Due diligence on Australian education providers in 2026: registration, ESOS agency and sanctions

Before recommending an Australian education provider in 2026, three checks come first: whether the provider is registered on CRICOS for the specific course and location, which ESOS agency is responsible for it, and whether any sanction — suspension or cancellation of registration — could interrupt a student's enrolment. Under the National Code of Practice for Providers of Education and Training to Overseas Students 2018 (National Code 2018) as published on the Federal Register of Legislation, registration is granted for a course at a location, and breaches of the National Code can lead to action against a provider under Division 1A of Part 6 of the Education Services for Overseas Students Act 2000 (ESOS Act), including suspension or cancellation of registration. This is a general map of that framework, not advice on any individual case; a specific enrolment or visa decision turns on the official record and, where needed, on professional advice.

Is the provider registered for this course, at this location?

"Registered provider" is narrower than most people assume. As defined in section 5 of the ESOS Act, the registered provider for a course for a location means a provider that is registered to provide that course at that location. A well-known institution name therefore answers very little on its own: the question is whether the particular course, at the particular campus, sits on the Commonwealth Register of Institutions and Courses for Overseas Students (CRICOS), the register prescribed under section 14A of the ESOS Act.

The same course-specific logic runs through the Confirmation of Enrolment (CoE). A CoE is a document, provided electronically, issued by the registered provider to intending overseas students, and it must accompany their application for a student visa; it confirms the student's eligibility to enrol in that particular course of that provider.

Registration under the ESOS Act is also a separate concept from course accreditation. An accrediting authority is the organisation designated by or under Commonwealth or state or territory legislation to accredit persons or organisations to offer education or training services to Australian students, and self-accrediting institutions are established by or under that legislation with authority to accredit their own courses. One status does not stand in for the other in a due diligence file.

Which ESOS agency is responsible for this provider?

The ESOS framework is administered across Commonwealth, state and territory agencies. "ESOS agency" takes the meaning given by section 6C of the ESOS Act, and in practice the responsible agency follows the sector of the course:

Course or provider type	ESOS agency under the ESOS Act
Higher education courses	TEQSA — Australia's independent national regulator of the higher education sector
Vocational education and training, including registered training organisations (RTOs) within the meaning of the National Vocational Education and Training Regulator Act 2011	ASQA — the national regulator for the VET sector
ELICOS and foundation programs	ASQA or TEQSA hold oversight responsibilities, except where the courses are delivered in the capacity of a school under the ESOS Act
School education; ELICOS, foundation and non-award programs delivered by schools; school education courses delivered by other providers	The designated State authority (DSA) in the relevant jurisdiction, with the Commonwealth Department of Education and Training making final registration or renewal decisions as the ESOS agency for schools

For an agent, the point is that enforcement capacity sits with the same body that registers the provider. Both ASQA and TEQSA have powers to register providers to deliver courses to overseas students, and to investigate and instigate enforcement action against registered providers for breaches of the ESOS Act and the National Code. In the school sector, the DSA recommends to the Commonwealth department that a school be registered as a registered provider, including any conditions on that registration, and some states and territories also have their own legislation relating to education services for overseas students, which they may use to take enforcement action where appropriate and necessary.

What should an agent verify about current status and sanctions?

Standard 11 (Additional registration requirements) is the provision that makes currency a live issue rather than a one-off check. It requires registered providers to continue to meet the requirements for CRICOS registration and to ensure that the ESOS agency approves, and has up-to-date information on, specific aspects of the provider's operations and any registered courses. A stale record — a campus, a delivered course, an ownership or delivery arrangement that the agency has not approved — is itself a due diligence finding.

Sanction risk is the other half. The National Code has legal effect as expressly provided for by the ESOS Act, so breaches of the National Code by registered providers can result in action under Division 1A in Part 6 of the ESOS Act, including suspension or cancellation of registration. For schools, the Commonwealth Department of Education and Training holds final registration or renewal and compliance monitoring and enforcement decisions, including suspensions and cancellations. ESOS agencies may also use information given by providers for other purposes when assessing registration or compliance.

Two further signals belong in the same file. First, any conditions attached to a registration — the DSA recommends conditions when recommending a school for registration, and those conditions shape what the provider may lawfully deliver. Second, reporting behaviour: under subsection 19(2) of the ESOS Act, registered providers are required to notify the Commonwealth when overseas students have breached student visa conditions, such as by failing to maintain satisfactory course attendance or progress. A provider's own compliance posture is part of how stable an enrolment at that provider is likely to be.

Where PRISMS fits

PRISMS — the Provider Registration and International Student Management System — is the system used to process information given to the Secretary of the department by registered providers. Standard 9 requires providers to appropriately manage enrolments and ensure all necessary enrolment information has been provided to the relevant government department by maintaining updated information in the PRISMS database, and Standard 8 sets out the attendance, progress and completion requirements providers must monitor and report on. For agents, that means the enrolment a student relies on is only as reliable as the provider's own record-keeping behind it.

If a provider is suspended, cancelled or defaults, where does the student stand?

The two concepts are different, and the difference decides the remedy. Provider default arises where the registered provider fails to provide a course, or ceases to provide a course, to an overseas student within the meaning of section 46A of the ESOS Act. Student default is where an overseas student does not start a course or withdraws from a course as defined in section 47A(2) of the ESOS Act.

Where a provider cannot fully deliver the course, the Tuition Protection Service (TPS) is the placement and refund service that assists affected students. The TPS ensures overseas students can either complete their studies in another course or with another registered provider, or receive a refund of their unspent tuition fees. The TPS framework and PRISMS are administered by the Commonwealth Department of Education and Training.

Moving to another provider is not, however, automatic. Standard 7 (Overseas student transfers) provides that registered providers must not knowingly enrol an overseas student wishing to transfer from another registered provider's course prior to the student completing six months of his or her principal course — or, for the school sector, until after the first six months of the first registered school sector course — except in certain circumstances. The principal course of study is the main course of study where a student visa has been issued for multiple courses, normally the final course. Standard 1.5 reinforces this on the marketing side: a provider must not actively recruit a student where doing so conflicts with its obligations under Standard 7. A sanction therefore changes a student's options, but the transfer rules still shape which provider can take them.

What do the provider's own materials tell you?

Standard 1 is the fastest check available, because it governs what the provider must put in front of a prospective student. Under Standard 1.4, the registered provider must include its CRICOS registered name and registration number in any written or online material that it disseminates or makes publicly available for the purposes of providing or offering to provide a course to an overseas student, inviting a student to undertake or apply for a course, or indicating that it is able or willing to provide a course to overseas students. In practice that registered name is the link between the marketing and the entry you are checking on CRICOS — a trading name that cannot be matched to a CRICOS registered name and number is a gap worth resolving before a recommendation is made.

Standard 1 also sets substantive limits. Marketing and promotion in connection with recruiting overseas students, including through an education agent, must not be false or misleading and must be consistent with Australian Consumer Law. Under Standard 1.2, in seeking to enter into written agreements with overseas students or intending overseas students, a provider must not give false or misleading information on its association with other persons or organisations it has arrangements with for delivering the course, on any work-based training the student is required to undertake, on prerequisites including English language proficiency, or on any other information relevant to the provider, its courses or outcomes associated with those courses. And under Standard 1.3, a provider must not claim to commit to secure a migration outcome from undertaking any course it offers, and must not guarantee a successful education assessment outcome.

The written agreement is the second place to check consistency. Standard 3 requires enrolment to be formalised through written agreements that set out the rights and responsibilities of each party, the courses and related education services to be provided, tuition and non-tuition fees payable, and refund policies. Standard 2 requires providers to recruit responsibly by ensuring students are appropriately qualified for the course, including the necessary English language proficiency, educational qualifications and work experience.

What changed in 2026?

The amendment history in the National Code 2018 records the National Code of Practice for Providers of Education and Training to Overseas Students Amendment (Education Agent Commissions) Instrument 2026, registered 20 January 2026 (F2026L00033) and commenced 21 January 2026. That instrument added Standard 4.7 and Standard 4.8 and amended the Definitions. Standard 4 (Education agents) is the standard requiring registered providers to ensure their education agents act ethically, honestly and in the best interests of overseas students, as well as to uphold the reputation of Australia's international education sector. The operative wording of the added provisions should be read from the consolidated text of the instrument itself rather than assumed from its title.

For an agent doing due diligence on a provider, the practical consequence is that the 2026 consolidated text, not the 2018 original, is the version to work from when assessing what a provider owes and what its agents owe.

Frequently Asked Questions

Is CRICOS registration brand-wide or course-specific?

It is course- and location-specific. Under section 5 of the ESOS Act, the registered provider for a course for a location is a provider registered to provide that course at that location, and CRICOS is the register prescribed under section 14A of the ESOS Act. A group reputation does not establish that a particular course at a particular campus is registered.

Which ESOS agency covers an ELICOS provider?

ASQA and TEQSA have oversight responsibilities for English Language Intensive Courses for Overseas Students (ELICOS) and foundation programs, except where those courses are delivered in the capacity of a school under the ESOS Act. Where a school delivers them, the designated State authority's role applies instead.

Can a provider promise that a course leads to a visa or migration outcome?

No. Standard 1.3.1 prohibits a registered provider from claiming to commit to secure, or to secure on the student's behalf, a migration outcome from undertaking any course it offers, and Standard 1.3.2 prohibits guaranteeing a successful education assessment outcome. Separately, a migration agent is a person registered as a migration agent under section 286 of the Migration Act 1958.

What happens to tuition fees if a provider stops delivering a course?

Where a provider fails to provide, or ceases to provide, a course — provider default within the meaning of section 46A of the ESOS Act — the Tuition Protection Service assists the student to either complete their studies in another course or with another registered provider, or receive a refund of unspent tuition fees.

Does the six-month transfer rule block a student from moving after a sanction?

It constrains the receiving provider, not the student's situation directly. Standard 7 provides that a provider must not knowingly enrol a student wishing to transfer from another provider's course before the student completes six months of the principal course — or, in the school sector, the first six months of the first registered school sector course — except in certain circumstances.

Do the 2026 amendments change education agent commission rules?

The Amendment (Education Agent Commissions) Instrument 2026 added Standard 4.7 and Standard 4.8 to the National Code 2018 and amended the Definitions, commencing 21 January 2026. The specific obligations they impose are set out in the consolidated text of the instrument on the Federal Register of Legislation.

Is a missing CRICOS number on a brochure proof that a provider is unregistered?

Not by itself. Standard 1.4 requires the CRICOS registered name and registration number to appear in written or online material used to offer, invite applications for, or indicate willingness to provide a course to overseas students. Absence of it means the material does not meet that requirement; registration status itself is determined by the register.