ASIC Regulatory Guides — including RG 209 (responsible lending), RG 165 (hardship), RG 271 (complaints within 30 days) and RG 96 (debt collection) — set the enforceable standards credit providers must meet under the NCCP Act and Privacy Act 1988. When a credit provider falls short of these standards before or after listing a default, that failure can form grounds to dispute the listing. Australian Credit Solutions (ACL 532003) uses these guides to identify whether a default was recorded lawfully.
What Are ASIC Regulatory Guides?
ASIC Regulatory Guides (RGs) are official documents published by the Australian Securities and Investments Commission that set out how the regulator interprets and expects credit providers to comply with legislation such as the National Consumer Credit Protection Act 2009 (NCCP Act) and the Privacy Act 1988. While not laws themselves, they define what "proper conduct" looks like — and falling short can indicate a breach of the underlying legislation.
For consumers, these guides matter because they document exactly what a credit provider should have done before listing a default on your credit file. A lender who didn't verify your income, ignored a hardship request, or failed to respond to a complaint within 30 days didn't just provide poor service — they likely breached ASIC's standards in a way that can be used to challenge the listing under the Privacy (Credit Reporting) Code 2025 (in force from 25 March 2025).
Regulatory guides represent ASIC's interpretation of the law and set compliance standards under the NCCP Act, the Privacy Act 1988 (Cth) and the Privacy (Credit Reporting) Code 2025. While not legally binding in themselves, failure to follow the guidance can indicate a breach of the underlying legislation and may be raised in disputes with the credit reporting bodies (Equifax and Experian) or the external dispute resolution scheme.
Key Regulatory Guides for Credit Disputes
Four ASIC Regulatory Guides are most relevant to Australians with defaults on their credit file: RG 209 (responsible lending), RG 165 (hardship), RG 271 (complaints within 30 days) and RG 96 (debt collection standards). Each one sets minimum expectations for credit provider conduct — and a breach of any can form grounds for disputing a default listing under the Privacy Act 1988.
RG 209 is ASIC's comprehensive guide on responsible lending under the NCCP Act. It requires that before approving any loan, a credit provider must make reasonable inquiries about your financial situation, verify that information, and assess whether the loan is "not unsuitable" — meaning you could repay it without substantial hardship. If they didn't follow this process and the loan turned to default, the listing may be challengeable.
- Reasonable Inquiries: What questions lenders must ask about your income, expenses and existing debts
- Verification Steps: How lenders must verify the information you provide (payslips, bank statements)
- Assessment Process: How to determine whether you can repay without substantial hardship
- Documentation: What records lenders must keep of their responsible lending assessment
- Scalability: How the depth of inquiry must scale with loan complexity and risk
If a lender failed to follow RG 209 guidance — for example, approving a loan without verifying income, or without asking about your existing debts — and the loan resulted in a default, that failure can support a challenge to the listing under the Privacy Act 1988. A responsible lending breach means the loan may not have been assessed properly in the first place.
RG 165 covers how financial service providers must handle disputes, complaints and hardship requests. For credit, it includes detailed guidance on what credit providers must do when a borrower is experiencing financial difficulty — including timely responses, genuine consideration, and written reasons for any refusal. A credit provider who skips these steps before listing a default has likely breached both RG 165 and the underlying NCCP Act.
- Hardship Requests: How credit providers must genuinely assess and respond to hardship applications
- Response Timeframes: Set maximum times for acknowledging and deciding hardship requests
- Genuine Consideration: The requirement to properly assess requests — not simply refuse without reason
- Written Reasons: Obligation to explain any refusal in writing
- Escalation Rights: Obligation to tell consumers about their right to escalate to external dispute resolution
If a credit provider listed a default after ignoring or improperly refusing a hardship request — without genuine consideration, without written reasons, or without informing you of external dispute resolution — that breach of RG 165 can support a challenge to the listing. The default may have been avoidable had hardship been properly handled.
RG 271 sets detailed requirements for internal dispute resolution (IDR) processes. Complaints must be acknowledged within 1 business day, final written responses must be given within 30 calendar days, and consumers must be told about external dispute resolution if the matter remains unresolved. A credit provider who mishandles a complaint before or during a dispute is in breach of RG 271 — and that breach can be raised in an escalated dispute.
- Acknowledgment: Must acknowledge complaints within 1 business day (24 hours if urgent)
- Response Time: Maximum 30 calendar days to provide a final written IDR response
- Hardship Response: Hardship complaints must be decided within 21 calendar days
- Written Response: Must provide written reasons when a complaint is rejected
- EDR Referral: Must inform the consumer of their right to escalate to external dispute resolution
When disputing a default, RG 271 ensures credit providers must respond properly and within 30 days. If a provider took longer, failed to provide written reasons, or didn't tell you about external dispute resolution, those failures strengthen your dispute and can be raised with the external dispute resolution scheme or ASIC directly.
RG 96 is ASIC and ACCC's joint Debt Collection Guideline, which sets what collectors can and cannot do when pursuing debts. It covers contact limits, prohibition on harassment and coercion, recognition of hardship circumstances, privacy protections, and the requirement for accurate debt information. A collector who violates RG 96 before listing a default may have compromised the validity of the listing itself.
- Contact Limits: Restrictions on how often collectors can contact you about a debt
- Harassment Prevention: Prohibition on threatening, abusive or coercive conduct
- Hardship Recognition: Requirement to consider hardship circumstances before escalating action
- Privacy Protection: Rules on who collectors can contact about your debt
- Accurate Information: Obligation to provide correct and verified debt details before listing
If a debt collector used improper conduct before listing a default — for example, inaccurate debt amounts, coercive contact, or failure to recognise hardship — that conduct can indicate broader compliance failures and may support a challenge to the listing under the Privacy Act 1988 where the amount or process was incorrect.
Other Relevant ASIC Regulatory Guides
Several other ASIC Regulatory Guides affect how credit providers must operate in Australia under the NCCP Act. While less central to default disputes, they inform the broader compliance framework and establish the licensing obligations ACS holds under ACL 532003.
How Regulatory Guides Help with Credit File Disputes
ASIC Regulatory Guides help with credit repair because they establish the benchmark for acceptable conduct under the Privacy Act 1988 and the NCCP Act. When a credit provider falls short of these benchmarks, it can form grounds for challenging a default listing — provided the breach is connected to how the default was listed or how the debt was handled. Australian Credit Solutions (ACL 532003) uses these guides to identify where credit providers have fallen short of the standard ASIC expects.
1. Responsible Lending Failures (RG 209)
RG 209 provides detailed guidance on what a proper loan assessment looks like. If your lender failed to ask about your expenses or existing debts, didn't verify your income before approving the loan, or approved a loan you clearly couldn't repay, those failures can indicate a breach of responsible lending obligations under the NCCP Act — making any resulting default potentially challengeable under the Privacy Act 1988.
2. Hardship Request Failures (RG 165 and RG 271)
RG 165 and RG 271 set out what must happen when you notify a credit provider of financial hardship. A default may be challengeable if the credit provider ignored your request entirely, refused without genuine consideration or written reasons, failed to respond within 21 days, or listed a default while your hardship application was still being considered. If you're currently experiencing financial difficulty, the National Debt Helpline (1800 007 007) offers free financial counselling as a first step.
3. Complaint Handling Failures (RG 271)
RG 271 requires credit providers to handle complaints to a set standard — 1 business day to acknowledge, 30 calendar days to provide a final written response, and a referral to external dispute resolution if unresolved. If a provider breached any of these steps during a dispute about your credit file, those failures can be raised in an escalated complaint. Our default removal service reviews whether your dispute was handled lawfully under the Privacy Act 1988.
What Our Solicitor Looks For
- Evidence the lender didn't follow RG 209's responsible lending assessment requirements
- Hardship requests that weren't handled to the RG 165/271 standard or timeframe
- Complaint handling that breached RG 271's 30-day response rule
- Debt collection conduct that violated RG 96 guidelines
- Any pattern of non-compliance with ASIC's regulatory expectations under the NCCP Act
Key Timeframes Credit Providers Must Meet
ASIC Regulatory Guides set precise timeframes under the NCCP Act and RG 271 that credit providers must meet when handling complaints and hardship. A missed deadline isn't just poor service — it's a documented compliance failure. Keeping records of when you submitted a complaint or hardship request, and when (or whether) the provider responded, is exactly the kind of evidence that supports a dispute under the Privacy Act 1988.
| Action Required of Credit Provider | Timeframe | ASIC Guide |
|---|---|---|
| Acknowledge complaint | 1 business day (24 hours if urgent) | RG 271 |
| Respond to standard complaint | 30 calendar days | RG 271 |
| Respond to hardship request | 21 calendar days | RG 271 |
| Provide written IDR response with reasons | Required on every rejection | RG 271 |
| Inform about external dispute resolution | In the final IDR response | RG 271 |
| Issue s 21D pre-listing notice | Before listing any default | Privacy (Credit Reporting) Code 2025 |
When a credit provider misses one of these deadlines, they've breached ASIC's documented standards — not just provided slow service. Keeping records of when you submitted a complaint or hardship application, and whether the provider met these timeframes, gives you the evidence base for a formal dispute under the Privacy Act 1988.
ASIC's Enforcement of Regulatory Guides
ASIC actively monitors compliance with its Regulatory Guides and takes real action against credit providers that fall short. Enforcement consequences include financial penalties, compensation orders, licence conditions and public action notices. For consumers, this matters: ASIC's enforcement record shows these standards are tested, not aspirational.
Recent ASIC enforcement has focused on:
- Responsible lending failures (RG 209) — penalties for inadequate loan assessments under the NCCP Act
- Hardship handling failures (RG 165) — action against providers who don't genuinely consider hardship applications
- Complaint resolution breaches (RG 271) — enforcement for missed timeframes and missing written responses
- Debt collection conduct (RG 96) — action against aggressive or non-compliant collection practices
Australian Credit Solutions operates under Australian Credit Licence ACL 532003 and is itself subject to ASIC's regulatory framework. Our solicitor, Elisa Rothschild BA/LLB, references these guides when assessing whether a default was recorded in accordance with ASIC's expectations under the Privacy Act 1988.
How to Use Regulatory Guides in a Credit File Dispute
Using ASIC Regulatory Guides effectively in a dispute requires connecting the breach to the default listing — not just pointing to poor service. Here's the process our solicitor follows when reviewing a credit file under the Privacy Act 1988:
- Identify the relevant guide — which RG covers the conduct in question: RG 209 (responsible lending), RG 165 (hardship), RG 271 (complaints), or RG 96 (debt collection)?
- Document the failure — gather evidence showing how the credit provider fell short: no responses, refusals without reasons, missed timeframes
- Connect the failure to the listing — was the loan unsuitable? Was hardship ignored before listing? Was the complaint mishandled during a dispute?
- Lodge the dispute — submit to the credit reporting body (Equifax or Experian) under the Privacy Act 1988, or escalate to external dispute resolution if unresolved within 30 days
- Cite the specific guide — reference the relevant RG paragraphs to ground the dispute in ASIC's stated expectations, not just general dissatisfaction
If you think a credit provider failed to follow ASIC's regulatory standards before or after listing a default, a free assessment is the first step. Australian Credit Solutions (ACL 532003) reviews credit files under the Privacy Act 1988 and identifies whether a listing was recorded lawfully — no obligation, no cost to find out where you stand.
Australian Credit Solutions Pty Ltd holds Australian Credit Licence ACL 532003. Credit repair services are subject to individual assessment. Results may vary. This page provides general information only and does not constitute legal or financial advice.