Regulatory AlertsAustralia: lending & credit regulation
RegulatedASIC credit licensing under NCCP Act; APRA regulates ADI credit risk
- Lead regulator
- Australian Securities and Investments Commission (ASIC)
- Also involved
- APRA (ADI prudential standards) · ACCC (unfair contract terms)
- Core law
- National Consumer Credit Protection Act 2009 (NCCP Act)
- Entry capital
- —
- Approval timeline
- 3-6 months
- Customer assets
- Trust accounts or segregated funds required
- Data protection
- Privacy Act 1988 · OAIC
- Sandbox
- No
Monthly snapshots:2026-07
Non-bank lending and credit activities are strictly regulated by ASIC under the NCCP Act. Entities must hold an Australian Credit Licence (ACL) unless exempt. APRA supervises credit risk management for Authorized Deposit-taking Institutions (ADIs) but does not license non-bank lenders. Recent guidance emphasizes responsible lending, best interests duties, and specific rules for BNPL and low-cost credit.
Which licence do you need?
| Your activity | Requirement | Capital | Timeline | Authority |
|---|---|---|---|---|
| Consumer lending | LicenceAustralian Credit Licence (ACL)[1][2] Responsible lending obligations apply | — | — | ASIC |
| SME / commercial lending | LicenceAustralian Credit Licence (ACL)[3] Exemptions may apply for large commercial loans | — | — | ASIC |
| Microfinance | LicenceAustralian Credit Licence (ACL)[4] Specific guidance for low cost credit contracts | — | — | ASIC |
| Buy-now-pay-later | LicenceAustralian Credit Licence (ACL)[4] Regulated as low cost credit | — | — | ASIC |
| P2P lending platform | LicenceAustralian Credit Licence (ACL)[3] Platform operators require licensing | — | — | ASIC |
| Credit bureau / scoring | Uncertainverify with regulator Privacy obligations apply | — | — | — |
| Debt collection | LicenceAustralian Credit Licence (ACL)[1] Conduct obligations apply | — | — | ASIC |
New — what changed recently
- 2026-03-09RG 205 Credit licensing: General conduct obligations — Clarified regulator expectations for compliance with general conduct obligations under the NCCP Act.[1]
- 2025-09-11APG 223 Residential Mortgage Lending — Issued guidance on prudent risk management practices for residential mortgage lending for ADIs.[5]
- 2025-05-08RG 281 Low cost credit contracts — Provided guidance on how the credit regime applies to BNPL and other low cost credit products.[4]
Market-entry checklist
- 1Apply for Australian Credit LicenceSubmit online application to ASIC demonstrating competence and compliance capacity.
- 2Implement Responsible LendingEstablish procedures to verify borrower suitability and financial capacity under NCCP Act.
- 3Set Up Breach ReportingCreate systems to report specific breaches to ASIC as required by Division 3 of Part 7.6.
- 4Ensure Data Privacy ComplianceAdhere to Privacy Act 1988 obligations for handling consumer credit data.
Sources
- RG 205 Credit licensing: General conduct obligations · 2026-03-09
- RG 209 Credit licensing: Responsible lending conduct · 2025-03-05
- RG 203 Do I need a credit licence? · 2025-05-07
- APG 112 Capital Adequacy: Standardised Approach to Credit Risk · 2025-07-01
- APG 223 Residential Mortgage Lending · 2025-09-11
This guide is compiled automatically from 5 primary-source documents published by Australia's regulators, reviewed by RegAlert, and refreshed monthly (last updated 2026-08-01). It is not legal advice — always confirm requirements with the regulator or local counsel before acting.