Lead signal
Consumer credit changed hands on 1 July. The FMA now polices lending, the disclosure templates and the definition of consumer credit changed the same day, creditors now need a licence, and a $2.6m undertaking shows what happens when systems drift from the paper. Behind the credit reset, the Privacy Commissioner has started naming names over data security and vendor oversight.
Show radar
Regulatory radar overview
Angle shows the regulatory category, distance from the centre shows when it bites, and size and colour show severity. Select a numbered signal to read its detail.
On a small screen, scroll the radar horizontally to see the full graphic.
Regulatory changes on the radar
A new regulator polices lending
- Who it affects
- non-bank lenders, finance companies, mortgage brokers and banks writing consumer credit
- What it can disrupt
- affordability logic, remuneration controls and complaints workflows built for the old regulator's playbook
- Why it matters now
- the FMA took over consumer credit on 1 July. Its first supervisory themes are already published.
Disclosure documents changed in July
- Who it affects
- lenders, finance companies, mortgage brokers and debt collectors generating CCCFA disclosure documents
- What it can disrupt
- document generation systems still producing last year's disclosure statements on every new loan
- Why it matters now
- in force 1 July. A second template change lands 5 December 2026.
Credit definitions changed in July
- Who it affects
- lenders, finance companies and any firm whose systems classify consumer credit contracts
- What it can disrupt
- product classification logic, registration data and workflows built to the old definition
- Why it matters now
- amendment in force since 1 July. Live now, not pending
$2.6m for a calculation mismatch
- Who it affects
- any lender whose systems calculate interest or fees against published terms
- What it can disrupt
- calculation engines that drifted from the terms customers actually signed
- Why it matters now
- enforceable undertaking accepted after $5.39m in underpaid interest. Find the drift before the regulator does.
Creditors now need a licence
- Who it affects
- creditors under consumer credit contracts, including securitisation vehicles and interim credit originators
- What it can disrupt
- contract assignment tracking that cannot evidence exemption eligibility within the one working day window
- Why it matters now
- in force 1 July. Exemptions exist, but eligibility must be evidenced.
The new regulator named its targets
- Who it affects
- lenders, finance companies, mortgage brokers and advice businesses under FMA conduct supervision
- What it can disrupt
- remuneration conflicts, complaints handling and fraud detection that cannot stand a supervisory visit
- Why it matters now
- the 2026/27 supervisory year is underway. Themes are published, sweeps follow.
Licensing now carries a price
- Who it affects
- consumer credit lenders applying for the new FMA market services licence
- What it can disrupt
- licence application workflows and finance processes that have not budgeted the $670 base fee plus hourly billing
- Why it matters now
- in force since 1 July. Applies to every creditor licence application.
Exemption requests now cost money
- Who it affects
- lenders seeking CCCFA declarations or exemptions from the FMA
- What it can disrupt
- compliance and accounts payable processes that assume regulator applications are free
- Why it matters now
- in force since 1 July. $115 up front, hourly billing after.
Health data breach findings landed
- Who it affects
- lenders and finance companies holding identity documents, income records and other sensitive borrower data
- What it can disrupt
- security safeguards that would not survive a post-breach inquiry into whether they were reasonable
- Why it matters now
- Phase 1 found Privacy Act breaches in May. Compliance notices are coming and Phase 2 is next.
Outsourcing does not outsource accountability
- Who it affects
- lenders relying on third-party origination, identity or collections vendors that handle customer data
- What it can disrupt
- vendor contracts and oversight that leave privacy obligations implied rather than enforced and monitored
- Why it matters now
- decision published and the stores named. The principle applies well beyond retail.
Compiled with care from public sources; errors and omissions excepted. Always check the linked source before acting. Regulatory Radar is general information, not legal or compliance advice.