NDIS Provider Registration Rules

The provider gives the Commissioner notice, in the approved form and as soon as practicable after the earlier of becoming aware the change will occur or its occurring, of any change to its contact details and any change in scale for the supports it is registered to provide: the geographic areas served, the locations it operates from, a significant increase or decrease in participants, or a significant increase or decrease in workers.

Held text: NDIS Provider Registration Rules, Comp. No. 6, compilation in force from 1 Jul 2026; NDIS Act Part 3A, Comp. No. 27.

what an auditor asks to see Notification records lodged in the NDIS Commission portal with dates; Internal trigger list linking new sites, service areas and headcount changes to a notification step

where it usually falls short New sites opened without notice; Rapid growth in participants or workers not notified

Every Registration Rules clause we hold

The provider notifies the Commissioner in the approved form of: an event that significantly affects its ability to comply with its conditions; a change that adversely affects access by people with disability to its registered supports; an adverse change in financial capacity; a significant change in organisation or governance; and events bearing on its own or its key personnel's suitability (the matters in ss 9(2)(c) to (h) and 10(2)(b) to (g)). Notice of a governance change arising from a change in ownership of the provider or of its business is due by the earlier of becoming aware it will occur and any step that is a precondition to effecting it (s 13A(3), from 1 July 2026); other notices by the earlier of awareness and occurrence.

Held text: NDIS Provider Registration Rules, Comp. No. 6, compilation in force from 1 Jul 2026; NDIS Act Part 3A, Comp. No. 27.

what an auditor asks to see Notification records for governance, financial and suitability events; Transaction timetable for any sale or restructure showing the Commission notice before the first precondition step; Board papers identifying events requiring notice

where it usually falls short Commission told of a sale only after completion; Key personnel charges or insolvency events not notified

Every Registration Rules clause we hold

The Commissioner registers only an applicant who is suitable, and whose key personnel are suitable, having regard to prior registration, any banning order, convictions for indictable offences (subject to the spent convictions scheme), insolvency or Chapter 5 administration, adverse findings or enforcement action by government regulators (including disability, aged care and child regulators, ASIC, ACNC, ACCC, APRA, the Australian Crime Commission, AUSTRAC and WHS regulators), findings or pending proceedings about fraud, misrepresentation or dishonesty, and disqualification from managing corporations. Suitability must continue: loss of it is a ground to suspend or revoke (ss 73N(1)(d) and (e), 73P(1)(d) and (e)). The provider therefore screens its key personnel against these matters before appointment and keeps the declarations current.

Held text: NDIS Provider Registration Rules, Comp. No. 6, compilation in force from 1 Jul 2026; NDIS Act Part 3A, Comp. No. 27.

what an auditor asks to see Key personnel register with suitability declarations covering each s 10(2) matter; Checks of the NDIS banning order register, ASIC banned and disqualified register and insolvency index for each key person; Board procedure for assessing suitability before a new key personnel appointment

where it usually falls short New directors appointed without suitability checks; Declarations collected once at initial registration and never refreshed

Every Registration Rules clause we hold

A person against whom a banning order is made must not breach it or its conditions (fault-based offence up to 5 years' imprisonment or 300 penalty units, strict liability offence and civil penalty). Providers check the NDIS Provider Register's banning order list before engaging workers, key personnel and contractors, since employing a banned person in breach of an order and failing the Code of Conduct and screening duties exposes the provider; approved quality auditors can be required not to engage banned persons (s 73U(5A)). Since 9 April 2026 banning orders can also be made against applicants for registration, approved quality auditors and the other persons listed in s 73ZN(2C) (Integrity and Safeguarding Act 2026).

Held text: NDIS Provider Registration Rules, Comp. No. 6, compilation in force from 1 Jul 2026; NDIS Act Part 3A, Comp. No. 27.

what an auditor asks to see Banning order register check recorded for every new worker, key person and contractor; Periodic re-check of the existing workforce against the register

where it usually falls short Checks only at hiring, never repeated; Contractors and consultants not checked

Every Registration Rules clause we hold

Workers, contractors, participants, nominees, families, carers and advocates who report a suspected contravention of the NDIS Act to the Commissioner, the Agency or the provider's key personnel or partners on reasonable grounds are protected (s 73ZA). No one may disclose the discloser's identity or information likely to identify them except as s 73ZBA(2) authorises (Commissioner, Agency, police, legal advice, consent, serious threat to safety, courts, complaint handling) (civil penalty 30 penalty units), and no one may cause or threaten detriment because of a protected disclosure (s 73ZC; civil penalty up to 10,000 penalty units for a serious contravention by an NDIS provider, otherwise 500), with a right to compensation (s 73ZD).

Held text: NDIS Provider Registration Rules, Comp. No. 6, compilation in force from 1 Jul 2026; NDIS Act Part 3A, Comp. No. 27.

what an auditor asks to see Whistleblower policy covering who is protected, recipients, confidentiality and anti-victimisation; Restricted-access register of protected disclosures; Training for key personnel who may receive disclosures

where it usually falls short Discloser identity shared with the manager being complained about; Roster cuts or contract termination after a worker reports to the Commission

Every Registration Rules clause we hold

A person must not provide a support under a participant's plan where the NDIS rules require registration for it and the person is not registered (s 73B(2)), nor hold themselves out as able to provide such a support (s 73B(3)). Rules s 7 requires registration for: specialist disability accommodation (s 7(1)); any class of supports where there is, or is likely to be, an interim or ongoing need to use a regulated restrictive practice (s 7(2)); specialist behaviour support that includes a behaviour support assessment or developing a behaviour support plan (s 7(3)); assistance with supported independent living (s 7(4) and (5)); and NDIS digital platform services (s 7(6)). Separately, supports to a participant whose funding is managed by the Agency may be provided only by a registered provider (Act ss 32D(7) and 33(6)). Contravention is a fault-based offence (up to 2 years' imprisonment or 120 penalty units), a strict liability offence and a civil penalty (up to 10,000 penalty units for a serious contravention by an NDIS provider).

Held text: NDIS Provider Registration Rules, Comp. No. 6, compilation in force from 1 Jul 2026; NDIS Act Part 3A, Comp. No. 27.

what an auditor asks to see Certificate of registration listing every class of support delivered, checked against the service catalogue; Register of participants whose supports involve regulated restrictive practices, with the provider's registration class for each; Review of website, brochures and platform listings confirming no claim to deliver registration-only supports without registration; Plan management type checked for each participant (Agency-managed participants served only while registered)

where it usually falls short Unregistered provider delivering supports where restrictive practices are in use; Marketing that implies SIL or SDA capability without registration; Serving Agency-managed participants after registration lapsed

Every Registration Rules clause we hold

To be registered for a class of supports, the applicant is assessed by an approved quality auditor, by certification or verification as the s 20(3) table specifies, as meeting each applicable standard, plus Module 2A by certification where regulated restrictive practices are or may be used; to remain registered it keeps complying with those standards (s 20(1) and (2)). Individuals and partnerships providing early childhood supports are assessed against Core clause 7 and Module 3 (s 20(4) and (5)); Commonwealth, State, Territory and local government providers are certified against the whole Core module for any class (s 22). Certification satisfies a verification requirement (s 23), and auditors apply the quality indicators (s 24).

Held text: NDIS Provider Registration Rules, Comp. No. 6, compilation in force from 1 Jul 2026; NDIS Act Part 3A, Comp. No. 27.

what an auditor asks to see Scope of audit document mapping each registered class to its modules and assessment method; Certification or verification audit reports and certificates from an approved quality auditor; Corrective action plans and close-out evidence for any nonconformity

where it usually falls short Registered classes added without the matching supplementary module audited; Module 2A not audited although restrictive practices are in use; Corrective actions left open past their due date

Every Registration Rules clause we hold

A provider registered for high intensity daily personal activities may provide a support listed in Schedule 2 (complex bowel care, enteral feeding, severe dysphagia management, tracheostomy, urinary catheter, ventilator, subcutaneous injections, complex wound management) only if that support is set out in its certificate of registration.

Held text: NDIS Provider Registration Rules, Comp. No. 6, compilation in force from 1 Jul 2026; NDIS Act Part 3A, Comp. No. 27.

what an auditor asks to see Certificate of registration listing each high intensity support; Participant register showing only listed supports are delivered

where it usually falls short New participant with a tracheostomy accepted before the support was added to the certificate; Certificate not varied after a module audit

Every Registration Rules clause we hold

A person provides assistance with supported independent living when the participant needs constant or immediately available person-to-person support for all or a substantial part of each day, the assistance is provided as a package to help with or supervise daily tasks so the participant can live as autonomously as possible at home and access the community, and the person manages the package and the supports under it. Such a person must be registered for that class (class 0138). Transitional rules (s 32(2) and (3)): a registered provider already delivering SIL continues until the Commissioner varies its registration and meanwhile, if registered for item 15 (daily life tasks in a group or shared living arrangement), complies with Module 5A; an unregistered provider already delivering SIL before 1 July 2026 may continue only if it applies for registration before 1 October 2026, until the application is decided, and otherwise must stop from 1 October 2026; a new entrant must be registered before starting.

Held text: NDIS Provider Registration Rules, Comp. No. 6, compilation in force from 1 Jul 2026; NDIS Act Part 3A, Comp. No. 27.

what an auditor asks to see Registration application or varied certificate adding the SIL class, with its date; For existing unregistered SIL providers, proof of an application lodged before 1 October 2026; Assessment of each participant's package against the s 7(5) test (constant support, package, provider manages it)

where it usually falls short Providers repackaging SIL as separate hourly supports to avoid the definition; No application lodged by 1 October 2026 but supports continuing; Module 5A not implemented after the registration variation

Every Registration Rules clause we hold

Where a certification-assessed provider has a significant organisational or governance change resulting from a change in ownership of the provider or of a business it operates, and within the following three months it is not undergoing a mid-term audit and its registration does not end, it undergoes a certification audit starting within 3 months of the change (or later if the Commissioner allows) against the Core module Part 3 standards and any standards with prior corrective action plans; the auditor reports to the Commissioner within 28 days of completing it. Applies to changes of ownership on or after 1 July 2026.

Held text: NDIS Provider Registration Rules, Comp. No. 6, compilation in force from 1 Jul 2026; NDIS Act Part 3A, Comp. No. 27.

what an auditor asks to see Change of ownership audit engagement starting within 3 months of completion; Audit report and auditor's submission to the Commission within 28 days

where it usually falls short Acquirer assumes the vendor's audit cycle continues unchanged; Audit not scheduled after a share sale

Every Registration Rules clause we hold

A registered provider keeps records of the kind, for the period and in the form the NDIS rules prescribe (s 73Q; for example Part 3 of the worker screening rules and the incident, complaints and restrictive practice rules), and a former registered provider keeps them for 3 years after ceasing to be registered (s 73R, civil penalty 60 penalty units). From 27 August 2026 every NDIS provider keeps records of a prescribed kind relating to claims for NDIS amounts and the supports claimed for, for 7 years from the claim or any shorter period the rules prescribe (s 45B, civil penalty 120 penalty units).

Held text: NDIS Provider Registration Rules, Comp. No. 6, compilation in force from 1 Jul 2026; NDIS Act Part 3A, Comp. No. 27.

what an auditor asks to see Records retention schedule mapping each NDIS rule to the record kind and period; Archive arrangements for records if the business closes or registration ends; Claim records (service agreements, delivery notes, invoices) retained for 7 years

where it usually falls short Records destroyed on closure of the business; Delivery records not linked to claims

Every Registration Rules clause we hold

Registration is subject to the conditions in s 73F(2), any conditions the Commissioner imposes on the certificate (s 73G, for example audit type and timing or limits on supports) and conditions in the NDIS rules (s 73H, Rules Part 4). The statutory conditions are: comply with applicable Commonwealth, State and Territory law; the NDIS Code of Conduct; the applicable NDIS Practice Standards; record-keeping rules under s 73Q; the complaints system under s 73W and complaints rules under s 73X; the incident management system under s 73Y and reportable incident rules under s 73Z; and give the Commissioner information or documents on request within the period stated (at least 14 days, shorter where there is a risk of serious harm). Breaching a condition is a civil penalty provision (s 73J: up to 10,000 penalty units for a serious contravention, otherwise 250).

Held text: NDIS Provider Registration Rules, Comp. No. 6, compilation in force from 1 Jul 2026; NDIS Act Part 3A, Comp. No. 27.

what an auditor asks to see Compliance register listing every statutory, Commissioner-imposed and rule-based condition with an owner; Certificate of registration with its conditions; Log of Commissioner information requests and responses within the stated period

where it usually falls short Conditions imposed on the certificate not known to operational managers; Information requests answered late or incompletely

Every Registration Rules clause we hold

Registration continues past its expiry date only if the provider applies for registration under s 73C within the 6 months before the day it would cease; it then continues until the Commissioner decides the application. A provider that misses the window loses registration on the expiry date.

Held text: NDIS Provider Registration Rules, Comp. No. 6, compilation in force from 1 Jul 2026; NDIS Act Part 3A, Comp. No. 27.

what an auditor asks to see Renewal application lodged within 6 months of expiry, with the portal submission date; Audit booked in time for the renewal assessment

where it usually falls short Renewal lodged after expiry; Renewal audit not completed so the application stalls

Every Registration Rules clause we hold