Australia

Brings digital asset platforms and tokenised custody platforms into the financial services licensing regime, with ASIC licensing and supervising them. ASIC reports passage on 1 April 2026, Royal Assent on 8 April 2026 and commencement on 9 April 2027, with an 18-month implementation timeline.

Requiring regulated entities to maintain operational risk management, including business continuity and management of material service provider relationships; updated April 2026.

Act No. 98 of 2024 with parts on security standards for smart devices, ransomware reporting obligations, coordination of significant cyber security incidents, the Cyber Incident Review Board and regulatory powers. Mandatory ransomware payment reporting has applied since 30 May 2025.

Accountability regime for authorised deposit-taking institutions, insurance entities and superannuation trustees and their directors and senior executives, replacing the Banking Executive Accountability Regime. APRA and ASIC administer it jointly; it applied to banking from 15 March 2024 and to insurance and superannuation from 15 March 2025.

APRA prudential practice guide on managing physical, transition and liability climate risks. It helps institutions meet CPS 220, SPS 220, CPS 510 and SPS 510, and does not itself create enforceable requirements.

Requiring regulated entities to maintain capability in information security, report to APRA of material information security incidents, and manage third party information security risks.

Requires entities with annual consolidated revenue of at least AUD 100 million to prepare annual Modern Slavery Statements; the reporting requirement took effect on 1 January 2019. The Modern Slavery Business Engagement Unit in the Australian Border Force supports implementation.

Sets up a register of critical infrastructure assets, critical infrastructure risk management programs (s 30AC), notification of cyber security incidents (Part 2B, s 30BC) and enhanced cyber security obligations (Part 2C).

Commonwealth competition and consumer law enforced by the ACCC, including the Australian Consumer Law that the ACCC invoked in its 2025 unconscionable conduct penalty case against Optus Mobile.

Act and Regulations that govern the employee and employer relationship, provide a safety net of minimum entitlements and aim to prevent discrimination. The Fair Work Ombudsman lists the Closing Loopholes amending Acts alongside it.

Credit regulation statute; Schedule 1 is the National Credit Code, whose s 87 on default notices ASIC cited in its 2026 CashnGo case.

Statute for the National Greenhouse and Energy Reporting scheme, which the Clean Energy Regulator administers. Registered corporations with NGER obligations above the s 13(1)(a) threshold fall into climate reporting Group 1 or 2.

Main Commonwealth anti-money laundering (AML)/countering financing of terrorism (CTF) legislation; sets out obligations for reporting entities (enrolment, customer due diligence, AML/CTF programs, reporting) and powers of the AUSTRAC CEO to regulate them.

Act under which ASIC operates and the Australian Accounting Standards Board is constituted. It also contains consumer-protection rules for financial services, including the unfair contract terms provisions in s 12BF that ASIC relied on in its 2026 CashnGo case.

Key law covering corporate governance, managed investment schemes and the regulation of financial services and markets in Australia; primarily administered by ASIC.

Principal Commonwealth privacy legislation includes the 13 Australian Privacy Principles (Sch 1) and the Notifiable Data Breaches scheme (Pt IIIC).

Relevant to ADIs; source of APRA's power to issue banking prudential and reporting standards.