Australia’s corporate regulator is redrawing the rules for how scam-related complaints will be handled, and insurance professionals have reason to pay attention even though their sector is not yet in scope.
The Australian Securities and Investments Commission (ASIC) has opened consultation on proposed changes to Regulatory Guide 267 (RG 267), which governs its oversight of the Australian Financial Complaints Authority (AFCA). The changes prepare for AFCA’s expanded jurisdiction under the Scams Prevention Framework (SPF), set to commence on March 31, 2027, and covering banking, telecommunications, and digital platforms “initially.”
That word matters. The federal government indicated in 2024 that superannuation, insurance, and crypto would be “fast followers” and would not need to wait for formal designation to improve consumer protections. For brokers, the question is not whether the SPF will touch insurance, but when and in what form.
The update to RG 267 is the first substantive revision since AFCA was established in 2018. According to ASIC’s Consultation CS 66, the proposed changes fall into three areas: reflecting AFCA’s expanded SPF jurisdiction, providing guidance informed by operational experience, and simplifying the overall guide.
ASIC has removed content now covered by AFCA’s approved scheme rules for complaints resolution while retaining references it considers central to AFCA’s operation. The regulator has also removed detailed information on financial firms’ AFCA membership obligations, clarifying that RG 267 is focused on ASIC’s oversight of AFCA rather than on firms’ individual requirements. ASIC said it intends to update its existing dispute resolution webpages to cover those membership obligations separately.
ASIC intends to publish the final RG 267 by March 31, 2027, aligning with the SPF’s commencement date. Industry stakeholders can provide feedback by emailing [email protected] by 5pm AEDT on November 24, 2026.
The National Anti-Scam Centre’s (NASC) 2025 Targeting Scams report, published in March 2026, recorded combined scam losses of $2.18 billion across Australia, up 7.8% from the prior year. Investment scams accounted for $837.7 million of that total, according to the NASC.
Payment redirection scams, at $166.8 million, are the category most directly relevant to insurance professionals. These losses overlap with business email compromise and funds transfer fraud, both common triggers for cyber and professional indemnity claims.
Read more: Scam losses are up – but the real story is in the policy wording
AFCA already handles a record caseload. In its 2025-26 annual review, the complaints body reported receiving almost 120,000 complaints, its highest figure on record. General insurance complaints rose 5% to 36,022, the fifth consecutive year of growth.
AFCA chief ombudsman and CEO David Locke said in the annual review: “Nobody wants to see this number of complaints.”
The addition of scam-related disputes from March 2027 will create a new category within that workload. Under AFCA’s proposed scheme rules, multiple regulated entities could be named in a single complaint, with liability divided among them. The direct scam-loss cap would increase from $631,500 to $1.263 million.
“It is imperative that people can transact safely and are treated fairly when things go wrong,” Locke said in a statement published on AFCA’s website.
AFCA recently concluded consultation on its proposed scheme rules for scam-related complaints. ASIC noted in its consultation that content in RG 267 may be further revised to reflect the final AFCA scheme rules.
The Insurance Council of Australia (ICA) addressed the prospect of insurance sector designation in its January 2025 submission to the Senate Standing Committees on Economics. The ICA called for a “proportionate, phased” approach and recommended that Treasury consult the general insurance industry before any designation.
The peak body flagged that insurers face a different scam risk profile to banks and telcos, noting that scams in which fraudsters seek policy benefits or account access are less prevalent in insurance. The ICA also asked for clarity on how the framework’s “reasonable steps” obligation would apply to insurers and how the safe harbour provision would interact with claims handling during fraud investigations.
The ICA’s members represent approximately 90% of private sector general insurers’ premium income in Australia, according to its submission.
Read more: AFCA-TIO agreement puts cross-sector scam liability in focus
The framework raises practical questions for brokers today. Social engineering and funds transfer fraud sublimits often sit well below headline cyber policy limits. Some policy wordings exclude business email compromise or invoice fraud losses where no covered system compromise has occurred.
Under section 912B of the Corporations Act 2001, Australian Financial Services licensees’ compensation arrangements are generally met through professional indemnity insurance. Brokers placing policies with material social engineering sublimits should consider whether clients understand the gap between their scam exposure and their coverage.
Whether an insurer that pays a scam claim could pursue subrogation against a bank or telco later found liable through AFCA also remains unresolved. AFCA’s cross-sector dispute model, where liability can be split across multiple parties, could create new claim dynamics for insurers and the brokers who place their coverage.
