ASIC has released a report on updates to the ePayments Code (‘the Code’) after consultation with a number of stakeholders last year, including the banking industry, industry associations, consumer and small business representatives, fintechs, government agencies and regulators.

Key points

The Code regulates, among other things, electronic payments including online payments, EFTPOS and credit/debit card transactions, internet and mobile banking.
ASIC is seeking to modernise the Code, following recent developments in technological innovation.

Under the proposed changes, protections for consumers will be extended by:

• allowing for the partial recovery of funds after a mistaken internet payment as soon as reasonably possible (the current ‘all or nothing’ position in the Code only allows for recovery of mistaken internet payments where there are sufficient funds to recoup the entire amount of the mistaken payment available);
• requiring the sending authorised deposit-taking institution (ADI) to investigate a mistaken internet payment and send a request to the return of funds to the receiving ADI within 5 business days;
• informing consumers of their right to make a complaint;
• imposing obligations on both the sending and receiving ADIs to keep records on the steps taken to comply with the Code;
• providing clarity around the definition of a “mistaken internet payment” and “unauthorised transaction”;
• requiring an onscreen warning for consumers to check the BSB and account number are correct when making an internet payment; and
• extending the code to transactions made using the New Payments Platform

Notably, ASIC rejected proposals to extend the Code to small businesses, citing industry opposition and complexities.

Arguably the most significant change proposed is that while the Code is currently voluntary to subscribers, the Government has previously indicated their support for a mandatory Code and will work with ASIC to produce this. Consultation with stakeholders will begin shortly.

ASIC expects to release an updated Code later this year following stakeholder feedback.

Once the updated Code is released, ASIC has indicated that they will apply a 12-month transition period for compliance.