Governance
Document and implement scam-governance policies, procedures, metrics and targets; review them and obtain senior-officer certification on the statutory cycle.
Regulatory explainer · Scams Prevention Framework
The SPF binds regulated sectors. Its evidence logic flows further.
Banks, telecommunications services and specified digital platforms are the first designated sectors, with most obligations applying from 31 March 2027. Professional firms are not regulated entities merely because they advise or transact with a client, but they still operate inside the same scam event.
Who the framework directly binds
Regulated entities in designated sectors, not every business touched by a scam.
The Scams Prevention Framework Act 2025 lets the Minister designate regulated businesses or services. The Act's entity test, designation instruments, rules and sector codes together determine coverage and obligations. A designation instrument made in May 2026 covers banking, telecommunications and digital-platform services, including specified instant messaging, internet search and social media services, subject to statutory definitions, exceptions and thresholds. External dispute resolution membership applies from 1 September 2026 and most remaining provisions from 31 March 2027. As at October 2026, no final SPF sector code had been registered.
A conveyancer receiving settlement instructions, an accountant handling a refund or an adviser processing a withdrawal does not become an SPF regulated entity merely by using a bank, telco or platform. Professional firms must follow their existing legal, professional, contractual and regulatory duties. The firm's own services would have to meet the coverage test, subject to applicable exceptions, and separate rules about involvement in contraventions may also matter.
The SPF operating model
Governance, prevent, detect, report, disrupt and respond.
The Act groups duties under six principles: Governance, Prevent, Detect, Report, Disrupt and Respond. Their operative duties carry civil penalties, including senior-officer certification on the statutory cycle, subject to transitional application. Sector codes can make them specific to the service and entity. This is an operating system for scam controls, not a promise that every scam will be stopped or every victim reimbursed.
Prevent
Take reasonable steps to prevent scams connected with or using the regulated service, informed by the entity, service, consumers, risks and applicable SPF code.
Detect
Take reasonable steps to detect scams, investigate actionable scam intelligence within the statutory period and identify impacted consumers within a reasonable time.
Report
Give the reports the Act requires, including reports a regulator requests and reports prescribed by the SPF rules, in the required form and time.
Disrupt
Act on actionable scam intelligence and take reasonable steps to prevent losses from the identified activity.
Respond
Provide accessible reporting paths, investigate reports and complaints, communicate outcomes and operate the redress processes that apply to the regulated service.
Liability and reasonable steps
The framework reallocates scrutiny before it reallocates loss.
For a regulated entity, reasonable steps are assessed in context. The Act points to the entity's size, the kind of regulated service, its consumer base, the scam risks those services face, with compliance with relevant SPF code obligations the primary consideration where applicable. The answer therefore comes from evidence about an operating control, not from a slogan or a single universal checklist.
The framework combines regulator enforcement, external dispute resolution and court remedies. It allows compensation and damages mechanisms where their legal tests are met, but it does not create automatic reimbursement for every scam loss. Outcomes turn on the parties, applicable provisions, causation and the available evidence.
That architecture changes the conversation after an incident. A bank can be asked what its systems detected and how it responded; a platform what it did with actionable intelligence; and a telco how the relevant service was protected. A professional firm remains outside those direct SPF questions unless it is regulated, but may still need to explain the instruction, authority and verification steps on its side of the event.
What flows downhill
Why professional firms may feel the pressure without direct SPF regulation.
These are pathways of scrutiny, not new statutory SPF duties for a professional firm. Each forum applies its own rules and must assess the evidence and law relevant to the particular dispute.
AFCA and financial-sector complaints
AFCA has been authorised as the SPF external dispute-resolution scheme for the three initial sectors, with SPF complaints limited to matters occurring on or after 31 March 2027. In a complaint involving a bank or financial service, the regulated entity's response, intelligence and evidence may be tested. That does not make an adviser, lawyer or accountant an SPF-regulated entity, but a professional firm's instruction and verification records may become relevant facts in the wider transaction history.
Professional indemnity review
SPF does not rewrite a professional firm's policy or decide insurance cover. After a scam loss, however, insurers and claims handlers may examine whether the firm followed its documented procedure, separated duties, verified a changed instruction and retained evidence. The framework's emphasis on operational controls and records can influence the questions stakeholders consider reasonable, without creating a direct SPF duty for the firm.
Client claims and contribution disputes
The Act provides damages remedies for qualifying SPF contraventions and apportions responsibility where more than one qualifying wrongdoer causes the same loss, subject to statutory exceptions. Separate claims against a professional firm still depend on the applicable contract, duty, causation and evidence. A court may examine the full sequence: who received the warning, who controlled the payment, what each party checked and whether a documented stop signal was ignored.
Reasonable-steps evidence
Preserve the control, the event and the decision.
A professional firm should design controls for its own duties and risks, not claim SPF compliance it does not owe. The same disciplined evidence can still help explain the firm's conduct when a scam crosses several organisations.
- 01
A defined trigger
Show why the interaction entered the high-risk path: new payment details, a changed contact point, unusual urgency, an unexpected representative or a mismatch with the known relationship.
- 02
An independent contact source
Record where the trusted phone number came from and that it predated the suspicious request. Do not authenticate an instruction using the number supplied by that instruction.
- 03
The verification event
Capture the requester, masked target, method, timestamp, outcome and any failed or abandoned attempt. A failure is evidence to stop and escalate, not a reason to bypass the procedure.
- 04
The complete decision chain
Keep the original instruction, read-back or comparison, approvals, escalation, warnings and final action together so a reviewer can reconstruct what happened before the loss or payment.
What Vericode records, and what it does not
Vericode sends a code to the mobile number already on file, not to the contact details supplied in the suspicious request. The check tests access to that number; it does not establish identity or authority. Codes are sent through Australian SMS provider MobileMessage using the ACMA-registered sender ID VERICODE.
Each check is logged with who requested it, the masked target number, its time, method and outcome. Authorised-contact register events also form a per-contact hash chain. Compliance-authorised users can export the record as PDF or CSV. These records support evidence of the recorded process; they do not establish identity, authority, the safety of surrounding instructions or compliance with SPF, AML/CTF, VOI or other regulatory obligations.
Verification evidence, not client files. Customer and verification data (recipient details, messages and verification records) is hosted in Australia. Staff sign-in is handled by our identity provider, WorkOS, in the United States; see the subprocessor information.
Sources
Federal Register of LegislationScams Prevention Framework Act 2025Read source Federal Register of LegislationSPF sector designation instrument (F2026L00627)Read source Federal Register of LegislationSPF Rules (F2026L01140)Read source Federal Register of LegislationAFCA SPF authorisation (F2026L00685)Read source ASICScams Prevention FrameworkRead source
Legislation and regulator guidance are cited for context only, checked 27 October 2026. No government, ASIC or AFCA endorsement of Vericode is implied.
Make the step reviewable
Turn “we called to check” into evidence of what happened.
Use qualified advice to set the firm's obligations and procedure. Then preserve a consistent authorised-contact check when a live instruction reaches the high-risk path.
General information only. This explainer is not legal, financial, regulatory, insurance or incident-response advice. Confirm the current SPF, AFCA and ASIC position with the applicable regulator and seek professional advice for your circumstances.