outsource Financial Put Document Forensics on the Broker’s Desk. What Happens After a Flag Is Governed by Section 118(4)

What actually launched

In the week to 15 September, aggregator outsource Financial rolled out a document-analysis tool called Fraud Finder to brokers in its network. The Adviser reported the rollout date as 11 September. The premise is narrow and, for once, technically interesting: the tool inspects the electronic file itself rather than the page you see when you open it.

That distinction is the whole product. A PDF or a spreadsheet carries structure beneath the rendered page — revision data, prior content, references to other documents and files. None of it is visible when a payslip is printed or screenshotted, and none of it survives if a document is scanned. Steven Chamos, quoted by The Adviser in its report on the launch, put it this way:

The more important quote is the second one, because it defines the tool’s limits and, by extension, where the broker’s own judgement has to take over:

outsource Financial chief executive Tanya Sale framed the rollout in compliance terms rather than enforcement terms — “practical solutions that can support stronger compliance and verification processes without adding unnecessary complexity”, as she told The Adviser. The architecture is unusual too: on the aggregator’s account, documents stay on the broker’s own device and the platform never receives, stores or views them, which sidesteps the obvious question about who else ends up holding a client’s bank statements.

For now the tool is available to brokers inside the outsource Financial network. Australian Broker reported the same launch and described the tool consistently, though it dated the launch 14 September rather than 11 September and attributed a slightly different set of words to Sale. Where the two accounts differ we have gone with the detail each outlet published rather than blending them.

So much for the product. The reason this matters to every broker in the country — including the large majority who will never touch this particular tool — is what a flag does to a file.

The question brokers are asking about knowing too much

There is a version of this conversation happening in broker group chats that goes roughly: if I run a forensic check and it turns something up, I now have knowledge I did not previously have, and knowledge is exposure. Wasn’t I safer not looking?

It is an understandable instinct. It is also, on the face of the legislation, wrong — and the section that settles it is one most brokers have never read.

Section 117(1) of the National Consumer Credit Protection Act 2009 sets out what a licensee must do before making a preliminary assessment. Three limbs matter here: make reasonable inquiries about the consumer’s requirements and objectives; make reasonable inquiries about the consumer’s financial situation; and — separately — “take reasonable steps to verify the consumer’s financial situation”. Subsection 117(1) carries a civil penalty of 5,000 penalty units. The verification limb is not a restatement of the inquiry limb. It is an additional obligation, and it has been sitting in the Act since the start.

Then comes section 118(4), which is where the “safer not looking” argument falls over. When assessing whether a credit contract will be unsuitable, only information meeting both of two conditions may be taken into account. The first is that it concerns the consumer’s financial situation, requirements or objectives. The second, in the Act’s own words, is that at the time of the preliminary assessment:

Read limb (ii) again. The benchmark is not what you noticed. It is what reasonable verification would have told you had you done it. Deliberately seeing less does not lower the standard you are measured against; it just means you are measured against a standard you did not meet. The detection tool does not raise the bar. It makes it harder to argue you could not have cleared it.

What “doubt” triggers under RG 209

ASIC’s Regulatory Guide 209, Credit licensing: Responsible lending conduct, is unusually direct about why the verification limb exists at all. At RG 209.48 it acknowledges that information provided in an application may not always be reliable, and lists three reasons: overstatement or understatement by the consumer through mistake or misunderstanding; mistake or negligence by someone assisting the consumer; and deliberate fraud by the consumer or by a person assisting them. Note the ordering. Two of the three causes are not dishonesty.

RG 209.50 adds that it is “not sufficient merely to rely on other persons providing true information about their financial situation”, and that “if other circumstances or information raise doubt about the information provided, it is reasonable to take steps to verify the true situation”. The guide’s note on that paragraph quotes the Financial Services Royal Commission interim report: “Verification calls for more than taking the consumer at his or her word.”

From there the guidance gets specific. RG 209.115 states that a licensee “should not rely on information if you have reason to believe it is not true”, and may need to seek further information to determine the true position. RG 209.116 identifies circumstances raising doubts about reliability, including “obvious inconsistencies”. And RG 209.132 — the paragraph that should be printed and stuck above every processing desk — discusses payslips directly, citing the Federal Court’s decision in ASIC v ANZ. On ASIC’s summary of that case, the lender failed to take reasonable steps to verify income where it relied solely on a purported payslip, in circumstances where it knew payslips were a type of document that was easily falsified.

RG 209.133 then sets out what a reasonable response looks like once doubt exists. Where doubts are raised, ASIC says it would be reasonable to not have regard to that information until additional steps have been taken to confirm its accuracy, and to take additional steps to confirm it — for example by obtaining a separate source of information, such as a transaction statement containing income information, to confirm whether a payslip is true.

That is the operative test for a flagged document. Park the figure. Corroborate it independently. Do not proceed on it in the meantime. It is not complicated, and it does not require software — but it does require you to have noticed.

Where best interests duty bites

Section 158LA of the Credit Act is a single sentence: “The licensee must act in the best interests of the consumer in relation to the credit assistance.” Credit representatives are covered by the equivalent obligation in s 158LE(1), with the licensee required under s 158LE(2) to take reasonable steps to ensure they comply.

ASIC’s RG 273 translates that into conduct, and three paragraphs bear directly on doubtful documents. RG 273.40 says that if it is reasonably apparent that information about a consumer’s circumstances is incomplete or inaccurate, you should make further inquiries to obtain complete and accurate information. RG 273.41 goes further: if critical information is not obtained, you should refrain from making a recommendation.

RG 273.42 is the one to sit with:

The clause after the comma is doing real work. A broker who reasons that submitting a stronger income figure gets the client a better rate, and that a better rate is in the client’s interests, has the logic exactly backwards. Best interests duty does not net off against outcome. Passing on information you have reason to doubt is not a service to the client even when it produces an approval.

The AUSTRAC question, answered properly

A live source of confusion deserves clearing up, because it has been muddied by a year of AML/CTF reform coverage.

Mortgage brokers are not reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, and the Tranche 2 reforms that commenced on 1 July 2026 did not change that. The relevant designated service in the Act’s table is “making a loan, where the loan is made in the course of carrying on a loans business”, with the borrower as the customer. The entity that makes the loan is the lender. Arranging one is not a designated service, and the expanded professional-services items introduced by the reforms cover real estate transactions, entity formation and related work — not consumer or home loan broking.

The MFAA has made the same point in its member guidance on the changes, noting that the expansion to real estate agents, lawyers and accountants does not bring brokers into the AML/CTF regime, and that lenders often require brokers to carry out identification checks on their behalf. That last clause is the nuance worth holding onto: brokers routinely perform AML steps as agents of the lender, under the lender’s program, without themselves being accountable to AUSTRAC.

Separately, the FBAA has been seeking clarification from AUSTRAC on whether commercial asset finance broking is caught by the reforms — a different question, about a different activity, still open at the time of writing.

What ASIC has actually said this year

ASIC Commissioner Alan Kirkland addressed mortgage fraud at the MFAA conference in Melbourne on 22 July 2026. His remarks were brief and worth quoting accurately, because they are being paraphrased loosely:

In the same speech, on evidencing compliance, Kirkland said file notes are “not enough just to document” — that reasons “have to be personalised and meaningful”, and that “if the reasons for a recommendation are boilerplate factors that could apply to anyone, then it will be hard to demonstrate that the recommendation was in that customer’s best interests.”

One correction is warranted here. ASIC published an open letter to licensees and directors on 8 May 2026 (release 26-092MR) containing the widely circulated lines that a risk “is here now, evolving quickly and requires the attention of boards and executives”, and that licensees should “act now, and act with discipline”. Those quotes are genuine. But the letter is about frontier AI and cyber resilience: it does not mention payslips, bank statements, mortgages or credit applications. Some trade coverage has connected it to AI-generated loan documents. That framing belongs to the publications, not to ASIC, and brokers building a compliance case on it should know the difference. Where trade reporting and the underlying release diverge, the release governs.

Your five-step response protocol

What the file note needs to contain

RG 273.165 sets out what broker records should generally include. Applied to a doubtful document, the useful subset is: what you observed and when; what inquiry you made of the client and what they said; what independent source you obtained and what it showed; whether you relied on the original figure, a revised figure, or neither; and the reasoning for the recommendation you ultimately made. RG 273.167 confirms the acceptable forms — file notes, correspondence, working papers, fact-finds, comparison tool outputs, audio recordings.

One phrasing point. A file note should record what you observed and what you did about it. It should not record a conclusion you are not qualified to reach. “Payslip metadata showed a prior revision; obtained three months of transaction data; income credits consistent with stated salary; proceeded on verified figure” is a defensible note. “Client submitted a fraudulent payslip” is a finding, and unless it has been established, it is one you should not be making in writing.

What to review this week

None of this requires buying anything. Four things are worth an hour:

• Find your escalation path. Open your credit representative agreement or licensee compliance manual and locate the section on suspected document irregularities. If you cannot find it in ten minutes, email your compliance team and ask. Discovering the process mid-file is the worst time to learn it.
• Check whether you already have a second source. Most brokers using an open banking or transaction-data service already hold the corroborating information RG 209.133 describes. The question is whether anyone reconciles it against the payslip, or whether both simply travel to the lender.
• Audit your last ten file notes for the reasoning, not the facts. Kirkland’s boilerplate warning is the cheapest compliance improvement available. If your notes would read identically for any client, they are not doing the job RG 273 expects of them.
• Decide your language in advance. Agree with yourself, before it happens, how you will raise an anomaly with a client without accusing them of anything. The conversation goes better when it is a question about a document rather than a question about a person.

The strategic point

Broker-side verification technology is going to keep arriving, from aggregators, from lenders and from third parties, and the marketing will keep framing it as protection. It is protection — but the more consequential effect is quieter. Every tool that makes an anomaly easier to see shrinks the space in which “it was not reasonably apparent” is a credible answer.

That is not a reason to avoid the tools. Section 118(4)(b)(ii) already measures you against verification you should have done, which means the defensive value of not looking was always an illusion. It is a reason to fix the thing the tools cannot fix: a documented, rehearsed, licensee-endorsed process for what happens in the twenty minutes after something does not reconcile. The brokers who have that will treat a flag as a workflow step. The ones who do not will treat it as a crisis — and will make the decision that matters under pressure, on a deadline, with a client waiting.