Who regulates what
In Australia, payments regulation is split among a central bank that sets standards, licensing and competition authorities, and a financial intelligence unit. Card regulation is tighter there than in any other large market economy. The Reserve Bank of Australia (RBA) has the power to designate a payment system and then impose binding standards on it, and it has used that power since 2003. Decisions rest with the Payments System Board, a board within the central bank. The designation power comes from the Payment Systems (Regulation) Act 1998, known as the PSRA.
The PSRA was overhauled in 2025. The Treasury Laws Amendment (Payments System Modernisation) Act 2025, passed by both houses of Parliament on September 4, 2025, and given royal assent on September 19, broadens the definitions of “payment system” and “participant.” Digital wallets and buy now, pay later (BNPL) providers now fall within the regulator's reach. The law also adds a ministerial power to designate a system “in the national interest,” civil penalties, and enforceable undertakings.
| Authority | What it covers | Main instrument |
|---|---|---|
| Reserve Bank of Australia — Payments System Board | Card standards, interchange, surcharging, routing, system oversight, RITS operation | Payment Systems (Regulation) Act 1998 |
| ASIC | Financial services licenses, credit licenses, market conduct | Corporations Act 2001; National Consumer Credit Protection Act 2009 |
| APRA | Banking authorization (ADI), prudential supervision of stored-value issuers | Banking Act 1959; prudential standard APS 610 |
| AUSTRAC | Anti-money laundering, reporting, registration of remitters and virtual asset service providers | AML/CTF Act 2006 |
| ACCC | Excessive surcharging, consumer law, National Anti-Scam Centre | Competition and Consumer Act 2010, section 55B |
| AusPayNet | Rules for the legacy clearing frameworks: paper, BECS, high-value | Contractual frameworks among members |
| Australian Payments Plus (AP+) | Runs eftpos, BPAY, NPP, PayID, PayTo, ConnectID | Scheme rules |
The Australian regulator has two tools of unequal force: standards and published expectations. A standard binds designated systems, and breaches can be penalized. An expectation has no legal force. But the RBA publishes the compliance rate of the major acquirers twice a year, and in practice that disclosure works as well as a mandate. Least-cost routing has relied on this second tool since 2018.
NPP, Osko, and PayID: the instant payment rail
The New Payments Platform (NPP) is Australia's infrastructure for instant interbank credit transfers. It has been live since February 2018 and is run by NPP Australia, a subsidiary of Australian Payments Plus. Its messaging is native ISO 20022, and each transaction settles individually in central bank money. The service runs around the clock. The description field holds 280 characters of free text. Billers put the payment reference there, so it travels with the payment instead of being pieced back together during reconciliation.
Osko is the brand under which Australian banks offer instant credit transfers to their customers. Run by BPAY Group on the NPP infrastructure, it was the first overlay service of its kind. The NPP is the interbank rail; Osko is a commercial service built on top of it, with its own membership rules and speed commitment. Integrators handle the two separately: connecting to the rail on one side, joining the service on the other. In everyday use, Australians refer to an instant transfer by the Osko name, not the NPP.
PayID is the platform's alias directory, which links a simple identifier to a bank account. A phone number, email address, ABN (Australian Business Number), or organization ID stands in for the BSB and account number. Before the payer confirms the transfer, the service displays the name of the holder registered to that alias. This payee check is Australia's main defense against redirected payments. It has been built in since 2018, long before Europe mandated its own name check.
PayTo: the direct debit mandate, rebuilt
PayTo is the NPP's payer-authorized payment service, live since 2022 and run by NPP Australia. It replaces the direct debit mandate with a digital agreement stored centrally on the platform. The payer authorizes the agreement in their banking app, where they can later view, pause, amend, or cancel it. The biller receives every response in real time, including declines.
The key difference from BECS direct debit is when the biller learns the outcome. A BECS debit goes out in a file, returns no response on submission, and comes back as a return several days later. A PayTo payment is initiated on the instant rail, and the payer's bank responds immediately, including on available funds. The biller therefore knows the outcome before shipping goods or activating a service. For a subscription business, exposure to failed payments shrinks from several days to a few seconds.
| Criterion | BECS direct debit | PayTo | Card on file |
|---|---|---|---|
| Mandate format | Signed form, kept by the biller | Central digital agreement, visible to the payer | Card token held by the PSP |
| Initial authorization | No real-time check | Explicit approval in the banking app | Authentication at enrollment |
| Payment outcome | Return after several days | Immediate response | Immediate decline, network response code |
| Change in amount or frequency | New mandate to sign | Amendment sent to the payer to accept or decline | New card details to collect |
| Cost to the biller | Low, priced per file | Per-transaction fee set by the PSP | Interchange, scheme fees, and acquirer margin |
| Common point of failure | Outdated account details, no name check | Uneven coverage across banks | Card expiry and reissue |
PayTo's bank coverage is still uneven. Not every institution offers the same level of functionality, so a single flow for an entire customer base cannot be taken for granted. The check has to be made bank by bank. AP+ runs a “Move to NPP” program to close these gaps. About 114 million accounts, or 87% of accounts reachable through BECS, can now receive an NPP payment (AP+, 2025).
- Check bank coverage for the target use case before offering PayTo as the only payment method.
- Treat an amendment as a product event: a subscription price change goes out as an agreement request, not as a notice.
- Keep a fallback: card on file or BECS direct debit until PayTo coverage is confirmed across the customer base.
- Use the 280 characters of description to carry the invoice reference, and eliminate fuzzy matching in reconciliation.
eftpos and least-cost routing
eftpos is Australia's domestic debit scheme. It was rolled out in the 1980s and has been run by Australian Payments Plus since 2022. Most Australian debit cards are DNDCs (dual-network debit cards), with eftpos on one application and Visa Debit or Debit Mastercard on the other. A transaction can be routed over either network, and the merchant pays different fees depending on which one is used.
Least-cost routing (LCR), also called merchant choice routing, sends a debit transaction over whichever of the card's two networks costs the merchant less. In Australia, the acquirer chooses the network; Europe settled the same question in the cardholder's favor. The RBA has never mandated LCR through a standard. It gets results through published expectations and semiannual monitoring of the major acquirers.
LCR is still rare online and in mobile wallets. In March 2026, the RBA decided against mandating it on those channels. It kept its expectations-based approach for in-person payments and deferred card-not-present commerce to the broader review launched in June 2026. An Australian online merchant therefore still pays the international network's debit rate on a large share of its volume.
The Australian model shifts the network choice from the cardholder to the party that bears the cost of the transaction, and other regulators are taking note. New Zealand adopted part of it in its Retail Payment System Act 2022, which empowers its competition authority to set network standards. The most useful comparison is with that close neighbor rather than with Europe.
The October 1, 2026, reform
On March 31, 2026, the RBA published the conclusions of its Review of Merchant Card Payment Costs and Surcharging, the third phase of its review of retail payments regulation. It is the most sweeping package since 2003. It lowers domestic interchange caps, ends surcharging on designated networks, caps interchange on foreign-issued cards for the first time, and requires fee schedules to be published.
| Card category | Previous regime | New cap | Entry into force |
|---|---|---|---|
| Domestic debit and prepaid | Weighted-average benchmark, higher individual caps | 8 cents per transaction, or 0.16% for percentage-based schedules | October 1, 2026 |
| Domestic consumer credit | Weighted-average benchmark | 0.30% of value | October 1, 2026 |
| Domestic commercial credit | 0,80 % | 0.80%, unchanged | – |
| Foreign-issued cards acquired in Australia | No cap | 1.00% of value | April 1, 2027 |
The key change in method is the end of the weighted-average benchmark. Under that system, a network complied as long as its average rate stayed within the benchmark, which let it charge high rates on some segments and offset them with low rates on others. The cap now applies to each individual rate. The RBA expects merchants to save about A$910 million a year. It notes that an Australian merchant pays close to 2.5% on average to accept an international card, scheme fees included.
The surcharging reform works indirectly, through network rules. The RBA lifts its ban on networks imposing no-surcharge rules; it does not prohibit surcharging itself. From October 1, 2026, eftpos, Mastercard, and Visa will therefore be able to ban surcharging on their debit, prepaid, and credit cards by contract. The central bank expects them to do so and puts the benefit to consumers at up to A$1.6 billion a year.
The current surcharging regime applies until that date. The RBA standard limits a surcharge to the cost of acceptance the merchant actually bears, calculated by card type. Each year, the acquirer gives the merchant a statement of that average cost, expressed as a percentage. A surcharge above that percentage is “excessive” under section 55B of the Competition and Consumer Act 2010. The ACCC investigates and enforces: infringement notices of A$218,400 for a listed company, and court penalties of up to A$2,355,444 per contravention for a company (amounts in effect since July 1, 2026).
BECS, BPAY, and the end of the check
Three legacy rails still carry a large share of Australia's non-card payments. BECS (Bulk Electronic Clearing System), also called Direct Entry, handles batch credit transfers and direct debits in files, addressed by BSB and account number. BPAY, launched in 1997, is the national bill payment system: payers enter a biller code and a customer reference in their online banking. Checks are still in circulation, but the federal government’s “Cheques Transition Plan” schedules their end.
| Rail | Use cases | Settlement time | Addressing | License type |
|---|---|---|---|---|
| NPP / Osko | P2P, payroll, refunds, on-demand collection | A few seconds, around the clock | PayID or BSB + account | More than a third of account-to-account payments (AP+) |
| PayTo | Subscriptions, authorized debits, usage-based billing | Immediate, with real-time response | Central digital agreement | Uneven rollout across banks |
| BECS / Direct Entry | Payroll, batch files, legacy direct debits | Next business day (D+1) in practice | BSB + account number | Retirement date withdrawn in December 2025 |
| BPAY | Recurring bills, taxes, insurance | Settles the next morning | Biller code + customer reference | More than 95,000 billers (AP+, 2026) |
| Checks (Australian Paper Clearing System) | Remaining niches: estates, local governments, regulated professions | Several days | Paper | Issuance ends June 30, 2028 |
The decommissioning of BECS was started, then put on hold. In November 2023, after three years of consultation, AusPayNet set June 2030 as the end date for the framework. On December 16, 2025, it withdrew that date, citing three reasons: no shared vision for the future of account-to-account payments, alternatives not yet mature enough for direct debits and large bulk files, and a tougher risk environment. No new deadline will be set until a roadmap exists.
These rails settle through RITS (Reserve Bank Information and Transfer System), Australia's RTGS system. The RBA owns, operates, and oversees it. Batches from BECS, the card schemes, and BPAY settle there each morning on a deferred net basis. High-value payments come in through HVCS, a SWIFT closed user group, and through Austraclear. The NPP settles payments one by one through the Fast Settlement Service. Deferred net settlement and real-time gross settlement thus run side by side in the same infrastructure.
Accepting payments: payment mix and acquiring
Cards dominate how Australian households pay, and those cards are increasingly presented from a phone. The RBA's household payments survey, conducted in 2025 and published in 2026, puts cards at about 73% of payments by number, down from 76% in 2022. Payments made from a device account for about 40% of card payments, up from 31% three years earlier. The shift is happening within cards, from the physical card to the mobile wallet.
Cash gained share by number of payments between 2022 and 2025. It made up about 15% of payments by number in 2025, up from 13% in 2022, and about 8% by value. For in-person payments alone, it reaches 19% by number and 16% by value. Nearly one in four payments under A$10 is still made in cash, and half of Australians use cash in a typical week. A retailer that refuses cash gives up a share of customers that the survey can quantify. Source: RBA, Consumer Payments Survey 2025.
Buy now, pay later took off commercially in Australia with Afterpay, founded there and acquired by Block in a deal announced at US$29 billion in 2021. Zip Co, listed on the ASX, operates in Australia, New Zealand, and the US. The legal regime changed on June 10, 2025: BNPL contracts now fall under the National Consumer Credit Protection Act 2009 as low cost credit contracts. Providers must hold an Australian credit license and be members of AFCA, the financial complaints authority. ASIC has published regulatory guide RG 281.
The acquiring market includes the four major banks (Commonwealth Bank, Westpac, NAB, ANZ) and specialist acquirers: Tyro and Zeller in physical retail, Square for micro-merchants, and Stripe and Adyen for e-commerce and platforms. Contract negotiations center on two points. The first is the pricing structure: flat rate or interchange plus. The second is whether least-cost routing is actually switched on. The October 2026 reform changes both at once.
Card fraud, scams, and liability
Fraud on Australian-issued cards is measured by financial year and broken down by where the transaction took place. In the year from July 2024 to June 2025, it totaled A$854 million, down slightly, on A$1.2 trillion of spending on Australian cards. The overall rate fell to 71.8 cents per A$1,000 spent, from 77.6 cents the year before. Domestic card-not-present fraud fell 11.1% to A$312 million, a record-low rate of 75 cents per A$1,000 (AusPayNet).
Card-not-present fraud on transactions made overseas totaled A$434.3 million, at a rate of A$10.75 per A$1,000, more than ten times the domestic rate. Half of all fraud is therefore concentrated in the small share of spending made outside Australia. Two categories rose sharply: lost or stolen cards, at A$74.3 million, up 27.9%, and fraudulent card applications, at A$2.0 million.
| Category | Amount | Year-over-year change | Rate per A$1,000 |
|---|---|---|---|
| Card not present, overseas transaction | A$434.3M | +0,1 % | A$10.75 |
| Card not present, domestic transaction | A$312.0M | −11,1 % | A$0.75 |
| Lost or stolen cards | A$74.3M | +27,9 % | – |
| Counterfeit and skimming | A$7.1M | +11,6 % | – |
| Card not received | A$2.4M | −14,9 % | – |
| Fraudulent card applications | A$2.0M | +129,4 % | – |
| Total, all cards | A$854M | – | A$0.718 |
Scams cost more than card fraud, and they fall under a different legal regime: the victim makes the payment themselves after being deceived. The National Anti-Scam Centre recorded A$2.18 billion in reported losses in 2025, up 7.8% year over year, across 274,577 reports involving a loss. That is still almost 30% below the 2022 peak of A$3.1 billion. Five scam types account for 60% of losses: investment (A$837.7 million), payment redirection (A$166.8 million), romance (A$139.9 million), phishing (A$97.6 million), and remote access (A$69.9 million).
The Scams Prevention Framework Act 2025, in force since February 21, 2025, requires three sectors to take reasonable steps against scams: banks, telecommunications, and digital platforms. Each is subject to an enforceable sector code drawn up by its regulator, and civil penalties reach A$50 million for a serious or systemic breach. Scam victims have a direct path to compensation. The ACCC oversees the framework as a whole.
Setting up: licenses, rail access, compliance
Australia's licensing regime is organized by product sold, and it is being rewritten. Taking deposits requires ADI authorization from APRA under the Banking Act 1959. Issuing widely accepted stored value falls under the purchased payment facilities regime, a restricted class of ADI governed by prudential standard APS 610. Operating a non-cash payment facility requires an AFSL (Australian financial services license) from ASIC.
Treasury is replacing this product-based approach with an activity-based one. The first tranche of the bill went out for consultation in March 2026. It brings firms that have operated without a license into the AFSL regime: acquirers, payment facilitators, prepaid card operators, e-commerce gateways, and payment technology providers. APRA would set prudential standards for large stored-value issuers holding more than A$200 million in balances at group level. The new rules are expected to apply one year after royal assent.
| Activity | Authority | License required | Note |
|---|---|---|---|
| Take deposits, hold accounts | APRA | ADI authorization (Banking Act 1959) | Gives direct access to a settlement account in RITS |
| Issue widely accepted stored value | APRA | Purchased payment facility regime, APS 610 standard | Supervision triggered by stored-value balances and number of users |
| Operate a non-cash payment facility | ASIC | AFSL with the appropriate authorization | The activity-based reform will significantly widen the scope |
| Provide credit, including BNPL | ASIC | Australian credit license and AFCA membership | Required since June 10, 2025, for low cost credit contracts |
| Transfer funds, provide virtual asset services | AUSTRAC | Registration on the relevant register | AML/CTF reform applies to existing reporting entities from March 31, 2026 |
| Settle in central bank money | RBA | Exchange settlement account (ESA) in RITS | Without its own account, settles through a sponsor |
The anti-money laundering reform runs on its own timetable. The overhauled obligations have applied to existing reporting entities since March 31, 2026, the date digital asset platforms moved onto the virtual asset service providers register. Newly regulated sectors, known as tranche two, came in on July 1, 2026. The date that applies to a payment provider depends on whether it transfers money or virtual assets.
Access to settlement follows a different logic from licensing. Settling directly requires a settlement account at the RBA; otherwise, a new entrant goes through a sponsor. The sponsoring institution then takes on settlement, part of the compliance work, and the associated risk. The NPP offers five access tiers at very different costs, and the choice determines latency, commercial independence, and the ability to put the entrant's own brand in front of the end customer.