The Spam Act requires consent, accurate sender details and a working unsubscribe facility for marketing emails and texts. The Do Not Call Register controls which numbers your brokerage can call for marketing. The Australian Communications and Media Authority (ACMA) enforces both schemes, including when another business sends or calls for you.
What the Spam Act Requires
The Spam Act 2003 (Cth) prohibits unsolicited commercial electronic messages with an Australian link, subject to limited statutory exceptions. A broker’s marketing message must meet three requirements.
- Have the recipient’s express consent or a valid basis for inferred consent.
- Identify the business that authorises the message and provide accurate contact details.
- Include a working way to unsubscribe.
The rules cover commercial email, SMS, MMS and instant messages. A message can be commercial even when promotion is only part of its content. Voice calls follow the Do Not Call Register rules and telemarketing standard instead.
ACMA can act against the person sending or causing messages to be sent. Outsourcing a campaign leaves your brokerage responsible for the messages it authorises. ACMA’s unsubscribe fact sheet explains that responsibility.
Express and Inferred Consent
Express consent means the person knowingly agrees to receive your marketing. Record who agreed and the marketing they accepted. Record when and how they gave permission. Retain the form wording or phone consent record alongside the contact.
Inferred consent depends on conduct and a relationship that reasonably supports the particular message. An ongoing loan-service relationship can support relevant marketing, but settling a loan alone does not establish permission for every later campaign.
A conspicuously published work address has narrower rules. Publication must reasonably have the person’s or organisation’s agreement, with no statement refusing unsolicited commercial messages. The message must relate to the recipient’s work role. A published accountant’s address is no general permission to promote their personal home loan. Schedule 2 of the Spam Act sets out these conditions.
An unsolicited email asking someone to consent to marketing is itself a marketing message. Buying a list does not automatically transfer the seller’s consent to your brokerage. Obtain evidence that the person’s permission actually covers your business and proposed messages. A seller’s assurance that a list is compliant does not prove that.
Sender Identification and Unsubscribe
A marketing email must accurately identify your brokerage and give contact details that remain correct for at least 30 days after sending. Identify the business that authorises the campaign even when the email comes through an aggregator’s platform.
Include clear unsubscribe instructions in every marketing message. An unsubscribe button or reply facility must work for at least 30 days after sending. Honour the request within five working days. ACMA’s spam guidance states these periods.
Provide a free email opt-out without account access. For SMS, an ordinary reply charge is permitted, but a premium service or a separate unsubscribe fee is prohibited. Recipients cannot be required to supply extra personal information or create an account.
Test the actual facility before sending. A text that says to reply STOP fails if the sender name cannot receive replies. Confirm that an opt-out reaches your newsletter tool, CRM campaigns and any platform sending marketing for the brokerage. Keep the suppression record when importing a new list so the import cannot restore a withdrawn permission.
Messages to Settled Clients and Your Trail Book
A purely factual service message has different treatment from an email promoting a loan or your brokerage. Classify the whole message, including promotional links and footer content.
| Broker Message | Treatment |
|---|---|
| A factual notice stating the client’s fixed-rate expiry and contractual next step | Can be a service message when it contains no promotion |
| A request for documents needed for the client’s existing application | Can be a service message when confined to that task |
| An invitation to refinance, seek repricing or discuss a new loan product | Treat as commercial marketing |
| A factual loan update with a promotional product banner added | Treat as commercial marketing |
Designated factual messages remain subject to sender identification requirements under Schedule 1 of the Act. Calling an email a service notice does not make promotional content exempt.
For a settled client, assess whether there is a provable ongoing relationship and whether the marketing directly relates to it. Receiving trail does not itself prove that the client expects your marketing. Keep consent as a separate client record.
When a client discharges or refinances elsewhere, stop relying on the former loan relationship for inferred consent. As a brokerage practice, obtain fresh express permission for ongoing marketing during a lawful interaction. Do not send an unsolicited re-permission email after the basis for consent has ended.
An aggregator platform, CRM newsletter service or referral partner needs the same controls when sending for you. Hold accessible consent evidence and require opt-outs to reach every sender. Once permission is established, choose suitable email marketing campaigns and check the credit advertising rules for their content.
Spam Regulations and Privacy Rules Beside the Act
The Spam Regulations 2021 remain in force and add detail to the Act’s unsubscribe requirements. They exclude faxes from commercial electronic messages under the Spam Act. Fax marketing has its own register and industry-standard rules.
The regulations prohibit premium unsubscribe services and charges paid to the sender or a related person, subject to the ordinary carrier-charge provision. They also prohibit requiring account access or personal information beyond the address that received the message. These are requirements in section 7 of the regulations, not optional email-platform settings.
Australian Privacy Principle 7 (APP 7) governs direct marketing by organisations covered by the Privacy Act. APP 7 does not apply to the extent that the Spam Act or Do Not Call Register Act applies. It can still apply to other marketing, including addressed postal campaigns or calls outside the register’s coverage.
Other privacy obligations continue where relevant. Permission to email does not settle how your brokerage collects, stores or discloses client information. The Office of the Australian Information Commissioner’s direct marketing guidance explains the overlap and which organisations APP 7 covers.
How the Do Not Call Register Works
The Do Not Call Register is Australia’s national register of numbers whose account-holders have opted out of unsolicited telemarketing. ACMA manages it under the Do Not Call Register Act 2006.
To make a marketing call to a registered number, your brokerage needs valid consent or an applicable exemption. Exemptions for certain charity, government and other public-interest calls do not give a mortgage brokerage a general exemption.
Call consent has its own duration rule. If express consent specifies neither a period nor indefinite permission, it expires after three months. When someone tells your brokerage to stop calling, consent ends immediately. Keep this separate from email consent and the email unsubscribe processing period. The register’s industry guidance explains these rules.
Washing Call Lists Before You Dial
Washing means checking your intended call list against the Do Not Call Register and using the returned result to exclude registered numbers. Treat bought leads and referral-partner numbers as unwashed until your brokerage has checked them.
- Create an industry administration account through the register’s subscription page.
- Select a subscription for the number of checks you need. Type A provides up to 500 number checks annually without a fee. Paid subscriptions cover larger volumes.
- Submit your numbers through the washing service and download the result.
- Remove registered numbers unless you hold valid consent covering the call. Then apply your own do-not-contact list, including requests made directly to the brokerage.
- Retain the submitted list, result and wash time with the campaign record. Confirm the final dialler list excludes suppressed numbers before calls begin.
The register’s protection for a number returned as unregistered depends on a wash within the 30 days before the call. Wash again before each later campaign as an operating practice. Rewash during a campaign if its calls extend beyond that period.
A clean result does not override a person’s direct request to stop your marketing. Compare lead sources on consent evidence as well as cost. Use broker call scripts only after the list is cleared for calling.
Calling Hours and the Telemarketing Standard
The Telecommunications (Telemarketing and Research Calls) Industry Standard 2017 sets the default calling windows in the recipient’s local time. It applies even when a number is absent from the register.
| Day | Permitted Telemarketing Hours |
|---|---|
| Monday to Friday | 9 am to 8 pm |
| Saturday | 9 am to 5 pm |
| Sunday | No telemarketing calls |
| National public holidays | No telemarketing calls |
Express permission is needed to call outside the standard windows. A general marketing opt-in does not by itself establish that permission. State or territory laws can impose further restrictions. ACMA lists the standard, while its telemarketing guidance explains the calling windows.
At the start of each marketing call, give your name, your employer’s name and the brokerage’s name if you call for another business. State the purpose. Enable calling line identification with a return number and end the call when the recipient asks or indicates they want it to stop.
The return number must remain available for at least 30 days. Your caller must also provide the required contact and complaints details on request. The register’s industry standards guidance explains these obligations.
ACMA Enforcement and a Pre-Send Check
ACMA can issue formal warnings and infringement notices, accept enforceable undertakings and seek court penalties. Financial-services campaigns have attracted penalties for failures in ordinary messaging systems.
In 2026, Latitude Finance paid a $3.96 million penalty. ACMA found more than 2.3 million marketing messages lacked accurate contact information. Of those, 344,416 also lacked a working unsubscribe function. Some recipients were told to reply STOP when the messages could not receive that reply.
In 2024, Commonwealth Bank paid a $7.5 million penalty. It sent more than 170 million marketing emails without an unsubscribe option. ACMA found that messages classified as service communications promoted products, services or the bank itself.
Complete these checks before releasing a campaign.
- Locate evidence of permission covering each recipient, channel and brokerage.
- Classify the message after reviewing all content for product or service promotion.
- Confirm the message identifies the authorising brokerage with accurate contact details.
- Test the unsubscribe facility and confirm every sending system honours requests within five working days.
- Check that the call list has a wash result within 30 days and excludes direct opt-outs.
- Schedule each call inside the recipient’s permitted local calling window.
Test one unsubscribe through every connected sending system before releasing the full list. If the contact returns as eligible for marketing after an import or sync, fix the suppression process before the campaign starts.
