Compliance and Licensing: Frequently Asked Questions

Compliance is the part of broking most prospective members underestimate, and the part an aggregator either handles well or handles badly. This page sets out how licensing works at Redrock, what obligations sit with you personally, and what to expect from file reviews and audits. Regulation changes, so where we reference a regulator, a form or an association rule, treat it as a starting point and confirm the current position with the official source before you rely on it.

Do I need my own credit licence to work as a broker with Redrock?

No. Most brokers operate as an authorised credit representative under a licensee's Australian Credit Licence rather than holding their own. That is the standard route into the industry and it removes a substantial compliance and capital burden. Holding your own licence remains an option — see the question below.

What is an authorised credit representative?

A credit representative is a person or company authorised by a credit licensee to engage in specified credit activities on the licensee's behalf. The authorisation is recorded on ASIC's register. In practical terms it means you write loans under the licensee's authority, within the scope it sets, and the licensee carries supervision obligations for your conduct. Confirm current requirements on the ASIC website.

What are ACL 405961 and ACL 384209?

These are the two Australian Credit Licences in the Redrock group. Red Rock Brokers Group Pty Ltd, ABN 40 149 728 030, holds ACL 405961. Red Rock Mortgage Group Pty Ltd, ABN 42 111 216 598, holds ACL 384209. Licence details can be independently checked on ASIC Connect's professional registers.

What is ComplySuite, and do brokers use it themselves?

ComplySuite is Redrock's own comprehensive, all-in-one NCCP compliance monitoring and reporting platform — and yes, it is a broker-facing tool rather than a head-office system. Brokers use it directly to maintain their compliance registers, interact with file auditors, complete their quarterly self-reviews, and manage ongoing compliance monitoring and reporting requirements. It is where most of the answers on this page turn into daily practice. See ComplySuite: NCCP Compliance Monitoring and Reporting.

What is best interests duty?

Best interests duty requires a mortgage broker to act in the best interests of the consumer. Where the interests of the client and the broker conflict, priority must be given to the client's interests. It is a conduct standard rather than a paperwork exercise: your recommendations, your lender selection and your file notes all need to stand up against it.

Scope matters here, and it is regularly misunderstood. Best interests duty applies to credit assistance provided to consumers. It does not apply to commercial or business lending. If you diversify into commercial, asset finance for business purposes or SME lending, the duty does not follow you into that work — though your general conduct obligations, your licensee's requirements and the relevant lender's own standards still do. Confirm the boundary with ASIC's current guidance before you rely on it for a particular deal.

What is responsible lending under the NCCP Act?

Under the National Consumer Credit Protection Act 2009, credit assistance providers must make reasonable inquiries into a consumer's requirements, objectives and financial situation, take reasonable steps to verify that situation, and assess whether the credit contract is not unsuitable. Requirements differ by product type and have been amended over time — check ASIC's current regulatory guidance rather than relying on a summary.

What disclosure documents do I have to give a client?

The National Consumer Credit Protection Act 2009 requires credit assistance providers to give the consumer a credit proposal disclosure document, which sets out the credit assistance being provided and the commissions likely to be received. Redrock's own framework refers to this as a Statement of Credit Assistance. Credit guide and quote requirements sit alongside it. The exact documents and timing depend on the activity and the product, so confirm the current requirements with ASIC and follow Redrock's documented process.

Do I need my own professional indemnity insurance?

Yes. The licensee's PI policy covers the licensee's own obligations as a licence holder — it is not, of itself, cover for you personally. Every Redrock broker holds a policy in their own name, and Redrock's minimum required coverage levels are $2,000,000 Limit of Liability and $6,000,000 maximum aggregate Limit of Liability.

The first-year premium is included in the initial investment when you join; renewal from the second year onwards is yours. Confirm your own policy details — limits, retroactive date, exclusions and renewal date — with your insurer. The full picture, including what to check in a policy and what happens to your cover when you leave an aggregator, is set out in professional indemnity insurance for mortgage brokers.

What is AFCA and why does it matter to me?

The Australian Financial Complaints Authority is the external dispute resolution scheme for financial services and credit. Credit licensees are required to be members, and Redrock is an AFCA member. It matters to you because a client complaint that is not resolved internally can be escalated there, and AFCA determinations are binding on the member. Verify scheme rules with AFCA directly.

Am I supervised, and what does that involve?

Yes. A licensee carries obligations to ensure its representatives are adequately trained and competent, and that credit activities are conducted efficiently, honestly and fairly. In practice that shows up as induction requirements, file reviews, audits, quarterly self-reviews in ComplySuite and ongoing training. It is not a formality — it is the licensee meeting its own obligations through you.

Mentoring for new brokers sits in the same frame. It is required under MFAA and FBAA membership standards and under the licensee's supervision obligations, rather than being a standalone statutory rule.

What is breach reporting and does it affect me?

Credit licensees must report reportable situations to ASIC, and the reporting windows are short — as little as 10 business days for the most serious matters. You will not normally lodge these yourself, but you are the person who has to raise an issue promptly with the licensee so the clock can be met. Sitting on a problem is the failure mode. Reportable-situation definitions and timeframes have been amended since introduction, so verify the current position with ASIC.

What happens in a compliance review?

Redrock runs file reviews and audits against its ten-step loan origination process and its compliance document checklist, worked in ComplySuite. A review typically looks at whether inquiries and verification were documented, whether the credit assessment supports the recommendation, whether disclosures were made and whether the file evidences the best interests duty. Alongside the audits, each credit representative completes a quarterly self-review in ComplySuite. Consistent process is what makes reviews uneventful.

What if an audit finds a problem?

Findings are worked through as remediation rather than treated as a verdict, tracked to close-out through corrective action management in ComplySuite. Depending on severity that can mean fixing file documentation, additional training, closer supervision of subsequent files, or in serious cases action under your agreement. The practical takeaway is that audit findings are easier to fix on file five than on file five hundred, which is why early reviews matter.

What records do I have to keep, and for how long?

You should expect to retain the client's application and supporting documents, your inquiry and verification evidence, the credit assistance documentation, disclosures, your recommendation reasoning and all client communications. Retention periods are set by legislation and by the licensee's own policy, so confirm the specific retention schedule that applies to you with Redrock and check current requirements with ASIC.

What is conflicted remuneration?

Conflicted remuneration rules restrict benefits that could reasonably be expected to influence the credit assistance provided or the products recommended. Commission paid by lenders is permitted, subject to conditions covering how it is calculated and disclosed, while volume-based and campaign-style benefits are constrained. These reforms have been amended since introduction — confirm the current position with ASIC.

Where do I go with a compliance question day to day?

Search Suite. It is Redrock's AI Smart Search tool, reached through the Redrock Broker Portal via an embedded iframe, and you use it by asking natural, human-language questions of Redrock's knowledge base rather than searching for keywords. For anything that needs judgement rather than information, Redrock's credit and compliance people are directly accessible. See Search Suite: AI Smart Search Inside the Redrock Broker Portal.

Do I have to belong to an industry association?

Redrock is a member of both the FBAA and the MFAA. Association membership brings its own education, conduct and professional development standards that apply to members, and lender and licensee expectations often assume it. Membership categories and requirements are set by each association, so check directly with the FBAA or MFAA for what applies to you. FBAA membership for your first year is included in the initial investment when you join.

What qualifications do I need before I can be authorised?

Entry education requirements for credit representatives are set by legislation and reinforced by association standards, with the FNS40821 Certificate IV in Finance and Mortgage Broking the common entry qualification and a diploma expected for association membership at some levels. Course codes and requirements change — confirm current standards with your training provider, ASIC and the relevant association. The practical sequence is set out in Start a Mortgage Broking Career.

Can I hold my own ACL instead of operating under Redrock's?

You can, and some established brokers do. Be aware that ASIC Regulatory Guide 206 generally expects a responsible manager to demonstrate at least two years of relevant problem-free experience. That is regulatory guidance about how ASIC assesses applications rather than a statutory minimum, and it is only one part of the organisational competence requirements. The trade-offs are set out in Credit Representative or Your Own ACL, or discuss them on 1300 667 694. Agreement mechanics are covered in agreement terms and working arrangements.