A purchased lead carries obligations the moment you call it. What to confirm before buying, and the consent record ACMA expects to see.
Figures in this article describe the wider market and are drawn from the third-party sources listed at the end. They are not Lead Foundry results, and nothing here is a projection of what any individual broker will achieve.
An Australian broker buying leads is buying an obligation alongside the record. The obligation attaches on contact rather than on purchase, which means the diligence has to happen before the first dial.
This sets out what applies and what to confirm with a supplier. It describes published regulatory guidance rather than advising on your licence.
ASIC RG 273 is the guide for mortgage brokers and other relevant Australian credit licensees, explaining what ASIC looks for when assessing compliance with the best interests obligations in Part 3-5A of the National Consumer Credit Protection Act 2009. The duty commenced on 1 January 2021.
Two features matter for anyone buying leads. Where there is a conflict of interest, brokers must prioritise the consumer's interests. And ASIC states that a failure to consider cost and investigate the lowest cost options available to the customer may suggest non-compliance.
The anti-avoidance provision is equally direct. Under section 158T, brokers cannot purport to contract out of the duty by any scheme or conduct. ASIC is explicit that the obligation cannot be avoided by any notice or disclosure provided to or signed by the customer, nor by procuring the customer's consent to credit assistance or to a conflict of interest.
How this connects to lead buying: A lead fee is an acquisition cost rather than a product commission, so it does not usually create a lender bias. It does create pressure to convert. Since the duty cannot be disclosed away, the only workable answer is to keep "no credit assistance is appropriate here" a genuinely available outcome.
The financial product hawking prohibition restricts unsolicited real-time offers of financial products. For a broker, the practical effect is that a lead captured without proper consent is a licence risk you inherit the moment you call, rather than merely a lower quality record.
The defence is documented consent, and consent is created upstream. That makes the supplier's capture process part of your compliance position, which is the strongest argument for buying from an operator who owns the consumer brand and captures consent on their own form.
ACMA has published its expectations for businesses conducting telemarketing and e-marketing under the Spam Act 2003 and the Do Not Call Register Act 2006. Consent may be express or inferred, with express consent being where a consumer has explicitly and freely consented.
The record-keeping expectation is specific. Businesses remain responsible for reliable, well-maintained consent records covering the method used to provide consent, the terms of that consent, and the date and time it was obtained. ACMA can require production of those records on complaint.
| ACMA names as non-compliant | What it means when buying leads |
|---|---|
| Adding contact details to marketing lists without consent | A supplier appending data from other sources is a problem |
| Relying on old consent | Aged leads carry aged consent, which weakens with time |
| Requiring account login to unsubscribe | Check the supplier's opt-out route, since it reflects on you |
| Inferring consent from a one-off purchase | A past transaction is not consent for new marketing |
If making a telemarketing call to a number listed on the Do Not Call Register, you must have the call recipient's consent to do so.
ACMA, consent expectations for businesses using direct marketing
APP 5 requires that, at or before collection, an entity takes reasonable steps to notify the individual of its identity and contact details, the purposes of collection, the consequences of not providing the information, usual disclosures, and how to access, correct or complain.
APP 7 then governs direct marketing, and it is the provision written for this situation. Where personal information has been collected from a third party, or where the individual would not reasonably expect direct marketing use, an organisation may only direct-market if it notified the individual under APP 5.1 that direct marketing was one of the purposes of collection. The OAIC guidelines name third-party lead generation explicitly as a source of caught data, and add an obligation to make the individual aware of the right to opt out.
The artefact that matters most: A consent record with method, terms and timestamp, per enquiry. A general assurance that "all leads are consented" is not the thing ACMA would ask you to produce.
Australia is the most broker-mediated mortgage market there is. MFAA data puts broker share of new residential home loans at 81.0% for the March 2026 quarter, up from 55.3% eight years earlier, with leading aggregators settling A$124.88 billion in that quarter alone.
A market that concentrated is a market where conduct standards are watched closely, and where the volume of consumer contact is high enough that a supplier with weak consent practices will eventually generate a complaint. Buying carefully is cheaper than defending.
Yes. Buying enquiry data is not prohibited. You need an Australian Credit Licence or credit representative status to provide credit assistance, the best interests duty under ASIC RG 273 applies to that assistance, the hawking prohibition restricts unsolicited contact about financial products, and the Spam Act 2003 and Do Not Call Register Act 2006 govern how you may make contact.
Yes, and it cannot be contracted out of. ASIC RG 273 explains the obligations under Part 3-5A of the National Consumer Credit Protection Act 2009, and section 158T prevents avoidance by any scheme or conduct. ASIC states the duty cannot be avoided by any notice or disclosure given to or signed by the customer, nor by obtaining the customer's consent to a conflict of interest.
ACMA expects reliable records covering the method used to provide consent, the terms of that consent, and the date and time it was obtained, and can require their production on complaint. Ask your supplier for that record per enquiry rather than accepting a general assurance, and check whether the collection notice named direct marketing as a purpose, which APP 7 requires for third-party-sourced data.
It restricts it rather than prohibiting it. Where personal information came from a third party, or the individual would not reasonably expect direct marketing use, you may only direct-market if the individual was notified under APP 5.1 that direct marketing was a purpose of collection. You must also make them aware of the right to opt out. The OAIC guidelines name third-party lead generation as caught data.