ASIC RG 205 — ASIC Regulatory Guide – RG 205 Credit licensing: General conduct obligations

Page 1 REGULATORY GUIDE 205 Credit licensing: General conduct obligations April 2020 About this guide This is a guide for credit licensees, licence applicants and unlicensed carried over instrument lenders (unlicensed COI lenders). This guide describes what we look for when we assess compliance with most of the general conduct obligations under s47(1) of the National Credit Act. The general conduct obligations not covered in this guide are covered in separate guides: see Table 1 in Section A. Page 2 REGULATORY GUIDE 205: Credit licensing: General conduct obligations © Australian Securities and Investments Commission April 2020 Page 2 About ASIC regulatory documents In administering legislation ASIC issues the following types of regulatory documents. Consultation papers: seek feedback from stakeholders on matters ASIC is considering, such as proposed relief or proposed regulatory guidance. Regulatory guides: give guidance to regulated entities by:  explaining when and how ASIC will exercise specific powers under legislation  explaining how ASIC interprets the law  describing the principles underlying ASIC’s approach  giving practical guidance (e.g. describing the steps of a process such as applying for a licence or giving practical examples of how regulated entities may decide to meet their obligations). Information sheets: provide concise guidance on a specific process or compliance issue or an overview of detailed guidance. Reports: describe ASIC compliance or relief activity or the results of a research project. Document history This guide was issued in April 2020 and is based on legislation and regulations as at the date of issue. In July 2021, we made minor updates to Table 1, RG 205.89 and Table 4 and added RG 205.100–RG 205.103 to reflect the ASIC Reference checking and information sharing protocol. We also updated Table 1 to refer to new Regulatory Guide 271 Internal dispute resolution (RG 271). In May 2025, we made changes at RG 205.1 to reflect regulation of buy now pay later products as credit products under amending legislation. In March 2026, we made minor updates to remove out-of-date information, update references and reflect current style and drafting practices. Previous versions:  Superseded Regulatory Guide 205, issued December 2009, reissued June 2010 Disclaimer This guide does not constitute legal advice. We encourage you to seek your own professional advice to find out how the credit legislation and other applicable laws apply to you, as it is your responsibility to determine your obligations. Examples in this guide are purely for illustration; they are not exhaustive and are not intended to impose or imply particular rules or requirements. Page 3 REGULATORY GUIDE 205: Credit licensing: General conduct obligations © Australian Securities and Investments Commission April 2020 Page 3 Contents A Overview ........................................................................................... 4 What are the general conduct obligations? ....................................... 4 When do you need to comply with the general conduct obligations? 6 What do you need to do to comply? .................................................. 8 Our regulatory approach .................................................................. 10 B Key compliance concepts............................................................. 11 What you need to do depends on the nature, scale and complexity of your business ............................................................................... 11 You must have measures for ensuring you comply with your obligations ........................................................................................ 12 You can outsource functions, but not your responsibility ................ 14 C Your broad compliance obligations ............................................ 16 Broad compliance obligations .......................................................... 16 Your compliance measures ............................................................. 16 Our approach to the broad compliance obligations ......................... 18 Responsibility for compliance .......................................................... 19 D Your internal systems ................................................................... 21 Risk management systems.............................................................. 21 Conflicts of interest .......................................................................... 22 E Your people .................................................................................... 24 Obligations of a credit licensee regarding its representatives ......... 24 Monitoring and supervision of your representatives ........................ 25 F Your resources .............................................................................. 27 Having adequate resources ............................................................. 27 Human resources ............................................................................ 28 Technological resources .................................................................. 28 Appendix: Designing and testing your measures ............................. 30 Key terms ............................................................................................... 34 Related information ............................................................................... 36 Page 4 REGULATORY GUIDE 205: Credit licensing: General conduct obligations © Australian Securities and Investments Commission April 2020 Page 4 A Overview Key points Credit licensees must comply with the general conduct obligations and licence applicants must be able to demonstrate in their licence application that they can comply with these general conduct obligations: see RG 205.1–RG 205.10. As a credit licensee or licence applicant, you are responsible for deciding how to comply with the general conduct obligations: see RG 205.12–RG 205.14. An unlicensed carried over instrument lender must comply with a modified set of general conduct obligations as set out in s47 of the National Consumer Credit Protection Act 2009 (National Credit Act), as modified by the National Consumer Credit Protection Regulations 2010 (National Credit Regulations). Some general conduct obligations are also civil penalty provisions: see RG 205.5–RG 205.7. To help you comply, this regulatory guide: • outlines key compliance concepts that apply to all of the general conduct obligations (see Section B); • describes what we look for when we assess compliance with various general conduct obligations (see Sections C to F); and • includes questions to help you design and test your measures for complying with the general conduct obligations (see the appendix). What are the general conduct obligations? RG 205.1 Credit licensees have general conduct obligations under s47(1) of the National Credit Act. This guide does not cover all of the general conduct obligations. Some general conduct obligations are covered in separate guides: see Table 1. Note 1: In this guide, references to sections (s), chapters (Ch) and parts (Pt) are to the National Credit Act, unless otherwise specified. References to regulations (reg) and schedules (Sch) are to the National Credit Regulations, unless otherwise specified. Note 2: Credit licensees must also comply with the responsible lending obligations in Ch 3 of the National Credit Act: see Regulatory Guide 209 Credit licensing: Responsible lending conduct (RG 209). Low cost credit contract providers may elect to comply with the modified responsible lending obligations: see Regulatory Guide 281 Low cost credit contracts (RG 281). Note 3: For information specific to the needs of small business: see Information Sheet 97 Guidance for small credit businesses (INFO 97). RG 205.2 If you ceased offering new credit contracts or consumer leases before 1 July 2010 but continue to be a lender or lessor in relation to credit contracts or consumer leases entered into by you before 1 July 2010 and you do not hold Page 5 REGULATORY GUIDE 205: Credit licensing: General conduct obligations © Australian Securities and Investments Commission April 2020 Page 5 an Australian credit licence (credit licence), you are regulated as an unlicensed carried over instrument lender (unlicensed COI lender). You will need to comply with a broadly similar set of general conduct obligations. For more information about carried over instrument lenders (COI lenders), see RG 205.15–RG 205.16. Note: A ‘carried over instrument’ is a contract or other instrument that was made and in force, and to which an old Credit Code applied, immediately before 1 July 2010: see s4 of the National Consumer Credit Protection (Transitional and Consequential Provisions) Act 2009 (Transitional Act). Table 1: General conduct obligations of credit licensees Obligation Description/section Where to find our guidance Your broad compliance obligations This cell is blank This cell is blank Engaging in credit activities efficiently, honestly, fairly You must do all things necessary to ensure that the credit activities authorised by your licence are engaged in efficiently, honestly and fairly: see s47(1)(a) Section C of this guide Complying with the conditions on your licence You must comply with the conditions on your licence: see s47(1)(c) Section C of this guide Complying with relevant laws You must comply with the credit legislation: see s47(1)(d) You must comply with any other obligations that are prescribed by the regulations: see s47(1)(m) Section C of this guide Your internal systems This cell is blank This cell is blank Risk management systems Unless you are a body regulated by the Australian Prudential Regulation Authority (APRA), you must have adequate risk management systems: see s47(1)(l)(ii) Section D of this guide Conflicts of interest You must have in place adequate arrangements to ensure that your clients are not disadvantaged by any conflict of interest that may arise wholly or partly in relation to credit activities engaged in by you or your representatives: see s47(1)(b) Section D of this guide Dispute resolution You must have an internal dispute resolution (IDR) procedure that:  complies with standards and requirements made or approved by ASIC (see s47(1)(h)(i)); and  covers disputes in relation to credit activities engaged in by you or your representatives (see s47(1)(h)(ii)) You must report specified IDR information to ASIC: see s47(1)(ha). You must be a member of the Australian Financial Complaints Authority (AFCA): see s47(1)(i) Regulatory Guide 271 Internal dispute resolution (RG 271) The IDR data reporting handbook Section B of Regulatory Guide 267 Oversight of the Australian Financial Complaints Authority (RG 267) Page 6 REGULATORY GUIDE 205: Credit licensing: General conduct obligations © Australian Securities and Investments Commission April 2020 Page 6 Obligation Description/section Where to find our guidance Your people This cell is blank This cell is blank Ensuring your representatives comply You must take reasonable steps to ensure that your representatives comply with the credit legislation: see s47(1)(e) Section E of this guide Reference checking and information sharing You must comply with the ASIC Reference checking and information sharing protocol (ASIC protocol) in relation to prospective representatives who will act as mortgage brokers or financial advisers: see s47(1)(ea) Section E of this guide Information Sheet 257 ASIC reference checking and information sharing protocol (INFO 257) Training and individual competence You must ensure that your representatives are adequately trained, and are competent, to engage in the credit activities authorised by your licence: see s47(1)(g) Regulatory Guide 206 Credit licensing: Competence and training (RG 206) Organisational competence You must maintain the competence to engage in the credit activities authorised by your licence: see s47(f) RG 206 Your resources This cell is blank This cell is blank Adequate resources Unless you are a body regulated by APRA, you must have available adequate resources (including financial, technological and human resources) to engage in the credit activities authorised by your licence and to carry out supervisory arrangements: see s47(1)(l)(i) Section F of this guide Regulatory Guide 207 Credit licensing: Financial requirements (RG 207) Compensation arrangements You must have compensation arrangements in accordance with s48: see s47(1)(j) Regulatory Guide 210 Compensation and insurance arrangements for credit licensees (RG 210) Ensuring compliance with the general conduct obligations You must have adequate arrangements and systems to ensure compliance with your obligations under s47(1), and a written plan that documents those arrangements and systems: see s47(1)(k) Section B of this guide and the appendix When do you need to comply with the general conduct obligations? RG 205.3 You must comply with the general conduct obligations from the time your credit licence is granted (or if you are an unlicensed COI lender) and on an ongoing basis. If we have reason to believe that you are not complying with your obligations, we may take administrative action, which could include suspending or cancelling your licence, or imposing additional licence conditions: see s45(1) and 55. Note: See Information Sheet 104 FAQs: Complying with your credit obligations (INFO 104) for further information. Page 7 REGULATORY GUIDE 205: Credit licensing: General conduct obligations © Australian Securities and Investments Commission April 2020 Page 7 RG 205.4 If we conduct a surveillance of your business, we may check your ongoing compliance with the general conduct obligations, including the measures you have for ensuring compliance. RG 205.5 Some general conduct obligations (i.e. those in s47(1)(a), (b), (e), (ea), (f), (g), (h), (i), (j), (k), (l) and (m)) are also civil penalty provisions: see s47(4). RG 205.6 If an individual breaches any of these civil penalty provisions, the maximum penalty is the greater of: (a) 5,000 penalty units; and (b) three times the benefit obtained and detriment avoided. Note: See Fines and penalties for more information about penalties, including the value of a penalty unit. RG 205.7 If a body corporate breaches any of these civil penalty provisions, the maximum penalty is the greater of: (a) 50,000 penalty units; (b) three times the benefit obtained and detriment avoided; and (c) 10% of the annual turnover for the 12-month period ending at the end of the month in which the body corporate contravened, or began to contravene, but no more than 2.5 million penalty units. Note: See Fines and penalties for more information about penalties, including the value of a penalty unit. Applying for a licence RG 205.8 If you are applying for a credit licence, you must be able to show that you can comply with the general conduct obligations from the time you are granted a licence, and on an ongoing basis: see s47(1)(k). Note: If you are also an Australian financial services (AFS) licensee, you must be able to show that you can comply with the general obligations for AFS licence holders from the time you are granted a licence, and on an ongoing basis: see reg 7.6.03(g) of the Corporations Regulations 2001. Our expectations for compliance with reg 7.6.03(g) are equivalent to our expectations for compliance with s47(1)(k). RG 205.9 We cannot grant you a credit licence if we have any reason to believe you are likely to contravene the general conduct obligations: see s37(1)(b). Note: If you are applying for a credit licence, you should read Regulatory Guide 204 Applying for and varying a credit licence (RG 204). It explains the licence application process and the documents you may need to provide to support your application. Section 47(1)(k) of the National Credit Act requires that you have adequate arrangements and systems to ensure compliance with your obligations under s47(1), and a written plan that documents those arrangements and systems. RG 205.10 We do not expect your business to be fully operational at the time you apply for a licence. However, when you apply, you must be able to show that you Page 8 REGULATORY GUIDE 205: Credit licensing: General conduct obligations © Australian Securities and Investments Commission April 2020 Page 8 have arrangements in place to ensure compliance once you are granted a licence. RG 205.11 Additionally, ASIC may cancel your licence if you do not operate your credit business before the end of six months after the licence is granted. If you have not commenced your credit business before the end of six months after the licence is granted, you must notify ASIC within 15 business days. What do you need to do to comply? RG 205.12 The general conduct obligations are principles-based and designed to apply in a flexible way. For this reason, we do not think we can or should give prescriptive guidance on what you need to do to comply with them. The National Credit Act places responsibility on you to decide how to comply. RG 205.13 However, to help you comply, this guide: (a) outlines key compliance concepts that apply to all of the general conduct obligations (see Section B); (b) describes what we look for when we assess compliance with various general conduct obligations (see Sections C to F); and (c) includes questions to help you design and test your measures for complying with the general conduct obligations covered in Sections C to F (see the appendix). RG 205.14 In this guide, we often use the phrase ‘we expect’. In using this phrase, we are describing what we look for when we assess compliance with the general conduct obligations, consistent with our approach to other conduct obligations we enforce. Our expectations are not intended to limit the ways in which you can comply. It is up to you to decide how best to comply with the general conduct obligations. Application of general conduct obligations to carried over instrument lenders RG 205.15 If you are regulated as an unlicensed COI lender, you are subject to a modified statutory regime contained in Pt 2-2 of the National Credit Act, as modified by Sch 2 to the National Credit Regulations. Note: Schedule 2 to the National Credit Regulations was inserted by item [32] of Sch 1 to the National Consumer Credit Protection Amendment Regulations 2010 (No. 2). RG 205.16 As the general conduct obligations imposed on unlicensed COI lenders are broadly similar to the general conduct obligations imposed on credit licensees, this guide will also assist unlicensed COI lenders to comply with their obligations. The key difference in the obligations for unlicensed COI Page 9 REGULATORY GUIDE 205: Credit licensing: General conduct obligations © Australian Securities and Investments Commission April 2020 Page 9 lenders is that membership of AFCA is optional under the modified statutory regime: see s47 of the National Credit Act, as modified by Sch 2 item 2.17 to the National Credit Regulations. The obligations for unlicensed COI lenders who are not AFCA members include requirements to: (a) keep a register of complaints in relation to the carried over instruments (see s47, as modified by Sch 2 item 2.17); (b) maintain registers of requests for hardship variations and stays of enforcement (see s47, as modified by Sch 2 item 2.17); (c) provide ASIC with an audit report prepared by a suitably qualified person of whether the COI lender has complied with the National Credit Code in relation to its carried over instruments (see s49, as modified by Sch 2 item 2.23); and (d) notify ASIC in writing of any significant contravention or likely contravention of the National Credit Act, Transitional Act or Australian Securities and Investments Commission Act 2001 (ASIC Act) as soon as practicable, and no more than 10 business days after becoming aware of the contravention or likely contravention (see s52, as modified by Sch 2 item 2.27). Note: For more information on obligations of carried over instrument lenders: see Information Sheet 110 Lenders with carried over instruments (INFO 110). Bodies regulated by APRA RG 205.17 If you are a body regulated by APRA, you do not need to read the paragraphs in Section D relating to risk management or Section F relating to adequate resources. You only need to read the paragraphs in Section D relating to conflicts of interest: see RG 205.82–RG 205.88. RG 205.18 This is because the general conduct obligations to have risk management systems and adequate resources do not apply to you: see s47(1)(l). This is the case even if only a part of your credit business is an activity that APRA regulates. APRA, not ASIC, imposes any requirements for risk management and resources that apply to you. Note: The term ‘body regulated by APRA’ has the meaning given in s3(2) of the Australian Prudential Regulation Authority Act 1998. RG 205.19 The exemption for requirements in relation to risk management and adequate resources also applies to unlicensed COI lenders regulated by APRA: see s47, as modified by Sch 2 item 2.17. RG 205.20 In administering the other general conduct obligations, we will take into account that you are regulated by APRA and we will aim to minimise regulatory duplication. We regularly communicate with APRA and coordinate regulatory activities where we share an interest. Page 10 REGULATORY GUIDE 205: Credit licensing: General conduct obligations © Australian Securities and Investments Commission April 2020 Page 10 Our regulatory approach RG 205.21 This guide aims to strike a balance between certainty and flexibility for credit licensees, while furthering the primary goals of the licensing regime and the general conduct obligations. At the broadest level, these regulatory goals are to promote: (a) consumer confidence in using credit; and (b) the undertaking of efficient, honest and fair credit activities by all licensees or unlicensed COI lenders and their representatives. Standards and international principles RG 205.22 In thinking about how to comply with your obligations, you might find it helpful to look at good industry practice as captured in standards. Industry and Australian standards are relevant to most licensees and unlicensed COI lenders because they have been drafted with the Australian regulatory environment in mind. For licensees or unlicensed COI lenders with larger or more complex businesses, or those that are part of a global business, international principles might also be relevant. RG 205.23 We also use standards in a similar way—that is, as a guide to good industry practice. However, we check compliance with the law and licence conditions, not with standards—unless the law or your licence conditions require you to comply with a particular standard. RG 205.24 We will approve codes of conduct where we have a regulatory responsibility to do so. Note: Our guidance on approving codes of conduct under s238A of the National Credit Act is set out in Regulatory Guide 183 Codes of conduct for the financial services and credit sectors (RG 183). Page 11 REGULATORY GUIDE 205: Credit licensing: General conduct obligations © Australian Securities and Investments Commission April 2020 Page 11 B Key compliance concepts Key points What you need to do depends on the nature, scale and complexity of your business: see RG 205.25–RG 205.29. You must have measures for ensuring you comply with your obligations as a credit licensee or COI lender: see RG 205.30–RG 205.42. You can outsource functions, but not your responsibility as a credit licensee or COI lender: see RG 205.43–RG 205.47. This section outlines key compliance concepts that underpin what we look for when we assess compliance with the general conduct obligations. You need to bear these key concepts in mind when reading Sections C to F. What you need to do depends on the nature, scale and complexity of your business RG 205.25 There are many different kinds of licensees engaging in a range of credit activities. We do not take a ‘one-size-fits-all’ approach to regulation. Rather, we acknowledge that what you need to do to comply with your obligations will vary according to the ‘nature, scale and complexity’ of your business. RG 205.26 ‘Nature, scale and complexity’ includes factors such as: (a) the credit activities you engage in; (b) the diversity and structure of your operations (including the geographical spread of your operations and the extent to which you outsource any of your functions); (c) the volume and size of the transactions you are responsible for; (d) whether your main business is undertaking credit activities; and (e) the number of people in your organisation. RG 205.27 The National Credit Act (s47(2)) states that when considering whether compliance is adequate, the nature, scale and complexity of the credit activities that are engaged in by the licensee must be taken into account in relation to four of the general conduct obligations in s47(1): (a) ensuring that clients are not disadvantaged by a conflict of interest (s47(1)(b)); (b) training representatives (s47(1)(g)); (c) having adequate compliance arrangements (s47(1)(k)); and Page 12 REGULATORY GUIDE 205: Credit licensing: General conduct obligations © Australian Securities and Investments Commission April 2020 Page 12 (d) for licensees that are not regulated by APRA, having adequate resources and risk management systems (s47(1)(l)). RG 205.28 Section 47, as modified by Sch 2 item 2.18, also imposes similar expectations on unlicensed COI lenders in relation to these four general conduct obligations. We will take into account similar factors when assessing whether you have complied with these obligations as an unlicensed COI lender. RG 205.29 We will also take into account the nature, scale and complexity of your credit business when assessing compliance with the other general conduct obligations. You must have measures for ensuring you comply with your obligations RG 205.30 We use the expression ‘measures’ or ‘compliance measures’ in this guide to refer to your processes, procedures or arrangements for ensuring that, as far as reasonably practicable, you comply with your obligations as a credit licensee or unlicensed COI lender, including the general conduct obligations. RG 205.31 We expect you to: (a) document your measures in some form (see RG 205.33–RG 205.34); (b) fully implement them and monitor and report on their use (see RG 205.35–RG 205.40); and (c) regularly review the effectiveness of your measures and ensure they are up to date (see RG 205.41–RG 205.42). If you do not do this, we think you will find it more difficult to show you are complying with the general conduct obligations. RG 205.32 Your measures will be affected by the nature, scale and complexity of your business: see RG 205.25–RG 205.29. Documenting your measures RG 205.33 The National Credit Act requires credit licensees to have adequate arrangements and systems to ensure compliance with their obligations under s47(1), and a written plan that documents those arrangements and systems: see s47(1)(k). Under the National Credit Regulations, unlicensed COI lenders must also comply with the requirement to have adequate arrangements and systems, including having a written plan: see s47, as modified by Sch 2 item 2.17. We will take into account the nature, scale and complexity of a credit licensee’s or unlicensed COI lender’s credit activities when assessing compliance with this obligation: see s47, as modified by Sch 2 item 2.18. Page 13 REGULATORY GUIDE 205: Credit licensing: General conduct obligations © Australian Securities and Investments Commission April 2020 Page 13 RG 205.34 Documentation helps you demonstrate that you are complying with the general conduct obligations. When you document your measures, we expect this will include details of who is responsible for compliance, the timeframes involved and associated record keeping and reporting. Implementing, monitoring and reporting on your measures RG 205.35 It is not enough just to document your measures. You also need to implement them fully. This means you need to put them into practice and integrate them into the day-to-day conduct of your business. RG 205.36 For measures to work effectively in practice, you need people at all levels of your business, including your senior management, to understand them and be committed to their success. Integrating your measures into the culture of your business helps ensure they are effective on an ongoing basis. RG 205.37 You also need to monitor your compliance. RG 205.38 Credit licensees are required to lodge with us a compliance certificate on an annual basis: see s53. To comply with this obligation, we expect that you will need to keep records of your monitoring and reporting, including records of reports on compliance and non-compliance. Note: Annual compliance certificates are lodged using Form CL50 Australian credit licence annual compliance certificate. RG 205.39 Unlicensed COI lenders must also provide an annual compliance certificate: see s53(1), as modified by Sch 2 item 2.28. RG 205.40 We understand that, in some instances, your monitoring and reporting will be built into your business processes. We also acknowledge that your compliance measures might reflect your business’s overall approach to compliance. Whatever the case, you need to be able to show us how you are able to monitor your compliance and appropriately address any compliance breaches. Note: If you breach or are likely to breach your general obligations, you may need to notify ASIC of that breach: see s50A and 50B. For guidance on breach reporting, see Regulatory Guide 78 Breach reporting by AFS licensees and credit licensees (RG 78). Reviewing your measures RG 205.41 Regularly reviewing your measures will help to ensure they remain effective. In some cases, it may be sensible for you to consider external review. Where compliance issues have arisen (such as major breaches or repeated compliance failures), an external compliance review is particularly appropriate. RG 205.42 You need to review your measures when there are changes to your obligations, your business or the environment in which you operate. We expect that you will have a process for identifying changes that may alter the effectiveness of your measures. Page 14 REGULATORY GUIDE 205: Credit licensing: General conduct obligations © Australian Securities and Investments Commission April 2020 Page 14 You can outsource functions, but not your responsibility Outsourcing functions that relate to your credit activity RG 205.43 We recognise that many credit licensees outsource functions that relate to their credit activity, including administrative or operational functions. Outsourcing might be to external parties or other entities within a corporate group. Functions that are commonly outsourced include: (a) information technology (IT) systems for storing records in relation to engaging in credit activities; (b) recruitment and training of representatives; (c) research on credit products for which credit activities are undertaken; (d) the operation of call centres (including customer inquiries); (e) periodic compliance reviews of representatives; (f) sales; and (g) debt collection. You remain responsible for outsourced functions RG 205.44 If you outsource functions that relate to your credit activity, you remain responsible for complying with your obligations as a credit provider: see s324 and 325. For example, if you outsource the training of your representatives, you will still be responsible for ensuring that your representatives are competent and adequately trained. Third parties undertaking credit activities on your behalf RG 205.45 If a third party undertakes credit activities on your behalf, they will generally need to be your credit representative or a licensee: see s29(1) and (3). RG 205.46 You can only authorise a person to be your credit representative for a credit activity that is authorised by your licence: see s64(5)(a). You cannot authorise another licensee to engage in credit activities as your credit representative if the other licensee is authorised to engage in that credit activity under their own licence: see s67(1). Complying with your obligations RG 205.47 If you outsource functions that relate to your credit activity, we expect that you: (a) will have measures in place to ensure that due skill and care is taken in choosing suitable service providers; (b) can and will monitor the ongoing performance of service providers; and Page 15 REGULATORY GUIDE 205: Credit licensing: General conduct obligations © Australian Securities and Investments Commission April 2020 Page 15 (c) will appropriately deal with any actions by service providers that breach service-level agreements or your obligations as a credit licensee. Note: If you are also regulated by APRA, see APRA’s prudential standards and guidance notes on managing risks associated with service providers (e.g. Prudential Standard CPS 230 Operational Risk Management). Page 16 REGULATORY GUIDE 205: Credit licensing: General conduct obligations © Australian Securities and Investments Commission April 2020 Page 16 C Your broad compliance obligations Key points You must have measures in place for ensuring you comply with your licensee obligations on an ongoing basis: see RG 205.50–RG 205.61. We expect your compliance measures to cover all of your obligations as a credit licensee: see RG 205.62–RG 205.68. We expect your compliance area to have adequate resources to do its job properly: see RG 205.69–RG 205.72. Broad compliance obligations RG 205.48 You must: (a) do all things necessary to ensure that you engage in credit activities efficiently, honestly and fairly (s47(1)(a)); (b) comply with the conditions on your credit licence (s47(1)(c)); and (c) comply with the credit legislation (s47(1)(d)). RG 205.49 In this guide, we refer to these obligations as the ‘broad compliance obligations’: see RG 205.62–RG 205.68. RG 205.50 You must have measures in place for ensuring you comply with your obligations as a licensee, including the broad compliance obligations, on an ongoing basis: see s47(1)(k). We expect you will document your measures: RG 205.33–RG 205.34. RG 205.51 If you are an unlicensed COI lender, you must also do all things necessary to ensure that you engage in the credit activities efficiently, honestly and fairly: see s47, as modified by Sch 2 item 2.17. RG 205.52 This section explains what we look for when we assess the adequacy of your compliance measures. When reading this section, you need to bear in mind the key concepts in Section B. For more help in designing and testing your measures, see the appendix. Your compliance measures RG 205.53 Compliance with your obligations as a credit licensee is central to the protection of consumers and the promotion of market integrity. Having effective compliance measures is a way for you to ensure you comply with your obligations as a licensee, including identifying and appropriately Page 17 REGULATORY GUIDE 205: Credit licensing: General conduct obligations © Australian Securities and Investments Commission April 2020 Page 17 dealing with instances of non-compliance. Compliance measures also help you demonstrate to us that you can comply and are complying with your obligations. What your compliance measures need to cover RG 205.54 We consider that the broad compliance obligations are both standalone obligations and obligations that encompass the other general conduct obligations: see RG 205.62–RG 205.68. For this reason, we expect your measures for ensuring compliance with the broad compliance obligations will cover all of your obligations as a licensee including: (a) the rest of the general conduct obligations (including those covered in Sections D, E and F of this guide); (b) your licence conditions; and (c) any other credit legislation that applies to you. RG 205.55 We also expect that your compliance measures will: (a) take into account the specific compliance risks of your business, especially those that may materially affect consumers or market integrity; and (b) enable you to: (i) communicate to your representatives what they need to do to comply; (ii) monitor compliance with all of your licensee obligations; and (iii) address any compliance breaches. Note: In thinking through your compliance obligations, you might find it helpful to look at Australian Standard AS ISO 37301:2023 Compliance management systems— Requirements with guidance for use. Nature, scale and complexity of your business RG 205.56 Your compliance measures might include one or a number of different documents and any of a variety of standalone or integrated IT systems. As a general rule, the smaller and simpler your business, the smaller and simpler we expect your measures to be. RG 205.57 For example, if you engage in limited credit activities as an incidental part of your main business or you are a very small business, you might meet your compliance obligations by having a checklist focusing on compliance risks that would adversely affect consumers and the provision of efficient, honest and fair credit activities. RG 205.58 On the other hand, if your main business is to engage in credit activities, you deal in a broad range of products and you have numerous staff that are Page 18 REGULATORY GUIDE 205: Credit licensing: General conduct obligations © Australian Securities and Investments Commission April 2020 Page 18 spread out geographically, you are more likely to meet your compliance obligations by having compliance measures that involve the use of manuals, programs and dedicated compliance staff. RG 205.59 If you use external providers to provide functions that relate to your credit licence, we think your compliance measures will need to be different from those you would need if you performed those functions in-house. Compliance measures and risk management systems RG 205.60 From our experience, it is common for some licensees’ compliance measures to be integrated into their risk management systems. Compliance measures can be one of several controls you can use to address or mitigate risks to your business (including the risk of non-compliance with your obligations under the National Credit Act). The general conduct obligation to maintain adequate risk management systems is explained in Section D. RG 205.61 If you are regulated by APRA, the general conduct obligation to have adequate risk management systems does not apply to you: see RG 205.17– RG 205.20. However, this does not affect the need for you to meet our requirements on compliance measures, even if your compliance measures are integrated into your risk management systems. Our approach to the broad compliance obligations RG 205.62 The broad compliance obligations are both standalone obligations and obligations that encompass the other general conduct obligations. This means that: (a) if you fail to comply with one or more of the other general conduct obligations, you are also likely to breach the broad compliance obligations; and (b) even though you may be complying with all of the other general conduct obligations, you may still be in breach of the broad compliance obligations. This is because the broad compliance obligations are also standalone obligations. Engaging in credit activities efficiently, honestly and fairly RG 205.63 Credit licensees and unlicensed COI lenders need to do all things necessary to ensure that they engage in their credit activities in a way that meets all of the elements of the phrase ‘efficiently, honestly and fairly’. RG 205.64 If you fail to comply with the other general conduct obligations, it is unlikely that you will be complying with the ‘efficiently, honestly and fairly’ obligation. Page 19 REGULATORY GUIDE 205: Credit licensing: General conduct obligations © Australian Securities and Investments Commission April 2020 Page 19 RG 205.65 However, the ‘efficiently, honestly and fairly’ obligation is also a standalone obligation that operates separately from the other general conduct obligations. For example, if you have contractual obligations to clients and breach them, this might not be a breach of the other general conduct obligations, but it could amount to a failure to engage in credit activities efficiently, honestly and fairly. Complying with other relevant laws RG 205.66 If you are a credit licensee, the obligation to comply with the credit legislation encompasses the other general conduct obligations. However, it also includes an obligation to comply with: (a) the National Credit Act (including the National Credit Code); and (b) the provisions of the ASIC Act and other Commonwealth, state and territory legislation dealing with credit activities. Note 1: See the definition of ‘credit legislation’ in s5 of the National Credit Act. Other legislation that may apply to you includes the Anti-Money Laundering and Counter- Terrorism Financing Act 2006 (Cth), Privacy Act 1988 (Cth), and the various state Fair Trading Acts (such as the Fair Trading Act 1999 (Vic)). This list is by way of example, and is not exhaustive. Note 2: ASIC has agreements to share information with other agencies, including AUSTRAC, the Australian Taxation Office, the Australian Competition and Consumer Commission and the Commonwealth Director of Public Prosecutions. ASIC may disclose such information to another Commonwealth, state or territory government agency under s127 of the ASIC Act. Complying with modified obligations for unlicensed COI lenders RG 205.67 If you are an unlicensed COI lender who is not a member of AFCA, there are modified obligations you must comply with: see RG 205.16. Complying with your licence conditions RG 205.68 You must comply with any licence conditions that we impose: see s47(1)(c). In addition, you must also comply with the licence conditions set out in the regulations. These conditions reinforce some of the general conduct obligations, so breaching a condition will sometimes also be a breach of the general conduct obligation to which the condition relates. Responsibility for compliance RG 205.69 We expect that you will allocate to a director or senior manager responsibility for: (a) overseeing your compliance measures; and Page 20 REGULATORY GUIDE 205: Credit licensing: General conduct obligations © Australian Securities and Investments Commission April 2020 Page 20 (b) reporting to the governing body (including having ready access to the governing body). RG 205.70 You need to ensure that the area responsible for compliance: (a) is independent enough to do its job properly (particularly for larger or more complex credit businesses); (b) has adequate staff, resources and systems; and (c) has access to relevant records. RG 205.71 We expect your compliance area to have adequate resources to do its job properly. In the case of some credit businesses (e.g. larger, more complex businesses, including corporate groups), it may be appropriate for you to have a separate compliance function (which might be outsourced to a third party). For credit licensees or unlicensed COI lenders whose business is small or whose main business is not engaging in credit activities, we expect that a person or persons will have responsibility for overseeing compliance, and that they will spend an appropriate amount of time on compliance. The role of senior management RG 205.72 The level of senior management involvement in overseeing your compliance measures might extend to: (a) communicating the measures to those responsible for implementing them and other stakeholders; (b) ensuring that your business has adequate staff and resources to undertake required compliance functions; (c) ensuring staff education and awareness of the measures; (d) implementing clear reporting lines for the manager(s) responsible for the measures; and (e) receiving regular reports on the measures. Note: If you have a small credit or finance broking business, see INFO 97 for further guidance on this issue. Note that our expectations about how you structure your compliance measures relate to the nature, scale and complexity of your business. Page 21 REGULATORY GUIDE 205: Credit licensing: General conduct obligations © Australian Securities and Investments Commission April 2020 Page 21 D Your internal systems Key points Unless you are regulated by APRA, you must have measures in place to ensure you comply with the obligation to have adequate risk management systems on an ongoing basis. We expect you to have a structured and systematic process for identifying, evaluating and managing risks faced by your business: see RG 205.76– RG 205.81. All licensees and unlicensed COI lenders must have adequate arrangements in place to ensure clients are not disadvantaged by any conflict of interest: see RG 205.82–RG 205.88. This section explains what we look for when we assess the adequacy of your risk management systems and conflict of interest arrangements. When reading this section, you need to bear in mind the key concepts in Section B. If you are regulated by APRA, you only need to read the paragraphs relating to conflicts of interest (i.e. RG 205.82–RG 205.88): see RG 205.17–RG 205.20. Risk management systems RG 205.73 You must have adequate risk management systems: see s47(1)(l)(ii). You must also have measures in place to ensure that you comply with this obligation on an ongoing basis: see RG 205.50. RG 205.74 You must have adequate arrangements in place to ensure that your clients are not disadvantaged by any conflict of interest that may arise wholly or partly in relation to credit activities engaged in by you or your representatives: see s47(1)(b). Similar requirements also apply to unlicensed COI lenders: see s47, as modified by Sch 2 item 2.17. RG 205.75 This section explains what we look for when we assess the adequacy of your risk management systems and conflict of interest arrangements. When reading this section, you need to bear in mind the key concepts in Section B. For more help in designing and testing your measures, see the appendix. Note: This requirement does not apply to you if you are regulated by APRA. RG 205.76 The requirement for risk management systems ensures that you explicitly identify the risks you face and have measures in place to keep those risks to an acceptable minimum. Page 22 REGULATORY GUIDE 205: Credit licensing: General conduct obligations © Australian Securities and Investments Commission April 2020 Page 22 RG 205.77 We expect your risk management systems will: (a) be based on a structured and systematic process that takes into account your obligations under the National Credit Act; (b) identify and evaluate risks faced by your business, focusing on risks that adversely affect consumers or market integrity (this includes risks of non-compliance with the credit legislation as relevant); (c) establish and maintain controls designed to manage or mitigate those risks; and (d) fully implement and monitor those controls to ensure they are effective. Note: In thinking through your risk management obligations, you might find it helpful to look at Australian Standard AS ISO 31000:2018 Risk management—Guidelines. Nature, scale and complexity of your business RG 205.78 Your risk management systems will depend on the nature, scale and complexity of your business and your risk profile. They will be different for each credit licensee or unlicensed COI lender. RG 205.79 Your risk management systems will need to adapt as your business develops and your business risk profile changes over time. RG 205.80 If you use external providers to provide functions that relate to your credit licence, we think your risk management measures will need to be different from those you would need if you performed those functions in-house. Note: We will take into account the nature, scale and complexity of your credit activities when assessing compliance with this obligation: see s47(2). Financial risks RG 205.81 Your risk management systems will normally need to address the risk that your financial resources will not be adequate. Note: For further guidance see RG 207. Conflicts of interest RG 205.82 All credit licensees and unlicensed COI lenders have a general conduct obligation in relation to conflicts of interest: see s47, as modified by Sch 2 item 2.17. RG 205.83 This obligation is to have adequate arrangements in place to ensure that your clients are not disadvantaged by any conflict of interest that may arise wholly or partly in relation to credit activities engaged in by you or your representatives. Page 23 REGULATORY GUIDE 205: Credit licensing: General conduct obligations © Australian Securities and Investments Commission April 2020 Page 23 RG 205.84 We consider that this obligation also includes the obligation to manage and monitor any conflicts that arise in relation to any credit activities in which you engage. RG 205.85 This obligation is different from the obligation under s912A(1)(aa) of the Corporations Act 2001 (Corporations Act) that applies to AFS licensees in relation to conflicts of interest. We think that the conflicts obligation for credit licensees is more explicit about the required outcomes for the consumer. RG 205.86 The obligation arises where an interest of the licensee or unlicensed COI lender conflicts with a legal obligation that the licensee (or unlicensed COI lender) owes to the client, including one that arises under the credit legislation, National Credit Regulations, or at law (whether through statute, common law or contractual arrangements between the licensee and the client). Note: See consolidated Explanatory Memorandum to the National Consumer Credit Protection Bill 2009, paragraph 2.117. RG 205.87 Whether arrangements are ‘adequate’ will depend on the particular circumstances in each case. We will take into account the nature, scale and complexity of your credit activities when assessing compliance with this obligation: see s47(2). RG 205.88 Additional requirements apply to mortgage brokers: see Regulatory Guide 273 Mortgage brokers: Best interests duty (RG 273). Mortgage brokers are required to act in the best interests of consumers and to prioritise their consumers’ interests when providing credit assistance. Page 24 REGULATORY GUIDE 205: Credit licensing: General conduct obligations © Australian Securities and Investments Commission April 2020 Page 24 E Your people Key points You must have measures for monitoring and supervising your representatives (i.e. the people who act on your behalf). We expect these measures will allow you to determine whether your representatives are complying with the credit legislation: see RG 205.94–RG 205.104. You must also have measures to ensure that your representatives who engage in credit activities have, and maintain, the necessary knowledge and skills to engage in those credit activities competently: see RG 206. This section explains what we look for when we assess compliance with each of these obligations. We have provided separate guidance about meeting your obligations for training representatives: see RG 206. Obligations of a credit licensee regarding its representatives RG 205.89 You must: (a) take reasonable steps to ensure that your representatives comply with the credit legislation (s47(1)(e)); (b) comply with the ASIC protocol by: (i) requesting references when employing or authorising mortgage brokers to act on your behalf; and (ii) sharing information with other credit licensees and AFS licensees by providing references about your current and former representatives (s47(1)(ea)); and (c) if your representatives engage in credit activities (as relevant), ensure they are trained and competent to do so (s47(1)(g)). RG 205.90 If you are an unlicensed COI lender, you must also comply with the requirement to ensure that, if your representatives engage in credit activities in relation to carried over instruments, they are adequately trained and competent to do so: see s47, as modified by Sch 2 item 2.17. RG 205.91 You must also have measures in place to ensure that you comply with these obligations on an ongoing basis: see RG 205.50. RG 205.92 This section explains what we look for when we assess compliance with these obligations. When reading this section, you need to bear in mind the key concepts in Section B. For more help in designing and testing your measures, see the appendix. Page 25 REGULATORY GUIDE 205: Credit licensing: General conduct obligations © Australian Securities and Investments Commission April 2020 Page 25 RG 205.93 You must also have adequate resources, including people, to engage in credit activities and carry out supervision: see s47, as modified by Sch 2 item 2.17. This particular obligation is covered in Section F. Monitoring and supervision of your representatives RG 205.94 To ensure your representatives comply with the credit legislation, we consider that you need to monitor and supervise them. Who do you need to monitor and supervise? RG 205.95 Any person who acts on your behalf is your ‘representative’: see s5. Under s5, ‘representatives’ refers to the following classes of persons: (a) your employees and directors, or the employees and directors of a body corporate related to you; (b) your credit representatives; and (c) any other person acting on your behalf. How closely do you need to supervise your representatives? RG 205.96 The level of monitoring and supervision your representatives need will depend on the functions your representatives perform and the nature, scale and complexity of your business (e.g. whether your business operates from one or a number of locations). RG 205.97 We do not think that you need to scrutinise every activity of your representatives. However, we expect you will have measures that: (a) allow you to determine whether your representatives are complying with the credit legislation (including your licence conditions); and (b) include a robust mechanism for remedying any breaches. Note: Where a credit licensee or its representatives provide mortgage broking services to consumers, the licensee must meet additional obligations to investigate certain breaches of the law and notify and remediate clients and consumers. For more information, see Information Sheet 259 Complying with the notify, investigate and remediate obligations (INFO 259). RG 205.98 We also expect that you will have measures in place for complying with new requirements as they arise. Employment screening RG 205.99 We expect your measures for monitoring and supervision will include carrying out appropriate background checks before you appoint new representatives. These checks could include referee reports, searches of ASIC’s register of banned and disqualified persons and police checks. Page 26 REGULATORY GUIDE 205: Credit licensing: General conduct obligations © Australian Securities and Investments Commission April 2020 Page 26 Complying with the ASIC protocol RG 205.100 If you are considering employing or authorising a representative to act as a mortgage broker on your behalf, you will need to comply with the ASIC protocol by requesting a reference(s) about the representative from other credit licensees and AFS licensees. RG 205.101 The ASIC protocol is intended to promote better information sharing about the performance history of prospective mortgage brokers and financial advisers (prospective representatives). RG 205.102 The ASIC protocol requires a recruiting licensee to request a reference about a prospective representative from specific current and/or former licensees who employed or authorised that prospective representative. Other reference requests may also be made under the ASIC protocol. Credit licensees and AFS licensees that receive a request for a reference under the ASIC protocol must share information with the recruiting licensee by providing a reference about the prospective representative. RG 205.103 The ASIC protocol provides a template reference request, which asks for information about a prospective representative in the past five years. It also provides a template consent form, which must be completed by the prospective representative before a recruiting licensee requests a reference. Note: For information about the obligations that apply under the ASIC protocol, see INFO 257. Measures for monitoring and supervision RG 205.104 Your measures for monitoring and supervision will normally show how you: (a) keep track of who your representatives are, what role they perform and whether they are appropriately authorised; (b) ensure your representatives (including your credit representatives) act within the scope of what you have authorised them to do; (c) ensure your representatives understand your compliance arrangements; (d) monitor your representatives’ compliance; and (e) respond to compliance failures. Page 27 REGULATORY GUIDE 205: Credit licensing: General conduct obligations © Australian Securities and Investments Commission April 2020 Page 27 F Your resources Key points Unless you are regulated by APRA, you must have measures in place for ensuring you have adequate resources to engage in the credit activities covered by your licence and to carry out supervisory arrangements: see RG 205.105–RG 205.110. You at least need to have enough resources to enable you to comply with all of your obligations under the law and meet your current and anticipated future operational needs: see RG 205.111–RG 205.118. This section explains what we look for when we assess the adequacy of your human and technological resources. When reading this section, you need to bear in mind the key concepts in Section B. See the appendix for more help in designing and testing your measures. If you are regulated by APRA, you do not need to read this section: see RG 205.17–RG 205.20. Having adequate resources RG 205.105 You must have adequate financial, technological and human resources to engage in the credit activities covered by your licence or in carried over instrument lending activity, and to carry out supervisory arrangements: see s47, as modified by Sch 2 item 2.17. RG 205.106 If you are an unlicensed COI lender and are not regulated by APRA, you must similarly ensure that you have adequate resources so you can engage in the credit activities in relation to carried over instruments, and to carry out supervisory arrangements: see s47, as modified by Sch 2 item 2.17. RG 205.107 Whether your resources are adequate will depend on the nature, scale and complexity of your business: see RG 205.26. RG 205.108 You must also have measures to ensure that you have adequate resources on an ongoing basis: see RG 205.50. RG 205.109 We have provided separate guidance about meeting your obligation to have adequate financial resources: see RG 207. RG 205.110 Having adequate technological and human resources is crucial to your ability to demonstrate you have the capacity to carry on your credit business in full compliance with the law and to supervise your representatives. Failure to have enough resources may create an unacceptable risk that you may not comply with all your obligations as a credit licensee (or unlicensed COI lender). Page 28 REGULATORY GUIDE 205: Credit licensing: General conduct obligations © Australian Securities and Investments Commission April 2020 Page 28 Human resources RG 205.111 Whether your human resources are adequate will depend on the nature, scale and complexity of your business: see RG 205.26. However, you need to have enough people to enable you to: (a) comply with all of your obligations under the law; (b) carry out monitoring and supervision; and (c) meet your current and anticipated future operational needs. RG 205.112 Your measures for ensuring that you have enough people will normally include: