic and family violence notification opt‑out), which regulators will likely examine for consistency with the "reasonable grounds" standard the Determination uses. Providers should therefore treat the record‑keeping and documentation obligations as enforcement‑relevant.

Finally, although the Determination includes no express administrative penalties, the remedial obligations (for example the requirement to reverse or remediate completed high‑risk transactions and to notify the relevant person of steps taken) create customer‑facing consequences for non‑compliance: failure to remediate can lead to customer harm, complaints, and consequent regulatory escalation under the Telecommunications Act’s complaint and dispute resolution architecture. In short, enforcement is not specified in the Determination itself, but the duties are structured so that non‑compliance is auditable and can be acted upon under the parent statute and applicable regulatory processes.

The Determination cross‑references and sits beneath the Telecommunications Act 1997 by operation of its enabling provision, subsection 99(1), as stated in section 3. It explicitly contemplates interaction with other instruments and external systems. Section 7 states that references to any other legislative instrument or other kind of instrument are to be read as references to those instruments as in force from time to time. That means that where the Determination requires a carriage service provider to apply or take account of an external standard, the provider must do so as that external standard stands.

The Determination contains explicit references to other specific instruments and statutes. The definition of "digital mobile number" refers to Schedule 5 of the Telecommunications Numbering Plan 2015, and "special services number" cites section 31 of the Telecommunications Numbering Plan 2015 (section 6). The definition of "defence access control point" and "defence premises" is linked to section 71A of the Defence Act 1903 (section 6). The definition of "high‑risk customer transaction" excludes transactions to port a mobile number to which the Telecommunications (Mobile Number Pre‑Porting Identity Verification) Industry Standard 2020 applies, and adds that a carriage service provider which must comply with that standard is not required to comply with the Determination in relation to a port (see the relevant exclusions and Note 2 in section 6). These cross‑references mean providers must coordinate compliance across multiple industry instruments; in the specific case of number porting, the existence of the pre‑porting standard relieves double compliance.

The Determination requires the use of "government online document verification services" and "government‑accredited digital identity services" as acceptable identity authentication processes under section 10. Those services are external to the Determination and will be governed by their own regulatory and operational frameworks. The Determination specifies the minimal documentary evidence a requesting person must provide for the provider to be taken to have confirmed identity when using these services, including the identifying numbers of at least two unique government documents, issuers' State or Territory information, and, if required, dates or other information on the documents; and that the information must be verified on the government service (sections 10(3) and 10(4)). That creates an interoperability requirement between carriage service provider systems and government verification systems, and it ties carriage service provider compliance to the technical availability and decision outcomes of those government services.

Privacy and data protection are implicated because the Determination requires the handling of "personal information", defined within the instrument as information or opinion about an identified individual or an individual who is reasonably identifiable (section 6). While the Determination does not explicitly reference the Privacy Act 1988, carriage service providers will need to operate within the applicable privacy and data protection law when collecting, verifying and retaining personal and government document information. The Determination sets record retention requirements (section 16), and it requires storage of documentary evidence and logs where higher assurance pathways are used (sections 11(3) and 12(3)). Providers will need to ensure these practices align with privacy obligations, data security obligations and any record retention rules under other Commonwealth law.

The Determination may interact with obligations arising under financial services or anti‑money laundering regimes where identity verification processes are also required, though the instrument itself does not address those regimes. Providers should be conscious that using government‑accredited identity services and storing government document identifiers will bring other regulatory responsibilities depending on the use and retention of the data, and the Determination expressly contemplates reliance on government verification services as a compliance path.

Finally, section 7’s general saving and reference provision means that the Determination should be read in the broader legislative context, including any amendments made to referenced instruments over time. Practically, carriage service providers must align their identity authentication policies with the Telecommunications Act, the Numbering Plan provisions where relevant, the Mobile Number Pre‑Porting identity standard for ports, and the technical and legal requirements of government verification and accredited digital identity services.

The text provided contains formal metadata that documents the instrument’s identity and commencement: it is titled the Telecommunications Service Provider (Customer Identity Authentication) Determination 2022 (section 1) and it commenced on 30 June 2022 (section 2). The Determination is made under subsection 99(1) of the Telecommunications Act 1997 (section 3). Beyond these commencement and authority details, the supplied text does not include any subsequent amendment entries, amending instruments, or historical versions.

Section 7 sets out how references to other instruments should be read, including that references are to instruments "as in force from time to time". That clause creates a forward‑looking reading rule for references and means that, over time, the Determination will operate in the context of any amendments to external instruments (for example, the Telecommunications Numbering Plan 2015 or the Mobile Number Pre‑Porting Identity Verification standard). However, within the Determination itself no internal amendment history appears in the supplied material.

Because the Determination is a legislative instrument made under the Act, any amendments to it would typically be made by subsequent legislative instruments or as otherwise provided under the Act. The supplied text does not show any such amending instruments, nor does it show a schedule of retrospective adjustments. Users relying on this analysis should verify the instrument's current version on the Federal Register of Legislation, as section 7 notes that Commonwealth Acts and legislative instruments are registered there and are to be read as in force from time to time.

For compliance and risk assessment, the immediate practical takeaways are: the Determination came into force on 30 June 2022; it depends on other instruments and standards that may themselves change; and providers should monitor the Federal Register of Legislation for any amending instruments, as updated cross‑referenced instruments may alter operational requirements (for example if the Mobile Number Pre‑Porting standard is revised or government verification services change their interfaces or verification criteria).

The provided text of the Telecommunications Service Provider (Customer Identity Authentication) Determination 2022 contains no references to litigation history, case law, or judicial interpretation. The Determination itself is a legislative instrument and does not include decisions, judicial commentary or examples of dispute resolution outcomes. There are no cases named within the instrument.

Because the Determination is an administrative regulatory instrument made under subsection 99(1) of the Telecommunications Act 1997, any litigation that might arise concerning its operation,for example disputes about whether a carrier followed the prescribed identity authentication processes, whether notifications were properly sent, whether remedial steps complied with the Determination, or whether an entity was correctly categorised as an account managed customer or integrated customer,would occur in the ordinary course through the courts or tribunals in which statutory powers and obligations under the Act are enforced. The Determination does not itself specify a dispute resolution forum or administrative review path.

In the absence of litigation references in the instrument, practitioners should assume that contested questions about interpretation,such as what constitutes "reasonable grounds" for believing a customer is affected by domestic or family violence, or whether a particular verification process meets the definition of an account information authenticator or personal information authenticator,would be resolved by reference to the Determination’s text, any relevant legislative history, and ordinary principles of statutory interpretation if litigation occurred. Similarly, compliance findings by relevant regulators under the Telecommunications Act could be subject to merits review or judicial review in appropriate circumstances, though the Determination does not specify remedies.

Users evaluating legal risk should therefore monitor regulatory guidance and any administrative determinations or enforcement actions by regulators (for example the Australian Communications and Media Authority or other bodies empowered under the Act), and should consider the possibility of litigation over factual and legal determinations where carriers exercise discretion under standards such as "reasonable grounds". Because there are no cases mentioned in the instrument, this section records the absence of litigation history in the provided text.

Several operational and interpretive points in the Determination give rise to practical pitfalls providers and advisers should note.

1. Exclusions narrow application in unexpected ways. Section 4 excludes account managed customers and integrated customers. Those customers are likely to be businesses with dedicated contacts or B2B integration. Providers must therefore determine, for each customer, whether the account falls within the exclusion. Misclassification risks non‑compliance where a customer is treated as account‑managed while the Determination would otherwise require the provider to follow the identity authentication processes.

2. "Validated" contact points are provider‑defined. The definition of "validated" in section 6(2) leaves the validation process to the carriage service provider’s security process. The Determination mandates use of validated contact points for verification codes and notifications (for example sections 9(3)(c), 10(5), 11(4), 12(4)). Because there is no central standard for what constitutes an adequate validation process, providers who adopt weak validation may fall short of the Determination’s apparent security intent and face regulatory scrutiny. Conversely, overly onerous validation may impair customer experience.

3. Discretionary "reasonable grounds" standards. The Determination places several decisions on provider staff based on "reasonable grounds" (for example whether a requesting person is a person in vulnerable circumstances, section 11(1), or whether the provider has reasonable grounds to believe the customer is affected by domestic or family violence and requested no notification, sections 10(7), 11(6), 12(6)). These standards require providers to implement and document internal criteria and training. A failure to document the rationale for reasonable grounds is addressed explicitly by record keeping requirements (sections 11(3) and 12(3)). Lack of documentation can be a liability in regulatory scrutiny.

4. Training is mandatory for certain paths. The Determination requires that employees or agents who use additional authentication processes under sections 10, 11 and 12 must have completed "fraud mitigation training" (sections 10(2), 11(1), 12(2)). Providers must therefore define, deliver and maintain records of such training. The Determination does not prescribe the content or frequency of training, but the requirement is precondition to using those authentication paths.

5. Government document checks depend on Schedule 1 and external services. Use of category A and category B documents is tied to Schedule 1 (see definitions and sections 9(3)(e), 10(2)(a)). The supplied text does not include Schedule 1. Providers must consult the Schedule to implement compliant document‑based checks. Similarly, reliance on government online document verification services or government‑accredited digital identity services requires integration with those external systems; availability, technical interfaces, and acceptance criteria of those services are outside the Determination and may change over time.

6. Notification exceptions for domestic and family violence. The Determination allows providers to avoid sending notifications where they have reasonable grounds to believe a customer is affected by domestic or family violence and the customer has requested that notifications not be sent (see sections 10(7), 11(6), 12(6)). Providers must have procedures to respond to such requests while balancing safety and identity verification. Failure to correctly implement opt‑outs could expose victims to safety risks or to regulatory criticism.

7. Timing and immediacy obligations. Several provisions require immediate notification either prior to, or immediately after, undertaking the first high‑risk transaction (for example sections 10(5), 11(4), 12(4)). The Determination does not define "immediately" precisely. Providers must design workflows that deliver notifications within a short operational timeframe and document timing, otherwise they risk non‑compliance.

8. Messaging content obligations. Section 9(3)(c)(ii) requires that the message containing a verification code or secure hyperlink include a clear statement informing the relevant person that a high‑risk interaction has been initiated, that the code or link should not be shared except with the provider if the person initiated the interaction, and what they can do if they did not initiate it. Messages that omit these elements will not comply.

9. Fee prohibition nuances. Section 15 prohibits charging a fee for the specific messages and notifications identified, and for taking actions described in section 13. The prohibition does not cover all interactions; there is an exception where a customer uses a telecommunications service to initiate a high‑risk customer interaction that is not associated with the customer’s account. Providers that attempt to recoup costs through ancillary fees or account charges must map those charges against the Determination’s narrow prohibition to avoid breaching the instrument.

10. Record retention minimum is short. Section 16 requires retention of records for a minimum of one year. Providers should consider whether longer retention periods are required by other laws (privacy, financial sector obligations, or corporate records) and whether retaining only a year will be adequate for regulatory audits or dispute resolution.

11. No explicit enforcement mechanism or penalties in the Determination. The lack of specified penalties does not nullify the obligations. It means enforcement and consequences of non‑compliance will derive from the Telecommunications Act and regulatory action, making thorough documentation important.

12. Interaction with pre‑existing porting standard. Providers subject to the Mobile Number Pre‑Porting Identity Verification standard are excluded from the Determination with respect to ports (section 6), therefore they must ensure they apply the correct standard in porting scenarios.

These gotchas require operational review, updates to policies and systems, staff training, and careful record keeping. Providers should consult the full text (including Schedule 1 and any related instruments) and operationalise decisions about validated contact points, training content, documentation evidencing reasonable grounds, and integration with government verification services.

Complying with the Determination requires an integrated program spanning policy, systems, staff training, customer communications, documentation and audit. Below is a practical compliance checklist built from the Determination’s text.

1. Map scope and customer categories

   • Identify which accounts fall within the Determination: individual customers and qualifying small business or non‑profit customers as defined in section 6. Exclude account managed customers and integrated customers per section 4, but document the basis for determining exclusion.
   • Flag accounts subject to the Mobile Number Pre‑Porting Identity Verification standard; do not apply the Determination to porting transactions covered by that standard (section 6).

2. Implement identity authentication flows

   • For high‑risk interactions initiated by the requesting person, implement multi‑factor authentication conforming to section 9(1): either two account information authenticators, two personal information authenticators, or one of each. Ensure account information and personal information authenticators are defined, documented, and available for staff to apply.
   • For high‑risk interactions initiated by the provider calling the public number listed on the account, implement at least one personal information authenticator as required by section 9(2), and in all cases apply at least one of the subsection 9(3) confirmation processes.
   • Implement the methods in subsection 9(3): direct immediate access checks (for example call‑back to the mobile device), unique verification codes/secure hyperlinks to validated contact points (see below), biometric verification, document checks using category A documents (Schedule 1), or cryptographic keys.

3. Define and operationalise "validated" contact points

   • Establish and document a validation process for email addresses, mobile applications, devices and accounts per section 6(2). The provider’s security process should be auditable and clearly documented, including the steps a customer must take to validate a contact point.
   • Ensure the verification code workflow only uses validated contact points and that verification messages include the explicit content requirements from section 9(3)(c)(ii).

4. Integrate government verification options

   • Where primary processes fail, equip trained staff to use the higher assurance methods in section 10(2): category A/B document checks via Schedule 1, government online document verification services, or government‑accredited digital identity services.
   • For government verification or accredited digital identity services, implement the requirement to obtain identifying numbers for at least two unique government documents and verify them as required by sections 10(3) and 10(4). Providers must ensure technical integration to receive verification results and log the outcomes.

5. Staff roles and training

   • Identify roles that will carry out higher assurance checks and ensure those employees or agents complete "fraud mitigation training" (sections 10(2), 11(1), 12(2)). Document training content, completion dates and records for audit.
   • Define policies and decision‑support tools to guide "reasonable grounds" assessments (for persons in vulnerable circumstances or domestic/family violence opt‑outs). Documentation and stepwise checklists will help satisfy the record keeping requirements of sections 11(3) and 12(3).

6. Notifications and remediation

   • Implement automated notification workflows that send messages immediately after authentication processes where required by sections 10(5), 11(4) and 12(4), unless the specific exceptions apply (no validated contact points or domestic/family violence opt‑out).
   • Ensure notification channels align with validated contact points and message content meets the required information elements (see section 9(3)(c)(ii)).
   • Establish remediation playbooks for instances where the customer reports an unauthorised interaction, including reversing or remediating completed transactions and communicating the steps taken and recommended protections (see subsections 9(5), 10(8), 11(7) and 12(7)).

7. Fraud mitigation protections

   • Implement systems to identify at‑risk customers and a menu of fraud mitigation protections per section 13(1) and 13(3), for example account flags, channel‑specific MFA, transaction pausing, and authorised representative notifications.
   • Create a process for customers to request fraud mitigation protections and for staff to apply and document such requests in line with section 13(2).

8. Website and customer information

   • Publish the required advice on the provider’s website explaining that identity authentication processes will be used for high‑risk interactions and what customers should do if they suspect fraud, including reporting to the carrier and to their financial services provider (section 14).

9. No fee policy

   • Update billing and customer service policies to ensure the provider does not charge customers or authorised representatives for the messages and notifications enumerated in section 15, or for actions described in section 13, except where the limited exception applies.

10. Record keeping and audit trail

    • Create and maintain records sufficient to demonstrate compliance with Parts 2 to 5, and retain at least the records required by paragraph 16(a) and subsections 11(3) and 12(3) for a minimum of one year (section 16). Records should include authentication method used, timing of notifications, employee identity and training records, basis for "reasonable grounds" assessments, documentary evidence used for unlisted authorised representatives, and remediation actions taken.
    • Implement internal audit routines to check adherence to procedures, and maintain an incident register for disputed interactions that tracks timelines and remediation.

11. Technical and security considerations

    • Ensure cryptographic keys, biometric data storage, and document images are stored in accordance with applicable data security and privacy requirements and that access is controlled and logged. Although the Determination does not specify technical standards, providers should adopt industry best practice to support regulatory scrutiny.
    • Test and monitor integrations with government online verification services and government‑accredited digital identity services to ensure availability and correct verification results.

12. Policy for domestic and family violence opt‑outs

    • Implement procedures to receive and record customer requests to suppress notifications for safety reasons, and to make "reasonable grounds" assessments that such requests should be honoured, per sections 10(7), 11(6) and 12(6). Ensure staff are trained to handle such sensitive requests and document their basis.

13. Governance, legal and compliance liaison

    • Coordinate with legal, privacy and risk teams to ensure record retention aligns with other regulatory obligations. Review the Determination in the context of the Telecommunications Act and any industry standards the provider must follow.
    • Monitor the Federal Register of Legislation and referenced instruments for amendments and guidance (section 7).

14. Documentation and escalation paths

    • Maintain templates and scripts for verification calls, message content templates that meet statutory text requirements, and escalation paths for suspected fraud. Ensure that employees who are authorised to make "satisfaction" determinations for unlisted authorised representatives have clear checklists and access to legal or senior compliance support.

Taken together these steps create a compliance programme that addresses the Determination’s authentication, notification, remediation, training and record keeping requirements. Providers should treat the record keeping and documentation elements as central, because the Determination emphasises auditable processes and places several decisions on staff who must be able to demonstrate that they had appropriate training and reasonable grounds for their actions.