The Scam Prevention Framework is now here – and more work on the way

With the passage on Thursday 13^th February of the Scams Prevention Framework Bill 2024, banks, telecommunications providers and social media companies now have new obligations to take positive steps to protect their customers from scams.

The new Framework comes into operation the day after Royal Assent, which could be any day now, so we have to assume we are in the new world of scam preventions within a week.

But as ACCC Deputy Chair Catriona Lowe noted, “there is considerable work ahead to implement the Framework, including the formal designation of sectors, development of sector codes, consumer and industry guidance”.

The evolution of the Scams Prevention Framework

Since its release for consultation in September 2024, the Scams Prevention Framework has undergone a further round of amendments, and was subsequently introduced to the House of Representatives, where it was referred to the Senate Economics Legislation Committee for further inquiry and report (including public consultation).

In broad terms, the Committee recommended that the Scams Prevention Framework be passed by the Senate in its current form. 

Although the Committee did not make any other express recommendations (such as in relation to any necessary amendments or further policy considerations) the report contained the following observations:

• AFCA as initial EDR - AFCA will initially be authorised as the external dispute resolution (EDR) scheme under the Scams Prevention Framework, and the Committee has expressed confidence in AFCA's capacity and ability to provide appropriate dispute resolution services in accordance with the legislation.
• Further detail to be contained in rules and regulations – The Scams Prevention Framework is ultimately a framework with built-in flexibility; further detail to enliven the Scams Prevention Framework will be included in future legislative instruments, in the first instance Industry Codes for Banking, Telcos and Digital Platforms sectors.
• Continued stakeholder engagement and consultation – There will be continued engagement and consultation with regulated entities and stakeholders in the development of sector-specific codes and rules, as well as in the ongoing improvement of the operations of the Scams Prevention Framework.
• Urgent enactment of the Scams Prevention Framework – Several participants in the inquiry called for the landmark legislation to be passed and enacted as soon as possible. In particular, AFCA seeks "urgent passage" of the Scams Prevention Framework "so that the significant work that needs to follow to implement the framework can begin". The Committee endorsed and reiterated those calls.

The report also recorded concerns raised by various stakeholders about aspects of the Bill, such as:

• uncertainty and confusion around the interaction between the enforceable principles-based obligations in the Scams Prevention Framework and the specific and targeted obligations to be included in future rules, regulations and codes;
• the risk to regulated entities of a significant compliance burden if further guidance and clarity is not given around "actionable scam intelligence" and the "reasonable steps" a regulated entity must take to otherwise meet its obligations under the Scams Prevention Framework; and
• lack of clear liability rules and an apportionment mechanism for situations where multiple entities across different sectors are involved in a scam.

While the Committee noted these concerns (and these concerns were picked up in a number of dissenting recommendations made by the Coalition Senators on the Committee), it nevertheless recommended the Scams Prevention Framework pass in its current form.

In the Senate, three changes were made:

• In determining if a regulated entity has taken reasonable steps, the primary consideration will be whether the regulated entity has complied with any relevant SPF code obligations relating to that provision (if applicable). The greater clarity regarding the reasonable steps obligations provided by this amendment appears directed at alleviating (at least partially) the concern raised by stakeholders regarding the compliance burden in assessing what constitutes "reasonable steps";
• The Bill now clarifies that guidelines prescribed by the SPF rules for apportioning any liability in internal dispute resolution processes, need not be consistent with other provisions about proportionate liability for concurrent wrongdoers in actions for damages; and
• the SPF general regulator (ie. the ACCC) must publish a summary statement of each regulator's roles and responsibilities.