Guide to applying for and acquiring an Australian credit licence ACL and to ongoing compliance

ACL is a credit licence granted to a specific legal entity under the National Consumer Credit Protection Act 2009. Regulated activities include not only providing consumer loans, but also acting as a lessor under a consumer lease, exercising rights under a loan contract, acquiring related credit rights, holding a mortgage or security interest, and providing advice, assistance or intermediary services in relation to a specific credit contract. Fee-charging debt management and assistance with credit reporting may also constitute credit services requiring a licence. The precise scope should be determined by reference to the National Credit Act, the National Credit Regulations and the authorisation conditions together.ASIC scope of licensing

General consumer credit assessments involve factors such as the borrower’s identity, use of funds, fees and whether providing credit is part of a business. Credit used wholly or predominantly for personal, domestic or household purposes, or by a natural person to purchase, renovate or improve a residential investment property, may fall within the national credit regime. Company business loans are generally outside the same consumer credit scope, but the company name, loan security or a “business purpose declaration” cannot replace an assessment of the actual purpose. ASIC explains that “predominantly” generally means more than 50% consumer use; mixed-purpose lending, residential development, refinancing and trust structures should each be checked separately.ASIC INFO101

ACL does not authorise securities, funds, insurance, foreign exchange or other financial product business requiring AFSL authorisation, nor is it a banking deposit-taking licence. Margin lending falls under the financial services regime in the Corporations Act and should not be presented as ordinary consumer credit ACL authorisation. An organisation holding both ACL and AFSL must identify the obligations under each licence separately; satisfying the AFSL capital conditions does not imply that the ACL financial resource requirements are met.RG207

• First set out the borrower’s legal identity, actual purpose, product terms and source of funds, then assess whether the activity is regulated.
• Identify, item by item, lending, leasing, credit assistance, intermediation, assignment of receivables and debt management activities.
• Separately assess AFSL, APRA, AUSTRAC, company law, privacy and State business requirements.

ASIC's current application guidance distinguishes four main authorisations: operating as a credit provider or lessor; engaging in credit activities other than as a credit provider or lessor; engaging in all credit activities, but not debt management services; and debt management services as a separate category. Applicants should select the authorisation that matches their actual business model. A lending-only institution should not select all activities merely to make the authorisation appear more comprehensive, as this would require it to demonstrate capability in both lending and third-party broking.ASIC authorisation FAQ

After meeting the eligibility requirements and obtaining the appropriate ACL, an entity may operate within the approved scope under Australia’s national consumer credit framework and establish its own products, customer service and representative supervision systems. Compared with relying on another licensee’s authorisation, holding an independent ACL can help the entity retain control of its business and relationships, but it also carries direct regulatory responsibility, complaints and compensation obligations, staff supervision and ongoing costs. A licence does not guarantee lender acceptance, access to finance, commercial returns or consumer trust, and does not constitute an endorsement of product quality by ASIC.

Choosing not to hold a separate licence does not mean that business can be conducted without authorisation. An employee, director or formally authorised credit representative acting for a licensee within the scope of its authorisation may not need to hold their own ACL; referral exemptions, merchant exemptions and other exceptions must meet their specific conditions. Simply publishing contact details is not the same as recommending a specific loan contract, and fees and commission disclosures may also determine whether the referral exception applies.ASIC INFO101

• Create a corresponding checklist of ‘proposed business activity — required authorisation — responsible manager coverage — documentary evidence’.
• Compare the control, costs and responsibilities involved in an independent ACL, a credit representative and a lawful exemption pathway.
• Do not conduct credit activities requiring authorisation before obtaining a licence or a valid exemption.

ACL may be applied for by an eligible company, individual, partnership or trust-related applicant; applications are not restricted to Australian companies. A common structure for institutional applicants is to establish an Australian Pty Ltd and clearly identify the legal applicant, ACN, business name and ownership and control chain. A trust cannot use only the name of a trust without separate legal personality in place of the correct applicant; the trustee and the entity actually providing the services must be checked. The choice of structure should take account of liability, tax, financing, customer contracts and future acquisition arrangements.RG207

An ordinary Australian Pty Ltd must have at least one director who ordinarily resides in Australia; this is a company law requirement, not a rule that ‘every ACL must have two locally responsible managers’. Different director and secretary arrangements apply to a public company; the proprietary company standard cannot simply be applied to it. Directors must be at least 18 and not be disqualified from managing a company. A new director should personally apply for a director ID before appointment; an agent cannot complete the identity application on the director’s behalf.ASIC company officers ABRS director ID

An Australian company’s registered office must be a physical street address in Australia, not a PO Box. A third-party address, such as an accountant’s, may be used, but the occupier’s written consent must be retained. The principal place of business should reflect the genuine business location and cannot be replaced by a post office box. The registered office, business address and mailing address serve different purposes; remote operations must still demonstrate customer-information protection, retrievable records and staff supervision. A single mailing address cannot be used to claim that actual operational capability has been established.ASIC Company address

• Prepare company registration documents, the constitution or partnership/trust documents, business names and a diagram of the control chain.
• Confirm consent to the director's appointment, residency circumstances and the director's ID filing responsibilities.
• Provide consent to occupy the registered office, a genuine business address and separate correspondence arrangements.
• Overseas shareholders, controllers and foreign investment transactions are assessed separately under the fit and proper assessment and applicable foreign investment rules; no uniform Australian shareholding percentage is invented for ACL.

ASIC's fit and proper assessment does not consider only the responsible manager. Depending on the application structure, its scope includes the applicant, company officers, partners, trustees, relevant senior managers and direct or indirect controllers. Where a controller is a company, partnership or trust, the assessment may also extend to its relevant officers and managers. A minority shareholder is not necessarily a controller automatically, but acting in concert, board control or substantive power to determine policy may amount to control; disclosure cannot be avoided solely by relying on the shareholding percentage.ASIC fit and proper person information

The application materials must allow verification of personnel identity, employment history, criminal record, bankruptcy status, and regulatory and professional disciplinary history. The ASIC application guidance requires relevant background checks to be current; generally, evidence dated no more than 12 months before submission is required, and applicants are advised to allow at least 6 weeks for background checks. Overseas experience, name changes, relevant complaints, insurance claims, licence refusals or disciplinary matters must be disclosed accurately. A past issue is not a reason to omit it, nor does it necessarily mean automatic refusal; it must be assessed in light of the facts and any remediation.ASIC application steps

Fit and proper status is not a one-off check before approval. After a new controller, director or manager joins, the licensee must continue to maintain fit and proper status and keep review records. The duties of a company secretary, non-executive director, financial controller and responsible manager may differ, but a person cannot be excluded from disclosures about fit and proper persons required by law simply because they are not a responsible manager.

• Personnel list and each person’s name, birth details, residential address, appointment dates and responsibilities.
• Proof of identity, evidence supporting any name change, criminal and bankruptcy checks, CV and evidence of qualifications.
• Regulatory sanctions, bans on operating, refused licences, investigations and litigation, PI claims, and remediation details.
• Information on direct and indirect control chains, acting-in-concert arrangements, shareholders’ agreements and board control.

A responsible manager is a person who is substantively responsible for the quality and day-to-day management of the credit business, not a nominal appointment that can be satisfied by buying a certificate or borrowing someone’s name. The usual minimum expectation for RG206 is at least two years of relevant experience not affected by significant non-compliance issues, together with a relevant credit industry qualification at least at Certificate IV level, or a relevant higher diploma or university degree. A responsible manager for third-party residential mortgage credit assistance should hold at least a Certificate IV in Finance and Mortgage Broking. Do not transfer other competency pathways for AFSL, or the purported ‘uniform five-year recent experience standard’, directly to ACL.RG206

The number of responsible managers required depends on the scope and scale of the business, the number of representatives, product complexity and geographical spread. A small business may be managed by one person who genuinely takes day-to-day decisions; a large lending, platform or multi-product organisation may need several people to provide adequate coverage. People responsible only for board governance, administrative support or a nominal role will generally not substitute for managers who directly manage credit activities. Experience should be relevant to the activities applied for; business experience acquired unlawfully in an unlicensed environment cannot be relied on as a normal basis for demonstrating competence.

All responsible managers should complete at least 20 hours of relevant continuing professional development each year and keep records. Third-party representatives assisting with residential mortgage lending also have specific qualification and 20-hour CPD expectations; training for general non-mortgage representatives should be tailored to their roles, and the same qualification requirement should not be applied indiscriminately to all employees. If ASIC considers that competence depends on one or two managers, it may impose a key person condition; when a key person leaves, timely notification and an application for replacement are required under the specific licence conditions.RG206 Official full text

• A responsible manager’s CV should state the employing organisation, dates, products, approval or supervisory authority, and specific responsibilities.
• Provide evidence of qualifications and industry credentials, recommendations from former supervisors or other verifiable evidence of experience.
• Prepare role allocation, working hours, management reporting lines, supervisory authority and backup arrangements.
• Keep an annual CPD register and reassess capability coverage before adding products or changing the manager.

RG207 makes clear that the financial resources rules adopt a principles-based standard and do not prescribe a single minimum amount as a standard condition of an ordinary ACL licence. The website should therefore not state that ‘all ACL holders must have net assets of at least AUD 50,000/500,000’ or that ‘share capital of AUD 1 allows operations without funding’. Share capital reflects shareholder contributions; net tangible assets reflect the book value of tangible net assets after deducting liabilities and intangible assets; cash flow reflects the ability to make payments when due. These three measures are not interchangeable.RG207 Official full text

A licensee should be able to pay its debts as they fall due and meet the costs of personnel, systems, AFCA, insurance, supervision, remediation and orderly exit. RG207 requires planning to take account of information available for at least the next 12 months, with cash flow monitored on an ongoing basis; complex or start-up businesses will generally require more detailed forecasts and stress scenarios. Borrowings, shareholder funding and guarantees that can reasonably be expected may be included when assessing available resources, but the reliability of commitments, when funds can be drawn and any resulting debt-servicing burden must be checked. Uncommitted financing intentions must not be treated as cash currently available.

A financial manager who reports directly to the board or licensee may be appointed; this does not mean the regulations require every ACL to appoint a separate, independent registered financial manager. For entities directly regulated by APRA, the related resource and risk management requirements are dealt with by APRA; merely being an associated company of a APRA institution does not automatically qualify for the same exception. ASIC may also require a qualified person to report on resource adequacy in an individual case.RG207

• Prepare a balance sheet, operating and cash flow projections for at least the next 12 months, and key assumptions.
• Lenders should separately list lending, repayments, arrears, financing covenants and bad-debt stress scenarios.
• For a brokerage, separately account for delayed commission, clawback, PI excesses and representative supervision costs.
• Assess notification obligations for material adverse financial changes; reg9(14) generally requires notification as soon as practicable, and no later than 3 business days after becoming aware.

ACL licensees must have appropriate consumer compensation arrangements, but not all lenders are required to hold the same PI policy. Specific exceptions under current reg 12 concern APRA institutions, entities with an associated guarantee approved by ASIC, and certain licensees authorised only for the relevant lending/leasing activities and without additional PI conditions. There is also a corresponding provision for cases where credit assistance is provided only for the entity’s own loans or leases. Any exception must be confirmed against the actual authorisations and conditions, and does not remove the requirement for adequate compensation arrangements.Current National Credit Regulations

Non-lending credit businesses, such as third-party brokers, that do not qualify for the PI exception will generally need to hold appropriate PI or an alternative indemnity arrangement approved by ASIC. The RG210 minimum cover expectation is at least AUD 2 million per claim and in aggregate. It is assessed on a sliding basis, taking into account actual or projected income from consumer credit activities, representative income, risk and indemnity exposure; AUD 2 million is an insurance cover amount, not a capital requirement. Representative conduct, AFCA indemnity, exclusions, excesses and the retroactive period must also be reviewed. Reasonable efforts must be made to obtain at least 12 months of automatic run-off cover; if it is not reasonably available, evidence of the attempts must be retained.RG210 Official full text

Licensees must maintain external dispute resolution membership with AFCA and establish internal dispute resolution procedures that comply with RG271. ASIC allows an application to be lodged before membership of AFCA has been obtained, but the applicant must have joined in the credit licensee category before the licence is granted; membership of AFCA is not a substitute for a ASIC licence. After approval, the licensee must specify the person responsible for complaints, response processes, support for customers experiencing hardship and complaints data management. Current guidance from ASIC requires AFS and credit licensees to report IDR data periodically.ASIC application steps ASIC credit dispute resolution

• Determine whether the PI exception applies and prepare a written conclusion; check the actual licence conditions.
• Where PI is required, prepare the policy, calculation of the insured amount, representative coverage, exclusions and information on resources to meet the excess.
• Prepare AFCA membership information, IDR policy, complaints register, complaints contact and data reporting arrangements.
• Review insurance or other indemnity arrangements at least annually, and immediately following a material change to the business.

Generally, responsible lending obligations require reasonable inquiries into consumers’ requirements and objectives, inquiries into and reasonable verification of their financial situation, and an assessment of whether the contract would be unsuitable. Lenders conduct the relevant credit assessment, while providers of credit assistance conduct the relevant preliminary assessment; neither party’s responsibilities automatically disappear because the other has also made checks. The method of income verification and depth of inquiry must be proportionate to the product, customer and risk. Do not promote “loans without proof of income if you hold ACL”.RG209

Provide credit guides and, where required, quote and proposal disclosures according to the relevant role, and retain sufficient records to explain the basis for assessments. Loan or lease contracts must also meet applicable requirements for contractual disclosure, fees, hardship variations, debt collection and enforcement. An arrangement must still be made to obtain or have access to the original assessment records when acquiring existing contracts; consumers' access or complaint rights cannot be disregarded because the acquirer was not involved in the original loan.ASIC standard ACL conditions PF224

Small amount loans, consumer leases and low-cost credit have specific rules, so a single template should not be applied mechanically. The small business exception amendment taking effect on 5 September 2026 only extends the reg28RB exception period to the start of 3 October 2036. It applies to specified responsible lending obligations where there is a genuine small business purpose that is not minor or incidental; it is not a blanket exemption for all business loans or all ACL obligations. Check and document each condition to determine whether it applies.Text of the 2026 amendment

• Records of client needs and objectives, financial enquiries, verification evidence and unsuitability assessments.
• Credit guides, applicable quote/proposal disclosures, pre-contract disclosures and evidence of client receipt.
• Processes for hardship variations, debt recovery, default notices, early repayment and consumer access to assessments.
• Establish separate assessments and approval records for special products, exceptions and mixed uses.

Operators who meet the definition of a mortgage broker must comply with the best interests duty and the conflict priority rule when providing credit assistance. ‘The loan has not been assessed as unsuitable’ does not mean ‘it is in the client’s best interests’. Mortgage brokers must demonstrate how a recommendation serves the particular client, and must not select a product solely by reference to the highest commission, a rebate or an arrangement with an associated lender. General consumer credit brokers and mortgage brokers should identify the applicable obligations separately. Do not claim that all car or personal loan intermediaries are automatically subject to exactly the same provisions merely because they hold an ACL.RG273

The October 2026 ASIC review of mortgage broking emphasises that, where cheaper alternatives are available in the market, brokers should keep adequate records explaining why their recommendation better serves the client’s interests, and that licensees should improve their supervision of and record-keeping for broking services. This regulatory focus should be translated into records of client objectives, product comparisons, the range of lenders available, reasons for the recommendation and subsequent quality checks—not merely a sentence about ‘best interests’ added to the file.ASIC 26-240MR

Licensees must train and supervise representatives and comply with the relevant reference checking and information sharing protocol. Franchising, aggregator platforms, external brokers and remote teams do not relieve the licensee of its supervisory responsibilities. Cooperation agreements should specify the scope of authority, access to information, complaints reporting, sampling, remediation and termination mechanisms; commissions and referral benefits must be disclosed in accordance with the relevant rules.2026 maintenance edition of RG205

• Lender panel and eligibility criteria, commissions and conflicts register, referral comparisons and written reasons.
• Qualifications of brokerage personnel, reference checks, formal authorisations, CPD and records of client file sampling.
• Escalation of higher-risk cases, commission clawbacks, representative disciplinary action and information-sharing procedures.

A consumer lease generally involves a consumer renting an item during the contract term, with ownership remaining with the provider at the end of the term. A transaction that includes an option to purchase, transfers ownership in practice, or is structured as an instalment sale may be a credit contract rather than a lease. ASIC continues to enforce against arrangements that use the label of a lease to avoid credit cost caps. Product classification should be based on the substance of the contract and the business model.ASIC consumer lease review

Consumer leasing reforms have been implemented, including an after-tax income protection mechanism, a cap on the total contract cost, consideration of bank statements and records of suitability assessments, and anti-avoidance rules. The protected income regime for leases of household goods limits relevant repayments to 10% of after-tax income, and the relevant lease and statutory calculation method should be checked. The cost cap must be calculated lawfully by reference to the basic price, lease term and permitted fees; it is not enough to consider whether the monthly payment is ‘acceptable’.

Business documents should include genuine base prices and procurement evidence, a complete fee schedule, lease suitability assessments, bank statements, arrangements for customers in hardship, and procedures for returning and repossessing goods. Automatic debits or deductions from welfare payments cannot be treated as substitutes for income verification and affordability assessment. The Centrepay policy proposals in the ASIC 2025 article are not presented as rules implemented in 2026 without separate verification in this guide.

• Distinguish genuine leases, instalment sales, arrangements with an option to purchase and other consumer credit products.
• Establish evidence of the base price, fee cap calculations, income protection calculations and anti-avoidance review.
• Keep records of bank statement reviews, hardship variations, item maintenance, repossessions and handling of client complaints.

From 10 June 2025, statutory BNPL and low cost credit contracts entered the national consumer credit regime. BNPL providers must hold and maintain the appropriate ACL and meet the relevant obligations; ‘no interest is charged to consumers’ or ‘the merchant pays the fee’ is no longer a general basis for operating without a licence. The 2025 transitional arrangements have strict entity, lodgement and timing conditions; they are not a basis for any new entrant in 2026 to apply and then immediately operate without a licence.ASIC BNPL licence RG281

BNPL does not automatically qualify as an eligible LCCC. Only for contracts that meet the definitions and fee conditions may a provider elect in writing to use modified responsible lending as prescribed, and make the required statement in the relevant contract; it may also choose to comply with the standard responsible lending obligations. The modified regime still requires reasonable inquiries into a consumer’s financial situation, verification and an assessment of unsuitability, and a written unsuitability assessment policy. The relevant presumption for amounts below AUD 2,000 may be rebutted and does not exempt a provider from checking repayment capacity; for amounts greater than or equal to AUD 2,000, credit reporting and verification steps must also be adjusted in accordance with the applicable rules.RG281 Official full text

Current reg69G aggregates all LCCC for the same provider and consumer over a 12-month fee period: non-default fees are capped at AUD 200 for the first period and AUD 125 thereafter; default fees are generally capped at AUD 120. If all relevant contracts can only charge default fees, special caps of AUD 320 for the first period and AUD 245 thereafter apply. These are eligibility-related fee rules under LCCC, not fixed loan limits, licence capital requirements or amounts that may be charged repeatedly under each contract.Current Credit Regulations reg69G

The regime may cover LCCC that already existed before the reforms, including hardship variations and complaint rights. Pre-reform contracts generally do not require a responsible lending assessment to be retrospectively completed, but an increase in the credit limit after the reforms triggers the corresponding assessment requirements. Platforms should also check merchant pathways, automated credit provision, payment processes, limit increases, fees under old contracts and electronic disclosure, rather than merely submitting a licence application.

• For each product, prepare an BNPL/LCCC classification opinion and fee-eligibility test.
• Prepare a written decision to opt in, prescribed contract statements, an unsuitability assessment policy and rules for increasing limits.
• Build systems for aggregating fees across contracts, credit checks, customer hardship support and management of legacy contracts.
• Assess on a case-by-case basis, according to the actual activities, whether a merchant or partner platform can rely on an exemption or representative authorisation.

Assisting consumers for a fee to negotiate with creditors, deal with credit-related debts or provide regulated credit reporting assistance may require debt management services authorisation. The current ‘all credit activities’ category expressly excludes this separately listed service; one brokerage or all-credit-activities authorisation cannot be used to cover all paid debt advice. Businesses should verify whether the service is regulated debt management, who pays, whether an exemption applies, and the client contract and complaints pathway.ASIC authorisation FAQ

A debt assignee that owns and exercises regulated consumer credit rights may need appropriate authorisation as a credit provider. An agency that collects solely on behalf of the debt owner may be exempt where the relevant state-level regulatory and statutory conditions are met, but this is not a general exemption for all debt collection or loan servicing companies. All debt collection must still comply with requirements prohibiting improper harassment or coercion. Before acquiring a loan portfolio, identify the actual contractual rights-holder, servicing agent and licensed entity.ASIC INFO101

A special regime may apply to an original lender dealing only with specified carried over instruments from before 1 July 2010, but buying an old loan now does not make the buyer a COI lender that can operate directly without a licence. RG207 makes clear that a person who acquires the relevant contracts after 1 July 2010 cannot rely on the original lender’s COI status instead of obtaining its own licence. Personnel in fee-charging debt management or debt service businesses should be trained in negotiations, customer vulnerability, hardship applications and debt collection compliance, and should prepare the chain of assignment, original assessment materials, customer notices and fund reconciliation arrangements.RG207 Official full text

• Identify separate debt management authorisations, debt owners, collection agents and the entities charging customers.
• Prepare authorisation/transfer agreements, customer service contracts, registers of complaints and hardship applications, and conflicts of interest policies.
• Verify state debt collection requirements, handling of funds, access to original contracts and transfer of personal information.
• Before acquiring a loan portfolio, verify the transferee's own licences; it cannot simply rely on the seller's licences or historical exemptions.

A formal application should include material demonstrating that the business is operationally capable, rather than only company registration and the responsible manager’s CV. Core content includes the proposed business and authorisations, company and control structure, fit and proper person materials, an explanation of the responsible manager’s capability, and financial resources and indemnity arrangements. ASIC requires evidence in accordance with the application and risk requirements. Further information in individual cases may involve contracts, procedures, financial information or external reports; a generic checklist should not be presented as a fixed number of documents that guarantees approval.ASIC application steps

RG205 requires licensees to have adequate arrangements and systems to ensure compliance and to maintain a written compliance plan. The plan should cover efficient, honest and fair conduct, conflicts of interest, organisational competence, supervision of representatives, resources, risk, complaints and consumer compensation. Where systems are outsourced, contracts, service standards, access and audit rights, and contingency arrangements are still required. The licensee's ultimate responsibility cannot be discharged on the grounds that a third party is responsible.2026 maintenance edition of RG205

Supplementary evidence for each product is needed to ensure the application reflects actual operations: lenders should provide funding and approval models; brokers should provide their lender panel, commissions and referral processes; consumer lessors should provide base prices and cost caps; BNPL platforms should provide processes for cross-contract fees, limit changes and written LCCC selection. The materials should consistently reflect the actual entity, business address, managers’ responsibilities and proposed commencement date.

• Company and control information, personnel identity checks, managers’ CVs and qualifications, and verifiable evidence of experience.
• Business description, authorisation matrix, compliance plan, organisational structure, risk and representative supervision arrangements.
• Financial forecasts and funding basis, PI or other indemnity basis, AFCA and IDR arrangements.
• Product contracts and disclosures, responsible lending, customers experiencing hardship, collections, privacy, cyber security and outsourcing documents.

Stage one involves confirming the activities requiring a licence and the applicant entity, selecting the correct authorisations, establishing the company and genuine business operations, and putting responsible managers and personnel screening in place. Stage two involves completing product and client processes, resource planning for at least the next 12 months, compensation arrangements and preparations for AFCA membership. Without suitable personnel or funding, simply lodging an application first will generally not address fundamental capability gaps.

In stage three, complete the online application and fee payment through the current ASIC credit licensee portal, and accurately retain the application reference details. The ASIC website currently directs applicants to use the credit licensee portal; access the current interface through the official page, and do not categorically state that all new ACL applications use the same channel as AFSL applications. After receiving ASIC instructions for securely submitting proofs, submit the core proofs promptly in accordance with those instructions. The current application page states that these usually need to be provided within two days, so the materials should already be prepared before submission.ASIC application portal

Stage four involves ASIC assessment, further enquiries and any necessary adjustments; provide additional personnel, authorisation or financial information where required. Stage five involves obtaining the required AFCA membership and satisfying other preconditions before the licence is granted. After approval, check the authorisations and individual conditions, disclose the actual licence number externally, train representatives and conduct a pre-opening check. Regulated business may only commence once the relevant licence has been obtained or an exemption genuinely applies. A submission reference number is not permission to operate.

• Define the business and authorisations, and complete entity, address and staffing arrangements.
• Prepare core evidence, products and compliance systems, and put funding and compensation arrangements in place.
• Apply online through the official ASIC portal, pay according to the current fee schedule and retain the receipt.
• Submit evidence in accordance with secure submission requirements, and address further enquiries and conditions.
• After the licence is granted, check the registration and conditions, and complete pre-opening checks before commencing the relevant activities.

ASIC Service targets are not approval commitments. The verified 2025 licence processing report sets targets for decisions on 70% of applications within 150 days and 90% within 240 days; outcomes also depend on the completeness of the application, business complexity, fit and proper checks, further information requests and prerequisites. Actual outcomes for different businesses, periods and application categories cannot be treated directly as guaranteed timeframes for this project.ASIC REP825

Present commercial budgets and official targets separately. The guide's 4–9 months for brokerage and 6–12 months or longer for lending/leasing/complex BNPL are conservative project-planning ranges from preparation to being ready to commence business, not measured average approval times. The timeframe may exceed these ranges if it is difficult to find responsible managers, overseas personnel are reviewed, financing is not secured or systems need rebuilding. An acquisition may also require a new application to vary authorisations; do not promise that ‘buying an existing licence allows launch within two weeks’.

Costs include at least ASIC current application or variation fees, company maintenance, background checks, qualification training, personnel, AFCA, insurance, systems and industry regulatory levies. The old INFO108 publication date on the ASIC fees page is 2018; its historical amounts cannot unconditionally be treated as current fees for 2026. This guide does not provide a fixed total price that has not been verified against the current fee schedule; an CL50 annual compliance certificate submitted electronically and on time may incur no lodgement fee, but this does not mean there are no other costs of maintaining the licence annually.ASIC Fee information CL50

• Budget separately for personnel, preparation of materials, AFCA and system time, and ASIC assessment time.
• When issuing a formal quote, check the ASIC fees applicable on the day of lodgement and itemise ongoing third-party costs.
• Allow time buffers for requests for further information, complex businesses, overseas checks and changes to authorisations.

ACL is attached to the licensed legal entity. It cannot be sold separately from that entity like an ordinary product, nor can another company use it simply by purchasing the number. When shares in a licensed company are acquired, the licence usually remains with the original company, but changes to control, directors, responsible managers, funds and products remain subject to regulation. When business assets or a loan portfolio are acquired, the buyer cannot automatically use the seller's ACL. Before a transaction, confirm the target company's actual authorisations and conditions, whether they are suspended or cancelled, and whether they match the buyer's intended business.

Current National Credit Regulations reg9(10) expressly provides that when a licensee becomes aware of a change in control, it must submit details of the change to ASIC in the approved form, no later than 10 business days after the change occurs. This is not the 30-business-day rule under AFSL. Control includes holding more than half the voting rights or relevant issued share capital, as well as controlling the composition of the board or actually determining financial and operating policies. A series of transactions within 12 months and joint control with associates must also be considered. It is not enough to consider only whether a single shareholding change exceeds 50%.Current Credit Regulations reg9

Notification does not mean that ASIC has approved or endorsed the new shareholder’s business model. Under the current regime, it is incorrect to state that all ACL share transactions uniformly require prior ASIC acquisition approval; equally, it is incorrect to claim that no regulatory review is required. New controllers and relevant personnel must be fit and proper, and competence, financial resources and compensation arrangements must remain adequate. If the authorisation or specific conditions need to be varied, the required variation must be completed before the additional business is carried on. Foreign investment, competition, banking prudential or other transaction approvals should be assessed separately on a case-by-case basis.

Before completion, include breaches, complaints, AFCA compensation, unreported matters, unpaid fees, commission clawbacks, bad debts, historical collections, PI gaps and staff departures in due diligence and contractual warranties. After completion, complete control notifications, company registration updates, any necessary licence-condition changes, management handover, AFCA and insurance changes, and transfer of portal access, to avoid retaining former personnel in name only while losing genuine management.

• Distinguish between a share acquisition, a transfer of business assets and an acquisition of a loan portfolio in the transaction structure.
• Check ASIC registration, authorisation conditions, control chain, managers, regulatory history and annual compliance records.
• Due diligence on AFCA/IDR, insurance, client compensation, loan files, funds, tax and financing covenants.
• Completion conditions should specify key personnel, funding, necessary authorisation changes and the person responsible for notifications.
• Apply the 10-working-day control notification requirement under reg9; do not apply the AFSL timeframe.

When the business scope, authorisation or licence conditions change, apply to ASIC for the relevant variation rather than merely changing the company registration or website copy. Updating details such as the company name or address alone is different from extending an authorisation. The current details-update guidance indicates separate processes for the licence name, principal place of business, service address and related registration information. Changes to registration information are generally subject to the 10-business-day update requirement under reg9; the specific requirement depends on the matter and the conditions that apply.ASIC details update

The same notification timeframe does not apply every time a responsible manager leaves. If the licence contains a key person condition, the standard PF224 requires notification within 5 business days of the event and an application to vary the relevant condition, with details of a replacement or an explanation of how ongoing capacity will be maintained. The actual licence conditions should be checked individually as the priority. If there is no key person condition, capacity must still be reassessed and maintained. It is incorrect to claim categorically that ‘every departure of a responsible manager requires ASIC approval within 5 days’.RG206 PF224

If a material adverse financial change occurs, AFCA membership is lost, or the original insurance exception no longer applies, escalate the matter immediately and check for any short-term notification or variation obligations. For relevant non-APRA entities, reg9(14) requires notification of a material adverse financial change as soon as practicable and no later than 3 business days after becoming aware; standard AFCA conditions may also require notification within 3 business days. The deadlines, triggers and lodgement methods differ, so they must not all be described as ‘notification of all licence changes within 30 days’.

• Establish a register of changes to names / addresses, control, representatives, key persons, financial matters and AFCA.
• Check authorisation and apply for any necessary changes before adding lending, BNPL, leasing or fee-charging debt management.
• When a key person departs, retain transitional management, evidence of a replacement and receipts for notifications of changes to conditions.
• Company law registration notifications and ACL regulatory notifications must be handled separately; neither substitutes for the other.

A licensee must submit the CL50 annual compliance certificate within 45 days after each licence anniversary. The certificate reflects ongoing compliance; it is not a purchase for automatic licence renewal. Before signing, there should be genuine evidence of personnel competence, financial resources, indemnity arrangements and operational checks. A formal declaration alone, without annual records, is not sufficient. The company’s annual review and the ACL annual compliance certificate are separate obligations, and both should be included in the calendar.ASIC CL50

Ongoing maintenance should include responsible managers CPD, representative qualifications and reference checks, client file sampling, product and fee reviews, complaints and hardship applications, financial resources, insurance／AFCA renewals, outsourcing, cyber security and data retrieval testing. Separate test samples and key risk indicators should be designed for lending, broking, leasing and BNPL. Regulatory requirements do not impose a single annual audit report or a uniform number of independent compliance officers; the specific assessment depends on business size, conditions and individual circumstances.

The current reportable situations regime of ASIC covers prescribed circumstances such as significant breaches or likely significant breaches of core obligations, relevant investigations lasting more than 60 days, gross negligence or serious fraud. Reports should generally be made within 30 calendar days after first having reasonable grounds to believe that a reportable situation has arisen, using the prescribed form through the ASIC Regulatory Portal. Do not rely on outdated material stating that all relevant investigations lasting more than 30 days automatically trigger reporting, or misstate 30 calendar days as 30 business days; exceptions and significance assessments must be checked against the current RG78 and the law.ASIC breach reporting

• CL50: submit within 45 days after the licence anniversary and retain the supporting basis for sign-off and the acknowledgement.
• 20 hours of annual CPD for responsible managers; training for other personnel should be arranged according to their specific activities and roles.
• Regularly review AFCA, PI or alternative indemnity, financial forecasts, representatives and outsourcing oversight.
• Establish processes for incident identification, investigation, materiality assessment, reporting, consumer remediation and evidence retention.
• Establish a separate calendar for current IDR data reporting and industry levy requirements.

ACL and AUSTRAC are assessed under separate regimes. Lending, finance leasing, hire purchase or other actual activities may constitute a designated service with an Australian geographical link. Registration, the AML/CTF programme, risk assessments, customer and beneficial-owner checks, ongoing monitoring, reporting and record-keeping obligations should be checked against the current service definitions. It should not be claimed that ‘all ACL companies must have the same type of AUSTRAC registration’, or that ‘credit brokers never need to consider AUSTRAC’.AUSTRAC current service names

As at the date of this guide, the 2026 AML/CTF reforms are being implemented. Do not treat the old Part A/Part B programme templates as the entirety of the current rules. AUSTRAC’s public guidance provides an initial transition period for the CDD framework for qualifying existing reporting entities, from 31 March 2026 to 30 March 2029; this is not a general compliance grace period for all new lenders. New entrants, existing entities and newly designated services must be assessed separately. Nor should the transition be interpreted as suspending customer identification or suspicious matter reporting.AUSTRAC Reform transitional arrangements

If the business involves taking deposits, banking activities or direct regulatory status with APRA, the relevant licensing and prudential capital requirements must be checked separately; these are not covered by ACL. Issuing financing instruments, raising funds through a fund structure, payment facilities or investment advice may also involve AFSL and other regimes. Obligations relating to tax, company records and directors ID apply under their respective regimes. The website should not promote the proposition that ‘obtaining ACL enables one-stop operation of all financial businesses’.

• Prepare an assessment matching actual services to AUSTRAC designated services, distinguishing new and existing entities and transition arrangements.
• Where applicable, clearly specify the AML/CTF responsible person, management oversight, client checks, reporting and record-keeping systems.
• Assess licensing separately for financing, deposits, payments, investment products and consumer lending.

Stopping new business does not mean that all obligations as a licence holder immediately cease. Before applying to cancel the ACL or exit, make arrangements for outstanding loans, leases, complaints, customers in hardship, compensation and access to records; confirm whether any remaining credit activity still requires a licence; and make an appropriate request to ASIC. After cancellation, activities requiring a licence cannot continue, and historical consumer claims and information obligations do not automatically disappear. Assess funding for an orderly exit and any available run-off insurance in advance.RG207 RG210

Attribution for this guide: Drew Tang ( Mr Tang/Drew), Business Manager; Rengangyongsheng (Hong Kong) Limited, English name Rengangyongsheng (Hong Kong) Limited. This may be used to describe the scope of services for application preparation, information coordination and compliance-related business planning; without actual evidence, it must not be stated that the company or named individuals are Australian-licensed lawyers, agents recognised by ASIC, holders of a ACL licence or regulator-accredited experts.

This guide was verified up to 5 November 2026, based on the listed ASIC and official sources such as Commonwealth legislation. New applications, acquisitions and additional products should be decided according to the legislation in force at the time, actual authorisation conditions and professional advice. Commercial time estimates in the text are for planning only and do not guarantee approval, completion of a transaction or any particular business outcome.

• Before exit, complete an inventory of loan and lease balances, unresolved complaints, compensation, collections and records access.
• Confirm the correct pathway for retaining a licence, varying an authorisation or cancelling a licence.
• Retain financial resources, AFCA and insurance arrangements during exit, and check ongoing obligations.

Complete guides to each subtype

The following are branches covering business activities, products or corporate structures; not every item corresponds to a separate statutory licence.

Frequently Asked Questions