The ePayments Code is a code of conduct issued by Australia's Securities and Investments Commission, first released in 2011 and periodically amended, which regulates consumer electronic payments. It sets standards covering how liability for unauthorized transactions is allocated between consumers and financial institutions, dispute resolution processes, and disclosure obligations for electronic payment facilities such as debit and credit cards, online banking and mobile payments.
Unlike a piece of legislation passed by parliament, the ePayments Code is a voluntary industry code, though in practice the great majority of Australian banks and other payment providers subscribe to it, making its protections broadly applicable across the retail banking sector.
The ePayments Code in plain terms
The ePayments Code exists to answer a very practical question: if money disappears from your account through an electronic payment you did not make, who is responsible for the loss — you or the bank? The Code sets out clear rules for exactly this scenario, generally protecting consumers who have not contributed to the loss through unreasonable carelessness, such as writing a PIN on the card itself.
Because subscription is voluntary rather than mandatory by law, consumers dealing with a provider that has not adopted the Code may have somewhat different protections, though most mainstream institutions do subscribe.
What the ePayments Code covers
Key areas include allocating liability for unauthorized transactions, requiring providers to investigate disputed transactions within set timeframes, mandating clear terms and conditions disclosure before a consumer opens an electronic payment facility, and setting rules for correcting mistaken internet payments sent to the wrong account.
Liability for unauthorized transactions
Under the Code, a consumer is generally not liable for losses from an unauthorized transaction unless they contributed to the loss, for example by acting with extreme carelessness in protecting a PIN or password, in which case liability may be shared or shifted toward the consumer depending on the specific circumstances.
The ePayments Code's mistaken internet payment rules
Beyond unauthorized transactions, the ePayments Code also sets out a process for correcting mistaken internet payments sent to the wrong account, requiring the receiving institution to investigate promptly when a sending institution reports a mistaken payment and, where the receiving account still holds sufficient funds, to return them to the rightful sender within a defined timeframe.
Periodic review and updates to the Code
ASIC periodically reviews and updates the ePayments Code to keep pace with evolving payment technology, having made significant revisions over the years to address issues such as mobile payments, biometric authentication and the growing role of digital wallets that did not exist when the Code was first introduced in 2011.
Complaints handling under the ePayments Code
Consumers who believe a subscribing institution has not complied with the ePayments Code can escalate their complaint to the Australian Financial Complaints Authority, which can investigate and make binding determinations against financial firms, giving the Code's voluntary commitments real practical teeth even though it is not itself an act of parliament.
Transition from voluntary subscription toward mandatory rules
Because subscription to the ePayments Code remains voluntary rather than legally mandatory, policymakers and consumer groups have periodically debated whether its core consumer protections should instead be enshrined directly in legislation, ensuring every provider offering electronic payment facilities in Australia is bound by the same minimum standards regardless of whether it has chosen to formally subscribe.
How the Code interacts with other Australian payments regulation
The ePayments Code sits alongside other Australian regulatory frameworks governing payments, including rules administered by the Reserve Bank of Australia for payment systems more broadly, meaning a single electronic payment transaction can be shaped by several overlapping sources of regulation rather than the ePayments Code operating entirely in isolation.