Clause 23
New sections 24A, 24B and 24C
of Scams (Countermeasures) and Other Matters Bill
In the Online Criminal Harms Act, after section 24, insert —“Regulatory action for non-compliance with implementation directive24A.—
If the competent authority is of the opinion that a designated provider has not implemented any system, process or measure in compliance with an implementation directive given to the designated provider within the permitted time, the competent authority may —
give the designated provider an order (called in this Act a compliance order) to comply with the implementation directive; or
subject to section 24B, order the designated provider to pay, within the time specified in the order, a financial penalty of any amount not exceeding $10 million that the competent authority thinks fit.
A compliance order under subsection (1)(a) must set out —
details of the non‑compliance with the implementation directive; and
the time within which the implementation directive must be complied with.
This section applies to any non-compliance by a designated provider with an implementation directive that occurs entirely on or after the date of commencement of section 23 of the Scams (Countermeasures) and Other Matters Act 2026, whether the implementation directive was given to the designated provider before, on or after that date.Procedure for ordering designated provider to pay financial penalty under section 23(1)(b) or 24A(1)(b)24B.—
The competent authority must, before ordering a designated provider to pay a financial penalty under section 23(1)(b) or 24A(1)(b), give a written notice to the designated provider —
stating that the competent authority intends to order the designated provider to pay a financial penalty under section 23(1)(b) or 24A(1)(b), as the case may be;
specifying the details of the designated provider’s non‑compliance that is the subject of the order; and
specifying the time within which written representations may be made to the competent authority as to why the designated provider should not be ordered to pay the financial penalty.
The time mentioned in subsection (1)(c) must not be earlier than 7 days from the date of service of the written notice under subsection (1) on the designated provider.
The competent authority may, after considering any written representation made by the designated provider under subsection (1)(c), decide to order or not to order the designated provider to pay a financial penalty under section 23(1)(b) or 24A(1)(b), as the case may be.
When the competent authority has made a decision under subsection (3) against a designated provider, the competent authority must serve on the designated provider a written notice of the decision.
A decision that is specified in a written notice given under subsection (4) takes effect from the date on which that notice is given, or on any other date that may be specified in the notice or decided by the Minister in an appeal.Recovery of financial penalties24C.—
If a person fails to pay any financial penalty imposed on the person under this Act by the date on which the financial penalty is due, the person is liable to pay the competent authority interest on the amount unpaid at the prescribed rate or, if no rate is prescribed, at the same rate as for a judgment debt.
Any financial penalty and any interest on any financial penalty payable by a person under this Act is recoverable by the competent authority as a debt due to the competent authority from that person.
The competent authority may, in any case in which the competent authority thinks fit, waive, remit or refund in whole or in part any financial penalty or any interest on any financial penalty payable under this Act.
Any financial penalty and any interest on any financial penalty collected by the competent authority under this Act must be paid into the Consolidated Fund.”.