ASIC Consults on New Access Settings for Companies Register Information

Key Takeaways

• ASIC's CP 391 proposes a revised access model for the companies register, introducing tiered access across general, company, business, and government user categories while restricting sensitive personal details like residential addresses and full dates of birth.
• Compliance teams at financial institutions should assess how these changes affect due diligence, KYC, and fraud-prevention processes that rely on register data, and consider submitting feedback before the October 12, 2026 deadline.

Deep Dive

CP 391 represents a significant overhaul of how personal and company information on ASIC's companies register will be accessed, balancing transparency with privacy and security concerns. For compliance teams, this is directly relevant to KYC, customer due diligence, credit risk assessment, and fraud prevention functions that routinely rely on register searches to verify officeholders and company details. The proposed model introduces four access tiers—general, company, business, and government—with business access (including legal practitioners, journalists, and registered liquidators) requiring verification of professional need, which may change how institutions or their outsourced providers obtain registry data.

Key changes include the introduction of new data fields (director ID numbers, service addresses, electronic addresses) and new display flags (director ID confirmation status, overdue annual review status) that will help users assess company legitimacy and reduce impersonation risk. Simultaneously, ASIC proposes restricting access to more sensitive data—full dates of birth will be replaced by year of birth, and full residential addresses by state/country locality—for many access categories, with full residential addresses becoming available only if no service address has been lodged after August 2028. This could reduce the granularity of identity verification data currently available to compliance teams conducting enhanced due diligence.

The rollout timeline is staggered: the consultation runs until October 12, 2026, a report on submissions with a draft legislative instrument is expected in March 2027, officeholders begin lodging new director ID, service address, and electronic address information from July 1, 2027, and full implementation of the new access settings is targeted for August 1, 2028. This extended transition period gives institutions time to adjust internal processes, but also signals a period of parallel data standards that compliance teams must track carefully.

Recommended actions include reviewing current reliance on ASIC register data for verification and due diligence workflows, assessing whether reduced availability of full dates of birth and residential addresses will affect identity verification or AML/CTF obligations, and considering formal submission of feedback to ASIC by the deadline—particularly regarding business access eligibility criteria if the institution's compliance, legal, or investigative functions depend on register searches. Firms should also monitor whether they qualify as "business access" users (e.g., legal practitioners) or need to establish alternative verification processes for officeholder identity given the forthcoming restrictions on personal data.

The risk implications are moderate but concrete: reduced access to granular personal information could hinder fraud detection and identity verification processes, while new director ID and flag indicators may enhance confidence in detecting overdue companies or unconfirmed directors. Institutions should factor these changes into vendor and data-source reviews, particularly for any automated KYC/AML tools that ingest ASIC register data feeds.

Source: Australian Securities and Investments Commission