Every conveyancer and lawyer who settles on PEXA or Sympli has agreed to the Model Participation Rules. They are the national rules, published by the Australian Registrars' National Electronic Conveyancing Council (ARNECC) and adopted state by state, that decide who may use an electronic lodgment network and on what terms.
In May 2026 ARNECC released a consultation draft of version 8. Most of it tidies up drafting. The parts about cyber security do not. They turn what has been general guidance into specific obligations, and for the first time they name the cyber security frameworks a practice can rely on.
This is a draft. The consultation has closed, ARNECC's explanatory notes give October 2026 as the anticipated start date, and the draft itself still lists its commencement as "to be announced". Each state then adopts the final rules. The wording below may change. The direction is unlikely to.
What the draft adds
Multi-factor authentication, in three places
New rule 7.1(d) requires a subscriber to implement for all its users on:
- all remote access to the practice's systems, including VPN access
- administrative accounts
- email accounts
ARNECC's notes say the change came from a security expert recommendation, aimed at reducing account compromise. In conveyancing that mostly means email takeover, the starting point for settlement payment fraud. This is not optional, and holding a certification (below) does not replace it.
Cyber training for everyone, every year
Rule 7.2.1 already required training for ELN users. The draft extends it. Users must complete cyber before they get access to the ELN and at least once a year after that. It must cover, at a minimum, secure use of the ELN, of the practice's own systems, and of email and other electronic communication.
The draft then goes further. Every other principal, officer, employee, agent and contractor who uses the practice's systems must also complete cyber security awareness training each year. The receptionist who never logs in to PEXA but opens the email is included.
ELN credentials must not be shared between users.
Police checks for ELN users
A user must have a police background check before being given access to the ELN. ARNECC's stated reason is to reduce the risk of a .
Rule 7.11 and the framework safe harbour
This is the new rule most practices will need to think about. Under rule 7.11, a subscriber must take reasonable steps to secure use of:
- the ELN
- the practice's own systems, whether accessed remotely or in the office
- the subscriber administrator account
- email accounts
The draft gives two ways to comply. A practice can take reasonable steps in a way of its choosing and be ready to show they were reasonable. Or it can obtain and maintain, at least annually, certification as compliant with a Cyber Security Framework, and that certification is deemed to be the taking of reasonable steps.
The draft defines a Cyber Security Framework as one of three:
- the , developed by the
- , developed by Dynamic Standards International
It also allows for a framework that supersedes any of these, or one that is substantially equivalent.
That second route, the safe harbour, is the important part. "Reasonable steps" is a judgement call that someone else gets to make after something has gone wrong. A current certificate is a fact.
Cyber insurance becomes compulsory
The draft insurance rules require every subscriber to hold , either as a standalone policy or within its professional indemnity or fidelity cover. The minimum is:
- an annual aggregate of at least $50,000, including legal costs
- cover for third-party claims arising from cyber incidents
- cover for , business interruption, data recovery and system recovery
- cover that extends to conveyancing transactions
Professional indemnity or fidelity cover does not count automatically. It counts only if the policy actually meets those minimums. The draft also lifts the minimum professional indemnity and fidelity cover from $1.5 million to $2 million, from 1 July 2027.
Which framework makes sense for a conveyancing practice?
The draft treats all three frameworks the same, but they are not the same amount of work.
ISO 27001 is an international management-system standard with an external certification audit. It suits larger firms that already run formal risk and policy processes. For a five-person practice it is a large, ongoing commitment.
The Essential Eight is the ASD's set of mitigation strategies, measured in maturity levels. It is well known and its controls are sound. But it has no certification of its own. Showing compliance means an independent assessment, and the draft does not say which would satisfy rule 7.11. ASD has also signalled that the Essential Eight is being replaced by its new .
SMB1001 was written for small and medium businesses. It has five levels. Bronze, Silver and Gold are attested by a company director and certified by CyberCert, and annual certification starts at around a hundred dollars at the entry level. Platinum and Diamond are independently audited. The Queensland Law Society already recommends SMB1001 to its members and advises working towards Gold.
For most conveyancing practices SMB1001 is the realistic route, and Gold is the sensible target. The draft does not say which level is enough, so do not assume Bronze will do. SMB1001 Gold's 2026 controls include multi-factor authentication, , with an enforced policy, staff training, an asset register and cyber insurance. Most of what the draft asks for separately is already on that list. We compare the two smaller frameworks in more detail in SMB1001 vs the Essential Eight, and the levels are set out in our SMB1001 certification guide.
How this sits with AML/CTF
Since 1 July 2026, conveyancing has been a designated service under the AML/CTF reforms. A practice that provides it is now an AUSTRAC reporting entity. AUSTRAC does not set a cyber security standard. But as a reporting entity, a practice is covered by the Privacy Act for the information it collects for AML/CTF purposes, whatever its turnover. Customer due diligence means holding more identity documents than before, and the Privacy Act requires reasonable steps to protect them.
So a typical practice now has two "reasonable steps" duties pointing at the same systems: one under the Privacy Act and one, once version 8 starts, under the Participation Rules. One certification is a straightforward way to show both have been taken seriously. We cover the AML/CTF side in AML/CTF Tranche 2 and legal practices.
What to do now, before the final rules land
Nothing here is wasted effort if the final wording shifts. Every item is a control insurers and the Privacy Act already expect.
- Turn on MFA for email, remote access and every admin account. This is the single biggest risk reducer in conveyancing, and it is in the draft as a hard requirement.
- Check your insurance against the four minimums above. Ask your broker in writing whether your current policy covers third-party cyber claims, incident response, business interruption, data and system recovery, and conveyancing transactions, to at least $50,000.
- Book cyber training for every staff member, not only the people who use PEXA, and keep a record of who completed it and when.
- Stop sharing logins, for the ELN and for anything else.
- Arrange police checks for anyone who has, or will have, ELN access.
- Pick a framework and start. For most practices that means an SMB1001 gap review against Gold, fixing what is missing, and certifying before the rules commence. Then renew every year, because the safe harbour depends on keeping the certificate current.
- Lock down your email domain. , and an enforced DMARC policy stop criminals sending convincing settlement emails in your name. You can check yours with our free email security checker. Our guide to settlement payment fraud explains how those emails work.
Where IronSights fits
We work with Australian conveyancing practices and law firms on exactly this list: multi-factor authentication, email security, staff training and SMB1001 readiness. We prepare practices for certification. CyberCert issues the certificate. If you want to know how far your practice is from SMB1001 Gold and from the draft rules, talk to us, or read more about how we work with conveyancers.
We will update this article when ARNECC publishes the final version 8 and confirms its start date. The consultation draft and explanatory notes are on ARNECC's Model Participation Rules page.
