Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:5:p3
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 5 (pt 3/3)
Character Range: 94917–97429

position of fraud controller held by a senior officer of the entity (fraud controller).
 (2) The fraud controller must have responsibility for:
 (a) managing fraud risks; and
 (b) facilitating the entity's compliance with the fraud control requirements specified in this Part.
 (3) The fraud controller must have appropriate qualifications and experience to effectively carry out the duties specified for the position in this Part and the entity's fraud control plan.
 (4) Details of the fraud controller must be included in the accredited entity's fraud control plan.

4.28  Fraud awareness training
  An accredited entity must ensure that each of its personnel whose duties relate to its accredited services or DI data environment successfully complete appropriate training in relation to the management of fraud risks:
 (a) before starting work on those duties; and
 (b) at least once in every 12-month period thereafter.

4.29  Advice to individuals
  An ISP must provide advice to individuals about how to safeguard their digital ID against digital ID fraud risks and update that advice, as soon as practicable, as new risks and threats emerge.

4.30  Support to individuals
 (1) An accredited entity providing public-facing accredited services must provide support services to individuals who have been adversely affected by a digital ID fraud incident.
 (2) For the purposes of subrule (1), support services must, at a minimum, include the provision of:
 (a) one of the following:
 (i) a monitored chat function; or
 (ii) a monitored email function; or
 (iii) a call centre; and
 (b) a function that allows the individual to speak with a natural person.

Division 3—Fraud control plan

4.31  Fraud control plan
 (1) An accredited entity must have, maintain and comply with a plan that details the entity's key fraud risks and the structures, controls and strategies the entity has in place to counter fraud in relation to its accredited services and DI data environment (fraud control plan).
 (2) An entity of the kind specified in column 1 of an item in the following table must, at a minimum, detail each matter specified in column 2 of that item in the fraud control plan.

Fraud control plan requirements
Item                              Column 1                                                                      Column 2
                                  Kind of entity                                                                Matter to be detailed
                                    Risks