Educational resource · a plain English guide to the rules for your profession, not legal advice
What Matters Most
Thought leadershipEducational resource

The Rules in Plain English

The current laws that apply to your profession, gathered in one place, each written plainly and shown with its official government source and the date it was checked.

Read this first

This page does not give advice, does not tell you what to do, and does not confirm that you are compliant. It gathers the current laws that apply to your profession, written in plain English, and shows you where to read each one at its official government source, with the date it was last checked. The official source is always the final word. If a rule bears on a decision you are making, speak to a qualified adviser.

Every segment is one obligation. It cycles on its own, or tap one to hold it.
The obligation
Loading
Read the full obligation, with its source, below
Before the detail

Do you lodge these anywhere? Mostly, no.

A fair question, and an important one. For most of these obligations there is nothing to submit. They are duties you must meet and be able to evidence, not forms you file. It helps to see them in three groups.

1
Most are never lodged

Responsible lending, the disclosure documents, best interests, conflicted remuneration, hawking, how you handle client information, and staying competent. You must meet each one and keep records, but nothing is sent anywhere. ASIC supervises through your credit licence, and you show your work only if there is a complaint, a review or an audit.

2
Some are reported only when something happens

A reportable situation goes to ASIC. An eligible data breach goes to the OAIC. A significant dealing that does not fit a product's target market goes to ASIC. These are event driven: if nothing happens, nothing is filed.

3
A few are ongoing or annual

You hold and renew your credit licence and your AFCA membership. Every credit licensee also lodges one annual compliance certificate with ASIC, within 45 days of the licence anniversary. Money laundering enrolment and reporting to AUSTRAC applies only if part of your firm actually makes loans, not if you only arrange them.

asic.gov.au, annual compliance certificate checked 2 September 2026

This is why each obligation below shows its official door, and why so many of them show no online door at all.

Your authority to operate

Your credit licence, and how you must conduct yourself

You must hold an Australian Credit Licence, or act as an authorised credit representative under one, covering the credit activities you perform. For the life of that licence you must run the business efficiently, honestly and fairly, stay competent, and keep the required arrangements in place.

Have ready
  • A current licence or credit representative authorisation covering what you do
  • A nominated fit and proper responsible manager, and organisational competence
  • Training and competence records for anyone giving credit assistance
  • Documented compliance, risk and conflicts arrangements
  • AFCA membership and an internal complaints process (see complaints rule)
  • Adequate compensation arrangements, in most cases professional indemnity insurance
  • Up to date business details and the annual compliance certificate
The official door

ASIC Connect and the ASIC eLicensing portal, for the licence, variations and the annual compliance certificate. Licence conditions run alongside.

connectonline.asic.gov.au
Source, checked on 2026-09-02

How a loan must be handled

Responsible lending

Before you give credit assistance you must make reasonable inquiries into the consumer's needs, objectives and financial situation, take reasonable steps to verify what you are told, and assess that the loan is not unsuitable for them. You must not suggest or assist with a loan that is unsuitable.

Have ready
  • A preliminary assessment of unsuitability on file for each matter
  • Records of the reasonable inquiries into the consumer's requirements and objectives
  • Records of your inquiries into, and verification of, the consumer's financial situation, with supporting documents
  • Your reasons the recommended loan is not unsuitable
  • The preliminary assessment kept, and given to the consumer on request (s120)
The official door

Your own records under the licence. The preliminary assessment goes to the consumer on request. No separate lodgement; ASIC supervises through the licence.

No online door, kept in your own records under the licence
Source, checked on 2026-09-02

The disclosure documents

You must give the consumer a credit guide up front, a quote before you charge for credit assistance, and a disclosure of the fees, commissions and indirect remuneration involved. Together they show who you are, what you will be paid, and what the consumer will pay.

Have ready
  • Credit guide, given as soon as it is apparent credit assistance is likely: your name, contact details, credit licence number, internal and AFCA dispute resolution details, information on your fees and commissions, and the six credit providers you deal with most
  • Quote, given, signed and dated before you charge a fee: a description of the assistance and the maximum the consumer is expected to pay; give them the accepted copy
  • Fees, commissions and indirect remuneration disclosure, given when you provide the assistance: the fees and charges the consumer will pay, a reasonable estimate of commissions you or an associate are likely to receive, and payments to third party referrers
The official door

The documents go straight to the consumer and are kept on file. Nothing is lodged with ASIC.

No online door, kept in your own records under the licence
Source, checked on 2026-09-02

Best Interests Duty, and the conflict priority rule

When you give credit assistance you must act in the best interests of the consumer. Where your interests, or a related party's, conflict with theirs, you must give priority to the consumer.

Have ready
  • Records of the consumer's individual circumstances
  • Evidence that a range of products and lenders was considered
  • Documented reasons the recommended product and lender were assessed as in the consumer's interests, with cost given significant weight alongside other features
  • Records showing you identified conflicts and put the consumer first
  • File notes showing the assessment at the point in time it was made
The official door

Your own records under the licence. ASIC supervises through the licence; no separate lodgement.

No online door, kept in your own records under the licence
Source, checked on 2026-09-02

Conflicted remuneration

You must not give or accept conflicted remuneration, meaning a payment that could reasonably be expected to influence the credit assistance you give or the products you recommend. You must also follow the mortgage broker remuneration rules in the credit regulations, which shape how upfront and trailing commissions may be paid.

Have ready
  • Your remuneration and commission arrangements documented and reviewed against the ban (ss158N to 158NF)
  • A review of upfront and trailing commission arrangements against the mortgage broker remuneration rules in the regulations
  • No volume or campaign based benefits that would be conflicted
  • A register of benefits given or received
  • Consumer disclosures that reflect the actual remuneration
The official door

Internal governance and records under the licence. No separate ASIC lodgement.

No online door, kept in your own records under the licence
Source, checked on 2026-09-02

Design and Distribution Obligations

When you help place a consumer into a lender's credit product you are a distributor. You must take reasonable steps so your distribution fits the lender's target market determination, keep records, pass complaint numbers to the lender, and tell the lender promptly if you see dealings outside the target market.

Have ready
  • The current target market determination for each credit product you distribute, and a check the consumer falls within it
  • Records of the reasonable steps you took, and any distribution information the lender requires
  • A process to record and report complaint numbers to the lender within its reporting period
  • A process to notify the lender of a significant dealing inconsistent with the target market, as soon as practicable and within 10 business days (s994F(6))
The official door

Routine reporting flows to the lender, as set in each target market determination. A significant dealing that is inconsistent with the determination is notified to ASIC through the ASIC Regulatory Portal.

regulatoryportal.asic.gov.au
Source, checked on 2026-09-02

The hawking prohibition, and why the home loan sits outside it

Applies in some cases

When it applies: offers financial products alongside a loan

You must not offer a financial product for issue or sale during, or because of, unsolicited contact with a consumer, unless a valid consent exception applies. Importantly for brokers, this does not apply to the credit contract itself. It applies to financial products offered alongside a loan, such as consumer credit insurance.

Have ready
  • For any financial product offered alongside a loan: evidence of the consumer's positive, voluntary and clear consent given before the contact
  • Consent limited to the particular product, or products reasonably within its scope
  • The offer made within six weeks of consent
  • Records of how and when consent was obtained
The official door

Your point of sale process and consent records, kept under the licence. ASIC supervises and enforces; nothing is lodged.

No online door, kept in your own records under the licence
Source, checked on 2026-09-02

Your clients' information

Privacy, and the small firm exemption that may not protect you

Applies in some cases

When it applies: depends on whether you handle credit information or are a credit provider

The Privacy Act 1988 and its 13 Australian Privacy Principles govern how personal information is handled. A small business, meaning annual turnover of three million dollars or less, is generally outside the Act. But the exemption falls away for a credit reporting body, a credit provider, or a business that handles individuals' credit reports. Whether a particular mortgage broker falls into one of those categories, and so loses the exemption, depends on what the broker actually does. The official sources do not name mortgage brokers or settle it either way, so do not assume you are exempt, and do not assume you are caught. Check your own position.

Have ready
  • If you are drawn in, a clearly expressed, up to date privacy policy covering what you collect and hold, how and why, access, correction, complaints, and any overseas disclosure. If substantially automated decisions significantly affect people, the 2024 reforms require the policy to say so
  • Collection notices given at or before collection
  • Reasonable security safeguards, and destruction or de identification when information is no longer needed
  • Access, correction and complaint handling processes
The official door

The Office of the Australian Information Commissioner, for complaints and guidance. Reform status sits with the Attorney General's Department.

oaic.gov.au
Source, checked on 2026-09-02

Credit reporting, under Part IIIA and the Code

Applies in some cases

When it applies: handles credit reporting information

If you handle consumer credit reporting information, special rules govern what may be collected, how it may be used and disclosed, how it is corrected, and how complaints are dealt with. They sit in Part IIIA of the Privacy Act and in a mandatory, registered Credit Reporting Code.

Have ready
  • Handling practices for credit information consistent with Part IIIA and the 2025 Code
  • The consumer consents and notices the Code requires
  • Correction and complaint processes for credit information
The official door

The Office of the Australian Information Commissioner.

oaic.gov.au
Source, checked on 2026-09-02

Data breaches you have to report

Applies in some cases

When it applies: covered by the Privacy Act

If you are covered by the Privacy Act, you must notify both the OAIC and the affected people when there is an eligible data breach: unauthorised access to, disclosure of, or loss of personal information that is likely to result in serious harm you cannot head off. When you suspect one, you must assess it quickly, with an outer limit of 30 calendar days.

Have ready
  • A data breach response plan that lets you assess a suspected breach within the 30 day limit
  • A way to notify the OAIC by the required statement, and to tell affected people as soon as practicable
The official door

The OAIC, for the notification.

oaic.gov.au/report-a-data-breach
Source, checked on 2026-09-02

Money laundering

The money laundering rules, and why arranging a loan is not caught

Applies in some cases

When it applies: caught only if you make loans in your own name

A broker who only arranges or introduces a loan, and is not the lender, is not a reporting entity under the money laundering rules. Under those rules you are a reporting entity only if you provide a designated service, and arranging or broking a loan is not one. Making a loan, as the lender, is a designated service, so lenders and credit providers are caught, but that turns on the activity, not the job title. A firm that also lends in its own name, or under a white label arrangement actually makes the loan, would be caught in that lending capacity. The Tranche 2 reforms did not add broking.

Have ready
  • Nothing under these rules if you only arrange loans
  • Worth knowing: the lenders on your panel are reporting entities for the loans they fund, and conveyancers and real estate agents you deal with became reporting entities from 1 July 2026
  • If any part of your firm makes loans in its own name, that part is caught: enrol with AUSTRAC, maintain an AML/CTF program, carry out customer due diligence, and meet the reporting duties
The official door

Only if you are a reporting entity: AUSTRAC Online, to enrol and report. If you only arrange loans, there is no door here.

austrac.gov.au/austrac-online
Source, checked on 2026-09-02

When something goes wrong

Complaints: AFCA membership and internal dispute resolution

You must be a member of the Australian Financial Complaints Authority, the single external complaints scheme, and you must run an internal complaints process that meets ASIC's standards in RG 271. Membership is tied to holding the licence; credit representatives are covered through their licensee.

Have ready
  • Current, paid AFCA membership on the licence, and a duty to tell ASIC in writing if it lapses
  • A written internal complaints procedure meeting RG 271, and a complaints register
  • The ability to give a compliant response within the maximum: 30 calendar days for a standard complaint, 21 calendar days for a default notice or a hardship request
  • Complaints data captured in the ASIC format for periodic reporting
The official door

Join or renew at AFCA, the scheme operator. Complaints data is reported to ASIC through the ASIC Regulatory Portal.

afca.org.au/members regulatoryportal.asic.gov.au
Source, checked on 2026-09-02

Breach reporting: reportable situations

You must notify ASIC when you have reasonable grounds to believe a reportable situation has arisen. That is mainly a significant breach, or likely significant breach, of a core obligation, plus certain matters deemed significant.

Have ready
  • A process to identify and assess breaches against the significance test and the deemed significant categories
  • A breach register that dates clearly when you first knew, because that starts the clock
  • Investigation, notification and remediation procedures
  • The ability to lodge within 30 calendar days of first knowing, with a 90 day window in limited cases involving conduct already reported
The official door

Lodge each reportable situation with ASIC through the ASIC Regulatory Portal.

regulatoryportal.asic.gov.au
Source, checked on 2026-09-02

Staying qualified and fit

Competence, and continuing professional development

You must maintain your organisation's competence and make sure your representatives are adequately trained and competent. There is no CPD hour figure set in the credit law for brokers. ASIC's guidance suggests about 20 hours a year for people who provide home loan credit assistance. Any higher figure, such as the 30 hours the MFAA requires, is an industry association membership rule, not the law.

Have ready
  • Evidence your organisation and your representatives are competent for the credit activities you are authorised for
  • A CPD record for the current period: date, provider, description and hours, with evidence kept
The official door

Competence is met and evidenced under the licence. CPD records are kept, and where you belong to an association, recorded with it.

No online door, kept in your own records under the licence
Source, checked on 2026-09-02

Watch list: rules in transition

These are the moving pieces as at 2026-09-02, and the natural home for a monthly note and an early warning ahead of a dated change.

Not the law: your industry association

These are membership rules of industry associations, not law, and are shown separately so they are never mistaken for a legal obligation. Sourced to the associations, which are not government.

This page is a plain English map of the rules that apply to your profession, checked and kept current. A morning brief follows what actually moves, each day.

A daily signal to sharpen judgement, for professionals who act, not react.

See the Briefs
Rules checked on 2026-09-02 · mortgage broker edition