ACMA’s priorities: Where telcos should focus compliance effort.

The Australian Communications and Media Authority (ACMA) has identified five annual priorities: branded SMS scams, Triple Zero and outage communications, mobile phone equipment compliance, protections for customers experiencing domestic and family violence, and gambling advertising reforms. Financial hardship, scams and spam, and broader consumer protections remain important ongoing concerns.

The direction is clear: having compliance policies is not enough. Businesses need to demonstrate their controls are working in practice and that failures are identified and addressed promptly.

With the SMS Sender ID Register now in operation, and unregistered sender IDs in use are labelled “Unverified”, consumers are better equipped to identify potentially fraudulent messages. ACMA is prioritising compliance with the new register alongside its broader work on scams, spam, mobile number fraud, and telcos meeting their Know Your Customer (“KYC”) obligations with heightened focus on pre-porting ID verification.

What to do:

Review sender ID registration (may require updating ABN details), messaging controls and customer onboarding processes. Messaging providers, aggregators and carriers should clarify responsibilities across the delivery chain. Businesses using branded SMS should verify their sender IDs and review their suppliers’ controls.

All businesses sending marketing messages should also check consent records, sender identification and unsubscribe processes under the Spam Act 2003 (Cth). Outsourcing messaging does not remove the need to manage compliance risks.

Public safety remains a key priority, against a backdrop of high profile Triple Zero issues in recent years and introduction of the Triple Zero Custodian. ACMA has previously imposed strict penalties on providers for breaching their Triple Zero obligations, and continues to prosecute leading carriers over compliance failures.

ACMA is focusing on emergency call requirements and compliance with the Telecommunications (Customer Communications for Outages) Industry Standard 2024, including the accuracy and timeliness of outage information provided to customers.

What to do:

Providers should test emergency call procedures, escalation pathways, incident management and coordination with other network participants. Outage processes should support accurate, accessible and timely updates to affected customers, with mandatory outage registers introduced this year.

A simulated significant outage is a useful test: can the business demonstrate that it identified the impact, communicated promptly, maintained updates and documented its decisions? Policies should be supported by tested systems and reliable records.

The Telecommunications (Domestic, Family and Sexual Violence Consumer Protections) Industry Standard 2025 is an explicit enforcement priority, requiring extensive work to achieve full implementation. Financial hardship, debt management, complaints handling and responsible selling also remain under ACMA scrutiny.

What to do:

Review how the business handles disclosures of domestic and family violence, account access, safe communications, debt disputes and service continuity. Train frontline staff and ensure systems support safe account changes, appropriate escalation and record-keeping to demonstrate compliance.

For financial hardship, test whether customers are identified early, offered appropriate assistance and protected from inappropriate debt recovery or disconnection. Review actual customer cases, not just policies and training records. Systemic failures can create significant regulatory and reputational exposure.

For complaints handling, review timeframes and record-keeping practices, so teams are collecting and reviewing the necessary data. Complaints reporting and some other reporting obligations only apply to providers once they meet a minimum threshold for the number of active services. Review reporting thresholds and plan for deadlines and capacity impacts.

ACMA has signalled its intention to replace the Telecommunications Consumer Protections (“TCP”) Code with a directly enforceable industry standard. The existing Code continues to be a guide for industry on their consumer obligations, until the new requirements commence. Annual TCP Code compliance reporting has been suspended.

The proposed standard would require telecommunications providers to report mis-selling on a quarterly basis, set out how sales bonuses are to be calculated, and provide additional customer rights where mobile coverage fails or provider changes affect customer devices.

In October 2026, the Government also announced the passage of legislation strengthening ACMA’s enforcement powers, increasing penalties and establishing a carriage service provider registration scheme.

Telecommunications providers are also likely to be caught by proposed content obligations under the proposed Digital Duty of Care, which is currently at the Bill stage in the Australian Parliament, and will be enforced by the eSafety Commissioner.

What to do:

Focus efforts on existing obligations while monitoring commencement dates, transitional provisions and new ACMA guidance. Assess the likely impact of a new standard on contracts, sales incentives in staff remuneration, customer processes, compliance reporting and governance. Review claims about pricing, coverage and service performance to ensure they are accurate and supported by evidence, and maintain record-keeping to meet ongoing reporting obligations.

ACMA is targeting mobile phone equipment that fails Australian regulatory requirements, including relevant labelling, conformity and testing requirements. Manufacturers, importers, distributors and retailers should not assume that devices suitable for overseas markets automatically comply in Australia.

Gambling advertising reforms are also an annual priority, although the precise obligations will depend on the legislation enacted and its commencement.

What to do:

Equipment suppliers should verify conformity documentation, testing and labelling before products enter the Australian market. Businesses potentially affected by gambling advertising restrictions should map their advertising arrangements, allocate responsibility for compliance and monitor the final rules rather than treating proposals as settled law.

Telecommunications businesses should take a risk-based approach, prioritising obligations that present the greatest consumer, safety and enforcement risks.

• By December 2026: Assess gaps across scam prevention, Sender ID, emergency calling, outage communications and current and proposed consumer safeguards.
• By March 2027: Remediate material gaps, test controls and review third-party arrangements and staff training.
• By June 2027: Complete a documented compliance review, check regulatory changes and escalate unresolved risks to the senior leadership team.

The priorities will differ between network operators, retail service providers, messaging intermediaries and equipment suppliers. Each business should assess its obligations against its role in the telecommunications supply chain and ACMA’s enforcement priorities.

ACMA’s 2026–27 priorities reinforce a shift towards demonstrable, operational compliance, with a focus on public safety and consumer safeguards. Strong internal compliance policy matters, but effective systems, staff training, reliable records and timely remediation matter more.

Businesses that identify weaknesses now will be better placed to reduce enforcement risk, protect customers and respond to regulatory changes on the horizon.