Fintech & Digital Payments Compliance in Australia

The Australian market is open to non-bank payment, e-money, remittance and lending businesses, and most of it is reached online. The principal regulators are AUSTRAC for anti-money laundering and counter-terrorism financing, ASIC for financial services and credit licensing and consumer conduct, and APRA for stored value facilities that amount to banking business, with the Treasury and the Reserve Bank of Australia steering the payments system reforms.

The biggest obstacle for a new entrant is the layered authorisation map: a single app can need an AUSTRAC enrolment and remittance registration, an ASIC licence and, for a widely usable redeemable wallet, APRA authorisation, each with its own timetable. The 2026 reform of the AML/CTF Act removed prescriptive identification rules and replaced them with a risk-based duty, so onboarding design is now the firm's own decision to justify.

1. Who regulates this sector

Payments, consumer credit and anti-money laundering law are Commonwealth matters, so a fintech deals with national regulators only; states and territories add no licensing layer. The Australian Financial Complaints Authority is the dispute resolution scheme licensees must join, not a regulator.

2. Licensing and authorisation

Authorisation is activity-based and comes from three statutes at once; a single app can need all of them.

Unregistered remittance is an offence, unlicensed financial services breach the Corporations Act (s 911A), and unauthorised banking business is an indictable offence (Banking Act 1959 s 8).

3. AML, KYC and customer due diligence

The reformed AML/CTF Act applies to existing reporting entities from 31 March 2026 (Compilation No. 63, 1 October 2026), with the AML/CTF Rules 2025 (Compilation No. 1, 31 March 2026) and the Transitional Rules 2026 (Compilation No. 1, 14 May 2026). There is no revenue threshold: a business is in scope from its first designated service with a geographical link to Australia. FATF's 2024 follow-up rated Australia "partially compliant" on new technologies and wire transfers; the next mutual evaluation has its on-site visit in November 2026 and plenary discussion in June 2027.

Programme

No designated service without an up-to-date risk assessment (s 26E) and proportionate AML/CTF policies covering customer due diligence (s 26F); a compliance officer notified to AUSTRAC; independent evaluations.

Initial due diligence

Before the first service: establish on reasonable grounds the customer's identity, persons acting for or on whose behalf they act, beneficial owners, PEP and sanctions status and the purpose of the relationship (s 28(2)); for individuals, take reasonable steps to establish they are who they claim to be, rate risk, and collect and verify KYC information "using reliable and independent data" (s 28(3)).

Beneficial ownership

An individual who ultimately owns 25% or more of, or controls, a non-individual customer (s 5); simplified treatment only for customers owned or controlled by a prudentially or investor-protection regulated entity (Rules 6-18). ABN Lookup gives free Australian Business Number status data.

Ongoing due diligence and EDD

Monitor customers (s 30), including for behaviour indicating fraud, identity theft and scams (Rules 6-35). Enhanced due diligence, with source of wealth and funds (Rules 6-21), where risk is high, a suspicious matter arises, a foreign PEP is involved, a party is in a FATF call-for-action jurisdiction or the service is nested (s 32).

Delayed verification and transition

Section 29 allows a service to start before due diligence is complete only where the Rules permit, starting is essential to avoid interrupting business and the extra risk is low. Rules 6-12 require the firm to have already taken reasonable steps to establish who the individual is and bar any transfer or release of funds (other than holding them on deposit) until section 28 is met, within 20 business days; Rules 6-13 (account opening and deposits) carry the same bar on outflows; the explanatory statement (para 369) confirms that verifying the customer's own identity cannot be deferred. An entity enrolled on 30 March 2026 may keep its pre-reform identification procedure for named customer classes, with a stop date for each set by 1 July 2026, until the transitional rule ceases to have effect on 31 March 2029 (Transitional Rules s 7); customers identified before 31 March 2026 are deemed verified (Rules 6-42). [Transitional relief to 31 Mar 2029]

Reporting and records

4. Identity verification and onboarding

Data and documents

AUSTRAC's initial due diligence guide for individuals (31 March 2026) sets the baseline: collect full name, other names, date of birth, residential address, a unique identifier such as a passport or licence number, occupation and purpose; verify name and date of birth against a government-issued photographic document (driver licence, passport, proof of age card, foreign national identity card), or a non-photographic document plus a secondary document showing name and address. Rules 6-10 allow onboarding of an individual who cannot obtain standard evidence if the firm takes reasonable steps to establish who they are and manages the residual risk.

Binding the applicant to the identity

AUSTRAC lists three acceptable methods, in person or online: comparing the customer with the photograph on their licence or passport in their presence, a video call, or "using biometric technology to compare the customer's identification against their appearance", for example through an identity verification provider. No liveness or presentation attack standard is prescribed for AML purposes; the closest Australian benchmark is the Digital ID (Accreditation) Rules 2024, which require accredited identity providers to run online biometric binding in a single continuous workflow with liveness detection as part of presentation attack detection under ISO/IEC 30107-1 (rule 5.17).

Non-documentary checks

Section 35A authorises disclosure of name, address and date of birth to a credit reporting body for a match assessment once the individual has been told what will be disclosed and why. The Document Verification Service checks a document against the issuing government record through an approved gateway service provider; the Attorney-General's Department states that a match result should not be the sole basis for a decision to provide or refuse a service. Under the Identity Verification Services Act 2023 a non-government requester of the Face Verification Service receives only a match or no-match response, the individual's express consent is required, and facial images created for the request must be destroyed once no longer needed.

Reliance, agents and screening

5. Digital channels: what's different

Bottom line: the AML/CTF Act is channel-neutral by design. The delivery channel is a mandatory factor in rating each customer's risk (s 28(4)(d)), but remote onboarding is not an enhanced due diligence trigger, and AUSTRAC treats in-person comparison, a video call and biometric face comparison as equally acceptable ways of confirming the applicant.

Only the binding step changes

What differs online is how the firm satisfies section 28(3)(a): a live face comparison or video call instead of a glance at the photo. Because the Act prescribes no method, the AML/CTF policies must say which applies to which customer class and why.

No value-tiered remote onboarding

Simplified due diligence (s 31, Rules 6-17) is risk-based, not value-based, and still requires reasonable steps to establish who an individual is. The stored value thresholds and ASIC's AUD 1,000 low value exemption decide whether a service is regulated at all; neither lightens identification once a customer is in scope.

Payer information before the first transfer

Before passing on a transfer message an ordering institution must collect and verify payer information (full name plus a unique customer number, another unique identifier, date and place of birth, or a non-post-box address) and pass it on with the payee's name and tracing information (s 64, Rules 8-3); domestic BECS, BPAY and DEFT transfers carry tracing information only. Verification is waived for pre-commencement customers and, until 1 July 2030, for customers already subject to completed due diligence where nothing casts doubt on the data (Rules 8-8(6), (7)). [In force]

Pending changes

The Anti-Money Laundering and Counter-Terrorism Financing Amendment Bill 2026 would let the AUSTRAC CEO restrict high-risk mechanisms for providing designated services; it passed the House on 16 September 2026 and reached the Senate on 12 October 2026. [Bill, before the Senate] The Australian Government Digital ID System opens to private sector relying parties from December 2026. [Adopted, private sector access from Dec 2026]

6. Data protection and biometrics

Biometric information and templates used for automated verification are sensitive information: the OAIC's facial recognition guide (updated 29 July 2026) requires collection to be reasonably necessary and consented to, warns against implied consent, expects a privacy impact assessment before deployment, and says templates for non-matches should be deleted immediately while retention for matches must be justified (APP 11). A face-match step therefore needs an explicit consent screen and a deletion schedule separate from the seven-year AML record of the check.

From 10 December 2026 an entity using a computer program to make, or take a substantial step in, a decision that could significantly affect a person's rights or interests must disclose in its privacy policy the personal information used and the kinds of decisions involved (APP 1.7 and 1.8); automated onboarding approvals, risk scoring and fraud declines are within scope. [Adopted, applies from 10 Dec 2026]

7. Sector-specific obligations

The bank or BaaS partner's retained responsibilities

A fintech distributing accounts or cards issued by an authorised deposit-taking institution does not take over the bank's status: account opening (item 1) and the bank's transfers remain the bank's designated services, so the bank is the reporting entity and can only use the fintech as an agent (s 37) or rely on it under a Rules 6-29 agreement. Under CPS 230 (in force since 1 July 2025) the bank must treat a fintech it relies on for a critical operation as a material service provider, so the partner bank's standard sets the onboarding floor.

Scams Prevention Framework

The Scams Prevention Framework (Regulated Sectors) Designation 2026 (registered 28 May 2026) designates services provided by ADIs in their banking business, including ADI purchased payment facilities, with ASIC as sector regulator. Only the sector-code, dispute resolution and (from 1 September 2026) external dispute resolution membership provisions apply before the full duties to prevent, detect, report, disrupt and respond to scams start on 31 March 2027. Non-ADI payment providers are not yet a designated sector, but a fintech distributing an ADI's products sits inside the bank's scam controls. [Partly in force, full obligations from 31 Mar 2027]

Consumer protection and fraud

The ePayments Code (ASIC, last updated 2 June 2022) allocates liability for unauthorised transactions and governs mistaken internet payments; it binds subscribers only, and the licensing reform proposes a power to make a revised Code mandatory. [Voluntary code]

8. Risk indicators and red flags

AUSTRAC's 2024 national risk assessment rates registered remittance service providers as a high and stable money laundering vulnerability (unregistered remitters high and increasing), citing remote delivery channels and online account openings with stolen identities; non-bank lenders and financiers are rated low with an emerging outlook, and online payment service providers, including buy now pay later, are flagged as a national vulnerability. The indicators below are AUSTRAC's (26 March 2026).

Payments and remittance typologies

• Identity friction: false, vague or conflicting details, repeated name variations, or changing the amount once asked for identification.
• Structuring: transfers kept just below AUD 10,000, or large amounts split across transactions, cards or agents on the same day.
• Shared identifiers: unrelated customers sharing an address or common identifiers, or several customers remitting to one beneficiary.
• Corridor mismatch: spikes to higher-risk jurisdictions or destinations with no link to the customer.
• Child exploitation pattern: same-day payments of AUD 15 to 500 to multiple beneficiaries labelled school, uniform or medical fees, or payments for VPN, livestreaming or anonymising software.
• Third-party control: acting under someone else's direction, indifferent to fees, or asking to provide identification later.
• Sanctions and proliferation: list matches, routing through countries of proliferation concern, or questions about avoiding due diligence.
• Dormant account burst: multiple high-value transactions in a short period through a new or dormant account.

9. Enforcement and penalties

Civil penalties are set by the Federal Court on AUSTRAC's application: up to 100,000 penalty units per contravention for a body corporate and 20,000 for anyone else (s 175), which at the AUD 364 penalty unit from 1 July 2026 is AUD 36.4 million and AUD 7.28 million. Initial due diligence breaches count per designated service provided (s 28(9)); infringement notices cover enrolment, registration and reporting failures (s 184).

On 29 July 2025 AUSTRAC issued Revolut Payments Australia Pty Ltd, a registered remittance service provider, an infringement notice of AUD 187,800 (ten late international funds transfer reports at AUD 18,780 each) after self-disclosure; the notice noted that civil proceedings could seek up to AUD 31.3 million per contravention. On 26 May 2026 the Federal Court ordered Castra Licensee Pty Ltd and Princeton Securities (NSW) Pty Ltd to pay AUD 50,000 and AUD 45,000 plus costs for unpaid AUD 18,780 notices, and on 28 October 2026 it ordered The Star Entertainment Group to pay AUD 260 million after finding it failed to maintain a compliant AML/CTF programme and to monitor high-risk customers, including failures to verify customer information and source of funds.

10. Recent changes and what to watch

• 28 October 2026[In force] AUD 260 million Federal Court penalty against The Star for programme and monitoring failures.
• 12 October 2026[Bill, before the Senate] AML/CTF Amendment Bill 2026 reaches the Senate; if enacted, AUSTRAC could restrict high-risk delivery mechanisms.
• 10 December 2026[Adopted, effective 10 Dec 2026] Automated decision-making disclosures become mandatory in privacy policies.
• December 2026[Adopted, phased] The Australian Government Digital ID System opens to the private sector.
• 1 July 2026[In force] The re-made CPS 230 commenced for APRA-regulated entities (the original standard has applied since 1 July 2025); the penalty unit rose to AUD 364, with the next indexation due on 1 July 2029.
• 9 April 2026[Proposed, consultation closed] Full Tranche 1 draft legislation for payment service provider licensing consulted on; no bill introduced yet.
• 31 March 2026[In force] Reformed AML/CTF Act and Rules commenced: outcomes-based CDD, ongoing CDD for all customers, pre-reform procedures usable until 31 March 2029.
• 31 March 2027[Partly in force] Full Scams Prevention Framework duties start for ADIs and their purchased payment facilities.

11. What this means for identity verification

The AML/CTF policies must state, per customer class, how name and date of birth are verified (government photo document, DVS, credit bureau match under section 35A), how the live applicant is bound to the identity (biometric face comparison, video call or in-person comparison) and why that fits the class's risk. Firms keeping pre-reform procedures until 31 March 2029 need two parallel flows.

A fully remote channel belongs in the risk model and in the evidence kept: document images, match results, data sources and the risk decision must survive seven years after the relationship ends, while biometric templates follow a shorter consent-based schedule. Business customers need an ownership tree to the 25% threshold and an ABN check. Verified payer information must exist before the first transfer leaves, so verification completes before funds move even under delayed verification. Re-verification follows a suspicious matter, a significant change in the relationship, a PEP or sanctions hit, or behaviour suggesting account takeover. From December 2026 an accredited Digital ID adds a government-assured route.