National Consumer Credit Protection Act 2009

The National Consumer Credit Protection Act 2009 is the Commonwealth framework for consumer credit regulation. It establishes the Australian credit licensing regime, regulates people who engage in credit activities, and sets responsible lending rules for many consumer credit dealings.

The Act also expressly includes the National Credit Code. That matters because businesses often need to read the two together. The Act deals with who can lawfully engage in credit activities, what conduct standards apply, and what disclosures and assessments are required. The National Credit Code then contains the detailed rules for regulated credit contracts, consumer rights and related protections.

If your business provides consumer loans, arranges loans, helps consumers apply for loans, acts between a consumer and a lender, or operates through credit representatives, this Act is likely to be one of the first laws you need to check.

The starting point is whether your business is engaging in a regulated credit activity. The Act contains definitions for credit activity, credit service, credit assistance and when a person acts as an intermediary. Those definitions sit near the front of the Act and are the practical gateway into the licensing and conduct rules.

In broad terms, businesses are commonly in scope if they provide consumer credit, provide credit assistance in relation to consumer credit contracts, or act as an intermediary in arranging or facilitating those contracts. This can include lenders, brokers, introducers with a more active role, and businesses that build consumer credit into a retail or digital platform.

The Act is aimed at consumer credit. A business that only deals with commercial or business-purpose lending may be outside much of this regime. But that is not a label-based exercise. You need to check the actual borrower, the purpose of the credit, the contract structure and whether the National Credit Code is engaged. If your product can be used by individuals for personal, domestic or household purposes, you should not assume you are outside the Act.

For most businesses, the first practical trigger point is commencement of a consumer-facing credit model. If you move from software, referrals or retail sales into actually arranging, assisting with or providing consumer credit, the Act may start applying immediately.

The second trigger point is marketing and holding out. The Act does not only regulate completed loans. It also contains prohibitions about engaging in credit activities without a licence, holding out and advertising in a way that suggests you are licensed when you are not, conducting business with unlicensed persons, and charging fees in prohibited circumstances.

The third trigger point is using representatives. If your business does not hold its own licence and instead operates through a licensee, you need to confirm that the authorisation is valid, the scope of authorised activities is clear, and ASIC notification requirements have been met.

The fourth trigger point is product design. The Act contains additional rules for standard home loans, credit card contracts, low cost credit contracts, short term credit contracts and small amount credit contracts. If your product sits in one of those categories, extra obligations may apply beyond the general licensing and responsible lending framework.

Chapter 2 of the Act is the licensing framework. The core rule is that a person must not engage in credit activities without a licence unless an exception applies. The Act then sets out how to apply for an Australian credit licence, when ASIC may grant one, and the fit and proper person test that applies to many applicants.

Holding a licence is not the only pathway. A licensee may authorise credit representatives, and a body corporate credit representative may in some cases sub-authorise natural persons. But representative arrangements are not informal outsourcing. The Act deals with authorisation, variation and revocation, ASIC notification, representative numbers, and the responsibility of licensees for representatives.

For businesses, the practical question is not just whether someone in the group has a licence. It is whether the exact entity doing the work is properly licensed or properly authorised for the exact activities it performs. If your business model changes, your authorisations and licence conditions should be checked again.

Once licensed, the business moves into an ongoing compliance regime. The Act includes general conduct obligations for licensees, requirements for compensation arrangements, obligations to provide information and assistance to ASIC, annual compliance certificate obligations, and notification obligations for changes in control or where the licensee does not engage in credit activities.

The Act also gives ASIC powers around suspension, cancellation and variation of licences, and banning orders can be made against persons in appropriate cases. That means compliance is not a one-off licensing exercise. It is an operational system that needs to continue after launch.

For many businesses, this is where governance becomes important. You need clear responsibility for compliance, documented procedures, and a process for escalating issues that may become reportable situations.

Chapter 3 contains the responsible lending framework. The Act separately addresses licensees that provide credit assistance and licensees that are credit providers under credit contracts. In both settings, the structure is similar: provide required disclosure, make reasonable inquiries, assess unsuitability, and do not suggest, assist with, enter into or increase unsuitable credit contracts where the Act says you must not.

For credit assistance providers, the Act deals with credit guides, quotes, preliminary assessments, reasonable inquiries about the consumer, and prohibitions on suggesting or assisting with unsuitable credit contracts. For credit providers, the Act deals with credit guides, assessment of unsuitability, reasonable inquiries, and prohibitions on entering into or increasing unsuitable credit contracts.

The practical point is that responsible lending is not satisfied by a generic form. The Act is built around inquiries into the consumer and an assessment of unsuitability. If your business uses automated onboarding, scorecards or platform-based decisioning, those systems still need to support the inquiries and assessments the Act requires.

The Act requires specific documents and consumer-facing disclosures in different situations. These include credit guides for credit assistance providers and credit providers, quotes for providing credit assistance in some cases, and assessment documents that may need to be given to the consumer.

There are also product-specific disclosure rules. The Act contains additional Key Facts Sheet requirements for standard home loans and credit card contracts. Credit card provisions also deal with matters such as offers to increase credit limits, the consumer's ability to reduce limits, over-limit use, order of application of payments, retrospective interest charges, and termination requests.

For businesses, this means compliance is not only about the contract itself. Website flows, application forms, scripts, online portals, customer communications and post-contract servicing can all be regulated touchpoints under the Act.

The Act contains additional rules for several product categories. These include standard home loans, credit card contracts, low cost credit contracts, short term credit contracts and small amount credit contracts. The table of contents shows that these parts go beyond the general responsible lending rules and add product-specific obligations and prohibitions.

For example, the Act includes Key Facts Sheet rules for standard home loans and credit cards. It also includes restrictions and documentation requirements relating to short term and small amount credit contracts, and a separate framework for low cost credit contracts including unsuitability assessment policies.

If your business is developing a new consumer credit product, do not stop at the general licensing chapter. Check whether the product falls into one of these categories, because the compliance burden may be materially different.

The Act requires licensees to keep financial records, specifies how those records are to be kept, and requires retention of financial records for 7 years. It also contains a separate record-keeping obligation in relation to compliance and reportable situations.

Where a credit service licensee holds trust account money, the Act contains trust account rules, including maintaining a trust account and lodging a trust account statement and trust account audit report. The Act also gives auditors rights of access and imposes reporting obligations in relation to audit matters.

On the reporting side, the Act defines reportable situations and requires reports to be lodged in certain circumstances. It also includes obligations to investigate reportable situations that may affect consumers and to report to consumers affected by a reportable situation. ASIC must publish details of certain reports.

These obligations mean businesses need more than a file retention policy. They need a compliance reporting framework that can identify incidents, investigate them, preserve evidence and decide whether ASIC or consumers must be notified.

The Act does provide for exemptions and modifications, but the legislation structure shows that these are dealt with through specific provisions, ASIC action and regulations. That is important because exemptions are not a broad safe harbour for any low-touch or innovative model.

Businesses are often outside the main consumer credit regime where they are dealing only with genuinely business-purpose credit and the National Credit Code is not engaged. But the Act extract does not support a simple list of all exclusions, and the exact position can depend on regulations, ASIC modifications and the detailed facts of the arrangement.

If you are relying on a referral-only model, a business-purpose lending model, or a product that you believe sits outside traditional credit, you should check the definitions in sections 6 to 10, the National Credit Code connection in section 3, and the exemption and modification framework in Chapter 2 Part 2-6 before treating the business as outside the regime.

The current compilation on the Federal Register of Legislation is compilation number 50, dated 10 June 2025, and includes amendments up to Act No. 138 of 2024. The Act itself commenced under section 2, and the Register should be checked for the commencement table and any staged commencements relevant to particular amendments.

The compilation notes also make two practical points. First, uncommenced amendments are not shown in the compiled text. Second, modifications may apply without changing the wording of the compilation. That means a business should not rely only on the body text of the Act. You should also check the endnotes, any pending amendments on the Register, relevant regulations and any applicable ASIC instruments.

This page is a practical overview, not a substitute for reading the Act against your business model. Before relying on it, confirm whether your product is consumer credit, whether the National Credit Code applies, whether your conduct is a regulated credit activity, and whether you are operating under your own licence or as a validly authorised representative.

You should also check whether any product-specific rules apply, especially for home loans, credit cards, low cost credit contracts, short term credit contracts and small amount credit contracts. Finally, confirm the current law position on the Register because the compilation itself warns that uncommenced amendments and modifications may affect the legal outcome.