Financial Hardship Obligations: NCCP Act and Banking Code Compliance Guide

Financial hardship is one of the most consequential and operationally demanding consumer compliance obligations for Australian credit licensees. The cost-of-living pressures that intensified through 2023–2025 — elevated mortgage rates, energy price increases, and retail sector weakness — drove a surge in hardship applications across banks, non-bank lenders, buy-now-pay-later providers, and credit card issuers. ASIC, AFCA, and the Australian Banking Association have all intensified their focus on how institutions handle these applications.

Getting hardship right is not just a compliance exercise. The Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry identified hardship handling failures as among the most egregious consumer harms it observed. Systematic failures — including denying or ignoring hardship applications, failing to offer appropriate assistance, and continuing debt collection against customers who had applied for hardship — led to enforcement action, enforceable undertakings, and compensation payments.

This guide covers the full hardship compliance framework: the statutory minimum under s72 of the National Consumer Credit Protection Act 2009 (NCCP Act), the enhanced obligations under the ABA Banking Code of Practice, the ASIC regulatory guidance in RG 271, and the emerging vulnerability framework that ASIC has signalled is its next enforcement priority.

The Statutory Foundation: NCCP Act Section 72

Section 72 of the National Consumer Credit Protection Act 2009 is the primary federal law governing hardship variations for consumer credit. It applies to all credit contracts regulated under the National Credit Code (Schedule 1 to the NCCP Act) — which covers residential mortgages, personal loans, credit cards, and other consumer credit extended to natural persons for personal, domestic, or household purposes.

Who Can Apply and the Grounds for Hardship

Under s72(1), a debtor under a regulated credit contract may apply to the credit provider for a change in the terms of the contract on the ground that the debtor is unable to meet their obligations. The section specifies three grounds that justify a hardship application:

• Illness
• Unemployment
• Any other reasonable cause

The "any other reasonable cause" ground has been interpreted broadly by AFCA and the courts. It encompasses relationship breakdown and separation, natural disaster, death of a co-borrower or income-earner in the household, unexpected caring obligations, reduction in income (including gig economy income volatility), and the direct financial effects of family violence. Lenders cannot refuse to accept a hardship application on the basis that the cause does not fall within one of the specified grounds if the debtor has a genuine inability to meet their obligations.

The 21-Day Response Obligation

Section 72(3) sets the critical procedural requirement: a credit provider must respond to a hardship application within 21 days of receipt. The response must be either:

• A written notice agreeing to a change in the contract (specifying the terms of the change), or
• A written notice stating that the credit provider does not agree to a change, and setting out the credit provider's reasons

The 21-day clock starts when the credit provider receives the application — not when it is assessed or when additional information is provided by the debtor. Hardship applications received through any channel (branch, phone, written letter, email, digital portal) start the 21-day clock. Failure to respond within 21 days is a breach of the NCCP Act and can be the basis for an AFCA complaint or ASIC enforcement action.

ASIC's REP 422 and subsequent hardship reviews have identified that many lenders treat the 21-day obligation as a documentation requirement rather than a service delivery standard — producing responses within 21 days on paper while giving customers the impression their application is still under assessment, or making response outcomes conditional on the receipt of documents that the lender has not promptly requested. ASIC has made clear this approach does not satisfy the legislative obligation.

The Changes Available Under Section 72

Section 72(1) specifies the range of contract changes a credit provider may offer in response to a hardship application. These are:

• An extension of the term of the contract
• A postponement of the date on which a repayment is due
• A reduction in the amount of each repayment for a specified period

The section does not require a credit provider to offer interest-free periods, debt waivers, or fee refunds — though these can be offered at the credit provider's discretion and are sometimes required under the Banking Code. The changes available under s72 are structural changes to the repayment schedule, not forgiveness of the underlying debt.

Where a credit provider refuses to agree to a change, s73 gives the debtor a right to apply to AFCA (formerly the Financial Ombudsman Service) for a determination of whether a change should be made. AFCA's jurisdiction to vary credit contracts under hardship is a significant consumer protection mechanism that operates independently of the statutory minimum.

Banking Code of Practice: Part 5 — Financial Hardship

The ABA Banking Code of Practice 2024 (the Banking Code) applies to all ABA member banks and their consumer and small business customers. Part 5 of the Banking Code significantly expands the hardship obligations beyond the NCCP Act minimum for two reasons: it applies to products outside the NCCP Act (such as business loans below the NCCP Act threshold and transaction accounts in overdraft), and it imposes higher service standards than the statutory baseline.

The Banking Code Hardship Principles

The Banking Code's approach to hardship is principles-based, supplemented by specific procedural requirements. The core principles are:

• Early identification — banks must proactively identify customers who may be in financial difficulty, including through internal data signals such as missed repayments, reduced account balances, and account conduct changes, not only when customers self-identify by lodging a formal hardship application
• Proactive outreach — where internal signals suggest a customer may be in difficulty, the bank should contact the customer to discuss whether assistance is needed, without waiting for the customer to initiate contact
• Dignified treatment — customers experiencing financial hardship are to be treated with respect and sensitivity, with communications designed to reduce the stigma of seeking help
• Genuine assessment — banks must genuinely assess whether assistance is appropriate and what form of assistance would be most suitable for the customer's circumstances, rather than applying a formulaic standard product
• Debt collection paused during assessment — while a hardship application is under assessment and during an agreed hardship arrangement, the bank should not take adverse debt collection action against the customer

Banking Code Timeframes

The Banking Code 2024 sets specific timeframes that are more demanding than the NCCP Act s72 minimum:

• Banks must acknowledge receipt of a hardship application promptly — within 3 business days in most cases
• Banks must respond with a decision within 21 days (consistent with the NCCP Act minimum) for standard hardship requests
• For natural disasters and comparable events affecting large numbers of customers simultaneously, accelerated processes apply under the Banking Code's natural disaster clause
• Where additional information is required from the customer, the bank must specify within the initial acknowledgement what information is needed and set a reasonable timeframe for its provision

Small Business Hardship

The Banking Code extends hardship obligations to small business customers as defined in the Code (businesses with less than $10 million annual turnover and less than $5 million total credit exposure to the bank). Small business hardship has distinct requirements: the assessment of ability to repay must account for business cash flow projections, seasonal income variations, and the prospects for business recovery rather than individual income assessment models. AFCA's small business financial difficulty jurisdiction is an important external review mechanism for small business hardship decisions.

ASIC's Approach: RG 271 and IDR Obligations

ASIC Regulatory Guide 271 (Internal Dispute Resolution, updated 2020 and 2023) governs how financial institutions must handle consumer complaints, including hardship-related complaints. RG 271 does not create the hardship obligation itself — that arises from the NCCP Act and the Banking Code — but it governs how hardship-related complaints must be processed once a customer raises a dispute about the way their hardship application has been handled.

IDR Timeframes for Hardship Complaints

Under RG 271, financial institutions must resolve IDR complaints about credit products within 30 calendar days of receiving the complaint. This is a shorter maximum than the previous 45-day standard. ASIC can impose enforceable obligations to reduce this timeframe further where institutions have persistent IDR quality issues.

Critically, a hardship application that is not acknowledged within 3 business days, or not responded to within 21 days, or where the customer disputes the decision reached, can become an IDR complaint that triggers the RG 271 framework. Credit licensees must ensure their hardship and IDR processes are clearly defined and connected — the handoff from hardship team to complaints team must be documented and efficient.

ASIC's Hardship Enforcement History

ASIC's enforcement history on hardship is instructive. Key actions include:

• Westpac (2022) — ASIC accepted an enforceable undertaking following a review that found Westpac had failed to identify customers who may have been entitled to hardship assistance and had not provided adequate assistance to some customers who did apply
• ANZ (2021) — ASIC accepted an enforceable undertaking regarding ANZ's consumer hardship practices, including issues with the quality of hardship assessments and the adequacy of assistance offered
• Credit cards and buy-now-pay-later (2023) — ASIC's review of hardship practices across credit card and BNPL providers found widespread failures to respond within required timeframes, failure to properly record hardship applications, and inadequate staff training on hardship obligations

The pattern across these enforcement actions is consistent: systemic process failures (inadequate recording, untrained front-line staff, escalation failures, debt collection continued against customers in hardship) rather than deliberate policy decisions.

Vulnerability Framework: The Next Frontier

ASIC's regulatory agenda for 2025–2026 has elevated the vulnerability framework — the obligations on financial institutions to identify and appropriately support customers experiencing circumstances that increase their vulnerability — to a standalone compliance requirement rather than merely an adjunct to hardship.

What Is Vulnerability?

ASIC's framework (drawing on the FCA's Consumer Vulnerability Guidance and the Banking Code's vulnerability provisions) treats vulnerability as a consumer characteristic — not a permanent state — that arises from combinations of personal circumstances:

• Health — physical illness, mental illness, cognitive impairment, or disability affecting the ability to engage with financial products or understand obligations
• Life events — bereavement, relationship breakdown, job loss, natural disaster, or significant life transition (recent immigration, leaving care)
• Resilience — limited financial buffers, absence of social support networks, or prior adverse experience with financial institutions creating reluctance to seek help
• Capability — low financial literacy, language barriers, or limited digital capability in a context where digital-only service delivery may exclude the customer from accessing services

Vulnerable customers are not automatically in financial hardship, but their vulnerability may make them more likely to experience financial difficulty, less able to navigate the hardship application process without additional support, and more susceptible to harm if the institution's communications are not calibrated to their circumstances.

Family Violence: A Standalone Obligation

Family violence has been identified by the Royal Commission, ASIC, AFCA, and the Banking Code as requiring a distinct response — not simply treatment as a subcategory of hardship or vulnerability. The specific obligations that apply where a customer discloses or the institution identifies indicators of family violence include:

• Safety first — communications and service delivery must be designed so that they do not create safety risks for the customer. This means not sending default notices to an address where the customer may no longer safely reside, not disclosing account information to joint account holders who may be perpetrators, and offering the ability to communicate through alternative channels.
• Joint account protocols — specific procedures for separating joint credit obligations where one account holder is a victim of family violence, including the ability to decline to share information about account conduct with the alleged perpetrator while maintaining service for the victim
• Fee waivers — the Banking Code requires banks to consider waiving break costs, early termination fees, and other charges that arise when a customer needs to separate financial relationships as a result of family violence
• Referral to specialist support — staff must be trained to recognise indicators of family violence and to refer customers to specialist support services (domestic violence helplines, financial counsellors with family violence training)
• No adverse credit reporting during assessment — credit reporting agencies are expected (and required by the Banking Code) not to have family violence-affected arrears reported as defaults while the customer is receiving assistance

AFCA has handled a significant number of complaints involving family violence and financial hardship. Its determinations have emphasised that lenders must take reasonable steps to identify family violence situations and must not use standard debt collection procedures against customers in these circumstances.

AFCA Jurisdiction: Hardship Determinations

The Australian Financial Complaints Authority (AFCA) replaced the Financial Ombudsman Service (FOS), Credit and Investments Ombudsman (CIO), and Superannuation Complaints Tribunal (SCT) from November 2018. AFCA's Complaint Resolution Scheme Rules (the AFCA Rules) give AFCA specific jurisdiction over credit hardship complaints under both the NCCP Act and the Banking Code.

AFCA's Hardship Powers

AFCA can:

• Review whether a credit licensee properly assessed and responded to a hardship application within the required timeframe
• Determine that a hardship variation should have been granted even if the credit provider refused
• Specify the terms of a hardship variation where AFCA determines one is appropriate, including by varying repayment amounts, extending loan terms, or capitalising arrears
• Award compensation where the consumer has suffered loss as a result of the credit provider's failure to properly handle the hardship application (e.g., enforcement costs incurred while the hardship application was ignored)
• Require credit providers to remediate adverse credit report listings that resulted from incorrect handling of a hardship application

AFCA's Compensation Limits

For credit hardship matters, AFCA's compensation limits are:

• Up to $500,000 for compensation for direct financial loss in credit matters
• Up to $5,000 for non-financial loss (distress and inconvenience) in credit matters
• Remediation orders for credit report corrections are not capped by a monetary limit

These limits represent the maximum AFCA can award — not a cap on the credit provider's total liability if ASIC pursues civil penalty proceedings separately.

AFCA's Systemic Issues Role

AFCA has an obligation to refer systemic issues — patterns of conduct affecting multiple consumers that suggest a systemic compliance failure — to ASIC. A cluster of hardship complaints against a single credit provider indicating that hardship applications are routinely denied without proper assessment, or that the 21-day response is routinely missed, is a systemic issue that AFCA will refer to ASIC. This is the channel through which AFCA complaint data has fed into ASIC enforcement action against major banks.

Natural Disaster and Extraordinary Events

The Banking Code and the NCCP Act create enhanced hardship obligations during and after natural disasters — floods, bushfires, cyclones, and other major events that affect large numbers of customers simultaneously.

Following the 2019–2020 bushfires and the 2022 east coast floods, the ABA's Disaster Relief Working Group established an industry protocol for coordinated hardship response during natural disasters. Key elements include:

• Automatic repayment deferrals for customers in declared disaster areas without requiring individual applications
• Fee waivers for credit card cash advances used for disaster-related emergency expenses
• Priority processing of hardship applications from customers in affected areas
• Dedicated hardship phone lines with extended hours during disaster response periods
• Referral to government assistance programmes (Services Australia disaster payments) integrated into the hardship response

Credit licensees that are not ABA members are not bound by the ABA's disaster protocol but ASIC's expectations about fair treatment of customers during extraordinary events apply. ASIC has used its design and distribution obligations (DDO) powers and its general fairness oversight to scrutinise post-disaster hardship handling.

Common Hardship Compliance Gaps GoComply Detects

When credit licensees run their hardship policies, IDR procedures, and vulnerability frameworks through GoComply's compliance scanner, the following gaps surface most frequently:

• 21-day obligation not clearly defined in the hardship policy — policies that describe the hardship assessment process without specifying that the 21-day clock starts on receipt (not on completion of document gathering or internal assessment), resulting in staff misunderstanding the legal obligation and clock management failures
• Hardship acknowledgement process absent or undocumented — no defined process for acknowledging receipt of hardship applications within 3 business days (Banking Code requirement), with acknowledgement treated as informal rather than a trackable compliance obligation
• IDR and hardship processes siloed — hardship applications and hardship-related complaints handled by separate teams with no documented handoff procedure, resulting in customers having to re-tell their story, duplicate document provision, and inconsistent decisions on substantively identical circumstances
• Debt collection not paused during hardship assessment — collections systems and hardship assessment systems not integrated, allowing automated debt collection letters, calls, or reporting to continue after a hardship application has been lodged
• Vulnerability framework not operationalised — policies that describe vulnerability in principle but contain no practical identification triggers, no staff training requirements, no escalation procedures for identified vulnerability, and no framework for calibrating communications to vulnerable customers
• Family violence protocol absent or generic — hardship policies that mention family violence as a category of hardship but contain no specific protocols for joint account separation, alternative communications channels, fee waivers, or referral to specialist support services
• Credit reporting integration absent — hardship policies that do not address how default listings are managed during and after hardship arrangements, and no defined process for requesting correction of inaccurate hardship-related listings with credit reporting bodies
• No natural disaster playbook — credit licensees with mortgage books in flood or bushfire-prone areas without a documented natural disaster hardship protocol, leaving staff to improvise when a major event occurs

The Royal Commission Legacy: Specific Recommendations

The Royal Commission made several specific recommendations relevant to hardship compliance that have been implemented through regulatory change and industry reform:

• Recommendation 1.6 — Amend the Banking Code to require banks to proactively assist customers in financial difficulty and to have robust policies for hardship. This was implemented in the Banking Code 2019 and 2024 revisions.
• Recommendation 1.7 — ASIC should undertake regular reviews of hardship practices across the industry, with particular attention to whether the s72 21-day requirement is being met. ASIC has since published multiple hardship reviews (REP 576, REP 636, REP 754) and used them as the basis for enforcement.
• Recommendation 7.1 — Mortgage brokers and credit intermediaries must disclose to borrowers the availability of hardship assistance at the time of credit application. This recommendation has been partially implemented through disclosure requirements in the NCCP Act and the ASIC financial services guide requirements.
• Recommendation 1.8 — Amendment of the NCCP Act to require that reasonable hardship applications must be granted absent compelling circumstances to the contrary. This recommendation is still under active consideration by Treasury and has not yet been enacted as legislation as of March 2026, but the direction of travel is towards a more prescriptive mandatory assistance obligation.

Building a Compliant Hardship Framework

For credit licensees seeking to move beyond minimum compliance to a genuinely consumer-centric hardship program, the following framework is recommended:

1. Integrated hardship policy — a single document (or coherent suite of documents) that covers the NCCP Act s72 statutory minimum, Banking Code Part 5 enhancements, ASIC RG 271 IDR interface, AFCA obligations, family violence protocol, and natural disaster playbook in one integrated framework
2. Proactive identification triggers — data analytics rules that flag customers whose account conduct suggests emerging financial difficulty (missed direct debits, large unexpected withdrawals, repeated overdraft, sustained minimum-payment credit card behaviour) before they are in formal default
3. Proactive outreach process — a documented, measurable outreach process for flagged customers that includes scripts, channel options (letter, text, phone, in-app notification), and options for customers who do not respond to initial contact
4. Staff training and assessment — mandatory annual training for all customer-facing staff on hardship identification, hardship application processes, vulnerability indicators, and family violence protocols, with competency assessment and documented completion records
5. Technology integration — integration between the hardship management system and the debt collection system, the credit reporting system, and the IDR/complaints system so that hardship status is visible across all customer touchpoints
6. Regular effectiveness measurement — quarterly board reporting on hardship application volumes, 21-day response rates, approval and denial rates with reasons, post-arrangement performance (customers returning to normal payments vs entering default), and AFCA hardship complaint rates

Related Regulations and Obligations

• NCCP Act 2009 Schedule 1 (National Credit Code) — s72-s73 hardship variations; s88 default notices; s179G credit reporting obligations for hardship arrangements
• ASIC RG 271 (Internal Dispute Resolution) — IDR timeframes (30 days for credit), complaint recording, IDR response content requirements, systemic issues reporting to ASIC
• ASIC RG 209 (Responsible Lending) — hardship history as a relevant factor in responsible lending assessments for refinancing applications; lenders cannot use a customer's past hardship as a basis to refuse a refinance that would reduce their financial burden
• Banking Code of Practice 2024 — Part 5 (Financial Difficulty), Part 8 (Vulnerable Customers), Part 12 (Responding to Family Violence)
• AFCA Complaint Resolution Scheme Rules — AFCA jurisdiction to vary credit contracts, compensation limits, systemic issues reporting
• Privacy Act 1988 — credit reporting provisions (Part IIIA) governing what hardship information can be reported to credit reporting bodies and when default listings must be corrected
• APRA CPS 220 (Risk Management) — for APRA-regulated ADIs, financial hardship represents a credit risk indicator that must be fed into the risk management framework and stress testing; rising hardship rates are an early warning signal for portfolio credit quality
• FAR Act 2023 — accountable persons responsible for retail credit and consumer protection must have hardship compliance within their accountability statements

This guide is for informational purposes and does not constitute legal advice. Consult qualified compliance professionals for specific obligations. GoComply covers 37 Australian financial regulations — ask the chatbot for instant clause-level answers on the NCCP Act, Banking Code, RG 271, AFCA Rules, and all related hardship frameworks.