Overview of Australia’s Mandatory Scams Prevention Framework (SPF)

Australia’s Scams Prevention Framework (SPF) establishes an economy-wide, legally enforceable regime under the Competition and Consumer Act 2010 to protect consumers and small businesses from scam activity across the entire scam lifecycle. Unlike voluntary industry codes, the SPF introduces mandatory overarching principles and sector-specific codes enforced by the ACCC, ASIC, and ACMA, backed by significant civil penalties and redress through the Australian Financial Complaints Authority (AFCA).

The Six Overarching Principles of the SPF

• 1. Governance: Regulated entities must document, implement, and independently review a senior-management-approved scam governance framework with clear accountability and performance metrics.
• 2. Prevent: Take reasonable steps to prevent scams from reaching or defrauding consumers—including Confirmation of Payee (CoP), sender ID registries, advertiser verification, and targeted consumer friction/warnings.
• 3. Detect: Deploy real-time behavioural analytics, mule-account typologies, and anomaly detection to identify suspected scams both before and after funds or communications are transmitted.
• 4. Report: Share actionable scam intelligence and actionable indicators in near-real time with the National Anti-Scam Centre (NASC) and relevant sector regulators.
• 5. Disrupt: Act rapidly to block, suspend, or take down suspected scam accounts, mule payment rails, spoofed numbers, and fraudulent digital listings—supported by statutory safe-harbour protections.
• 6. Respond: Provide accessible reporting channels, clear internal dispute resolution (IDR), and membership in a single external dispute resolution (EDR) scheme (AFCA) for coordinated multi-sector liability apportionment.

Designated Sectors & Convergence with AML/CTF

The initial designation covers Banks and Authorised Deposit-taking Institutions (ADIs), Telecommunications Providers, and Digital Platform Services (social media, paid search, and online marketplaces), with future expansion planned for superannuation, cryptocurrency/digital currency exchanges (DCEs), and non-bank payment service providers. For financial institutions, SPF obligations directly intersect with AML/CTF transaction monitoring, money-mule onboarding detection (KYC/CDD), and suspicious matter reporting (SMRs) to AUSTRAC.