NCCP and APRA Compliance: What Australian Lenders Need From Their Loan Management Software

In May 2026 the Federal Court ordered Westpac to pay $26 million for failing to receive and respond to online hardship notices within the time the National Credit Code allows. The failure sat in the machinery around the loans: an online hardship process and the statutory clock it was supposed to start.

Australian lenders need loan management software that runs the obligations of the National Consumer Credit Protection Act 2009 (NCCP Act) and the prudential standards of the Australian Prudential Regulation Authority (APRA) as default behaviour. That means assessments that cannot be skipped, hardship notices that start a timer the moment they arrive, and records that answer an examiner without a scramble. This guide maps each obligation to the capability it demands and ends with an eight-point checklist for your next vendor review.

This article is for informational purposes only and does not constitute legal advice.

Why Compliance Is a Software Problem, Not Just a Legal One

Compliance becomes a software problem when a regulation dictates how a decision must be made or how quickly a response must be sent, because only a system can apply a rule to every file on every day. The Australian Securities and Investments Commission (ASIC) has told lenders that automated credit decisioning needs to be tested rigorously and continually, and its enforcement record shows why a policy binder cannot carry the load alone.

The cost of a gap is concrete. A programming error in one automated serviceability calculator cost Commonwealth Bank $180,000 in infringement notices and about $2.5 million in write-offs, and between August 2025 and May 2026 the Federal Court imposed hardship penalties of $15.5 million on NAB and its subsidiary, $40 million on ANZ and $26 million on Westpac.

A useful way to read the statutes is as a list of clocks. A responsible lending assessment can be at most 90 days old when the contract is entered, or 120 days for secured credit used to buy residential property. A hardship notice starts a 21-day clock. A material information security incident starts a 72-hour clock under APRA’s CPS 234. Actions for responsible lending breaches can be brought up to six years after the breach. Loan management software Australia lenders rely on has to run those clocks on its own, because work left to people eventually loses track of them.

What the NCCP Act Requires From Lenders (And Their Systems)

The NCCP Act is the National Consumer Credit Protection Act 2009 (Cth), the federal law that requires anyone engaging in credit activities in Australia to hold an Australian Credit Licence (ACL) and places responsible lending, hardship and general conduct obligations on licensees. ASIC administers it, and breaches carry civil penalties. For NCCP compliance, loan management software has to turn each obligation into a workflow the lender cannot skip.

Responsible Lending Obligations (s 128 to 133)

Responsible lending software has to support three steps that run through sections 128 to 133 of the NCCP Act and ASIC’s RG 209. Section 128 requires the credit provider to assess whether a contract will be unsuitable before entering it or raising the limit. Section 130 requires reasonable inquiries about the consumer’s requirements, objectives and financial situation, plus reasonable steps to verify that financial situation. Section 131 sets the test: a contract must be assessed as unsuitable if the consumer likely could not comply with it, or could comply only with substantial hardship, or if it does not meet their requirements and objectives.

Each step has a system counterpart. Inquiries become a data-collection workflow that captures requirements and objectives in structured form. Verification becomes document checks and bank data connections that record what was verified and when. The suitability test becomes a serviceability calculator and an automated check that stops the file when the answer is unsuitable. Loan management software built around that sequence, such as the Prizm Lending Suite, makes the compliant path the default path.

The courts have tested how much the Act dictates. In ASIC v Westpac [2020] FCAFC 111, the Full Federal Court held that the Act does not prescribe how a credit provider must assess suitability, although lenders remain barred from entering unsuitable contracts. The design lesson is to hold the inputs and the outcome so a lender can show why a loan was suitable, and s 132 lets a consumer request a copy of the assessment for seven years after the loan, so those records must stay retrievable.

Hardship Obligations Under the National Credit Code

Section 72 of the National Credit Code (NCC), Schedule 1 to the NCCP Act, lets a debtor tell the credit provider, orally or in writing, that they are or will be unable to meet their obligations, and that notice starts the clock. The provider has 21 days to ask for further information, and the debtor has 21 days to supply it. The response notice is then due 21 days after the hardship notice arrives, or 21 days after the information arrives, or 28 days after the information request if nothing comes back (ASIC FAQ). Failing to give the response notice is a civil penalty contravention, and s 89A restricts enforcement action while a notice remains unanswered.

Loan management software has to do the following without relying on memory. It must capture notices from every channel, including phone calls, because oral notices count. It must stamp the receipt date, calculate each deadline, run the request and the decision, produce the response notice and hold enforcement activity. Delinquency management software that treats hardship as a collections flag rather than a statutory process misses the clock.

Licensing, Conduct and Record-Keeping (ACL Requirements)

Holding an ACL carries general conduct obligations under s 47(1) of the NCCP Act, which ASIC explains in RG 205. They include compliance arrangements that work in practice, competent and trained staff and credit representatives, and membership of an external dispute resolution scheme, which for most lenders means the Australian Financial Complaints Authority (AFCA).

The common thread is evidence: who made each decision, on what information, under whose authority, and what happened when a borrower complained. In loan management software terms that means an audit trail on every borrower interaction, complaint and dispute records tied to the loan, training and authority records for staff and credit representatives, and role-based access so only authorised people act on a file. Australian credit licence compliance is tested after the fact, so the record has to exist before anyone asks.

What APRA Expects: Prudential Standards That Touch Your LMS

APRA’s prudential standards apply to authorised deposit-taking institutions (ADIs), the banks, credit unions and building societies that take deposits, and they address the safety of the institution as distinct from the fairness of each loan. Non-bank lenders sit outside that regime but remain subject to ASIC and the NCCP Act. Three standards reach into loan management software.

APS 220 Credit Risk Management

APS 220 requires ADIs to control credit risk through prudent policies and procedures, and APRA’s revision widened it to cover credit standards at origination and ongoing monitoring of the credit portfolio. For loan management software, that means a configurable rules engine that enforces the lender’s own credit standards, such as loan-to-value ratio (LVR) and debt-to-income (DTI) limits, at the point of origination. It flags breaches and records every approved exception with an approver. Mortgage compliance software also has to carry the monitoring side, with early-arrears indicators and consistent classification data for risk teams.

CPS 234 Information Security

CPS 234 requires APRA-regulated entities to maintain information security capability that matches the threats they face and to assess the security capability of any third party that manages their information assets. APRA must be notified no later than 72 hours after the entity becomes aware of a material incident, and within 10 business days of a material control weakness. For cloud-hosted loan management software, the lender has to evidence the vendor’s controls, and the platform must supply role-based access, activity logs and the incident data needed to meet the 72-hour window.

CPS 230 Operational Risk Management (Replacing CPS 231 and CPS 232)

Many guides still cite CPS 231 (Outsourcing) and CPS 232 (Business Continuity Management). APRA retired both when CPS 230 took effect on 1 July 2025. It requires entities to manage operational risk, maintain critical operations through disruption and manage the risk that comes with service providers. ADIs had to lodge their first registers of material service providers from 1 October 2025, and existing service provider contracts had until the earlier of renewal or 1 July 2026 to comply, so that transition has now closed.

If your loan management software is a third-party platform, ask the vendor how its contract reflects CPS 230, how it tests business continuity, which fourth parties it depends on and what the exit plan looks like.

The LMS Compliance Checklist: 8 Features Australian Lenders Should Demand

Take these eight into any review of loan management software Australia lenders are considering, and ask to see each one on screen.

1. Automated responsible lending assessments. Your loan management software must capture requirements, objectives, income and expenses in structured form, run serviceability on declared figures and block an unsuitable contract before it completes.
2. End-to-end hardship management workflows. Your loan management software must start the s 72 clock on receipt from any channel, run the information request and decision, generate the response notice, modify payment arrangements and hold enforcement.
3. Full audit trail on every borrower interaction and decision. Your LMS must record who did what, when and on what information, and keep it long enough to answer a s 132 request and a six-year look-back.
4. Document verification and fraud detection. Your LMS must check income and identity documents against source data and flag inconsistencies, so reasonable verification steps are demonstrable.
5. Configurable policy rules engine. Your LMS must enforce APRA-driven and internal credit standards at origination, flag breaches and log every exception with its approver.
6. Regulatory reporting and ASIC-ready data exports. Your LMS must produce complaint, hardship and assessment data on demand, in a form an examiner can use without a manual rebuild.
7. Multi-channel communication logging. Your LMS must log SMS, email and voice contact on the borrower’s record with timestamps, so debt collection compliance software controls can be reviewed after the event.
8. Role-based access controls and CPS 234-aligned security. Your LMS must restrict actions by role, log access and give you the incident and vendor assurance data that CPS 234 and CPS 230 expect.

See how Prizm handles NCCP and APRA compliance out of the box: book a demo. Want to audit your current LMS against these eight? Talk to our team.

What Happens When Your LMS Falls Short: Real Enforcement Cases

Sources: ASIC on CBA, ASIC on Nimble, ASIC on Westpac, NAB and ANZ.

The Commonwealth Bank matter began with a self-report. Between July 2011 and September 2015 the calculator approved 9,577 consumers for overdrafts that would otherwise have been declined and 1,152 for higher limits, because it did not properly account for declared expenses.

ASIC’s position after the Nimble matter was that automated decisioning must be tested before use and regularly after, with a sample of assessments reviewed by a person.

The hardship cases follow a different pattern. The court accepted 277 contraventions by Westpac and imposed $26 million, against ASIC’s request for $30 million and the bank’s proposal of $10 million. These were failures of intake, clocks and follow-up.

One caution about a figure that circulates: the $35 million Westpac and ASIC agreed in 2018 over a household expenditure benchmark was never imposed, because the Federal Court dismissed ASIC’s case in 2019 and the Full Federal Court dismissed the appeal in 2020.

The lesson across all of them is that automation saves time and must be tested against NCCP obligations continuously. Your loan management software should make compliance the default, so nothing depends on someone noticing a drift.

How Prizm Collection Supports NCCP and APRA Compliance

Prizm Collection, part of Finspectra’s loan management software, is built for the Australian lending market, with the compliance workflows inside the product instead of added afterwards. Three modules do most of the work for you.

Hardship management gives you vulnerability assessment, personalised action plans, flexible payment options and automated monitoring of each arrangement, which maps to the s 72 process above. Delinquency management runs multi-product workflows, regulatory-aligned collection plans and work-queue management, so your team works accounts in the order and manner your obligations require. Account analytics puts a 360-degree customer view, aging history and payment monitoring on one screen. As debt collection software and a collections automation platform, Prizm Collection software keeps hardship, delinquency and communication history on one record.

The integrations carry equal weight. Prizm connects to Equifax, Experian, Credit Sense, DocuSign and Twilio, so verification, signing and communication steps happen inside the workflow and land on the same record. The full list sits on the page for integrations with Equifax, Experian and Twilio. Lenders that need loan collections software tied to origination and servicing get the same data model across the Prizm Lending Suite.

Conclusion: Which Clocks Does Your System Run?

Strip the statutes down and most of them describe a clock or a record: ninety days for an assessment, twenty-one for a hardship response, seventy-two hours for an incident, and a trail that holds up under six years of questions. In the cases above the rule was well known, and the system ran on its own logic anyway. Ask the vendor of any loan management software Australia offers, and your own team, which of these clocks it starts without being told. Whatever the answer, that is the gap to close first.

Built for Australian lenders. Compliant by design. Book a demo to see Prizm Collection in action.

‍

‍