You're eight months from March 2027. Your bank operates in Australia. Under the new Scams Prevention Framework, you face penalties of up to $52.7 million per contravention if a customer loses money to a scam. But the dating app where the scam started? Not regulated. The crypto exchange where the funds disappeared? Also excluded. The non-bank payment provider that moved the money between them? Same story.
This isn't a theoretical compliance puzzle. It's a liability decision you need to make now: how do you allocate resources when half the scam chain owes your customer nothing under law?
The Decision You're Facing
Your compliance budget is finite. The Scams Prevention Framework creates mandatory obligations for banks and telecoms, but it deliberately excludes dating apps, crypto exchanges, crypto ATMs, digital wallets, and certain marketplace platforms. When a scam crosses from an unregulated platform into your regulated environment, you become the reimbursement point of last resort.
The question: do you build controls that attempt to detect and block scams originating from unregulated platforms, or do you accept the liability and build for post-incident reimbursement and recovery?
This decision affects your fraud detection investment, your customer communication strategy, your incident response protocols, and your regulatory advocacy position.
Key Factors That Affect Your Choice
Scam volume and origination patterns. The Australian Securities and Investments Commission reported 3,106 crypto investment scams over the past financial year, up 30% year-over-year. If your transaction data shows high volumes originating from excluded platforms, detection becomes cost-justified.
Reimbursement clarity. Treasury confirmed verbally that receiving banks would be liable for both compliance and reimbursement, but the banking sector's own code provisions don't define "receiving bank." If you can't map liability across a multi-party scam chain, you can't price the risk accurately.
Cross-platform visibility. Romance scams don't stay on dating apps. A scammer builds trust inside the app, then moves to WhatsApp or Telegram. By the time your customer initiates a wire transfer, the manipulation happened entirely outside your view. You're deciding whether to invest in behavioral analytics that flag unusual transfers even when the preceding context is invisible to you.
Recovery mechanisms. Ken Palla, a fraud expert who formerly directed fraud operations at MUFG Union Bank, submitted detailed questions to Treasury in January asking for a chart showing how victims get reimbursed when scams cross from regulated to unregulated entities. That chart still doesn't exist. Without it, you're building recovery workflows blind.
Path A: Invest in Cross-Platform Detection
Choose this path if your transaction data shows material exposure to scams originating from excluded platforms and you have the technical capability to build behavioral models without direct platform visibility.
When it fits. You operate a retail bank with high volumes of person-to-person payments. Your fraud team has flagged clusters of losses tied to crypto exchanges and romance scams. You have access to transaction metadata (timing, amount patterns, recipient account age) even when you can't see the messaging that preceded the transfer.
What you build. Deploy behavioral analytics that flag transfers to crypto exchanges, international accounts, or newly added beneficiaries when combined with unusual customer behavior (first-time large transfer, rapid sequence of smaller transfers, transfers outside normal hours). Train your contact center to ask specific questions when these flags trigger: "Did you meet this person on a dating app?" "Have you verified this investment opportunity through a second source?"
The controls. You're implementing risk-based friction. ISO 31000 principles apply here: you're treating the unregulated platform as an external risk factor you can't control, so you control the decision point you do own (the transfer authorization). Document your risk assessment. If you later face a penalty, your defense is that you applied reasonable controls given the regulatory gap.
The cost. High upfront investment in analytics and staff training. Ongoing false positive management. Customer friction when you delay or block legitimate transfers. But you're reducing reimbursement liability and building evidence of due diligence.
Path B: Accept Liability and Optimize Recovery
Choose this path if detection is impractical given the visibility gap, or if your cost-benefit analysis shows that reimbursement is cheaper than the detection infrastructure required.
When it fits. You operate a smaller institution without the scale to justify advanced behavioral analytics. Or your transaction patterns show that scams originating from excluded platforms represent a small percentage of total fraud losses. Or you've concluded that romance scams are fundamentally undetectable at the transfer stage because the victim genuinely believes the relationship is real.
What you build. Streamline your incident response and reimbursement processes. Pre-define what constitutes a valid scam claim. Train your team to gather evidence quickly: screenshots of the dating app conversation, records of the Telegram chat, proof that the crypto exchange is unlicensed in Australia. Build templates for recovery attempts even when you know the receiving entity isn't regulated.
The controls. You're implementing post-incident efficiency. Under the NIST Cybersecurity Framework (CSF) 2.0, this is Respond and Recover. You're not preventing the scam; you're minimizing the time and cost to process the claim and reimburse the customer. Document every case. If patterns emerge, you have data to support a regulatory advocacy position.
The cost. Lower upfront technology spend. Higher reimbursement outlays. Reputational risk if customers perceive you as not protecting them. But you're avoiding the false positive burden and customer friction that comes with aggressive detection.
Path C: Build a Hybrid Model with Regulatory Advocacy
Choose this path if you have the resources to do both and you're willing to use your compliance data to push for framework expansion.
What you build. Implement targeted detection for the highest-risk scenarios (crypto transfers, international wires to high-risk jurisdictions) while accepting liability for lower-probability scams. Simultaneously, document every case where an excluded platform was the origination point. Aggregate that data quarterly.
The advocacy component. Use your documented losses to submit formal feedback to Treasury. Palla's January submission asked for a liability chart. Yours can go further: provide actual case studies showing how scams moved from dating apps to crypto exchanges to international banks, with timestamps and dollar amounts. Argue for specific inclusions: if 30% of your romance scam losses originated on three dating apps, name them and request they be added to the regulated platform list.
The timeline. March 2027 is your compliance deadline, but Treasury is still working through the regulations. Your advocacy won't change the March requirements, but it positions you for the first amendment cycle. Meanwhile, your hybrid detection model gives you defensible controls and reimbursement efficiency.
Summary Matrix
| Factor | Path A: Detection | Path B: Liability Acceptance | Path C: Hybrid + Advocacy |
|---|---|---|---|
| Best for | High scam volume from excluded platforms | Low volume or detection impractical | Resources for both + policy influence |
| Upfront cost | High (analytics, training) | Low (process optimization) | Medium (targeted detection) |
| Ongoing cost | False positives, friction | Reimbursement payouts | Balanced |
| Regulatory defense | Documented due diligence | Efficient recovery process | Data-driven advocacy position |
| Customer impact | Friction on legitimate transfers | Faster reimbursement post-scam | Balanced protection and service |
The framework takes effect in March 2027. The exclusions are deliberate, and Treasury has shown no sign of revisiting them despite industry objections filed months ago. Your decision isn't whether the framework is fair. It's how you allocate finite resources when the law places liability on you for scams you can't fully see or control.
Choose the path that matches your risk profile and transaction patterns. Then document everything. When the first amendment cycle opens, the banks with the best data will have the strongest case for closing the gaps.
