A provider excluded from one Australian care sector can register with the NDIS — a parliamentary committee reported on 2026-07-02 that no information-sharing arrangement between agencies prevents it

What is happening?

On 2026-05-01 an executive of the agency that runs the National Disability Insurance Scheme told a parliamentary hearing that of about 45 billion Australian dollars paid out in the financial year that ended 2025-06, about 8.3 percent, or about 3.7 billion dollars, was lost to what the agency calls integrity leakage. The same evidence recorded two limits on that number: it covers deliberate fraud together with unintentional non-compliance, and the agency does not publish a figure for fraud alone.

The enforcement response is large and it is counted. A Fraud Fusion Taskforce established in 2022-11 joins 23 agencies, among them the scheme agency, the national services delivery agency, the NDIS Quality and Safeguards Commission, the federal police and the criminal intelligence commission. As at 2026-05-01 it reported more than 600 active investigations, 15 matters before the courts, more than 2,500 providers removed from the scheme, and 77 search warrants in the most recent year against 30 across the four years from 2018 to 2021. As at 2026-07-02 the record had 17 people sentenced to a combined total of more than 60 years imprisonment.

The statute was strengthened in the same year. The National Disability Insurance Scheme Amendment (Integrity and Safeguarding) Act 2026 received assent on 2026-04-08. It set a civil penalty of up to 10,000 penalty units, about 3.3 million dollars, for a serious contravention; up to 2 years imprisonment or 120 penalty units, about 39,600 dollars, for providing services without registration; and up to 5 years imprisonment or 300 penalty units, about 99,000 dollars, for breaching a banning order. It also gave the Quality and Safeguards Commission advertising prohibition orders, banning orders reaching auditors and consultants, and faster powers to demand information.

Four months later the same Parliament said that was not enough in one specific respect. The Joint Standing Committee on the National Disability Insurance Scheme, which had the matter referred to it on 2026-03-25, reported on 2026-07-02 with 12 further recommendations. The central one is that no arrangement for sharing information between agencies stops a provider or a worker excluded from one care sector, aged care for example, from registering with the disability scheme. Alongside it the committee asked that kickbacks be made reportable, that conflicts of interest be managed, and that a worker registration scheme be created. The responsible minister said the recommendations would be considered seriously. Three opposition members of the committee said in a dissenting statement that the report understates the scale and the nature of the problem and leaves out provider registration and market control measures, and a Greens member said the response needed to be evidence-based, adequately resourced and directed at those who commit misconduct.

Whose problem is this?

The body that named the gap is a committee of the same Parliament that had legislated new integrity powers four months earlier. The exclusion records that the committee says should travel are held by regulators that answer for a different care sector, so no single body in this record both holds the records and needs them.

Where does this problem end?

The boundary here is not whether misconduct occurs but whether one regulator can see what another has already decided. A second boundary matters as much: money leaving the scheme and money being taken out of participant budgets are different events, and no source opened here connects them.

What is the state now, and what should it be?

Now

Needs a new measurementthe target state: no source opened here names a target. There is no published leakage rate the scheme is meant to reach, no date by which a cross-sector information-sharing arrangement is meant to exist, and no deadline for a response to the 12 recommendations. The committee described the mechanisms it says are missing and the Act describes the penalties that now apply, but every opened source is silent on when any of the missing mechanisms becomes binding.

How big is it?

The leakage is published in dollars and in a percentage, for one year only. About 3.7 billion dollars, or about 8.3 percent of about 45 billion dollars paid in the financial year that ended 2025-06, stated by an executive of the scheme agency on 2026-05-01. That figure mixes deliberate fraud with unintentional non-compliance and no opened source splits it. No opened source gives a series, so there is no earlier or later year here to read it against.

A second set of dollar figures appears in the reporting of 2026-07-02 — a scheme total of 56 billion dollars and 1.35 billion dollars already spent on the response to misconduct. That report states neither the financial year of the 56 billion nor the period covered by the 1.35 billion, so neither is joined to the 45 billion in this document.

The population side does not resolve. The scheme had 751,000 participants as at 2025-09-30, which is the size of the scheme rather than a count of the people standing behind the missing cross-sector check. Reaching that count would need the number of registered providers, the share of them that also operate in another care sector, and the number of participants served by those providers, and no opened source gives any of the three. The population estimate for this document is therefore recorded as not derivable rather than assembled from a division that no source performs.

The harm in this record is published in dollars and the scheme population is published in people, and no opened source joins the two.

One opened source, a commercial blog written for participants, reports a separate reform package passed in 2026-08 — reductions of up to 50 percent in community participation budgets from 2026-10, a new access test from 2028-01 assessing permanent impairment first, a projected fall in participants from 760,000 to 600,000, and 240,000 reassessments across 2028 to 2031. No official source opened here confirms those figures, and no opened source links them to the leakage figure in either direction.

Under what conditions does it arise?

1. The response is counted in actions taken after a matter has been identified. Investigations, removals, sentences and seizures are all measured and published. No source opened here publishes a count of registrations refused, or claims stopped, because of something already recorded about that provider in another care sector.

2. Exclusion decisions are made inside one sector and stay there. An exclusion recorded in one register does nothing in another register unless some rule obliges the second one to read the first. The committee reported on 2026-07-02 that between the care sectors no such arrangement exists.

3. The instrument strengthened in 2026-04 acts on parties already identified. Higher civil and criminal maxima, advertising prohibition orders and banning orders reaching auditors and consultants all raise what follows a finding. The committee reported four months after assent that 12 further measures were needed, and cross-sector information sharing was the first of them.

4. The scheme grows while the arrangement does not exist. Participants reached 751,000 as at 2025-09-30, up 1.6 percent in a single quarter, so the registration decisions that would have to consult another register are being made at a rising rate.

5. The quantity that would size the gap is not published by anyone. No opened source counts how many providers or workers excluded in one care sector later registered in another, which means the gap named by the committee has never been measured in the record available here.

What has been tried?

Two directions have run at the same time. One raises what happens once a body has found misconduct, and the other, which the committee put first in 2026, asks that each body be able to see what another has already decided before a provider is registered at all.

What was found?

Why is it still unsolved?

Coordination failure — the decision that would stop the registration has already been made, by a regulator that answers for a different care sector, and the committee reported on 2026-07-02 that no arrangement carries it across.

An exclusion is only as strong as the registers that can see it. The 2026 Act made the consequences of being caught heavier in every direction that a single regulator controls: the civil maximum, the criminal maximum, the reach of banning orders, the speed of information demands. None of those touches the case the committee put first, which is a party that has already been dealt with in one sector presenting itself to another. In that case the finding exists, the record exists, and on the account the committee gave on 2026-07-02 nothing obliges the second regulator to go and look.

The second part is that the two things this record measures are measured by different bodies and never multiplied together. The leakage figure comes from the agency that pays, on one year, mixing deliberate fraud with unintentional non-compliance. The exclusion counts come from the enforcement side, cumulative and undated in their coverage. Nobody publishes the number in between — how many of the parties excluded in one care sector turned up in another. A gap that nobody counts has no baseline, and without a baseline nothing can later be shown to have closed.

The third part is that the response produces a steady supply of visible activity. Investigations, warrants, removals and sentences all generate figures, and those figures grew: 77 search warrants in one year against 30 across four earlier years. Activity of that kind is evidence that the response is running, and it is not evidence about the registration door, because none of it is counted at that door. As at 2026-07-02 the committee had named the missing arrangement and the government had undertaken to consider it, and no source opened here records anything after that date.

What observation would mean it is solved?

Candidates — (a) an arrangement for sharing exclusion records between care sectors is in force, with named agencies, a stated effective date and a point in the registration process where it is consulted (b) integrity leakage falls as a share of payments across successive financial years on the same measurement basis (c) the number of providers and workers excluded in one care sector who later registered in another is published and falls.

(a) alone counts paper. An arrangement can be created with a scope narrower than the exclusions it needs to carry, or consulted at first registration and never again. The only account of it here is a recommendation, and as at 2026-07-02 the response on the record was an undertaking to consider it, which is not an effective date.

(b) alone cannot be read. The 8.3 percent figure exists for one year, mixes deliberate fraud with unintentional non-compliance, and comes from oral evidence rather than a published series. A fall could mean fewer wrong payments, or a change in what the category counts, and no opened source would let anyone tell those apart. It would also move with the 2026 penalties and the 2026-08 budget reductions at the same time, so it cannot be attributed to the arrangement in (a).

(c) is the observation that bears directly on the gap and it does not exist yet. No opened source publishes that count at any date, so the first version of it will be a baseline rather than a result. That is the reason it is worth more than the other two: it is the only one of the three measured at the point where the committee says the failure happens.

What is it connected to?

Fills with researchaged care regulation and its exclusion powers, child care and early education regulation, worker screening and clearance schemes, health practitioner registration, and cross-sector exclusion registers in other countries. Relation type and evidence grade were not confirmed in this round, and no source opened here draws any of these connections.

What these sources do not say

• How much of the leakage was recovered. Every opened source counts what was spent on the response, how many investigations are running and how many parties were removed or sentenced. None gives an amount recovered against the 3.7 billion dollars, so the most consequential ratio in this record cannot be formed.
• How much of it was deliberate. The agency stated that the figure includes unintentional non-compliance and did not divide it. That is a stated absence rather than a search that failed.
• Whether 45 billion and 56 billion describe the same quantity. One source gives about 45 billion dollars paid in the financial year to 2025-06; another gives a scheme total of 56 billion dollars without naming a year or a basis. Neither acknowledges the other, and this document does not join them.
• Whether 751,000 and 760,000 describe the same quantity. The participant count of 751,000 as at 2025-09-30 comes from quarterly figures, and the 760,000 baseline appears only in a projection in a commercial blog. No opened source reconciles them or states that they rest on the same basis, so the later-looking number is not a later actual here.
• The number of registered providers. No opened source gives it. An official page that would carry it returned HTTP 403 to automated retrieval, so the figure is absent from this record rather than estimated from something else.
• How many excluded parties moved between care sectors. That count would size the gap the committee named, and no opened source gives it at any date.
• What the government decided about the 12 recommendations. No source opened here records a response beyond the undertaking to consider them, and no opened source is dated later than 2026-07-02 on this question.
• What an independent audit makes of the taskforce. A national audit office page for a performance audit of the effectiveness of the taskforce sits in this record and could not be opened, so no opened source carries its findings, its scope or its status.
• The wording of the 2026 Act. The statute itself was not opened. The assent date, the penalty maxima and the new commission powers all rest on one professional note that cites them.
• What period the 1.35 billion dollars covers. The report that gives the figure names no start date, no end date and no appropriation, so it cannot be placed against any single year of leakage.
• Anything about the outcome of the 2025-10 investigation. No charges had been laid as at the date of the police release, no opened source records any since, and no inference about it is drawn anywhere in this document.

See the evidence

No primary statutory, committee or audit document was read in full. The only document opened directly from a body inside this record is the media release of the federal police, which is why the seizure and restraint figures carry a higher grade here than the leakage figure does. The statute, the committee report, the inquiry page and the national audit office page were each closed to automated retrieval, so the assent date, the penalty maxima and the 12 recommendations all rest on professional and news sources that cite them. Where two opened sources overlap they agree, and the finding that no arrangement for sharing information between agencies prevents registration after an exclusion elsewhere appears in both of the reports of 2026-07-02 opened here. Where the record does not join up it is left unjoined rather than reconciled — about 45 billion dollars of payments for the financial year to 2025-06 sits beside a scheme total of 56 billion dollars from a different source that states neither a year nor a basis, and 751,000 participants as at 2025-09-30 sits beside a projection baseline of 760,000 that no opened source reconciles with it. This is a Path A output, so observation_refs is empty and provenance_mode: press-derived.

People affected

Estimated range Not derivable

The reason and what is missing are listed under “What is missing” below