ESOS penalties in 2026: 60 vs 10 penalty units and who is liable

Under the Education Services for Overseas Students Act 2000 (ESOS Act) as published on the Federal Register of Legislation, as at September 2026, the gap between 60 and 10 penalty units is not a discount scale — it is a question of which instrument creates the offence. The offences written into the sections covered here — sections 19, 21, 21A, 21B and 32 — each carry 60 penalty units, while section 44 of the Act says an offence that the regulations create for breaching a prescribed provision of the National Code must be punishable by a fine of no more than 10 penalty units. This article is general reference only and not personalised professional advice; for a specific matter, rely on the official legislation and on qualified advice.

Why is there a 60 and a 10 in the same Act?

Because they come from different sources of law. Parliament wrote the 60 penalty unit offences directly into the Act's sections, and each of them states its own penalty. Section 44 then delegates a much smaller power to the regulations: they may make it an offence to breach prescribed provisions of the National Code, but that offence "must be punishable by a fine of no more than 10 penalty units".

In other words, the severity tracks the instrument, not the seriousness of the underlying conduct. Reporting, record-keeping, agent-list and commission-reporting duties sit at the top of the scale because the Act names them; National Code compliance sits at the bottom because Parliament capped what delegated legislation may impose.

Offence	Source	Who must comply	Maximum penalty	Strict liability
s 19 — reporting information about accepted students and visa condition breaches	Act	Registered provider; principal executive officer if unincorporated	60 penalty units	Yes (s 19(6))
s 21 — student records, six-monthly confirmation, assessment records, retention	Act	Registered provider; principal executive officer if unincorporated	60 penalty units	Yes (s 21(6))
s 21A — maintaining and publishing the education agent list	Act	Registered provider	60 penalty units	Yes (s 21A(1B))
s 21B — complying with a Secretary's commission reporting request	Act	Registered provider	60 penalty units	Yes (s 21B(8))
s 32 — conduct contravening a requirement of s 28 or 29 where the provider is not covered by s 31	Act	Registered provider; principal executive officer if unincorporated	60 penalty units	Yes (s 32(3))
Breach of a prescribed National Code provision	Regulations under s 44	As prescribed by the regulations	No more than 10 penalty units	As prescribed

The Act states these penalties in penalty units rather than dollars, and no dollar conversion appears in the sections covered here.

Which duties actually attract the 60 penalty unit figure?

Four reporting and record duties, plus one conduct offence, are stated in the Act at 60 penalty units.

Section 19 — information about accepted students. A registered provider must report, within the applicable number of days: each person who becomes an accepted student; the name, starting day and expected duration of the course; prescribed information about a student who does not begin when expected; any termination of studies before completion; any change in the identity or duration of a course; and any other prescribed matter. The applicable number of days is 14 where the student is under 18 and the information is about not starting or termination, and 31 days otherwise. Separately, a provider must give particulars of a breach of a prescribed student visa condition as soon as practicable, and that duty continues even after the student stops being an accepted student.
Section 21 — record keeping. Records must include the student's current residential address, mobile number (if any), email address (if any) and other prescribed details. The provider must have a procedure to confirm those details with the student in writing at least every six months while the student remains accepted, and update records accordingly. Assessment outcomes must be recorded for each completed unit of study and kept up to date. Records must be retained for at least two years after the person ceases to be an accepted student.
Section 21A — education agents. The provider must maintain a list of all its education agents and publish it on its website and in any other manner the regulations prescribe, and comply with requirements made under subsection (2).
Section 21B — agent commissions. Where the Secretary requests specified information about commissions given to agents over a reporting period, the request must be in writing and must specify the reporting period, the due day, the manner or form (which may include entry into the computer system established under section 109), and any accompanying documents. The due day must be at least 30 days after the request is given. The information may cover the total amount in dollars given to each agent, the value and description of non-monetary benefits, and the number of accepted students each agent recruited.
Section 32 — conduct contravening sections 28 or 29. This applies where the person is a registered provider (or its principal executive officer, for an unincorporated body), engages in conduct that contravenes a requirement of section 28 or 29, and the provider is not covered by section 31.

Who is liable if the provider is not a company?

The Act shifts the duty onto a named individual. Where the registered provider is an unincorporated body, the principal executive officer — not the body — must give the information required by section 19 and must keep and retain the records required by section 21. Section 32 also reaches the principal executive officer directly where an unincorporated provider contravenes a requirement of section 28 or 29.

For the section 21A and 21B offences, the Act frames the duty and the offence on the registered provider without the unincorporated-body carve-out.

Does intent matter for a 60 penalty unit offence?

No, for all five offences listed above. Each one is expressly an offence of strict liability, and the Act points to section 6.1 of the Criminal Code for what strict liability means. The practical effect is that the prosecution does not need to prove the provider meant to fail; the failure to comply is the offence. This is why compliance systems and deadlines matter more than explanations after the fact.

Does the 10 penalty unit cap cover every National Code breach?

No. Section 44(1) says the regulations may make it an offence to breach prescribed provisions of the National Code. Two limits follow. First, only provisions the regulations actually prescribe carry a criminal penalty at all. Second, where they do, the penalty ceiling is 10 penalty units and cannot be set higher.

The Act also draws an explicit line at section 32(2): that offence does not apply where a person contravenes a requirement of regulations made under section 30. So a breach of section 30 regulations is not prosecuted through the 60 penalty unit pathway in section 32.

What else follows from a breach, besides the fine?

The Act notes attached to sections 19, 21, 21A and 21B each record that if a registered provider breaches the section, the ESOS agency for the provider may take action under Division 1 of Part 6 against the provider. The criminal penalty and that administrative action are separate tracks.

Two further points matter in practice:

False or misleading information is separately covered. Notes to sections 19 and 21B point to section 108 for the offence of providing false or misleading information when complying, or purporting to comply, with those sections.
Continuing offences do not apply to the commission-reporting offence. Section 21B(9) says section 4K (continuing offences) of the Crimes Act 1914 does not apply to the offence in section 21B(7).

Frequently Asked Questions

Is 60 penalty units the highest penalty in the ESOS Act?

It is the figure attached to the offences the Act itself creates for provider duties, including sections 19, 21, 21A, 21B and 32. It is not a general maximum for the whole Act, and the sections covered here state penalties in penalty units rather than dollars.

Can a National Code breach ever be punished with 60 penalty units?

Not through section 44. That provision caps an offence created by the regulations for breaching a prescribed National Code provision at a fine of no more than 10 penalty units. A 60 penalty unit charge would have to come from a section of the Act itself.

Who carries the duty when the provider is an unincorporated body?

Sections 19 and 21 both provide that the principal executive officer must give the information, or keep and retain the records, instead of the body. Section 32 also applies to the principal executive officer of an unincorporated registered provider.

Does the regulator have to prove the provider intended to breach the rules?

No for the offences discussed here. Sections 19(6), 21(6), 21A(1B), 21B(8) and 32(3) each state that the offence is one of strict liability, referring to section 6.1 of the Criminal Code.

How long does a provider have to report a student who does not start?

Section 19(1A) sets the applicable number of days at 14 where the student is under 18 and the information concerns not beginning as expected or termination of studies, and 31 days in any other case.

Does the failure to answer a commission reporting request keep running as an offence day by day?

No. Section 21B(9) states that section 4K (continuing offences) of the Crimes Act 1914 does not apply to the offence under section 21B(7).

Is the fine the only consequence for a provider?

No. The notes to sections 19, 21, 21A and 21B record that the ESOS agency for the provider may take action under Division 1 of Part 6 where the provider breaches the section.