Mackay Chapman October 2026 Regulatory Roundup
September brought another busy month of enforcement, regulatory scrutiny and reform across tax, financial services and anti-money laundering.
The common thread is that regulators are looking closely at whether governance and compliance systems actually work in practice.
Key developments
- The ATO increased action against shadow economy operators, with non-lodgment prosecutions initiated up more than 80%.
- Accountants were among those charged in a major alleged fraud and money laundering investigation involving fraudulent loan applications.
- ASIC’s first review of mandatory sustainability reports found improved disclosure, but also identified areas requiring further development.
- AUSTRAC commenced an investigation into Western Union and continued enforcement against high-risk payment and virtual asset businesses.
- APRA and ASIC warned financial institutions to move from AI awareness to practical cyber and governance action.
- APRA and ASIC also proposed changes designed to streamline administration of the Financial Accountability Regime.
ATO
ATO targets alleged professional facilitators in major fraud investigation
Strike Force Myddleton was initially established to investigate alleged fraud involving vehicle finance and so-called “ghost cars”.
Investigators say the alleged offending later expanded into personal, business and home loan fraud involving multiple financial institutions.
Three accounting firm employees were among those charged in September. This included the firm’s director and two accountants.
Police allege false documents were used in connection with fraudulent loan applications involving millions of dollars.
The NSW Crime Commission has also restrained $95 million in assets during the wider investigation.
The ATO says the case highlights its focus on professional facilitators who may assist others to engage in financial crime.
For accountants, advisers and other professionals, the message is important. Regulators are not only looking at the person accused of the misconduct. They are also examining the professionals, businesses and systems that may have enabled it.
ATO shadow economy prosecutions rise sharply
The ATO has also significantly increased its use of prosecutions against shadow economy operators.
The number of non-lodgment prosecutions initiated increased by more than 80% between 2024–25 and 2025–26. Convictions increased by almost 60% over the same period.
Over the past two years, the ATO says it has successfully prosecuted more than 350 individuals and entities. It has secured more than 305 convictions, with courts imposing more than $2.7 million in fines.
Queensland, Western Australia and New South Wales accounted for almost three quarters of successful non-lodgment prosecutions nationally in 2025–26.
The activity forms part of the ATO’s wider focus on the shadow economy. This includes undeclared income, cash transactions designed to avoid tax and failures to meet tax and superannuation obligations.
For businesses, persistent non-compliance can move well beyond an administrative or tax debt issue. It can ultimately lead to criminal enforcement.
ASIC
ASIC sees improvement in sustainability reporting
ASIC reviewed a sample of 40 sustainability reports.
It says the introduction of mandatory reporting has already improved the quality, quantity and consistency of climate-related financial information.
However, ASIC also identified areas requiring further development.
Its concerns were particularly focused on forward-looking disclosures and information based on assumptions or judgement. This includes disclosures relating to strategy, metrics and targets.
ASIC has published eight practical action items for reporting entities. It also says it will continue reviewing sustainability reports during 2026–27.
The findings are particularly relevant as the regime expands beyond the first group of large reporting entities.
AUSTRAC
AUSTRAC launches investigation into Western Union
AUSTRAC has commenced an investigation into Western Union over concerns about its management of high-risk payment channels, customers and affiliates.
The investigation will examine Western Union’s AML/CTF program and transaction monitoring systems.
It will also consider its governance arrangements, including the role of its global head office in compliance decisions affecting Australian operations.
AUSTRAC says payment service providers face heightened exposure to financial crime risks. These include fraud, terrorism financing, human trafficking and child sexual exploitation.
The regulator has not determined whether enforcement action will ultimately be taken.
Western Union has committed to addressing issues identified in an earlier external audit.
The investigation reinforces AUSTRAC’s focus on how AML/CTF programs operate in practice. Having policies in place is not enough if the systems behind them are ineffective.
AUSTRAC removes 45 payment and virtual asset businesses
That scrutiny extends across the broader payments sector.
The regulator identified a range of issues. These included inadequate operational capacity, prolonged inactivity, insolvency and registration failures.
AUSTRAC also identified significant money laundering and terrorism financing risks in some cases.
Individuals connected with some of those businesses have been referred to law enforcement and other regulators.
The action highlights AUSTRAC’s increasingly active approach to high-risk payment businesses.
This is particularly relevant where money moves quickly and governance or financial crime controls are weak.
APRA
APRA and ASIC tell financial institutions to move from AI awareness to action
The warning follows a series of industry roundtables involving more than 600 participants.
The regulators say AI could increase both the speed and sophistication of cyber attacks.
Key areas of focus include basic cyber controls and board-level decision making before an incident occurs.
They also emphasised tested response and recovery arrangements, third-party risks and greater information sharing across the financial sector.
A particular concern is speed.
AI may significantly reduce the time organisations have to identify and respond to a cyber incident.
For boards and executives, the message is practical. AI and cyber risk should already be part of existing governance, operational resilience and incident response arrangements.
APRA and ASIC propose simpler FAR reporting
The proposals would remove certain key-function requirements from the FAR regulator rules.
They would also remove the requirement to include details of accountable persons’ direct reports in accountability maps.
APRA and ASIC estimate the changes would reduce reporting for all accountable entities and around 4,500 accountable persons.
They also expect the number of updates required to accountability maps to be roughly halved.
The regulators say the aim is to reduce unnecessary administrative burden without weakening substantive accountability requirements.
Subject to consultation, the changes are expected to be finalised by the end of 2026 and take effect in early 2027.
What does this mean for businesses?
September’s developments continue a broader trend.
Regulators are increasingly testing whether governance frameworks work in practice.
They want to know who facilitated a transaction. They want to know whether monitoring systems identified suspicious behaviour. They want boards to be ready to respond when something goes wrong.
They are also looking closely at whether statutory reporting is backed by meaningful analysis.
At the same time, the proposed FAR changes show that regulators are willing to reduce administrative burden where it does not weaken accountability.
For regulated businesses and their advisers, the challenge is increasingly to distinguish between genuine compliance and compliance that simply creates more paperwork.
The contents of this update do not constitute legal advice, are not intended to be a substitute for legal advice, and should not be relied upon as such. They are designed and intended as general information in summary form, current at publication, for general informational purposes only. You should seek legal or other professional advice concerning any particular legal matters you or your organisation may have.
