Regulatory Radar

Businesses with material exposure to domestic air travel or freight costs, including those negotiating corporate travel arrangements or logistics contracts, may wish to note the ACCC's continued interest in airfare movements, capacity reductions and fuel cost pass-through when assessing future pricing and contract terms with airlines. Given the current monitoring direction applies until December 2026, it would also be worth watching whether the government extends or adjusts that direction, since any change could affect the frequency and detail of future ACCC reporting on domestic airline pricing and competition.

Venues, broadcasters, retailers and other businesses that play music in the course of their operations can continue to obtain licences through APRA's existing collective licensing model, which remains authorised until 3 October 2031. Businesses with concerns about licence fees, royalty distribution or transparency in APRA's arrangements may wish to engage with the consultation and review processes that APRA is now required to maintain under the revised conditions, including use of the alternative dispute resolution scheme where a specific dispute arises.

Superannuation trustees could use this action as a basis to review website and member disclosure content, including asset allocation statements, time horizon assumptions and Member Outcomes Assessment Summaries, against the actual composition and management of each investment option. A periodic reconciliation process between disclosure teams and investment or portfolio management functions may help identify drift between published descriptions and underlying holdings before it becomes a compliance issue. Legal and compliance teams may also wish to confirm who is responsible for updating investment option disclosures when underlying asset allocations change.

Remittance providers and virtual asset service providers may wish to confirm that their AUSTRAC registration details, including notifications of material changes to the business, are current, since failure to notify such changes was cited as one of the grounds for the actions taken. Businesses that have reduced or paused operations, or that are experiencing financial difficulty, should consider whether their registration status still accurately reflects their current trading position, given AUSTRAC's stated focus on dormant, inactive or insolvent registrants.

Businesses considering acquisitions in markets with a strong local or regional presence, such as car dealership networks, may want to assess overlap at the level of the specific area in which both parties operate, rather than only at a national or state level, since that is where the ACCC's competition concern arose in this matter. Where an acquisition could increase concentration in a particular locality, it may be worth considering early whether a structural remedy, such as divestment of overlapping sites, could address the ACCC's concerns and support a faster clearance.

Businesses planning acquisitions in concentrated Australian markets may wish to factor a possible divestiture remedy into deal timing and pricing from an early stage, rather than assuming the ACCC's review will result only in unconditional clearance or prohibition. Where an overlap exists between merging parties in a market with few competitors, it may be worth identifying which assets or brands could realistically be divested to an ACCC-approved purchaser if a competition concern is raised during review.

Insurers offering cash settlements for home insurance claims may wish to review their quoting practices, including reliance on single quotes from preferred suppliers, against the expectations set out in this review. Insurers could also consider whether their processes for identifying and supporting vulnerable customers during the claims process are adequate, given ASIC's finding that most insurers reviewed fell short in this area. Disclosure provided to customers at the point a cash settlement is offered, including how clearly it explains what the settlement will and will not cover, may also warrant attention given the regulator's stated expectations.

Organisations that collect or handle personal information, including those using artificial intelligence or connected devices in customer facing processes, may find it useful to read the exposure draft bill and consultation paper to understand which proposed changes would affect their current privacy policies, consent mechanisms and data handling practices. Because the measures remain in draft and are subject to further consultation and parliamentary process, any internal assessment at this stage is best treated as preparatory rather than as a response to settled law. Estimating the scale of system, policy and contractual changes the draft would require may assist with future budgeting and planning.

Superannuation trustees may wish to review the methodology paper to understand how the Comprehensive Product Performance Package metrics and the legislated performance test are calculated, and to consider modelling their own products against that methodology ahead of future publication cycles. Trustees whose products have previously been identified as underperforming, or whose products are approaching repeated test failure, may want to assess what remediation steps APRA would expect to see documented, given its stated intention to apply heightened supervisory scrutiny where pockets of underperformance persist.

Businesses operating in the real estate, legal, accounting, conveyancing, trust and company services, and precious metals and stones sectors should confirm whether any of the services they provide fall within the designated services captured by the Tranche 2 reforms and, if so, whether they are correctly enrolled with AUSTRAC. Firms that have not yet enrolled, or are unsure whether their services are captured, may wish to review their position before receiving a section 167 notice. A business that does receive a notice should treat it as a priority and ensure any response is accurate and provided within the requested timeframe, given AUSTRAC's stated intention to move from education to active supervision of newly regulated entities.

Boards of APRA and ASIC regulated entities may wish to confirm that a documented risk appetite for frontier AI exists and has been considered at board level, covering matters such as escalation authority and recovery priorities, rather than being left to management alone. It may also be worth testing whether incident response and recovery plans have been exercised against scenarios involving AI-accelerated attacks, given the regulators' point that such incidents can unfold faster than traditional cyber events.

Regulated financial entities and their material service providers may wish to benchmark their own cyber and operational resilience arrangements, including patching, access controls, backup integrity and incident response testing, against the themes identified in this publication. Boards could consider whether governance arrangements for escalation, risk appetite and recovery decisions are adequately defined in advance of an incident, given the compressed response timeframes associated with frontier AI related threats. Entities relying heavily on a small number of third party service providers may also want to assess concentration risk in that context.

Businesses that are newly or recently enrolled with AUSTRAC may wish to brief relevant staff, particularly those handling compliance correspondence and payments, on how to verify contact that claims to come from AUSTRAC before acting on it, including checking requests against official AUSTRAC Online channels rather than links or numbers provided in an unsolicited message. Staff should be aware that AUSTRAC will not request payment in cryptocurrency or through messaging apps, and that any request of that kind is a strong indicator of a scam.

Businesses operating in the areas the plan identifies, including buy now pay later, superannuation advice fee deductions, disaster-related insurance claims handling and AI use in customer-facing financial services, may wish to map their current products and controls against these named priorities to anticipate where ASIC attention is most likely to focus. This may be a useful input into internal risk registers or compliance monitoring plans for the year ahead.

Finance teams and directors of entities phasing into mandatory sustainability reporting could use the modules as an introductory resource for staff who are new to climate related financial disclosure concepts, before moving to more detailed guidance in Regulatory Guide 280. Boards preparing for their first sustainability report may wish to use the governance and risk management module in particular to structure early discussions about how climate related risks and opportunities are integrated into existing governance processes. Given ASIC has flagged specific areas for improvement in reports already lodged, preparers could cross check draft disclosures against those observations in addition to the educational material.

Banks, insurers and superannuation trustees regulated by APRA may wish to compare their annual risk and compliance plan against the priorities set out in the 2026-27 Corporate Plan, particularly the stated focus on cyber resilience, geopolitical risk and the use of frontier artificial intelligence. Boards and risk committees could use the Plan to anticipate the likely focus of supervisory engagement and thematic reviews over the next 12 to 18 months, and to identify any gaps between current risk management practices and the pace of change APRA has flagged as expected of regulated institutions.

Lenders, mortgage brokers, accountants and lawyers involved in residential lending may wish to review their loan application verification processes, including how income, employment and the source of settlement or repayment funds are checked, in light of the patterns identified in Operation Claw. Businesses whose staff or clients are named in referrals arising from the operation should treat any resulting regulatory or law enforcement contact as a priority. More broadly, firms involved in the lending chain could consider whether their internal controls would detect coordinated use of the same broker, accountant or law firm across multiple applications.

Superannuation trustees, particularly platform trustees with extensive investment menus, may wish to begin assessing whether their current investment governance capability, including onboarding, monitoring and offboarding processes and management of conflicts, is proportionate to the complexity of the options they offer. Trustees could also consider member level diversification practices and oversight arrangements ahead of APRA's consultation on detailed reform proposals. Businesses providing investment options through platforms may want to monitor the consultation for potential capital or governance requirements that could affect product availability or commercial arrangements with trustees.

Businesses operating an existing employee share or incentive scheme could check whether the scheme was established under the superseded class orders referred to in RG 49, in which case the legacy guide remains relevant, or whether it should instead be assessed against the Division 1A framework introduced in 2022. Before issuing further offers under an existing scheme, it may be worth confirming which regime governs ongoing obligations, since relying on RG 49 alone could overlook requirements introduced by the 2022 reforms. Employers establishing a new scheme are likely to need to work primarily from the Division 1A provisions rather than the legacy guide.

Motor vehicle insurers and their distributors may find it useful to compare their current quote and renewal disclosure documents against the poorer and better practice examples set out in REP 838, particularly around explaining the factors behind premium changes and disclosing any difference in cost between instalment and annual payment. Given ASIC's comments on consumer disengagement at renewal, insurers may also wish to consider whether renewal communications give customers a genuine opportunity to understand and compare their options, noting that the report reflects ASIC's current regulatory expectations rather than a new binding disclosure standard.