EXPLANATORY STATEMENT

Issued by authority of the Assistant Treasurer and Minister for Financial Services

Competition and Consumer Act 2010

Competition and Consumer (Scams Prevention Framework—Regulated Sectors) Designation 2026

Subsection 58AC(1) of the Competition and Consumer Act 2010 (the Act) provides that the Minister may designate one or more businesses or services to be a regulated sector of the Australian economy for the purposes of the Scams Prevention Framework (SPF) in Part IVF of that Act. Further, subsection 58ED(1) of the Act provides that the Minister may designate a Commonwealth entity to be an SPF sector regulator for a regulated sector. 

The purpose of the Competition and Consumer (Scams Prevention Framework—Regulated Sectors) Designation 2026 (the Designation) is to designate the banking, telecommunications and digital platforms sectors as regulated sectors under the SPF. The digital platform sector is initially defined to include social media services, instant messaging services, and the provision of paid advertising on internet search engines.

The SPF sector regulators are:

                Banking sector: Australian Securities and Investments Commission (ASIC)

                Telecommunications sector: Australian Communications and Media Authority (ACMA)

                Digital platforms sector: Australian Competition and Consumer Commission (ACCC).

The SPF was introduced into the Act in 2025 as a whole-of-economy initiative aimed at preventing and responding to scams affecting the Australian economy. Under the framework, designated sectors of the economy (called regulated sectors) are required to comply with principles-based obligations (called SPF principles), sector-specific codes (called SPF codes) and rules (called SPF rules). 

Broadly, any entity that carries on or provides a business or service comprising a regulated sector is a regulated entity for that sector, and the business carried on or service provided is a regulated service for that entity. Regulated entities must comply with the SPF principles, which require the entities to take reasonable steps to prevent, detect and disrupt scams, report about and respond to scams, and have governance arrangements related to scams. These principles apply with respect to entities’ regulated services where they impact SPF consumers. A regulated entity must also comply with any SPF code made for the sector, which contains sector-specific obligations.

As discussed in detail for each sector below, the Minister has considered the matters set out in section 58AE of the Act before designating each sector. These matters include:

                the scam activity in the sector,

                the effectiveness of existing anti-scam initiatives,

                the interests of persons that would be SPF consumers in the sector, and

                the likely consequences to the public and to the businesses or services making up the sector.

This instrument operates in conjunction with the SPF rules and SPF codes when made. The SPF rules would support the effective operation of the SPF by providing further detail on activities and obligations enabled by the Act. Meanwhile, the SPF codes would establish sector-specific, mandatory and enforceable obligations for regulated entities in the designated sectors so that incentives are in place in the sectors where scammers act to cause harm in the community.

Designation of the banking sector

This instrument designates the banking sector as a regulated sector under the SPF. The banking sector comprises banking and purchased payment facility (PPF) services provided by authorised deposit-taking institutions (ADIs) in Australia (noting that there is expected to be an exception for certain providers of PPFs in the SPF rules, when made). This designation makes ADIs subject to the SPF obligations in relation to their banking services.

Consumers’ trust in ADIs is critical to the Australian economy. ADIs are entrusted with safeguarding funds and play a central role in the financial system. However, they are also a key channel through which scams are perpetrated. Scamwatch data highlights the prominence of bank transfers in scam-related losses; bank transfers are the most common payment method used by reporting victims, accounting for a financial loss of $118.1 million in 2025. Despite progress through industry-led initiatives, gaps remain in scam prevention and consumer support. There is a need for more consistent and coordinated action across the sector to reduce harm and ensure banks are held accountable for implementing effective prevention.

ASIC reports 671 and 790, published in 2023 and 2024 respectively, found that the approaches of banks to anti-scam governance and strategy were variable and less mature than expected. These reviews identified inconsistencies in scam detection, response and victim support across banking institutions.

Designating the banking sector under the SPF ensures that ADIs use appropriate and proactive anti-scam measures and adhere to the SPF principles and SPF code (when made).

It is expected that the SPF rules, when made, will contain an exception for certain providers of PPFs and will exclude certain indirect SPF consumers – that is, SPF consumers that are not direct customers, except for SPF consumers receiving an indirect service in the course of making a payment to, or receiving a payment from, a covered banking service. This is intended to ensure the SPF does not apply where it would not be appropriate.

Designation of the telecommunications sector

This instrument designates the telecommunications sector as a regulated sector under the SPF. The telecommunications sector comprises services provided by carriers and carriage service providers (CSPs) in connection with voice calls and messages, excluding those delivered wholly over the internet.

The Australian community relies on the telecommunications network for a range of personal and business purposes. However, it is also a common channel used by scammers to initiate and sustain deceptive activity. In 2025, Scamwatch recorded that consumer reports of scams originating from phone calls and text messages combined accounted for $90.5 million in losses and 67,055 reports, which made up 27 per cent of losses and 33 per cent of reports.

Scammers frequently use phone calls and text messages to impersonate legitimate entities, deliver phishing links and manipulate victims into sharing sensitive information or transferring funds. These channels are often the first point of contact and may also be used to build trust over time, as seen in investment scams.

Certain telecommunications activities are currently regulated by the industry code C661:2022 Reducing Scam Calls and Scam SMs (the industry code), registered by the ACMA under subsection 117(2) of the Telecommunications Act 1997 (the Telecommunications Act). The industry code was developed by the Australian Telecommunications Alliance and registered in July 2022.

It is expected that the SPF code for the telecommunications sector will replace the existing industry code, subject to its deregistration under the Telecommunications Act. Accordingly, it is intended that the scope of the telecommunications designation would generally capture the same businesses and services captured by the industry code.

Designating the telecommunications sector under the SPF ensures that carriers and CSPs implement consistent and proactive anti-scam measures, including intelligence sharing and service-level protections. This reflects the unique technical capabilities available within the telecommunications network to detect and disrupt scams, which differ from digital communication channels.

Designation of the digital platforms sector

This instrument designates the digital platforms sector as a regulated sector under the SPF. The digital platforms sector comprises social media services, instant messaging services, and the provision of paid advertising on an internet search engine. This designation is not intended to capture all services provided by digital platforms in the economy, but rather to address specific areas of risk.

Australians rely heavily on digital platforms in their day-to-day lives for both personal and work purposes; they are a significant point of vulnerability in the scams ecosystem. The prevalence of scams on digital platforms and their cost to consumers is alarming. Scams originating online comprised 22 per cent of reports to Scamwatch in 2025, but made up 47 per cent of losses, totalling $158.5 million. Scammers are becoming more successful using online methods such as social media platforms to steal money from Australians, with reports increasing by 29 per cent and losses by 22 per cent in 2025 compared to the previous year.

The September 2022 Digital Platform Services Inquiry interim report conducted by the ACCC identified that digital platforms were not taking sufficient and consistent steps to protect users from scams. It recommended targeted regulatory measures, including mandatory scam prevention and removal mechanisms, user and ad verification and public reporting on scam mitigation efforts.

Designating the digital platforms sector under the SPF responds directly to these concerns. It ensures that operators of platforms implement consistent and proactive measures to prevent, detect and disrupt scams, and are accountable for the safety of their users.

It is expected that the SPF rules, when made, will contain exceptions for digital platforms that do not meet a specified revenue test and services that do not meet a specified test for active Australian users. This is intended to ensure the SPF applies to digital platform services that present the highest likelihood of exposing Australian consumers to scams, without imposing regulatory and compliance burden on entities that pose a low risk.

Consultation and other matters

Public consultation was undertaken on an exposure draft of the Designation from 28 November 2025 to 5 January 2026. This process built on the extensive consultation undertaken during the development of the SPF and on subsequent policy papers published by the Treasury, which outlined the Government’s intention to designate the banking, telecommunications and digital platforms sectors. In accordance with paragraphs 58AE(1)(b) and (c) of the Act, this included consultation with sector participants and consumer bodies.

Submissions broadly supported the regulation of the three sectors under the SPF. Stakeholder feedback otherwise focused on seeking clarity on the definitions of certain services and concerns about the scope of certain services captured. The scope of the designated services has been refined in response. Most notably, the scope of a ‘designated internet search service’ has been narrowed to paid advertising on a search service to ensure regulated digital platforms can take decisive action against scams, rather than imposing an unworkable scope for industry. The definition of ‘social media service’ has also been updated and broadly aligns with an existing definition in the Online Safety Act 2021 for legislative consistency. The definition of ‘instant messaging service’ has also been updated to exclude enterprise instant messaging services used primarily for facilitating internal business communications as such services pose a low risk of scams compared to public-facing services.

The Designation is a legislative instrument for the purposes of the Legislation Act 2003 and is subject to the disallowance and sunsetting regimes under that Act.

The Designation commences on and applies from the day after registration, noting that Part 10 of the designation instrument sets out partial exceptions to the application of this instrument.

Details of the Designation are set out in Attachment A.

A Statement of Compatibility with Human Rights is at Attachment B.  

ATTACHMENT A

Details of the Competition and Consumer (Scams Prevention Framework – Regulated Sectors) Designation 2026

Part 1 – Preliminary

This Part sets out machinery provisions, including the name of the instrument, commencement, authorising legislation and definitions.

Section 1 – Name

This section provides that the name of the instrument is the Competition and Consumer (Scams Prevention Framework – Regulated Sectors) Designation 2026 (the Designation).

A legislative reference in this Explanatory Statement is a reference to the Designation unless otherwise stated.

Section 2 – Commencement

The Designation commences the day after it is registered. Part 10 of the Designation provides transitional provisions relevant to how Part IVF of the Competition and Consumer Act 2010 applies from commencement, as explained below.

Section 3 – Authority

The Designation is made under the Competition and Consumer Act 2010 (the Act).

Section 4 – Definitions

This section sets out definitions relevant to the Designation.

Definitions of general application

The Act means the Competition and Consumer Act 2010.

Definitions relevant for the banking sector

The following terms are definitions relevant to the banking sector:

                ADI has the same meaning as in the Banking Act. Under that Act, an ADI (short for authorised deposit-taking institution) is a body corporate that has authority from the Australian Prudential Regulation Authority (APRA) under subsection 9(3) of that Act to carry on banking business in Australia.

                Banking business has the same meaning as in the Banking Act 1959 (the Banking Act). Under subsection 5(1) of that Act, banking business means a business that consists of banking within the meaning of paragraph 51(xiii) of the Constitution, or a business that is both carried on by a corporation to which paragraph 51(xx) of the Constitution applies and consists, to any extent, of:

–               both taking money on deposit (otherwise than as part-payment for identified goods and services) and making advances of money; or

–               other financial activities prescribed by the regulations for the purposes of this definition.

                Covered banking service has the meaning set out in subsection 11(2) of the Designation. This is explained in detail later in this Explanatory Statement. 

                The definition of purchased payment facility is explained in detail later in this Explanatory Statement.

Definitions relevant for the telecommunications sector

The following terms are definitions relevant to the telecommunications sector:

                Carriage service has the same meaning as in section 7 of the Telecommunications Act 1997 (Telecommunications Act), which defines it to be a service for carrying communications by means of guided and/or unguided electromagnetic energy. An example of a carriage service includes a voice call service.

                A carrier is the holder of a carrier licence granted by the Australian Communications and Media Authority (ACMA) under section 56 of the Telecommunications Act. A carrier owns the network units that deliver carriage services to the public. A carrier may also be a nominated carrier as defined in section 7 of the Telecommunications Act, if a nominated carrier declaration under section 81 of that Act is in force in relation to one of the carrier’s network units.

                Covered telecommunications service is defined in subsection 13(2) of the Designation. This is explained later in this Explanatory Statement.

                Listed carriage service has the same meaning as in section 16 of the Telecommunications Act. Under that Act, a listed carriage service is any carriage service between a point and one or more other points, where one ‘point’ is connected to Australia.

                The term ‘point’ is also defined in section 16 of the Telecommunications Act, so that a listed carriage service refers to the services provided by a carriage service provider for communications connected to Australia.

                The definitions of message, message service, public carriage service provider, voice call and voice call service are explained in detail later in this Explanatory Statement.

Definitions relevant for the digital platforms sector

The following terms are definitions relevant to the digital platforms sector:

                Electronic service has the same meaning as in the Online Safety Act 2021, which is defined in that Act as a service:

–               that allows end-users to access material using a carriage service; or

–               that delivers material to persons having equipment appropriate for receiving that material, where the delivery of the service is by means of a carriage service;

–               but does not include a broadcasting service or a datacasting service (within the meaning of the Broadcasting Services Act 1992).

                Material has the same meaning as in the Online Safety Act 2021 being material whether in the form of text, data, speech, music or other sounds, visual images (moving or otherwise), or in any other form, or in any combination of forms.

                The definitions of covered digital platform service, designated instant messaging service, designated internet search service, designated social media service and instant messaging service are explained in detail later in this Explanatory Statement.

Parts 2 to 4 - Designation of regulated sectors

Parts 2 to 4 designate the banking, telecommunications and digital platforms sectors as regulated sectors of the Australian economy under subsection 58AC(1) of the Act. Under section 58AD of the Act, any entity that carries on, or provides, a business or service that is included in the regulated sector is automatically a ‘regulated entity’, and the business or service is a ‘regulated service’ for the entity in accordance with that section, unless an exception prescribed in the SPF rules under subsection 58AD(4) applies to the entity or service.

Under subsections 58AH(1) and (3) of the Act, a regulated service may be provided to an SPF consumer directly or indirectly, whether or not under a contract, arrangement or understanding with the person, or whether or not the regulated entity knows that person is a natural person or small business operator. A regulated service may involve the supply of goods. Regulated services are generally limited to services provided in Australia but can include services provided outside of Australia if the conditions in paragraph 58AH(1)(b) of the Act are met.  

Regulated entities must comply with the SPF principles in Part IVF of the Act. The SPF principles require these regulated entities to take reasonable steps to prevent, detect and disrupt scams, report about and respond to scams, and have appropriate governance arrangements relating to scams. The Australian Competition and Consumer Commission (ACCC) regulates and enforces compliance with the SPF principles as the SPF general regulator.

The ability to designate relevant sectors in a legislative instrument made by the Minister is appropriate as the designations contain complex and specific details about each regulated sector. Having this instrument-making power sit with the Minister ensures sufficient flexibility for the Government to respond quickly to changing scam methods and trends which may target particular sectors of the economy by allowing swift action to designate a sector. This also ensures the SPF remains agile to emerging scam threats so as to provide appropriate safeguards for SPF consumers.

The SPF principles will be supported by an SPF code for each regulated sector, which sets out sector-specific obligations. These code obligations must be consistent with the SPF principles but will be more prescriptive in nature. The SPF sector regulator designated for the sector will regulate and enforce compliance with the SPF code for that sector.

Failure to comply with obligations in the SPF principles and SPF codes may attract civil penalties. Further, a regulated entity may be liable to an SPF consumer in civil action for damages for loss or harm.

Part 2 – Designation of services as a regulated sector – banking

Section 11 – Designation of services as regulated sector - banking

Subsection 11(1) provides that, for the purposes of subsection 58AC(1) of the Act, covered banking services are designated as a regulated sector.

Subsection 11(2) defines covered banking service to be:

                a service provided by an ADI in the course of carrying on its banking business in Australia; or

                the provision of a purchased payment facility (PPF) within the meaning of the Payment Systems (Regulation) Act 1998 by an ADI, to the extent this is not already a service provided in the course of carrying on banking business. 

Accordingly, an ADI that provides a covered banking service is a regulated entity for the purposes of the banking sector, and a covered banking service is a regulated service for that entity. A service is only a covered banking service if it is provided by an ADI.

Covered banking service – banking business

The banking sector captures each service provided in the course of carrying on an ADI’s banking business. These services are ‘regulated services’ for the ADI. This may include (without limitation) any of the following:

                Opening, closing or making available a bank account, margin lending facility, cheque account, credit facility or other like facility, including issuing a digital or physical bank card.

                Receiving money on deposit. 

                Making advances of money (such as loans and provisions of credit).

–               This may include credit card facilities, home loans, personal loans, margin loans and buy-now-pay-later contracts.

–               It may also include banking services provided by the ADI in a ‘white-labelling’ arrangement. For example, if a credit card facility is branded and distributed by a person other than an ADI (such as a department store) but provided by the ADI, the department store distributing the branded card would not have obligations under the SPF. However, the ADI that provides the credit card would have SPF obligations as an ADI providing a covered banking service.

                Enabling transactions, transfers, payments or receipt of money through an account or facility provided by that ADI, including via cheques.

–               For example, an SPF consumer transfers money from a bank account with an ADI to a scammer’s bank account with a different ADI. In this example, the consumer is an SPF consumer of both the ‘sending’ ADI and the ‘receiving’ ADI, despite the ‘receiving’ ADI having no contractual relationship with the consumer. The ‘sending’ ADI has provided a direct covered banking service to the consumer, and the ‘receiving’ ADI an indirect covered banking service to the consumer.

–               An ADI providing the covered banking service must comply with the SPF in relation to transaction and payment activity, even if the ADI is using a third-party service to support that transaction and payment capability. 

Covered banking service only captures banking business in Australia. Therefore, banking business carried out through foreign branches is outside the scope of the banking sector (but not banking business carried out in Australia by foreign ADIs). However, this is not intended to exclude services provided in the course of carrying on banking business in Australia to an Australian who is overseas (such as an Australian using their Australian bank account to make a payment while overseas).

Covered banking service – provision of a PPF

To the extent it is not already captured by paragraph 11(2)(a) of the Designation, the provision of a PPF provided by an ADI is also a regulated service in the banking sector.

This limb of covered banking service captures the provision of PPFs that are not subject to a determination by APRA under section 6 of the Banking Regulation 2016 and therefore do not constitute the carrying on of banking business.

Provision of a PPF may include, without limitation, services such as issuing the facility, enabling use of the facility (e.g. through a card) and making payments on behalf of the user of the PPF as the holder of the stored value.

It is expected that the SPF rules, when made, will contain an exception for certain providers of PPFs.

Other services not captured

A covered banking service that is provided by an ADI is a regulated service for that ADI. Any other service that is provided by that ADI falls outside the scope of the Designation. For example, the provision of insurance products, superannuation products or share trading services by an ADI are not performed when carrying on a banking business, so are outside of the scope of the banking sector.

For clarity, services provided by payment service providers, including, for example, transaction initiation and the clearing and settlement of payments, are not captured in the banking sector. Though these services may be offered by an ADI, they are provided to other entities, and are not provided in the course of the ADI carrying on its banking business.

It is expected that the SPF rules, when made, will contain an exception for certain indirect SPF consumers of ADIs, which is relevant to these circumstances.

Section 12 – Designation of SPF sector regulator – banking

The Australian Securities and Investments Commission (ASIC) is designated as the SPF sector regulator for the banking sector.

Part 3 – Designation of regulated sector – telecommunications

Section 13 – Designation of services as regulated sector – telecommunications

Subsection 13(1) provides that for the purposes of subsection 58AC(1) of the Act, covered telecommunications services are designated as a regulated sector.

Subsection 13(2) provides that a covered telecommunications service is:

                either a voice call service, or a message service (‘nature of the service’), and

                provided by a carrier and a public carriage service provider using a listed carriage service (‘provider and provision of the service’).

Covered telecommunications service – nature of the service

The nature of the service being provided must either be a voice call service or a message service.

A voice call service is a service that enables voice calls to be made or received using a carriage service (other than where a voice call is carried wholly over the internet). Generally, a voice call is a call made on a phone or other device in which participants can hear but not see each other. Specifically, voice call has the same meaning as in the Do Not Call Register Act 2006. Under section 4 of that Act, a voice call means:

                a voice call within the ordinary meaning of that expression; or

                a call that involves a recorded or synthetic voice; or

                if a call such as those above is not practical for a particular recipient with a disability (for example, because the recipient has a hearing impairment) – a call that is equivalent to a call previously mentioned, whether or not the recipient responds by way of pressing buttons on a telephone handset or similar thing.

The Designation is intended to include where the voice call service is initiated over the internet, but then terminates on a listed carriage service (or vice-versa). For example, a voice call, such as Voice Over Internet Protocol, will be captured where it is used by a scammer on an over-the-top service call application that originates on the internet and is used to call an SPF consumer’s mobile phone number (so it terminates on a listed carriage service). However, where the voice call is wholly over the internet, that service is not captured by this element of the Designation.

A message service is a service that enables messages to be sent or received using a carriage service (other than where a message is carried wholly over the internet). Message has the same meaning as the Spam Act 2003 – which under section 4 of that Act means information whether in the form of text, data, speech, music or other sounds, visual images (animated or otherwise) or any other form or combination of forms – but excludes a message sent using a voice call service, which is already captured.

Examples of a message service include a short message service or a multimedia message service. These services provide ways to send messages, but they have different functionalities and features available to users. However, where the message is carried wholly over the internet, that service is not captured. For example, an instant message sent from a scammer to an SPF consumer using an over-the-top application carried wholly over the internet is not subject to the telecommunications designation but will instead be subject to the digital platforms designation.   

Covered telecommunications service – provider and provision of the service

To be captured, the voice call or message services must be provided by a carrier and a public carriage service provider, and provided using a listed carriage service.

A public carriage service provider is a carriage service provider (CSP) as defined in the Telecommunications Act. Under subsection 87(1) of the Telecommunications Act, a CSP is a person who supplies, or proposes to supply, a listed carriage service (as defined earlier in this Explanatory Statement) to the public using a network unit owned by one or more carriers or a network unit in relation to which a nominated carrier declaration is in force. For example, a supplier of voice call services or message services. It also includes an international carriage service provider and carriage service intermediary as defined in subsections 87(2) and (5) of the Telecommunications Act respectively. An international carriage service provider is a person who supplies, or proposes to supply, a listed carriage service to the public using a line link connecting a place in Australia and a place outside Australia or using a satellite facility.

A carriage service intermediary is a public CSP who arranges, or proposes to arrange, for the supply of a listed carriage service by a CSP to a third person (i.e. it is the middle person that acts between the CSP and customers). A CSP does not need a license issued by ACMA to operate.

A public carriage service provider does not include persons such as transport authorities, broadcasting services and electricity supply bodies who are only CSPs, because they are deemed so under subsection 87(3) of the Telecommunications Act.

The Designation is intended to capture both the retail arm of providing voice call and messaging services that would be attributed to a public CSP as well as the role telecommunications infrastructure provides in delivering the services that would be attributed to a carrier. This recognises that a person acting in the capacity of a carrier and public CSP may be the same person or a different person. As such, where the end-to-end delivery of a scam call or message involves multiple carriers and/or public CSPs, all would be captured by the SPF with respect to their individual role in the delivery of that call or message.

The telecommunications designation is not intended to capture other services that a carrier or public CSP may provide. For example, if a public CSP is also a reseller of insurance or energy services, these would not be in scope for the telecommunications designation. 

Section 14 – Designation of SPF sector regulator – telecommunications

For the purposes of subsection 58ED(1) of the Act, the ACMA is designated as the SPF sector regulator for the telecommunications sector.

Part 4 – Designation of regulated sector – digital platforms

Section 15 – Designation of services as regulated sector – digital platforms

Subsection 15(1) provides that, for the purposes of subsection 58AC(1) of the Act, covered digital platform services are designated as a regulated sector.

Subsection 15(2) defines a covered digital platform service as a designated instant messaging service, a designated internet search service or a designated social media service.

Because of section 58AD of the Act, an entity that provides a covered digital platform service is a regulated entity for the digital platforms sector, and that covered digital platform service is a regulated service for the entity.

This Designation does not designate an entity to be the SPF sector regulator for the digital platforms sector. Accordingly, because of the operation of 58ED(2) of the Act, the ACCC is the SPF sector regulator for the digital platforms sector.

Sections 5 to 7 – Meaning of designated instant messaging service, designated internet search service and designated social media service

Designated instant messaging service

Section 5 of the Designation defines a designated instant messaging service as an electronic service (see section 4) that satisfies six conditions.

Firstly, the service must be an instant messaging service. Instant messaging service is intended to have its ordinary meaning; for example, the Macquarie Dictionary currently defines instant messaging as text-based, real-time communication between individuals by means of a network of computers or the internet. The intention is for this to include, but not be limited to, text-based, voice-based or video-based communication, as well as the sharing of links and files through a messaging service. Accordingly, section 4 of the Designation specifies that instant messaging service includes real-time communication of non-text-based material. It is only intended to include instant and direct communication sent or delivered wholly via the internet. It is therefore not intended to include, for example, emails or comment sections on websites.

Secondly, the provision of the instant messaging service by an entity must not be ancillary or incidental to the provision of one or more other electronic services by the entity. The note to section 5 provides an example of when a service is ancillary or incidental. An ancillary or incidental service is where an online gaming service that also enables end-users to communicate with other end-users (such as through a chat feature) is an ancillary service to the main service of online gaming. As such, the chat feature that is an instant messaging service is not a designated instant messaging service.

Thirdly, the service must not be a service that has a significant purpose of facilitating communication within an entity as an internal resource or tool for a business. These types of services, generally known as ‘enterprise instant messaging services’, are typically provided on the basis of licensing or contractual agreements for business and organisational use only. Enterprise instant messaging services are typically used in a closed organisational environment, not for personal use or for the general public. For example, enterprise instant messaging services allow staff within the same entity or between specific authorised entities to communicate with each other, but not with the general public. Enterprise instant messaging services are typically governed and administered by the organisation that has obtained the license, rather than the provider of the service. These administrative controls may include control over user-identity and access management, data loss prevention policies and audit capabilities. Their oversight rests with the organisation that has obtained the license rather than the service provider; for example, where an organisation uses an enterprise instant messaging service under a license agreement primarily to facilitate communication within the organisation. The license agreement allows only employees of the organisation and authorised external parties of the organisation to access the service. This type of messaging service is not a designated instant messaging service. 

The remaining three conditions are that the service is not a designated internet search engine service, designated social media service or covered telecommunications service to avoid regulatory duplication.

Designated internet search service

Section 6 of the Designation defines a designated internet search service as an electronic service (see section 4) that satisfies four conditions. Section 6 is intended to only capture advertising content on a search engine that has been provided under an arrangement between the search engine and the advertiser for payment (which may be monetary or some other consideration), and not organic or unpaid search results.

Firstly, the service is the provision of advertising material to users of an internet search engine, either as a result in response to a search query, or otherwise. The Designation does not define internet search engine and it is intended to have its ordinary meaning. For example, the Macquarie Dictionary currently defines a search engine as software which enables a user to find items on a database on the internet. An internet search engine is not intended to include dedicated or standalone generative AI services that incorporate internet search functionality. However, it is intended to include search engines that use or include generative AI as part of their search service offerings (for example, through ‘AI summaries or overviews’ where these feature advertising content). Advertising material is not defined, and is intended to have its ordinary meaning. For example, the Macquarie Dictionary defines advertising as ‘the act or practice of bringing anything, as one’s requirements or one’s business or products, into public notice, especially by paid announcements in periodicals, on hoardings, etc., or on television: to secure customers by advertising’, though advertising may also include content that has other purposes, such as advertising for public information, political or issue-based advertising, or recruitment advertising. This limb operates only to capture the service that provides content on a search engine to SPF consumers that appears as advertising.

Secondly, the search engine allows searches on the internet more broadly. This means that searches conducted on a limited or restricted database would not be captured; for example, a job search site that allows a user to search for job openings advertised or listed on that site, or a news site that allows a user to search for articles published on that site. Moreover, a search engine that allows comparison of particular goods or services, including a comparison of particular goods or services across a particular sector, is not captured, as the search is not across the internet more broadly; for example, an online marketplace that lists a range of goods that can be bought or sold through a website. Similarly, it also includes an airfare or hotel booking site that allows a user to compare airfare or hotel room prices across the relevant sectors.

Thirdly, the advertising material is provided under an arrangement between the entity that provides the service and another person (not being the user of the internet search engine) for consideration. This limb is intended to capture commercial arrangements between service providers and advertisers or businesses seeking to promote their product or service through the search engine. For example, this is intended to capture paid advertisements featured on an internet search engine service (such as where a business pays a digital platform for a banner ad to be displayed). It is also intended to include arrangements whereby an internet search engine features search results syndicated from a third-party provider (but where the search provider has direct arrangements with advertisers).

Fourthly, the service is not a designated social media service. This is because such a service is already designated for the digital platforms sector.

Designated social media service

Section 7 of the Designation defines designated social media service as an electronic service (see section 4 for the meaning of electronic service) that satisfies four conditions:

                Firstly, the sole purpose, or significant purpose, of the service is to enable online social interaction between two or more end-users.

                Secondly, the service allows end-users to link to and interact with some or all of the other end-users.

                Thirdly, the service allows users to post material on that service (see section 4 for meaning of material). If a service limits users from posting material based on breaches of user policies (e.g. through a ban for inappropriate actions on the service), the service still satisfies this condition. 

                Fourthly, the provision of the social media service by an entity is not ancillary or incidental to the provision of one or more other electronic services by the entity. This excludes social media services that are provided only to supplement other electronic services.  

The note to subsection 7(1) provides an example of when a service is ancillary or incidental to another electronic service, where an online gaming service also enables online social interaction between end-users (such as through a chat feature). This is an ancillary service to the main service of online gaming and so would not be a designated social media service. However, where a social media service and an instant messaging service are provided together, they will not be considered ancillary or incidental to each other.

Section 7(3) provides a list of services that are not designated social media services, including services that have the sole or primary purpose of supporting the education of end-users, or interacting with end-users for the purpose of initiating a romantic relationship (such as dating and matchmaking apps and websites). When considering whether a service has the sole or significant purpose of enabling online social interaction, or whether a service is captured by a exception specified in subsection 7(3), the provision of advertising material on the service and the generation of revenue from that provision of advertising is to be disregarded.

A regulated entity that provides a designated social media service is subject to the SPF for scams that occur in relation to the service, including, for example, scams instigated through an instant messaging service that is offered as part of the social media service, advertisements on the social media service and information posted using the social media service.

The fourth and fifth conditions are that the service must not be a designated internet search service or designated social media service. This is because such services are already designated for the digital platforms sector. For example, a designated social media service may, as part of that service, include an instant messaging service. The provision of this instant messaging service is already captured as part of the designated social media service and is therefore excluded from being a designated instant messaging service. However, if the instant messaging service is capable of being provided independently of the designated social media service (for example, accessible through its own mobile app or website), it would be captured as a designated instant messaging service.

Finally, the service must not be a covered telecommunications service as designated instant messaging services are intended to only capture instant messaging services wholly provided using the internet.

A regulated entity that provides a designated instant messaging service is subject to the SPF for scams that occur in relation to the service, including, for example, scams instigated through messages on the service, through links sent on the service or contained in an advertisement on the service.

It is expected that the SPF rules, when made, will contain exceptions for digital platform services that do not meet specified revenue and active Australian user tests, in certain circumstances.

Part 10 – Application, savings and transitional provisions

Sections 101 to 103 – Transitional application to all regulated sectors – partial exceptions

Sections 101 to 103 of the Designation provide that for the purposes of paragraph 58AD(5)(b) of the Act, a covered banking service, a covered telecommunications service and a covered digital platform service are declared not to be a regulated service for the relevant sector for the purposes of all of Part IVF of the Act, other than:

                Division 3 (about sector-specific codes) and section 58DB (about Ministerial authorisation of external dispute resolution (EDR) schemes) which apply from the commencement of this Designation; and

                section 58BZG (about membership of an SPF EDR scheme) which applies from 1 September 2026.

From 31 March 2027, these transitional provisions no longer apply, meaning all of Part IVF of the Act, including the above provisions, apply to a covered banking service, a covered telecommunications service and a covered digital platform service.

This enables required code-making delegations and EDR scheme authorisation to be in place ahead of the obligation to be an EDR scheme member (from 1 September 2026) and the remaining obligations (from 31 March 2027).

ATTACHMENT B

Statement of Compatibility with Human Rights

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011

Competition and Consumer (Scams Prevention Framework—Regulated Sectors) Designation 2026

This Legislative Instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Overview of the Legislative Instrument

Subsection 58AC(1) of the Competition and Consumer Act 2010 (the Act) provides that the Minister may designate one or more businesses or services to be a regulated sector of the Australian economy for the purposes of the Scams Prevention Framework (SPF) in Part IVF of that Act. Further, subsection 58ED(1) of the Act provides that the Minister may designate a Commonwealth entity to be an SPF sector regulator for a regulated sector. 

The purpose of the Competition and Consumer (Scams Prevention Framework—Regulated Sectors) Designation 2026 is to designate the banking, telecommunications and digital platforms (the latter initially comprising social media, instant messaging and the provision of advertising on an internet search engine) sectors as regulated sectors under the SPF. The SPF sector regulators are the Australian Securities and Investments Commission, the Australian Communications and Media Authority and the Australian Competition and Consumer Commission for the banking, telecommunications and digital platforms sectors, respectively.

In accordance with the Act, entities that carry on or provide the designated business or service of these regulated sectors must comply with SPF principles in the Act and any SPF code made for the sector. Such a regulated entity must take reasonable steps to prevent, detect and disrupt scams, report about and respond to scams, and have governance arrangements related to scams, with respect to their regulated services.

Human rights implications

This Legislative Instrument does not engage any of the applicable human rights or freedoms.

Conclusion

The Legislative Instrument is compatible with human rights, as it does not raise any human rights issues and only impacts entities within the banking, telecommunications and digital platforms sectors and they are not natural persons.