The Australian Financial Complaints Authority (AFCA) scam compensation cap is set to double under draft rules published on 1 September, with the direct-loss ceiling rising from A$631,500 to A$1.263 million (roughly A$909,000 in US dollar terms). The four-week consultation also proposes pulling banks, telecoms providers and digital platforms into a single complaint for the first time.
AFCA was formally authorised as the external dispute resolution scheme for Scams Prevention Framework (SPF) complaints from 1 July 2026, covering the first sectors brought into scope. The new Scam Rules would then apply to covered conduct from 31 March 2027, with other financial-services disputes continuing under the renamed Financial Firm Rules.
AFCA Scam Compensation Cap: How the Numbers Work
The proposed A$1.263 million ceiling would align AFCA’s maximum scam award with its existing monetary jurisdiction. A consumer cannot abandon part of a loss to bring a claim below the threshold, and the cap applies once per scam regardless of how many companies are involved.
Below that headline figure, several sub-limits apply. Indirect financial loss (losses that flow from the scam but are not the direct stolen amount) would be capped at A$6,300 per regulated entity, matching the figure already in AFCA’s current rules. Non-financial loss (distress, inconvenience) would double to A$12,600 per complaint. Legal, professional and travel costs remain capped at A$5,000. All figures are to be indexed on 1 January 2027, so the limits in force at the March start are expected to be marginally higher than the consultation amounts.
AFCA’s own data put the scale of the problem in context. Only 42 complaints in fiscal 2026 sought more than the current A$631,500 cap, yet non-financial compensation was paid in 14% to 20% of scam complaints across fiscal years 2024 to 2026, totalling between A$3.4 million and A$5.7 million a year. Those sums sit against A$2.18 billion in total reported Australian scam losses during 2025, up 7.8% from 2024, with investment scams alone accounting for A$837.7 million.
The authority also proposes doubling the cap on expert-advice contributions from A$5,000 to A$10,000 per complaint, unless special circumstances apply.
One Scam, Several Defendants: How Multi-Party Complaints Would Work
AFCA expects many SPF complaints to involve a platform carrying a scam advertisement, a telecoms provider carrying the call or message, and one or more banks processing the transfer. Currently, only 1.3% of AFCA complaints in fiscal 2026 involved a joined firm. Under the proposed rules, AFCA could add or remove a regulated entity at any stage of a complaint and apportion any award between them after applying the SPF Rules.
AFCA could also request documents from a company that is not formally a party if its records would help resolve the case. Where a party fails to supply relevant information without reasonable excuse, AFCA may draw an adverse inference against it.
The new rules are prospective. A scam that began before 31 March 2027, or before a company’s sector designation took effect, would not automatically fall under the Scam Rules. AFCA’s consultation illustrates this with a hypothetical: a fraudulent platform advertisement placed in January 2027 and a scam call in February would sit outside the new framework, but a bank transfer processed in April could fall within it.
HSBC Australia Penalty Signals What Is at Stake
The enforcement backdrop sharpens the picture. The snippet described ASIC as seeking an A$35 million penalty from HSBC Australia over alleged scam-control failures; in fact, the Federal Court of Australia ordered that penalty on 18 June 2026, with Justice Bennett finding HSBC’s failures to be systemic and widespread, according to ASIC’s media release and Reuters.
ASIC found HSBC took an average of 144 days to investigate customer scam reports. Between January 2020 and August 2024 the bank logged more than 1,000 reports of unauthorised transactions totalling A$34.6 million. The failures centred on HSBC’s internal transfer payment rail, where the majority of customer losses occurred, during the period 29 May 2023 to 29 May 2024.
Following the court order, HSBC established a remediation programme that has paid approximately A$21.5 million in compensation to affected customers to date, with further payments expected, and has also recovered and returned A$6.5 million, according to the ICLG report and ASIC’s release. ASIC Chair Sarah Court called it ‘one of the first of its kind globally’ and ‘the strongest scam wake-up call yet to the banking industry.’
For UK investors with holdings in HSBC or other global banks with Australian operations, the case illustrates that regulators are now willing to impose nine-figure remediation costs where scam controls are found wanting.
Timeline and What Happens Next
The consultation closes on 28 September. AFCA plans to evaluate submissions in November, seek board and ASIC approval by late December and publish final rules and operational guidance in early 2027. Consumers would still need to exhaust a company’s internal dispute process before approaching AFCA, and must file within six years of becoming aware of the loss or within two years of the company’s internal response, whichever is earlier.
The AFCA scam compensation cap and the multi-party complaint structure are both still proposals subject to AFCA’s final rules. If the framework survives consultation largely intact, March 2027 becomes the hard start date that banks, telecoms firms and digital platforms will need to have built their compliance infrastructure around.
