ASIC Seeks Feedback on Future Access to Companies Register Information in CP 391

Key Takeaways

• ASIC has released Consultation Paper 391 proposing tiered access settings for companies register data, expanding free access to core officeholder information while restricting sensitive personal details to verified users with a clear need.
• Compliance teams that rely on registry data for due diligence, KYC, and onboarding should assess the impact now and respond by 5:00 pm on 12 October 2026, because the proposed changes begin on 1 July 2027.
• ANALYSIC:

Deep Dive

ASIC has released Consultation Paper 391 proposing tiered access settings for companies register data, expanding free access to core officeholder information while restricting sensitive personal details to verified users with a clear need. Compliance teams that rely on registry data for due diligence, KYC, and onboarding should assess the impact now and respond by 5:00 pm on 12 October 2026, because the proposed changes begin on 1 July 2027.

The proposal would reshape how institutions obtain and use registry data. ASIC proposes four user categories (general, company, business, and government access). More information would be free, including officeholders' names and status (current or ceased), director ID numbers, and whether a director has confirmed their director ID. From 1 July 2027, officeholders' year of birth, residential locality, and service address would be available to all registry users. Full residential address and full birth information would be restricted to certain business users. Teams must determine whether their organization would qualify for "business access" and what verification would be required, as this directly affects customer due diligence, beneficial ownership and officeholder verification, and fraud screening.

Key timelines: the consultation closes at 5:00 pm on 12 October 2026, with submissions sent to consultation.registrydata@asic.gov.au. Submissions are not confidential unless confidentiality is specifically requested for all or part of the response. ASIC will hold information sessions, and it intends to announce its final position by early 2027. The initial changes take effect on 1 July 2027, with full implementation from 1 August 2028, following a transition period in which companies can update officeholder service addresses so residential addresses stay restricted. The framework rests on the Treasury Laws Amendment (Business Registries Stabilisation and Uplift) Act 2026, enacted in July 2026, which introduced director ID, service address, and electronic address data types and new powers to manage access. Since February 2026, residential addresses have already been removed from purchased company extracts as an interim measure.

Recommended actions: (1) inventory processes, vendors, and systems that consume ASIC registry data, especially those using residential addresses or full birth details; (2) assess whether current use cases would meet the "clear need" threshold for business access and identify any gaps in KYC, AML/CTF, and credit or counterparty due diligence; (3) prepare a submission, or engage through industry bodies, and register for an information session; (4) plan for alternative verification sources and update procedures, data retention, and privacy notices; and (5) if your organization is an officeholder or company, review and update service addresses during the transition period so residential addresses remain restricted.

Risk implications: reduced access to residential address and full date of birth data may weaken identity matching and increase false positives or manual review workload. Conversely, wider availability of year of birth, locality, and director ID could heighten impersonation and scam risks, and institutions that hold or reuse this data take on privacy and security obligations. Organizations that misuse restricted data or fail to meet verification requirements face regulatory and reputational exposure. Early engagement is the best opportunity to influence the final settings and limit operational disruption.

Source: Australian Securities and Investments Commission