NDIS compliance
NDIS Fraud Protection Laws: What Providers Need to Know
The rules on what can be claimed, and the evidence behind each claim, are getting stricter. Here is what changes for providers.
This post is general information only. It does not constitute legal advice. Check the NDIS website and your legal adviser for guidance specific to your circumstances.
What the New Law Actually Says
The National Disability Insurance Scheme Amendment (Integrity and Safeguarding) Act 2026 is now Australian law. It was introduced as a Bill on 26 November 2025, passed Parliament on 1 April 2026 and received Royal Assent on 8 April 2026. It amends the NDIS Act 2013 in ten areas. It gives the NDIS Commission stronger powers and higher penalties. It also changes how the NDIA handles claims, plan variations and people leaving the scheme.
The reforms line up with recommendations from the NDIS Review and the Disability Royal Commission. The government consulted on them in late 2024 and again in September 2025.
For compliant providers, most day-to-day obligations stay the same. But the Commission has new powers to demand information quickly, and new penalties if you don’t comply. Refusing an information request now attracts a civil penalty. The Commissioner can require a person to appear and answer questions. Registration conditions now cover giving documents to the Commission.
The Senate also added stronger whistleblower protections (Schedule 3), in force since 9 April 2026.
The Seven Changes That Matter Most
The Act introduces changes across ten areas of the NDIS Act 2013. Here are the seven with the most direct impact on registered providers.
Criminal offences for unregistered service delivery
Providing supports that require registration without being registered is now a criminal offence. The maximum penalty is 2 years’ imprisonment or 120 penalty units. Before, it was only a civil penalty. If any part of your service delivery requires registration under the NDIS Act, you must hold and maintain that registration.
Criminal penalties for breaching a banning order
If the NDIS Commission bans someone from working in the scheme, breaching that order is now a criminal offence, carrying up to 5 years’ imprisonment. Good practice is to check the NDIS Provider Register for banning orders before you engage anyone.
Fines increased up to 40 times
The maximum penalties for the most serious Code of Conduct breaches have risen sharply. Where a breach leads to the death or serious injury of a participant, the maximum fine for a corporation goes from about $412,500 to more than $15 million. These are civil penalties; courts set the exact amount based on the seriousness of the conduct.
Changes to how claims are made
The Act lets the NDIA CEO approve the forms claims are made on. This lets the NDIA move to fully electronic claiming, but no date has been set for electronic-only claims. The NDIA can also ask for information or documents before paying a claim, giving at least 14 days to respond. Providers who still claim through PDF or paper processes should start moving to digital records that give a clear audit trail.
Expanded banning order powers
The NDIS Commission can now ban auditors and consultants, including people who help providers apply for registration, not just service providers. This matters if you rely on outside help to manage compliance. Make sure anyone you pay for compliance help is reputable and in good standing.
Anti-promotion orders
The Commissioner can now make anti-promotion orders. These stop a person promoting NDIS supports in ways the NDIS rules prescribe. Breaching an order carries a civil penalty of up to 250 penalty units. Review any service agreements or marketing materials that make claims about what NDIS funding covers.
Stronger information requests from the Commission
Information notices normally allow at least 14 days to respond. The Commissioner can give less time only if waiting would significantly increase the risk of serious harm to a participant. Refusing to comply now attracts a civil penalty. Your records need to be easy to find and complete.
$15M+
Maximum fine for the most serious breaches leading to death or serious injury
2 years
Maximum prison term for providing registrable supports while unregistered
Up to 40x
Increase in the maximum fine for the most serious Code of Conduct breaches
What This Means for Compliant Providers
The legislation is designed to target fraudsters and bad actors. The Minister described the laws as protecting the NDIS from “fraudsters, predators and shonks”. If your organisation delivers quality supports with sound documentation practices, you are not the target.
But the law’s operational effect lands on every provider, regardless of intent. Three specific mechanisms will change how you work day-to-day.
Scrutiny is now continuous, not periodic. The Commission can demand information at any time, not just at audit. You cannot keep a different standard between audits and outside them. If a participant incident triggers an investigation, your shift notes and records from six weeks ago need to be as clean as last week’s.
The claims process is changing. The NDIA can now ask for information or documents before paying a claim. That adds friction to billing if your process lacks a clear record from shift delivery to invoice. Providers who already capture GPS clock-ins, link shift notes to participant records, and generate clean timesheets will find this easier. Those running manual workflows will not.
Your third-party relationships are now part of your compliance picture. Auditors and consultants can be banned from the NDIS. If you pay anyone for compliance help, make sure they are reputable and in good standing.
Key Finding
Commission information notices normally give at least 14 days. The Commissioner can give less time only if waiting would significantly increase the risk of serious harm to a participant. If your records live in paper files, shared drives, or disconnected spreadsheets, pulling them together under a deadline is a real operational risk.
Why Electronic Claiming Still Matters for Your Workflows
The NDIA can now approve the forms claims are made on, which lets it move to fully electronic claiming. No date has been set for electronic-only claims. But the NDIA can already ask for information or documents before paying a claim. Taken together, these changes mean the link between your shift delivery record and your claim should be tight, traceable, and digital.
In practice, that means:
- ✓Every claim needs to trace back to a verifiable service delivery record: which support worker delivered the shift, when, to which participant, under which NDIS support category.
- ✓GPS clock-in and clock-out data, shift notes, and timesheet records become your claim’s audit trail, not just internal records.
- ✓If the NDIA asks for supporting documents before paying, you need to produce them within the time given, ideally from the same system that generated the claim.
Providers still emailing PDFs to submit invoices, or manually reconciling shift records against billing runs, face the most adjustment. Keeping digital, audit-ready records now means your rostering, timesheets, and invoicing are ready if the NDIA moves to electronic-only claiming.
Worth Checking
If your agency currently submits NDIS claims via paper forms, manual PDFs, or processes that don’t generate a digital audit trail linked to each shift, this is a good time to review that workflow. The NDIA will issue further guidance on approved claim forms: check the NDIS website for timelines as they are confirmed.
How TakeCareOS Supports Compliance Under the New Rules
TakeCareOS is an AI-native operating system built for home care, disability, and aged care agencies. Several of its features support the documentation and operational practices that the new Act makes more important. The platform’s conversational interface, Atlas, is covered in more depth in our guide to what conversational AI means for care agencies.
On claims and audit trails: Shifts, GPS clock-ins, shift notes, and participant records flow into timesheets and NDIS invoices inside a single platform. If the NDIA asks for supporting documents before payment, the records are already linked and easy to find.
On document retrieval: Shift notes, service agreements, incident reports, and worker credentials live in one place. When the Commission asks for information, your staff aren’t moving between systems or searching shared drives.
On credential tracking: You can ask Atlas which support workers have a police check or NDIS Worker Screening Check expiring this month. Separately, the Alerts module flags expiring credentials before you roster the worker, so a lapsed credential is easier to catch early.
On shift note quality: Workers log notes from their phone, in text or voice, in any language. The Shift Notes Companion restructures each entry, suggests improvements, and checks it against participant goals before it is locked. Vague or inconsistent notes are a common audit problem for NDIS providers. The platform helps at the moment of capture, not during a pre-audit review.
On ongoing compliance: Alerts surface credential expiries, missed clock-ins, and clock-ins from outside the shift location as they happen. The aim is to keep records in good shape all year, not scramble before audits.
TakeCareOS supports compliance practices. It does not guarantee compliance. Every provider remains responsible for its own obligations under the NDIS Act.
What to Do This Month
The Act is now law. Here is a practical starting checklist for registered NDIS providers.
Confirm your registration status is current
Providing registrable supports without registration is now a criminal offence. Log in to the NDIS Commission portal and verify your registration scope, including your expiry date and the support classes you are registered to deliver.
Audit your claims process
Can you currently submit claims electronically? Does each claim trace back to a digital service delivery record? If not, identify the gap and start moving to a system that supports electronic claiming with a linked audit trail.
Review your worker credential records
Every support worker delivering registrable supports needs current, documented credentials. Build or confirm a process for tracking expiry dates before they lapse, not after. Check the NDIS Provider Register for banning orders before you engage anyone.
Check your third-party auditor and consultant relationships
The Commission can now ban auditors and consultants. Make sure anyone you pay for compliance help is reputable and in good standing.
Review your marketing and service agreement language
The Commissioner can now make anti-promotion orders about how NDIS supports are promoted. Review any materials that make statements about what participants can fund through their plans.
Get your records ready for information requests
Commission information notices normally give at least 14 days, and less only where waiting would significantly increase the risk of serious harm to a participant. If your documentation is spread across multiple systems or paper files, make fixing that a priority now.
Watch for NDIS Commission implementation guidance
All of the Act is now in force, but some parts still need rules or NDIA decisions before they have full effect. Subscribe to NDIS provider updates and NDIS Commission news to stay current as those details are confirmed.
Frequently Asked Questions
Does this law apply to all NDIS providers, or only registered ones?
The new criminal offence targets people who provide supports that require registration without holding that registration. If you are an unregistered provider delivering supports that do not require registration, that offence does not apply to you. Other changes, including the claims changes and the Commission’s stronger information powers, apply more broadly. Check ndis.gov.au/providers for guidance on your registration obligations.
When do the new provisions actually come into force?
All of the Act is now in force. Most of it started on 9 April 2026, and the NDIA changes started on 6 May 2026. Some parts still need rules or NDIA decisions before they have full effect. The official source for commencement information is the Federal Register of Legislation.
How much are the new fines exactly?
Civil penalties in the Act are set in penalty units. For the most serious breaches, where a provider’s conduct leads to the death or serious injury of a participant, the maximum civil penalty is up to 10,000 penalty units. That is more than $15 million for a corporation at current penalty unit rates. Courts set the exact penalty based on the seriousness and circumstances of the conduct. For context, the previous maximum for the same category of breach was approximately $412,500.
What counts as “operating without registration when registration is required”?
This depends on which supports your organisation delivers. Some support types under the NDIS require the delivering provider to hold registration; others do not. The NDIS Commission maintains a registration groups page listing which support categories require registration. If you are in any doubt about your obligations, seek advice from a registered NDIS compliance professional.
Can Atlas help manage compliance obligations under the new law?
Atlas can help with parts of it. You can ask which support workers have expiring police checks or NDIS Worker Screening Checks, and it answers from your live data. The Alerts module flags expiring credentials, missed clock-ins, and location exceptions. Atlas drafts and surfaces information; it does not replace the judgement of your compliance team.