NDIS provider penalties increased sharply in 2026. Under the NDIS Amendment (Integrity and Safeguarding) Act 2026, serious contraventions can attract civil penalties of up to 10,000 penalty units, which is $3.64 million for an individual and generally up to five times that for a company. Delivering registration-required supports while unregistered, and breaching a banning order, are now criminal offences. From 1 July 2026, one Commonwealth penalty unit is worth $364.
Until this year, the highest fine a company could face for a serious NDIS Code of Conduct breach was $412,500.
Now it can exceed $18 million.
Most providers will never come close to that. But the same law that raised the ceiling also created new, everyday penalties: for ignoring a Commission information request, for giving the Commission misleading information, and for operating without registration. A second law added a 7-year record-keeping duty with its own civil penalty.
This guide explains which NDIS provider penalties changed in 2026, what each one costs, how the Commission escalates enforcement, and the practical steps that keep you well away from all of it.
What changed for NDIS provider penalties in 2026?
Two laws reshaped the penalty framework this year:
The NDIS Amendment (Integrity and Safeguarding) Act 2026. It received Royal Assent on 8 April 2026, and its regulatory powers started on 9 April. It brought in new civil penalties, new criminal offences, broader banning orders and a new tool called anti-promotion orders. The NDIS Commission's announcement of its new powers summarises the changes.
The NDIS Amendment (Securing the NDIS for Future Generations) Act 2026. It received Royal Assent on 20 August 2026. From 27 August, it gave the NDIA and the Commission stronger enforcement powers and created new offences. These cover giving false or misleading information, obtaining NDIS funds by deception, abusing a nominee's position and intentionally destroying records. It also introduced a 7-year record-keeping duty for providers.
What is a penalty unit?
A penalty unit is how Commonwealth law expresses fines. From 1 July 2026, one penalty unit is worth $364, set by the Crimes (Amount of a Penalty Unit) Instrument 2026. For contraventions between 7 November 2024 and 30 June 2026, it was $330. The value that applies is the one in force when the breach happened.
Companies generally face up to five times the civil penalty set for an individual.
NDIS penalty table 2026: what each breach can cost
Maximum amounts for an individual, at $364 per penalty unit:
Contravention | Type | Maximum penalty | Maximum fine (individual) |
|---|---|---|---|
Serious Code of Conduct contravention | Civil | 10,000 penalty units | $3,640,000 |
Delivering registration-required supports while unregistered | Criminal | 2 years' jail and/or 120 penalty units | $43,680 |
Same, strict liability offence | Criminal | 60 penalty units | $21,840 |
Same, serious contravention | Civil | 10,000 penalty units | $3,640,000 |
Breaching a banning order | Criminal | 5 years' jail and/or 300 penalty units | $109,200 |
Breaching a banning order, serious | Civil | 10,000 penalty units | $3,640,000 |
Breaching a banning order, other | Civil | 500 penalty units | $182,000 |
Breaching an anti-promotion order | Civil | 250 penalty units | $91,000 |
Giving the Commission false or misleading information | Civil | 120 penalty units | $43,680 |
Failing to comply with an information request | Civil | 60 penalty units | $21,840 |
Failing to keep claim records for 7 years | Civil | 120 penalty units | $43,680 |
Disclosing a protected whistleblower's identity | Civil | 30 penalty units | $10,920 |
For a company, a serious contravention can reach 50,000 penalty units, which is $18.2 million. That matches the Commission's "more than $15 million" figure, which was calculated at the old $330 rate.
Who can face NDIS penalties?
Penalties don't only apply to registered providers.
Registered providers must comply with the Practice Standards, their registration conditions and the NDIS Code of Conduct.
Unregistered providers must still follow the Code of Conduct, and can now commit a criminal offence by delivering supports that require registration. Since 1 July 2026, that includes SIL and NDIS digital platform services. See registered vs unregistered providers.
Workers are bound by the Code of Conduct and can be banned.
Registration applicants, approved quality auditors and consultants can now be banned too. Before 2026, banning orders covered only providers and their workers.
Holding yourself out as able to deliver registration-required supports also counts as a contravention, even if you haven't delivered them yet. If you deliver SIL and haven't applied, read how to become a registered NDIS provider and SIL provider compliance.
How the NDIS Commission enforces: from notice to prosecution
Big fines are rarely the first step. The Commission chooses a response that fits the risk. These are the main tools, from least to most serious:
Education and warnings for minor or first-time issues.
Compliance notices requiring you to fix a specific breach by a set date.
Infringement notices, which are fixed fines for some contraventions.
Enforceable undertakings, where you formally commit to corrective action.
Conditions, suspension or revocation of your registration.
Banning orders that stop a person or organisation from operating in the NDIS.
Anti-promotion orders that restrict misleading marketing about NDIS supports.
Civil penalty proceedings in court.
Criminal prosecution for the new offences.
Ignoring a compliance notice is one of the fastest ways to move up that ladder.
What triggers NDIS provider penalties in practice?
Worker screening
Rostering a worker without a valid clearance in a risk-assessed role breaches your registration conditions and can lead to enforcement action. Check screening against each shift date, not just today's. See worker screening requirements and staff credential tracking.
Incident reporting
Reportable incidents must be notified on time: within 24 hours for Priority 1 and 5 business days for Priority 2. Late or missing notifications are a common trigger. See SIRS compliance.
Record keeping
Since 27 August 2026, providers must keep records relating to claims for 7 years, backed by a civil penalty. See NDIS record keeping requirements.
False claims
Claiming for supports that weren't delivered, or inflating claims, can now be prosecuted under the new fraud offences. From 1 December 2026, claims must also be made within 90 days. Our claiming guide covers clean claiming.
Audit non-compliance
Audit non-conformities aren't fines. Unresolved major findings can lead to registration being refused, conditioned or revoked. See common NDIS audit findings.
How to reduce your NDIS penalty risk
Confirm your registration status covers every support you deliver, especially SIL.
Block rostering for expired screening. Don't just track the expiry dates.
Reconcile incidents monthly against Commission notifications.
Set record retention to 7 years for everything linked to a claim.
Answer Commission requests quickly and accurately. Both a late answer and a misleading one now carry a penalty.
Review your marketing for any claims about how NDIS funds can be spent.
Update your whistleblower and complaints policies for the new protections.
Run an internal audit every quarter so problems surface internally first.
For the full 2026 timeline, see NDIS compliance changes 2026.
Key takeaways
One Commonwealth penalty unit is worth $364 from 1 July 2026.
Serious contraventions can reach 10,000 penalty units ($3.64 million) for individuals and about $18.2 million for companies.
Unregistered provision of registration-required supports, and breaching a banning order, are now criminal offences.
Banning orders now reach applicants, auditors and consultants, and the new anti-promotion orders target misleading marketing.
Most penalty risk comes from everyday gaps: screening, incident timeframes, records and claims.
Frequently asked questions
What happens if an NDIS provider breaks the rules?
The NDIS Commission matches its response to the risk. Options range from warnings and compliance notices to infringement notices, enforceable undertakings, registration suspension or revocation, banning orders, civil penalties of up to millions of dollars, and criminal prosecution.
What is the new banning order law for the NDIS?
Since April 2026, banning orders can apply to registration applicants, approved quality auditors and consultants, as well as providers and workers. Breaching a banning order is now a criminal offence, with up to 5 years' imprisonment or 300 penalty units.
How much is a penalty unit in 2026?
One Commonwealth penalty unit is $364 for contraventions on or after 1 July 2026. For contraventions between 7 November 2024 and 30 June 2026, it was $330.
Can unregistered NDIS providers be penalised?
Yes. Unregistered providers must follow the NDIS Code of Conduct. Delivering supports that require registration without being registered can be a criminal offence, with civil penalties of up to 10,000 penalty units for serious contraventions.
What are the penalties for false NDIS claims?
New offences from 27 August 2026 cover false or misleading information and obtaining NDIS funds by deception. Giving the Commission false or misleading information also carries a civil penalty of 120 penalty units, and the NDIA can recover incorrect payments.
Do NDIS audit non-conformities result in fines?
No. Audit findings lead to corrective action plans, not fines. However, unresolved major non-conformities can affect your registration, and the breaches behind them, such as unscreened workers, can lead to separate enforcement action.
How do I report an NDIS provider?
Contact the NDIS Quality and Safeguards Commission. It handles complaints about the quality and safety of NDIS supports and about provider conduct, including concerns raised by participants, families and workers.
Stay well below the ladder
It sounds like the worry isn't the $18 million headline. It's not knowing whether one expired check or one late notification is already sitting in your records.
CareVisor blocks rostering on expired screening, tracks incident timeframes, and keeps claim records time-stamped and retained. Start a free trial and see your gaps before the Commission does. No credit card is needed.
About CareVisor
CareVisor is the audit-ready operating system for Australian NDIS providers, built in Sydney by NDIS operators who have prepared for and passed Quality and Safeguards Commission audits. Worker screening, incident reporting, claiming, record keeping, complaints and SCHADS payroll live in one platform mapped to the NDIS Practice Standards, with a time-stamped audit trail that keeps evidence ready on request. See how it works as NDIS compliance software, or check your workforce exposure with a SCHADS payroll audit.
