NDIS Commission Enforcement: What Unregistered Providers Should Understand

Registration status doesn't put you outside the Commission's reach

Since 1 July 2026, providers delivering Supported Independent Living must be registered with the NDIS Quality and Safeguards Commission, and the transition window for providers who were already delivering SIL closed on 1 October 2026. If you're still weighing up registration, or you've registered but are wondering what actually changes for your organisation now that the deadline has passed, one question tends to sit underneath the paperwork: what can the Commission actually do if something goes wrong, and does any of it apply to a provider who isn't registered?

The short answer is yes. The Commission's compliance and enforcement powers were never conditional on registration status, and understanding how they work — rather than assuming registration is the only thing that matters — is what actually reduces your organisation's exposure.

The Code of Conduct applies whether or not you're registered

The starting point is the NDIS Code of Conduct, which the Commission confirms applies to all NDIS providers and workers — registered and unregistered alike, including sole traders and self-employed support workers paid from a participant's plan. There is no category of NDIS-funded work that sits outside it. Registration changes which audit and registration-condition machinery applies to you; it does not change whether the Commission has a legitimate interest in how you conduct yourself.

Worker screening is one area where the obligations genuinely differ. The Commission's guidance on worker screening for unregistered providers confirms that unregistered providers aren't legally required to hold NDIS worker screening clearances for their staff, though the Commission recommends it. That's a real distinction — but it's narrower than many providers assume, and it doesn't extend to conduct standards, complaint handling, or the Commission's power to investigate.

The Commission's compliance and enforcement toolkit

The Commission describes its approach on its compliance and enforcement page: it uses a range of tools to prevent and address breaches of the NDIS Act, including compliance notices, banning orders, and court-based outcomes. These sit on a scale — from a documented request to fix a specific issue, through to the most serious tool available, a ban.

A compliance notice is the more routine end of that scale. Per the Commission's Compliance Notices Policy, it's a tool the Commissioner uses to respond to a contravention of the NDIS Act and address quality or safeguarding concerns — and it's deliberately framed as a non-punitive mechanism that lets a matter be resolved without going to court. In practice that means: the Commission has identified a specific problem, it sets out what needs to change, and it gives the provider a defined opportunity to fix it. Ignoring a compliance notice, rather than the notice itself, is what tends to escalate a matter.

All of the Commission's enforcement decisions — banning orders, compliance notices, enforceable undertakings, and suspensions or revocations of registration — are recorded and searchable through the compliance and enforcement actions register, which forms Part 2 of the NDIS Provider Register. Participants, families, and other providers can check it before deciding who to work with — which is itself a business-development reason to take the underlying conduct standards seriously, quite apart from the legal ones.

Banning orders: the most serious tool, and it isn't limited to registered providers

A banning order is the Commission's most serious compliance and enforcement instrument. The Commission's Banning Order Policy describes it as appropriate only in the most serious cases of poor conduct — where it's the most appropriate regulatory option to protect people with disability from harm or detriment arising from poor-quality, fraudulent, dishonest, or unsafe services. A banning order can prohibit a person or organisation from providing NDIS supports altogether, or restrict them to certain activities only, and it can run for a set period or be permanent.

The point that matters for this article: banning orders are not a tool reserved for registered providers. The Commission can — and does — ban registered providers, unregistered providers, and individual workers, and every order in force is published on the public NDIS Provider Register. That's a direct answer to "does registration status protect me from the Commission's most serious power" — it doesn't.

The specific offence for unregistered SIL after 1 July 2026

Beyond the general Code of Conduct and enforcement toolkit, the SIL registration change created a specific, named offence. The Commission's guidance on mandatory registration and transition pathways for SIL states plainly that delivering supported independent living without being registered is a serious offence, and that a provider who delivers SIL on or after 1 July 2026 without being registered may breach the NDIS Act. The maximum penalty set out in that guidance is two years' imprisonment, a fine of 120 penalty units, or both.

This is a different exposure to the general compliance-notice-and-banning-order pathway described above — it's a distinct offence created specifically around the SIL registration requirement, and it applies regardless of how good your day-to-day practice otherwise is. If your organisation delivers SIL supports and registration has lapsed, is incomplete, or was never started, that's the single highest-priority item to resolve, ahead of any broader compliance program.

Why this isn't a one-off — the 2027 expansion

SIL is the first tranche, not the last. The Commission's mandatory registration reform hub and the NDIS's own reporting on the expansion confirm that mandatory registration is set to extend further from 1 July 2027, moving progressively toward other supports the government has flagged as high-risk. Providers who sit outside SIL today but deliver supports adjacent to it — or who are watching the sector shift toward registration as the baseline expectation rather than the exception — have a genuine planning window now, rather than a scramble later.

What actually reduces your exposure

None of this means every unregistered provider is at imminent risk of a banning order — the Commission's own policy is explicit that bans are reserved for the most serious cases. But three things consistently reduce exposure for providers navigating this landscape:

• Know which registration group your supports actually sit in. "Unregistered" isn't one category — some supports never required registration, some now do because of the SIL change, and more will from 2027. Confirming exactly where your service offering sits is the first step, not an afterthought.
• Treat the Code of Conduct as a live obligation, not a registered-provider document. Complaint handling, incident response, and worker conduct standards apply to you today regardless of registration status — building genuine practice against them is what the Commission's enforcement scale is actually measuring.
• Register ahead of the deadline that applies to you, not at it. Registration under the certification pathway takes time — self-assessment, an independent audit, and evidence that reflects real practice rather than a document exercise assembled in a hurry. Starting early is what converts a compliance deadline into a manageable project.

How Compliance Care helps

We help SIL and other disability providers build genuine competence against the NDIS Practice Standards — the same standards an independent approved quality auditor will assess, regardless of which auditor you engage. That means preparing your policies, evidence, people, and systems so your registration application and subsequent audit reflect the real quality of your operation, not a rushed response to an enforcement deadline.

If you're still unregistered and delivering SIL, or unsure which of your supports now require it, our registration services are built around exactly this transition — from confirming your registration groups through to certification audit readiness. Our guide for unregistered SIL providers is a practical starting point if you're still mapping out what's changed and what it means for your organisation.

If you've already missed the 1 July 2026 deadline, our post on what to do if you missed the SIL registration deadline sets out the transition pathway in more detail. And if compliance gaps are a broader concern beyond registration itself, our guide to the most common compliance mistakes providers make is a useful companion read.

Ready to understand exactly where your organisation stands? Book a discovery call and we'll help you map out what registration and ongoing compliance actually require for your specific supports.