The MFAA’s Referrer Guidance Creates No New Legal Obligations. Reg 9AB Already Requires a Referrer Register, a 10-Business-Day Window and a Scripted Consent Question

1. What the MFAA actually released

The document is the Referrer Risk Management Guidance. Mortgage Professional Australia gives its subtitle as Standards for Management of Lending Referral Relationships; the MFAA’s own event listing also describes the resource as a “Referrer Risk Management Framework”, so brokers searching the member resources section may find it under either name.

It covers referrer due diligence, customer transparency, red flags, escalation, record keeping and a template referrer register, and it applies across broker, aggregator and lender or direct channels rather than landing only on the third-party channel. It launches at a free member webinar on Thursday 5 November, 2:00pm to 3:00pm AEDT, carrying one CPD point and titled “Referrers, introducers and fraud: Managing risk in a changing landscape”. The host is Naveen Ahluwalia, Executive, Policy and Legal at the MFAA, joined by Scott Stierli, General Counsel, Financial Services at REA Group; Daniel Oh, Group Legal Counsel at Connective; and Shirley Elliot, Head of Compliance and Legal Counsel at AFG.

The framing is deliberately not an attack on referrals. “Legitimate referral arrangements are an important part of the lending value chain,” Ahluwalia said, as reported by Mortgage Professional Australia. The risk the MFAA names is narrower than the practice: “Referral relationships are one potential entry point for fraud,” she told Australian Broker, with the guidance addressing impersonation, payment redirection, compromised communications, and false information or documentation entering the lending process.

MFAA chief executive Anja Pannek put the concern on scale rather than on the existence of referrers — “large-scale referrer programs, particularly where there is inadequate due diligence, monitoring or oversight,” in the words Mortgage Professional Australia attributes to her. She also set the test for how the industry should respond: “Our response has to follow the conduct and the evidence, rather than begin with assumptions about where the risk sits.”

And the MFAA has given itself room. Mortgage Professional Australia reports the association will allow roughly six to 12 months for implementation before it considers whether any part of the guidance needs strengthening.

2. The part that is not new: two clocks and a register

Here is the thing that makes a “no new obligations” standard worth your attention rather than your filing cabinet. A referrer who is not licensed relies on an exemption, and that exemption is conditional. ASIC’s own guidance for credit licensees describes it plainly: “This is a narrow exemption from licensing requirements for doing referrals.” On ASIC’s account, the referrer may inform the consumer that a particular credit licensee or credit representative “is able to provide particular credit activities”, tell the consumer how to make contact, and must disclose “any benefit or commission you may receive”.

The regulation behind that is more exacting than the summary. Under the referrer exemption in the National Consumer Credit Protection Regulations 2010, the arrangement has to rest on a written agreement — or an accepted written offer — with the licensee or registered person, and that agreement has to specify the conduct the referrer is permitted to engage in. The referrer tells the consumer the licensee can provide a credit activity, then passes on the consumer’s name and contact details, and the purpose of the credit if it is known, “within 5 business days after informing the consumer”. Benefits, including indirect remuneration, that the referrer or an associate may receive must be disclosed at the time of the activity. No fee may be charged to the consumer for passing on the name. The consumer must have consented to their name being passed on. The referrer must not be banned under state or territory law or under Part 2-4 of the Act.

It goes further than a register and a deadline. Where contact is made in person, reg 9AB sets out words to be used — including asking the consumer “Can you confirm that you agreed with [name of referrer] to have us contact you?” — and requires the licensee to say if “a payment of indirect remuneration or a financial benefit may be given to the referrer”. Where the contact is by letter or email, the opening has to state that the consumer’s details came from the referrer and that the referrer “may receive a financial benefit or payment”.

Read those two regulations side by side and the MFAA’s template referrer register stops looking like a new administrative burden and starts looking like a tool for a condition that has applied since the regime began. The guidance is not the obligation. The guidance is a way of evidencing it.

One caveat that matters for how you act on this: these conditions sit on the licensee. If you operate as a credit representative under your aggregator’s licence, the register, the contact window and the scripted disclosures are your licensee’s conditions, discharged through the process you are asked to follow. That is exactly why the right first call is to your licensee or compliance team rather than to your own filing system.

3. Why “large-scale referrer programs” sit awkwardly with the exemption

Pannek’s phrase — large-scale referrer programs with inadequate due diligence, monitoring or oversight — lands on a condition in the exemption that gets much less airtime than the disclosure requirements, and is harder to engineer around.

The exemption requires the referral to be incidental to a business that is not mainly about passing on people’s contact details. There is also a condition excluding a referrer who carries on a business of contacting people face-to-face from non-standard business premises.

That is a structural test, not a paperwork test. An accountant who mentions a broker to a client in the course of doing the client’s tax is comfortably inside it. A business whose principal activity is generating and distributing consumer contact details is a different proposition on the face of the condition, no matter how clean its consent wording is. Brokers assessing an unfamiliar referral source are often asking whether the disclosures were made. The prior question the regulation asks is what the referrer’s business actually is.

This is general information rather than a view on any particular arrangement, and whether a specific program fits the exemption is a question for your licensee and, where needed, independent legal advice. But it tells you where to aim your due diligence: at the referrer’s business model, ownership and client-sourcing method, which is precisely what the MFAA guidance asks brokers to understand. “It’s absolutely about knowing who you’re dealing with,” Christa Malkin, general manager, aggregation at AFG, told Mortgage Professional Australia.

4. The red flags read as evidence, not as a new rule

The red flags reported from the guidance are worth reading as a scale rather than a checklist, and the MFAA explicitly cautions that a single warning sign does not prove shadow broking. Ahluwalia’s formulation, as reported by Australian Broker, is the operative one: “A warning sign should prompt further enquiry.”

At the ordinary end, a referrer may suggest a broker could help, pass on contact details with consent, forward documents that were asked for, and check that the customer was contacted. The warning signs are a step past that: the referrer stays closely involved after the introduction; application documents come mainly from the referrer rather than the customer; the referrer offers views on lender or product choice; the customer seems rehearsed and cannot explain their own application. The heightened-risk signs are a step past that again: the referrer controls customer contact and the broker has little or no direct engagement; the referrer prepares application material that the broker simply submits; the referrer directs lender choice and coaches the customer on what to say.

Australian Broker adds several that go to the referrer’s own conduct — a referrer who will not disclose identity or ownership, resists providing documents, requests unusual payments, or resists reasonable due diligence — along with the case where it is unclear whether the client understands who referred them, whether a financial benefit is involved, or who is actually providing the credit assistance.

Notice what that last one is. It is not a fraud indicator in the first instance. It is the disclosure condition in the exemption, failing in the field. And the point where a referrer is directing lender choice and coaching the customer is the point where the conduct has moved well past informing a consumer that a licensee can help — which is the only conduct the exemption describes.

The same facts that trigger the MFAA’s heightened-risk tier also go to whether the arrangement was ever within the exemption, and to whether the recommendation on your file is yours. Best interests duty does not transfer to a referrer. If the lender selection on a file was effectively made by someone else, the duty and the file note are still yours.

5. Broker-to-broker is the under-discussed case

The guidance covers broker-to-broker referrals, and this is the part most likely to change behaviour in a boutique brokerage next week. Mortgage Professional Australia reports two expectations: a receiving broker should not rely on the referring broker’s enquiries or documents, and any referral fee or commission split should be disclosed to the customer.

Ahluwalia’s framing, as reported by Australian Broker, is that verifying supporting information independently matters especially when the referral comes from another broker. That cuts against a common and understandable instinct. A referral from a licensed peer feels like a lower-risk referral, and the documents arrive looking like a professional’s work. The expectation here is the opposite of that instinct: a licensed referrer’s file is not a substitute for your own enquiries, and the familiarity is the reason the gap goes unnoticed.

If your brokerage takes overflow or specialist referrals from other brokers — commercial, SMSF, construction, expat — this is the arrangement to document first, because it is the one most likely to be running on trust and a phone call.

6. What ASIC said, and when it starts

The timing of the MFAA’s release is not incidental. In its 2026–27 banking sector supervisory letter, published 30 September 2026, ASIC said: “We will commence a review into various aspects of lender conduct.” Under the heading “Lending practices and broker oversight”, the letter identifies the likely focus as including “the use of referrers by lenders, and lender oversight of brokers”. The review is expected to commence in the third quarter of 2026–27, and sits under ASIC’s strategic priority to “Improve consumer and small business outcomes”.

The letter also states the context: “This review follows ASIC’s work with APRA and AUSTRAC in relation to reported instances of mortgage loan fraud.”

Pannek’s line from September, reported by Australian Broker, reads as a forecast of exactly that: “Fraud does not respect organisational or distribution boundaries.”

7. What to review this week

Five things, in order of how quickly they would embarrass you if a lender asked.

1. Ask your licensee for the referrer register. Not whether one exists — ask to see the entries for your arrangements. Reg 9AB(2) frames this as a register the licensee must keep or have access to, so “access” may mean it lives with your aggregator. Find out where.
2. List every live referral source, including the informal ones. The accountant who sends two files a year, the buyer’s agent, the builder, the other broker. If it is not on a list, it is not being monitored.
3. For each one, write down what the referrer’s business actually is — ownership, main activity, how they source clients, relevant professional registrations. That is the MFAA’s due diligence ask, and it is also where the “incidental to a business” condition is tested.
4. Check the written agreement exists and still describes the conduct. The exemption contemplates an agreement specifying the permitted conduct. An agreement signed in 2019 for a referrer who now sends pre-packaged applications no longer describes the arrangement.
5. Check what the client was told, and when. Did they consent to their details being passed on? Were they told a benefit may flow to the referrer? Can you show it? On a broker-to-broker file, was the fee or split disclosed?

Frequently asked