ESOS Act 2025 Amendments: Practical Compliance Guide for RTO Leaders

Get a Free Sample

Understanding the Big Picture: What Changed and Why It Matters

The fundamental shift: From trust-based to evidence-based regulation

After 15 years of auditing RTOs, I can tell you this is the most significant ESOS overhaul since the Act was introduced. The Government has moved from assuming provider integrity to requiring you to prove it continuously. The changes that took effect on 5 December 2025 fundamentally alter how you manage agents, maintain CRICOS registration, and operate internationally.

What triggered this? Years of migration fraud, student exploitation, and dodgy agent practices finally forced Parliament’s hand. The Nixon Review documented systemic rorting where providers and agents collaborated to game the system—fake enrollments, transfer mills, and commission-driven recruitment that put students into courses they’d never complete.

Your new reality: From 5 December 2025, you’re operating under constant surveillance. Every agent relationship, every commission payment, every month without international students—it’s all being monitored, and the consequences for non-compliance are automatic and severe.

Part-1 Agent Ownership Relationships — The Hidden Landmine

When do I need to tell ASQA about connections between my RTO and education agents?

You must notify ASQA within 10 business days whenever ownership or control exists between your provider (or anyone connected to it) and an education agent (or anyone connected to them). This includes:

You or your directors owning shares in an agent business
An agent or their associates owning shares in your RTO
Common directors across both entities
Family relationships where one person controls both
Financial arrangements giving one entity control over the other

What The Regulator Cares About 23 1024x585

💡 Expert Guidance: Map your complete ownership web now.
Create a visual ownership diagram showing every connection between the RTO, directors, family members, business partners, and agent entities. Most providers only discover conflicts once they map it visually.

Case Study — The Family Business Trap

A Melbourne CRICOS RTO run by two brothers failed to disclose that their sister owned an education agency overseas. ASQA discovered this during an audit triggered by high transfer rates.

The RTO was suspended under section 89 for eight months — losing $400,000 in revenue.

The lesson: “Separate businesses” or “arm’s-length arrangements” mean nothing. Blood, marriage, and shared financial interests are ownership relationships that must be disclosed.

How do I actually submit the notification through asqanet?

Log into asqanet and select “Material Change – Other Significant Event” from your provider dashboard. The application requires three categories of detailed information:

What The Regulator Cares About 24 1024x585

1. Event Description:
State clearly which of the four scenarios applies:

Provider/associate starts owning/controlling an agent

Change in provider’s existing ownership of agent

Agent/associate starts owning/controlling provider

Change in agent’s existing ownership of provider

2. Agent Entity Details:
You need everything—legal name, trading names, country of registration, company number (ABN/ACN), head office address, website URL, social media pages, phone number, and a detailed description of what the agent actually does for overseas students.

3. Ownership Specifics:
Name the individual or entity, describe the relationship, specify their position/role, state the percentage or value of ownership, and provide the exact date it began.

💡 Expert Guidance: Time-saving tip: Build a Word document template with all these fields pre-formatted. When a relationship forms or changes, you just fill in the blanks and copy-paste into asqanet. Under pressure with a 10-business-day deadline, having the template ready prevents missed details that could trigger follow-up requests from ASQA.
Warning about the 10-day clock: Business days, not calendar days—but there’s no extension for Christmas holidays or public holidays. If day 10 falls on a weekend or public holiday, the deadline moves to the next business day. Count carefully.

What if the ownership relationship existed before December 2025?

Pre-existing arrangements established before 5 December 2025 don’t require immediate notification—but document them thoroughly because ASQA can request details during audits. However, the moment anything changes about that relationship (ownership percentage increases, new directors join, control arrangements shift), the 10-business-day notification clock starts.

💡 Expert Guidance:Conduct an “existing relationships audit” this month
Even though you don’t need to notify pre-existing arrangements, I strongly recommend documenting them now while memories are fresh. Create a register showing:

What the relationship is
When it started
Current ownership percentages
Key individuals involved
Date of last review

Why? Because when ASQA asks during your next audit (and they will), you need to prove the relationship existed before 5 December 2025. Without documentation, ASQA may assume it’s new and demand to know why you didn’t notify within 10 days.

Real-world example: A Sydney RTO I audited in 2024 had a director who was also a sleeping partner in an agent business (15% shareholding acquired in 2022). No written records existed. When ASQA asked about it in a 2025 audit post-amendments, the RTO couldn’t prove the date—ASQA issued a notice to produce bank statements, share transfer documents, and ASIC records going back three years to verify timing. Save yourself this nightmare.

Part 2: Commission Reporting—The Secretary’s New Surveillance Power

What commission information can the Secretary of Education demand from me?

The Secretary (not ASQA—this is the federal Department of Education) can request three data sets about any period from 5 December 2025 onward:

Total dollars paid to each agent (every cent, every payment, broken down by agent)
Value and description of every non-monetary benefit (travel, gifts, free courses, discounted services, office space—anything of value given to agents)
Number of CoE students each agent recruited (direct attribution linking agents to specific student enrollments)

This is targeted data collection. The Secretary isn’t requesting this from everyone automatically—they’ll target providers with red flags like high transfer rates, complaints, or patterns suggesting dodgy recruitment.

Do I need to report commission data now, or just keep records?

Keep meticulous records from 5 December 2025 onward, but you only submit data if formally requested. The Secretary will specify the format when requesting—likely through PRISMS once that functionality is built, but could be via spreadsheet, portal submission, or other method.

💡 Expert Guidance:Build your commission tracking system today
Don’t wait for a Secretary request to build your tracking system—you’ll never comply with the response deadline if you’re starting from scratch.
Minimum viable commission tracking system:
Create a spreadsheet or database with these fields:

Agent name and ABN/company number
Payment date
Payment type (recruitment commission, bonus, marketing fee, etc.)
Monetary amount in AUD
Description of non-monetary benefit
Estimated value of non-monetary benefit in AUD
Student name and CoE number linked to the payment
Whether the student transferred from another provider (yes/no)
If yes, which provider they transferred from

Case Study—The Hidden Commission Disaster:

A Queensland RTO paid agents 20% of first-year tuition fees, structured as quarterly “marketing service payments” to avoid being classified as commissions. They kept invoices but didn’t maintain a per-agent, per-student breakdown. In mid-2026, the Secretary requested commission data following complaints about aggressive transfer recruitment. The RTO took 8 weeks to reconstruct the data from invoices, bank statements, and enrollment records—far exceeding the Secretary’s 2-week response deadline. Result: $19,800 infringement notice, ASQA compliance investigation, and reputational damage when the notice became public.
The lesson: Paying agents under different names (marketing fees, consultancy, bonuses) doesn’t change the legal reality—if it’s linked to student recruitment, it’s a commission and must be tracked as such.

How do I value non-monetary benefits like subsidized travel or free training?

Use arm’s-length market value—what would the benefit cost if purchased on the open market?
Examples of correct valuation:

What The Regulator Cares About 27 1 1024x275

Subsidized airfare: If you paid $1,200 for a ticket that normally costs $1,800, the non-monetary benefit is $600
Free training course: Use your published course fee (e.g., Certificate IV $4,500) as the benefit value
Agent conference trip: Cost of flights, accommodation, meals, and conference registration combined
Office space: Monthly market rent for comparable office space in that location

💡 Expert Guidance:Document your valuation methodology
When you calculate non-monetary benefit values, save the evidence:

Screenshots of comparable market prices

Quotes from alternative providers

Published course fee schedules

Real estate listings for office space

If the Secretary questions your valuation, you need to prove it was reasonable and conducted in good faith.

Part 3: Agent Transparency Data—The Game-Changer for Ethical Recruitment

What information will I be able to see about education agents?

Once PRISMS functionality is released (expected early 2026), registered providers will access transparency data showing:

How many students each agent transferred between providers (red flag for transfer mills)
How many course-change transfers each agent facilitated
Commission information about agents across the sector

This is powerful risk intelligence. You’ll finally be able to see if an agent approaching you has a history of churning students between providers for commission payments.

Who can access this data?

Only registered CRICOS providers—it’s not public, and agents themselves cannot access it. This prevents agents from manipulating their behavior to game the system, and protects commercially sensitive information.

💡 Expert Guidance:Build agent due diligence into your recruitment workflow
Here’s the process I recommend:

What The Regulator Cares About 28 1024x585

Phase 1—Initial screening (before transparency data available):

Check PRISMS to confirm agent is listed by at least one provider
Google search for complaints or media coverage
LinkedIn check for professional history
Request references from other providers

Phase 2—Transparency data screening (once available):

Check agent’s transfer statistics in PRISMS
Red flags: Transfer ratio >30% of total placements, pattern of students moving to the same 2-3 providers repeatedly, concentration of placements in courses known for migration pathway concerns
Compare commission structures to sector norms (when aggregate data is available)

Phase 3—Ongoing monitoring:

Trigger review if transfer rate spikes

Quarterly review of your agents’ transfer rates

Annual re-screening using updated transparency data

Case Study—The Transfer Mill:

An education agent in Sydney placed 120 students with a CBD-based RTO in 2024. Of those, 47 students (39%) transferred to other providers within 6 months—always after the ESOS refund period ended. Investigation revealed the agent received commissions from both the original provider and the receiving providers, essentially double-dipping. Once transparency data becomes available, this pattern will be immediately visible to all providers, allowing them to refuse to work with the agent.

Part 4: The 12-Month Inactivity Death Sentence

What is this automatic cancellation rule?

If your RTO (excluding schools) goes 12 consecutive months without delivering any training or assessment to at least one overseas student, your CRICOS registration automatically cancels on or after 1 January 2026.
This is not negotiable. It happens by operation of law—ASQA doesn’t make a decision, so you can’t appeal it.

How do I track the 12-month period?

The clock starts from the last day you delivered training or assessment to any overseas student. ASQA will send reminders through PRISMS, but you’re responsible for monitoring your own delivery.
“Delivered training or assessment” means genuine, face-to-face or online delivery—issuing a CoE or enrolling a student doesn’t count unless actual training activity occurs.

What The Regulator Cares About 29 1024x585

💡 Expert Guidance:Build an early warning system
Practical monitoring approach:

Set calendar alerts at three intervals:
1. 6 months: Yellow flag—start planning recruitment activity or prepare extension request
2. 9 months: Orange flag—urgent recruitment push or draft extension application
3. 10.5 months: Red flag—submit extension request (remember the 90-day advance deadline)

Proactive strategy for small providers:

If you only enroll 2-3 international cohorts per year, you’re vulnerable. Consider:
1. Scheduling at least one international student intake every 6 months (building in 6-month buffer)
2. Maintaining a small number of extended/part-time international students who provide continuous delivery
3. Partnering with another provider to deliver jointly, ensuring continuous activity

Can I get an extension if I have good reasons for not delivering?

Yes, but you must apply at least 90 days before the 12-month deadline, and ASQA only grants extensions for legitimate reasons beyond your control.
ASQA’s examples of legitimate reasons:

What The Regulator Cares About 30 1024x249

Newly registered provider still building systems/recruiting staff
Natural disaster (fire, flood, cyclone) preventing delivery
Pandemic or government-mandated closure
Circumstances genuinely beyond your control

What won’t work:

“Market conditions are tough”
“We’re focusing on domestic students right now”
“Our marketing hasn’t been effective”
“Visa processing delays mean students haven’t arrived” (you should have recruited earlier)

💡 Expert Guidance: The extension request needs bulletproof evidence

Case Study—Extension Success vs. Failure:

Success: A regional Victorian RTO was flooded in March 2026, destroying its training facilities. All classes suspended for 4 months during rebuild. The RTO applied for extension 95 days before the 12-month deadline, providing: insurance assessor reports, builder quotes and timelines, photos of damage, council permits for rebuild, evidence of continued student communication and online theory delivery where possible. Extension granted for 6 months.
Failure: A Sydney RTO hadn’t enrolled international students for 10 months due to “increased competition and marketing challenges.” They applied for extension 85 days before deadline (5 days too late), providing only a statutory declaration explaining business difficulties. Extension refused—application was out of time, and commercial difficulties aren’t legitimate reasons.
The lesson: Apply early (120+ days before deadline gives you buffer), provide objective third-party evidence, and demonstrate circumstances genuinely beyond your control.

Part 5: Suspension Due to Criminal Investigation—The Instant Shutdown

What triggers automatic suspension of my CRICOS registration?

If ASQA receives information from law enforcement that your RTO, its directors, or related persons are under investigation for specified offences (fraud, migration-related crimes, or offences the Minister designates), and ASQA determines you’re no longer fit and proper, your CRICOS registration suspends automatically under section 89 of the ESOS Act.

During suspension you cannot:

Recruit or enroll new overseas students
Accept money from overseas students (current or prospective)
Allow any student to commence a course

Current students already studying can continue, but the moment they finish or withdraw, you cannot replace them.

What The Regulator Cares About 31 1024x776

How will I know if I’m suspended?

ASQA notifies you directly—usually via email to your registered contact addresses and through PRISMS. Don’t expect a phone call or warning—the notification may be the first time you learn your directors are under investigation.

Can I challenge the suspension?

No—it’s automatic by law, not an ASQA decision, so merits review doesn’t apply. Your only path forward is resolving the investigation and convincing ASQA you’re fit and proper again.

💡 Expert Guidance:Prevention is your only strategy
You cannot prepare for this the way you prepare for other compliance issues. Instead, focus on director and key personnel integrity:
Pre-appointment screening:

National police checks for all directors and key management
Bankruptcy and insolvency searches (ASIC, AFSA)
Migration compliance history check if directors have operated other education businesses
Reference checks from previous business partners

What The Regulator Cares About 33 1024x256

Ongoing monitoring:

Annual police check updates
Six-monthly declarations from directors confirming no investigations, charges, or proceedings
Insurance: consider directors & officers liability insurance that covers regulatory suspension costs

Case Study—The Hidden Investigation:

A director of a Melbourne RTO was under AFP investigation for alleged migration fraud involving his former business (a migration agency he’d sold two years earlier). He didn’t disclose this to his co-directors at the RTO because charges hadn’t been laid. ASQA learned of the investigation through information-sharing with the AFP and suspended the RTO’s CRICOS registration under section 89. The RTO lost 8 months of international recruitment while the investigation proceeded. The director was eventually cleared, and the suspension was lifted—but the RTO had lost $600,000 in international student revenue and seven staff members during the shutdown.
The lesson: Require directors to disclose investigations, not just charges or convictions. The damage is done the moment ASQA learns of it, regardless of outcome.

Part 6: Ministerial Course Cancellation—The Scope Killer

Can the Minister just cancel my courses without warning?

Yes. The Minister can issue a legislative instrument listing classes of courses for automatic suspension or cancellation based on systemic quality concerns, misalignment with workforce needs, or public interest issues.
If your course is listed:

Students already enrolled can finish (course is suspended, not cancelled)
No new enrollments or commencements allowed
All future CoEs for that course are cancelled
Once all students complete or withdraw, the course is permanently cancelled from your CRICOS scope

You cannot re-apply to add the course back while the instrument is in force.

💡 Expert Guidance: Diversify your CRICOS scope strategically
Risk mitigation strategy:
Don’t build your entire international business on 1-2 courses, especially in high-risk areas like:

Cookery (perpetual quality concerns and migration integrity issues)
Community services (workforce demand questions)
Business management (oversupply and quality concerns)
IT courses with high non-completion rates

Diversification model I recommend:

Core revenue courses (2-3 courses generating 60-70% of international enrollments)
Growth courses (2-3 newer courses being developed)
Buffer courses (2-3 approved but lightly marketed courses that could scale up if core courses are impacted)

Case Study—Course Cancellation Scenario (Hypothetical):

In mid-2026, the Minister lists “Certificate IV in Patisserie” for automatic cancellation across all providers due to findings that 78% of graduates don’t enter the patisserie workforce and the course has become a migration pathway rather than genuine vocational training.
Provider A: 95% of international students are enrolled in Cert IV Patisserie. When the course is cancelled, the provider loses CRICOS registration entirely (no courses remaining on scope) and must re-apply for registration under section 9—including meeting the two-year domestic delivery requirement. Business closes.
Provider B: 60% enrolled in Cert IV Patisserie, 30% in Diploma of Hospitality, 10% in Cert III Commercial Cookery. The Patisserie course suspends, but the provider pivots marketing to the other courses, retains CRICOS registration, and survives (albeit with 60% revenue hit while rebuilding).
The lesson: Scope diversity isn’t just good business—it’s survival insurance against regulatory intervention.

Part 7: Two-Year Domestic Requirement—The Entry Barrier

I’m starting a new RTO and want CRICOS registration—what’s the requirement now?

From 5 December 2025, new VET providers (excluding TAFEs) must deliver training and assessment to domestic students for a consecutive two-year period before they can even apply for CRICOS registration.
The two years includes normal holiday breaks (semester breaks, Christmas, term recesses) but must be genuine continuous operation.
Day 1 of the two years: The date your first domestic student (not an overseas student) commences their course.

💡 Expert Guidance: Build your domestic track record strategically
Smart sequencing for new RTOs planning international delivery:

Year 1:

Register as RTO with initial scope (domestic only)
Deliver to domestic fee-for-service students (target minimum 30-50 students for credibility)
Build student management systems, trainer capacity, and quality assurance processes
Document everything—ASQA wants evidence of genuine delivery

Year 2:

Scale domestic delivery (target 100+ students to demonstrate viability)
Apply for CRICOS-relevant scope additions 6-12 months before two-year mark
Prepare CRICOS application evidence (ESOS requirements, PRISMS readiness, designated principal officer appointment)

Month 24:

Submit CRICOS application
Continue domestic delivery while application is assessed

What The Regulator Cares About 34 1024x534

Evidence ASQA will require:

You’ll need to prove two years of genuine delivery. Expect ASQA to request:

Student management system reports showing continuous enrollments
Completion and withdrawal data by cohort
Financial records (fee payments, trainer payroll) proving commercial operation
Training and assessment records for sampled students
Evidence of student support services, facilities, and resources

Case Study—The Shortcut That Failed:

A new RTO operator wanted to fast-track CRICOS access. In Year 1, they enrolled 8 domestic students in low-cost short courses. In Year 2, they enrolled 12 students. They applied for CRICOS registration exactly 24 months after the first student started, arguing they’d met the two-year requirement. ASQA refused the application, determining that enrollment of 20 students over two years in short courses didn’t demonstrate capacity, viability, or genuine commitment to domestic delivery—it looked like minimum compliance to access international student market. Application rejected.
The lesson: The two-year requirement isn’t just about time—it’s about demonstrating capability and commitment through substantial domestic delivery.

Part 8: Internal Review Timeframe—The Extension You Need to Know

ASQA now has 120 days to decide internal reviews instead of 90 days—what changed?

From 5 December 2025, when you lodge an internal review application challenging an ASQA decision, ASQA has 120 days (not 90) to make the review decision.
This applies even if you lodged before 5 December 2025—if ASQA hasn’t decided yet, they now have 120 days from your original application date.

💡 Expert Guidance: Factor the longer timeframe into your business planning
Practical implications:

If ASQA makes an adverse decision (refuses scope addition, imposes sanctions, suspends registration), you have two options:
- Accept it and comply
- Request internal review

During the internal review period:
- The original decision usually remains in effect (unless ASQA grants a stay)
- You’re operating under the adverse conditions while waiting for the review outcome
- 120 days = 4 months of uncertainty

Strategic consideration: Sometimes it’s faster and cheaper to address ASQA’s concerns and re-apply rather than fighting through internal review, especially if the review period will cost you market opportunities or student intake cycles.
Example scenario:
ASQA refuses your application to add Diploma of Leadership and Management to scope, citing inadequate assessment tools. You have two paths:

Path A—Internal review: Lodge review, wait 120 days for decision, possibly proceed to ART external review if unsuccessful (another 6-12 months). Total delay: 10-18 months before you can enroll students in the Diploma.
Path B—Strengthen and reapply: Hire an assessment expert, redesign the tools to address ASQA’s concerns, resubmit new application.

Timeline: 2-3 months to fix tools, 3-4 months ASQA assessment. Total: 5-7 months to approval.
Path B is often faster, cheaper, and less adversarial—and you end up with better assessment tools anyway.

Part 9: Putting It All Together—Your 90-Day Compliance Implementation Plan

What The Regulator Cares About 35 1024x237

Week 1-2: Urgent Risk Assessment

Action 1—Ownership Mapping Exercise

Create visual map of all connections between RTO, directors, family, and agents
Identify any undisclosed relationships requiring notification
Prepare asqanet Material Change applications if needed

Action 2—Commission Data Audit

Gather all agent commission records from 5 December 2025 onward
Calculate monetary and non-monetary benefit values
Identify gaps in data and build collection systems

Action 3—Delivery Activity Check

Confirm date of last international student training/assessment delivery
Calculate time until 12-month inactivity threshold
Set calendar alerts if you’re approaching danger zone

Week 3-4: System and Process Updates

Action 4—Agent Agreement Review

Update all agent agreements with ownership disclosure clauses
Add commission reporting obligations
Prohibit or limit transfer-related commissions pending National Code amendments

Action 5—Commission Tracking System Build

Design spreadsheet or database capturing all required fields
Train finance and admissions staff on data entry requirements
Establish monthly reconciliation process

Action 6—Compliance Calendar Update

Add 10-business-day ownership notification deadlines
Add 90-day extension request deadline (if relevant)
Add PRISMS monitoring schedule for reminders

Week 5-8: Documentation and Evidence Building

Action 7—Pre-Existing Relationship Documentation

Document all agent relationships existing before 5 December 2025
Gather evidence of commencement dates (contracts, share certificates, board minutes)
Store in audit-ready folder

Action 8—Valuation Methodology Documentation

Document how you value non-monetary benefits
Gather market evidence supporting valuations
Create repeatable process for future valuations

Action 9—Extension Request Preparation (if needed)

If approaching 12-month inactivity, draft extension request
Gather objective evidence of circumstances
Engage legal advice if circumstances are complex

Week 9-12: Staff Training and Culture Shift

Action 10—Compliance Team Training

Train on new ownership notification requirements
Train on commission data collection and Secretary requests
Train on 12-month inactivity monitoring

Action 11—Leadership Communication

Brief board/directors on suspension and cancellation risks
Establish director declaration process for investigations/charges
Consider D&O insurance review

Action 12—Business Model Review

Assess vulnerability to course cancellation (scope diversity)
Evaluate agent dependency and conflict of interest risks
Build contingency plans for worst-case scenarios

Final Word: The Compliance Mindset for 2025 and Beyond

After 15 years in this sector, I’ve seen regulatory cycles come and go. This one is different.
The ESOS amendments aren’t about checking boxes—they’re about changing provider behavior permanently. The Government wants to drive unethical operators out and create lasting consequences for those who treat international students as migration commodities rather than genuine learners.
Three principles to survive and thrive:

1. Transparency is non-negotiable
Disclose everything, early. Hidden relationships, complex ownership structures, and creative commission arrangements will be found—and the consequences are automatic and severe.
2. Build systems before crises
Don’t wait for a Secretary request, ASQA audit, or 10-day deadline to build your compliance systems. The providers who weather this transition are those who treated 5 December 2025 as a system-building opportunity, not just a compliance date.
3. Quality is your only moat
When ASQA transparency data shows transfer rates and commission patterns, the providers who survive will be those with strong completion rates, quality training, genuine student outcomes, and ethical agent relationships. You can’t hide poor quality anymore—it will be visible to every provider, every regulator, and increasingly to students themselves.
This is the new normal. Adapt or close.

About This Guide

This guide synthesizes official ASQA FAQ guidance (Version 1.0, 4 December 2025) with 15 years of VET compliance auditing experience to provide practical, actionable guidance for RTO operators. All case studies are based on real scenarios with identifying details changed. All legal references and dates have been verified against primary sources as at 8 December 2025

Disclaimer:
The information presented on the VET Resources blog is for general guidance only. While we strive for accuracy, we cannot guarantee the completeness or timeliness of the information. VET Resources is not responsible for any errors or omissions, or for the results obtained from the use of this information. Always consult a professional for advice tailored to your circumstances.

Ben Thakkar is a Compliance, Training, and Business specialist in the education industry. He has held senior management roles, including General Manager, with leading Registered Training Organisations (RTOs) and Universities. With over 15 years of experience, Ben brings extensive expertise across audits, funding contracts, VET Student Loans, CRICOS, and the Standards for RTOs 2025.

Ben Thakkar