ASIC Consults on New Access Settings for Companies Register Information

Key Takeaways

• ASIC has released Consultation Paper 391 proposing a new framework for accessing company and officeholder information on the companies register, balancing transparency with privacy and security concerns.
• Compliance teams at firms that rely on register data for due diligence, KYC, or AML purposes should review the proposed access tiers, as changes to residential address and date-of-birth availability could materially affect verification processes from mid-2027 onward.

Deep Dive

CP 391 sets out ASIC's proposed model for restructuring access to the companies register, introducing four user categories—general, company, business, and government—each with differentiated access to person and company details. Notably, new information types such as director ID numbers, service addresses, and electronic addresses will be introduced, while some currently available personal information (full date of birth, full residential address) will be restricted or replaced with partial data (year of birth, residential locality) for most user groups. This represents a significant shift in the transparency-versus-privacy balance that compliance teams, particularly those in financial services conducting counterparty due diligence, should monitor closely.

For compliance and risk functions that currently rely on paid extracts to obtain officeholder residential addresses or dates of birth for identity verification, AML/KYC checks, or credit risk assessment, these changes could reduce the granularity of available data unless the firm qualifies for "business access" (e.g., as a legal practitioner or registered liquidator) or "government access." Firms should assess whether their current data access arrangements fall within the proposed restricted categories and whether alternative verification methods (e.g., director ID confirmation flags) can adequately substitute for residential address data in existing risk models.

Key timelines include: the consultation period runs from 11 September to 12 October 2026; a report on submissions with a draft legislative instrument is expected in March 2027; director ID, service address, and electronic address lodgements begin 1 July 2027; new registry services and access settings also start 1 July 2027; and full implementation of the new information requirements and access settings is expected by 1 August 2028. This phased rollout gives organizations approximately 18-22 months to adapt internal processes, update due diligence workflows, and potentially renegotiate data access arrangements with ASIC.

Compliance professionals should consider submitting feedback to ASIC by the 12 October 2026 deadline, particularly regarding impacts on fraud prevention, due diligence, and compliance cost. Firms should also begin assessing internal systems that ingest companies register data to identify where residential address or date-of-birth fields are used, and plan for contingencies such as relying on new display flags (e.g., director ID confirmation, overdue annual review status) as alternative risk indicators. Given the long transition window, this is a moderate-priority item for now, but one requiring proactive engagement to avoid future data-access disruptions.

Source: Australian Securities and Investments Commission