The Procurement Manager's Guide to Supplier Fraud in Australia

Every year, Australian businesses lose hundreds of millions of dollars to supplier fraud. The losses aren't just from elaborate schemes — most are mundane: a supplier who wasn't who they claimed to be, an ABN that had been cancelled for two years, or a director who had quietly been banned from managing corporations while still signing contracts.

The tragedy is that most of it is preventable. The Australian government publishes more supplier-risk data than almost any other country — the ABR, ASIC registers, APRA supervision lists, Fair Work compliance notices, ATO tax debt disclosures, the AFSA personal insolvency register. The problem isn't a lack of data. It's that checking 11 different registers manually, for every new supplier, is genuinely impractical at procurement volume.

This guide covers what each register tells you, when it should be a deal-breaker, and how to build a verification routine that a procurement team can actually sustain.

The 11 Registers That Matter

1. The Australian Business Register (ABR)

This is your baseline. The ABR, run by the ATO, holds every registered business entity in Australia — their legal name, ABN status, entity type, GST registration, main business location, and any trading names.

What to check:

• ABN status: must be Active. Cancelled means the entity no longer legally operates as a business. A supplier presenting a cancelled ABN is presenting false credentials — knowingly or not.
• GST registration: any supplier invoicing you for GST must be registered. If they're not, they legally cannot charge GST, and paying it to them creates a compliance problem for you.
• Entity type: a sole trader carries very different risk from a pty ltd. Sole traders have no separate legal entity — if the individual becomes insolvent or dies, the "business" disappears overnight. Know what you're contracting with.
• Business location: ABR addresses can be residential (normal for home-based businesses), PO boxes (a flag, not a deal-breaker), or nonexistent. An address that doesn't match a working premises is worth a second look.

What it doesn't tell you: whether the business actually operates, whether contact details are current, or anything about the principals behind it. The ABR is a registration record, not a character reference.

2. ASIC Company Register

If your supplier is a company (Pty Ltd, Ltd, etc.), ASIC holds its incorporation record, current status, registered office, and document history. The most important status values:

• Registered: normal, active company.
• Deregistered: the company no longer legally exists. Contracts with a deregistered company are unenforceable against the company — there is no company.
• Under External Administration: an insolvency practitioner has been appointed. Paying an externally administered company can require approval from the administrator; in some cases payments are clawable.
• In Liquidation: the company is being wound up. Any money owed to you is an unsecured creditor claim. Any money you pay them goes into the liquidator's pool — rarely recoverable.

The deregistration trap: ASIC deregisters companies automatically when they stop filing. A company can be struck off while still invoicing customers and appearing entirely normal. This happens more than you'd expect — and it means you've paid a ghost.

3. ASIC Insolvency Register

ASIC's insolvency register records companies under external administration, receivership, or voluntary winding up. It's distinct from the company status field — a company can appear "Registered" on ASIC while a subsidiary or related entity is under administration.

The register uses codes: EXAD (External Administration), DISS (Being Dissolved), VWUP (Voluntary Winding Up), CVLN (Court-ordered winding up). Each tells a different story about how far along the process is and whether the business can continue trading.

Practical note: ASIC's register lags. External administrations sometimes aren't gazetted for weeks after appointment. For high-value contracts, cross-reference with the insolvency practitioner's announcements and the AFSA gazette.

4. ASIC Banned & Disqualified Register

ASIC maintains a register of individuals and organisations banned from providing financial services or credit, disqualified from managing corporations, or subject to ASIC enforcement orders.

A director or officer on this list cannot legally manage a company. If they're doing so, the company is operating illegally, and any contracts may be voidable. More practically: someone banned from managing companies is banned for a reason. The register notes the nature and duration of each action.

Key distinction: the ban registers cover individuals (directors, officers) and organisations separately. Always check both when onboarding a new supplier — and check the names of the directors, not just the company.

5. ASIC Financial Services Licence Register

If your supplier provides financial services — advice, dealing in financial products, credit, insurance — they must hold an Australian Financial Services Licence (AFSL) or Credit Licence. Operating without one is a criminal offence.

This register matters most in industries where sub-licensees and referral arrangements are common: insurance broking, financial planning, mortgage broking, investment management. A supplier claiming to be an "authorised representative" of a licence holder should be cross-checked — unauthorised representatives do get caught, and the liability often flows upward to the buyer who engaged them.

6. The APRA Supervision Register

If you deal with banks, insurers, or superannuation funds, the Australian Prudential Regulation Authority (APRA) is the relevant regulator. APRA publishes lists of Authorised Deposit-taking Institutions (ADIs), general and life insurers, and registrable superannuation entity (RSE) licensees.

For most procurement teams, this is only relevant when you're considering engaging a new bank or insurer — but it's worth knowing that a supplier claiming to hold prudential authorisation can be verified here. Unlicensed deposit-taking is a serious criminal offence.

7. Fair Work Compliance Notices

The Fair Work Ombudsman publishes compliance notices and court-enforceable undertakings against employers who have underpaid workers or breached workplace laws. For procurement teams, a supplier with active Fair Work compliance action is a material risk in two ways:

• Labour-hire and supply chain liability: the Fair Work Act's supply chain provisions mean buyers can face liability for wage theft by their contractors and sub-contractors in certain circumstances.
• Operational risk: a workforce that isn't being paid correctly is a workforce at risk of industrial action, high turnover, and operational disruption.

Compliance notices on the FWO newsroom typically include the employer's name, the nature of the breach, and whether it's been remediated. An active notice (not yet closed) is the most concerning signal.

8. ATO Super Guarantee Non-Compliance Register

The ATO publishes a quarterly register of employers who have not met their Superannuation Guarantee obligations after having been directed to pay. This register has real teeth: employers named on it have already had a compliance direction issued and failed to comply. They're not just behind — they've refused to fix it.

The SG context for procurement: if you're using a labour-hire supplier, and that supplier is non-compliant with SG, your workers (or their workers) are building up superannuation entitlements that will never materialise. In some industries, the liability for this can be passed to the labour-hire client.

9. ATO Tax Debt Disclosure

Under the Tax Debt Disclosure regime (introduced 2019), the ATO can disclose business tax debts over $100,000 that are at least 90 days overdue and not subject to a payment arrangement, to credit reporting bureaus. The ATO also publishes a register of businesses subject to this disclosure.

A supplier with a disclosed tax debt is in serious ATO arrears. It doesn't mean they can't operate, but it does mean their cash flow is significantly compromised, and the ATO has priority over other creditors in any insolvency event.

10. AFSA Personal Insolvency Register

The Australian Financial Security Authority publishes a register of individuals subject to personal insolvency actions — bankruptcies, debt agreements (Part IX), and personal insolvency agreements (Part X). This matters when you're dealing with sole traders or checking the principals behind a company.

A bankrupt individual cannot be a director of a company without court approval. A sole trader in bankruptcy is functionally insolvent. The AFSA register isn't exhaustive (it covers formal proceedings, not informal distress), but a hit here is a hard stop.

11. ASIC Financial Adviser Register

If you engage financial advisers or planners, the ASIC Financial Adviser Register (FAR) shows their current authorisation status, the licence holder they operate under, and any historical banning actions or compliance outcomes. An adviser not on this register — or one whose registration has lapsed — cannot legally give personal advice on financial products.

---

The Phoenix Fraud Pattern: What Registers Don't Show (and How to Spot It)

SUPPLIER FRAUD RISK

Supplier Type	Risk Description	Risk Level
Ghost Suppliers	Non-existent entities	High
Phoenix Companies	Reborn from insolvency	Medium
Shell Companies	No legitimate business	High
Overseas Suppliers	Complex tax laws	Medium
Small Business	Limited financial records	Low

The most common form of sophisticated supplier fraud in Australia isn't a clean breach of a single register. It's the phoenix pattern: a company accumulates debts and liabilities, is deliberately wound up or allowed to deregister, and then a "new" company with similar branding, the same personnel, and the same actual business simply continues operating — leaving creditors, employees, and the ATO holding unpaid claims.

Phoenix fraud is hard to detect from a single register check because the new company may be entirely clean — no adverse records, active ABN, ASIC status "Registered." The signals are structural:

• Domain registered recently, ABN older than domain by years — the old entity owned the domain; the new entity had to register a new one.
• Same director on a deregistered company AND the new entity — particularly if the deregistered company had adverse records.
• GST registration gap — new entity not yet GST registered despite claiming to have traded for years.
• Address match between old (deregistered) entity and new entity — same premises, different ABN.
• Trading name that matches the old entity's name — the new company registers the old name as a trading name to capture repeat customers.

No single signal here is conclusive. The combination — and especially the director linkage — is the tell. A manual check won't surface this without deliberate effort to search by director name across ASIC's records, which most procurement workflows don't have time for.

---

The Director Problem

Australian company law is clear: the company is a separate legal entity from its directors. But in practice, the company is often the directors — particularly in SMEs. A pty ltd with a single director can present excellent company-level credentials while the director has a track record of phoenixing, banning orders, or insolvency events with other entities.

This is why director-level checks matter:

• Check ASIC's banning register for the director's name.
• Search ASIC for other companies associated with the director — look for deregistered entities with unpaid debts.
• Check AFSA for any personal insolvency proceedings against the director.

ASIC publishes company officer records as part of its bulk data extracts, but searching them manually by director name is not a one-click exercise. This is one area where automated tooling earns its keep.

---

Building a Verification Routine That Actually Gets Used

The hardest part of supplier verification isn't knowing what to check. It's making the check routine enough that it actually happens at volume, under deadline, with no one to remind you.

A few principles that procurement teams report as genuinely useful:

Tier your suppliers by risk, not just spend

High-spend suppliers aren't always the highest fraud risk. A $500 contractor who physically accesses your premises or handles payments is a higher fraud risk than a $200,000 logistics partner with a 10-year relationship. Tier verification requirements by the nature of the risk, not just the dollar amount:

• Tier 1 (full check): new suppliers with payment access, sub-contractors handling labour, financial services providers, any supplier with physical site access.
• Tier 2 (ABN + ASIC status + insolvency): established supplier categories with low access risk, existing relationships being renewed.
• Tier 3 (ABN only): one-off low-value transactions below a defined threshold.

Gate onboarding on verification completion

If verification is something that "should happen" but isn't a hard gate on the purchase order being raised, it will be skipped under deadline. Embed the verification step into the workflow — not as a form to fill, but as a required completion state before the PO can be issued.

Annual re-verification for high-risk suppliers

A supplier who was clean on onboarding can acquire a compliance notice, a company status change, or a director banning in the two years since. High-value, high-access suppliers should be re-checked at least annually — automated monitoring is the only practical way to do this at scale.

Document the result, not just the action

When an auditor asks you why you engaged Contractor X, "we checked them" is not an answer. A timestamped verification report — even just a screenshot with a date — is. The audit trail matters as much as the check itself.

---

Red Flags That Warrant Escalation (Not Just a Note)

Not every adverse signal is a deal-breaker. Some require judgment. But these should always go to a decision-maker rather than being quietly absorbed:

• Any active ASIC banning order or disqualification against a director of the supplier company.
• Active external administration or voluntary winding-up proceeding against the supplier or a related entity.
• Named on the ATO SG non-compliance register.
• Personal bankruptcy of a sole trader supplier.
• A domain registered within 12 months of the ABN, where the ABN claims to have been operating for significantly longer.
• Any AFSL, credit licence, or financial adviser authorisation that appears required by the services being provided but is missing from the register.
• Two or more of the above in combination.

The combination rule matters. A single yellow flag on an otherwise clean supplier often has an innocent explanation. Two or three flags on a single entity is a pattern, and patterns warrant a conversation before the contract is signed.

---

A Note on Timing

Supplier verification is most useful at onboarding — before you've committed. By the time a problem surfaces post-engagement, you're managing a live issue rather than preventing one. The check that takes five minutes before signing a contract can save weeks of dispute management afterward.

The registers described here are live or near-live. ASIC's company status updates within days of a change. The ATO SG and tax debt registers are quarterly. AFSA's insolvency register is updated as proceedings are gazetted. None of them require you to wait for an annual report.

Run the check before you sign. Run it again before the contract renews. That's the routine.

---

Gumshoe runs all 11 checks described in this guide in a single search — ABR, ASIC company status, insolvency, banning registers, AFSL, APRA, Fair Work, ATO SG, ATO tax debt, AFSA bankruptcy, and financial adviser register. See what each check covers, or run a search now.

Uncommon Insights

One of the lesser-known risks in supplier verification is the use of "shadow" or "shelf" companies, which are incorporated but remain dormant until needed. These companies can be used to facilitate phoenixing, where a company is deliberately wound up to avoid debts, only to be reconstituted under a new name. ASIC's Company Register can help identify these entities by showing a history of frequent changes to company details or a pattern of deregistrations and re-registrations. Procurement teams should be wary of companies with multiple name changes or those that have been recently re-registered.

Under section 596A of the Corporations Act 2001, ASIC has the power to wind up a company that is unable to pay its debts. However, this process can take time, and in the interim, the company may continue to trade and accumulate further debts. Procurement teams should check the ASIC Insolvency Notices website for any notices related to their suppliers, as these can provide early warning of potential insolvency issues. Additionally, the ATO's tax debt disclosure regime, introduced in 2019, requires the Commissioner to report tax debts over $100,000 that are more than 90 days overdue. Procurement teams should check the ATO's Tax Debt Disclosure website for any disclosures related to their suppliers.

The Australian Financial Security Authority's (AFSA) Personal Insolvency Register can provide valuable insights into the financial stability of a supplier's directors. Under section 54A of the Bankruptcy Act 1966, AFSA is required to maintain a register of all personal insolvency agreements, debt agreements, and bankruptcies. Procurement teams should check this register for any adverse information about a supplier's directors, as this can indicate a higher risk of insolvency or phoenixing. Furthermore, the Fair Work Ombudsman's (FWO) Fair Work Compliance Notices database can provide information on a supplier's compliance with workplace laws and regulations. Procurement teams should check this database for any notices related to their suppliers, as non-compliance can indicate a higher risk of reputational damage or financial instability.

Finally, procurement teams should be aware of the Australian Securities and Investments Commission's (ASIC) enforcement patterns when it comes to supplier fraud. ASIC has a strong focus on combating phoenixing and other forms of corporate misconduct. Under section 596B of the Corporations Act 2001, ASIC has the power to take action against directors who engage in phoenixing or other forms of misconduct. Procurement teams should check ASIC's website for any enforcement actions related to their suppliers, as this can provide valuable insights into the supplier's risk profile.