Guide · Scams Prevention Framework

Most SPF obligations start on 31 March 2027. What changes for a small firm?

The Scams Prevention Framework puts new duties on banks, telcos and large digital platforms. It doesn't regulate conveyancers, accountants, mortgage brokers or financial advisers as such. It can still change how your clients' payments, complaints and expectations work.

Who the SPF covers

Three sectors are designated. Professional firms aren't one of them.

The designation instrument (F2026L00627) names banking services supplied by authorised deposit-taking institutions, telecommunications voice and messaging services, and certain messaging, search and social media platforms. The SPF Rules (F2026L01140) narrow that further, for example with revenue and user thresholds for digital platforms.

Under section 58AD of the Act, the regulated entity is the person who carries on or provides the designated business or service. Using a bank account, a phone service or online advertising doesn't make your firm a provider of those services. So, as at 28 October 2026, a conveyancer, accountant, broker or adviser that supplies none of the designated services has no direct SPF duties. In May 2026, the Government said it would consult relevant sectors ahead of potential further designations. Its response did not commit to additional sectors or a timetable.

Key dates

What has started and what is coming

  1. 29 May 2026Banking, telecommunications and digital platforms designated as regulated sectors (F2026L00627).
  2. 1 September 2026The SPF Rules commence (F2026L01140), and regulated entities must be AFCA members.
  3. 24 November 2026Feedback closes on ASIC's proposed guidance on its oversight of AFCA's SPF role.
  4. Early 2027AFCA plans to publish final SPF rules, subject to ASIC approval.
  5. 31 March 2027Most SPF obligations commence. AFCA's SPF jurisdiction covers matters occurring on or after this date.
  6. 2027 (indicative)ASIC's timetable lists intelligence-sharing rules in Q2 2027 and intelligence sharing from H2 2027. These are planning milestones, not fixed dates.

AFCA's SPF jurisdiction applies to matters occurring on or after 31 March 2027; it doesn't apply SPF standards to earlier scams. Treasury's codes consultation closed on 25 June 2026 and AFCA's rules consultation closed on 28 September 2026, so their drafts shouldn't be read as final.

How it can still reach your firm

Indirect effects, not new obligations

  • Banks may hold or question payments

    Treasury's draft banking code proposes proportionate limits on high-risk transactions and activity. Separately, it proposes closing, freezing or restricting an account where a bank reasonably believes it is being used to facilitate a scam. The draft is a proposal, not a final code, and it sets no fixed hold period. If it is adopted in a similar form, a settlement or client payment could be paused while the bank checks it, so leave room in the timetable.

    Treasury: SPF codes exposure draft

  • Complaints can involve several organisations

    Since 12 March 2026, AFCA has been able to consider complaints against a receiving bank where scam funds were received, separately from the SPF. AFCA also says SPF complaints involving multiple organisations can be considered together. Clients who lose money may ask your firm for payment records and a clear account of what happened.

    AFCA: Receiving banks and unauthorised account opening

  • Clients will hear more about scams

    Banks, telcos and platforms will be under new duties to prevent, detect, report and respond to scams. Clients may start asking how your firm checks that a call or payment instruction is genuine. That is an expectation, not a legal duty on your firm under the SPF.

    ACCC: Scams Prevention Framework

The effects above are our reading of how the framework may play out for small firms, not statements from the sources about professional firms.

Where Vericode fits, and where it stops

One recorded check in your own process.

Your staff use an Australian mobile number from an existing trusted record. Vericode sends a one-time SMS code to it and records whether the code your staff enter matches, with who requested the check, the masked number, the time and the outcome. It can sit beside your callback, payment approval and file-note steps when a call or instruction is unexpected.

A correct read-back doesn't establish identity or authority, and it doesn't prove an instruction or bank account is genuine. Vericode isn't covered by the SPF, and using it doesn't satisfy SPF, AML/CTF, AFSL or any other obligation. It doesn't guarantee that a bank will process a payment or that AFCA will reach a particular outcome.

Sources (checked 28 October 2026)

Legislation and regulator material is cited for context only. No government, ASIC, ACCC, Treasury or AFCA endorsement of Vericode is implied.

Before March 2027

Write down how your firm checks unexpected payment instructions.

If a client or their bank asks later, a written procedure and a file note are easier to show than a memory of the call.

SPF explainer How to check a caller is your client
General information only. This guide is not legal advice. The SPF codes and AFCA rules are still being finalised, so check the current position before relying on it.