What is actually happening in 2026
The numbers from the NDIA and the NDIS Quality and Safeguards Commission tell the story:
- 635+ active fraud investigations and roughly $86 million in blocked claims reported by the NDIA
- 2,500+ providers with non-compliant claims patterns disrupted by the Fraud Fusion Taskforce
- ~200 individuals and providers banned by the Quality and Safeguards Commission
- 59 people referred to court via the Fraud Fusion Taskforce, with new arrests almost every month — including a Sydney operator charged in late April over an alleged $1.5 million claim-for-services-not-delivered scheme
- 20 NT providers flagged for serious compliance action after 8 investigative warrants and 50+ site visits between September and December 2025
On top of that, the Australian Criminal Intelligence Commission has publicly warned that organised crime groups have moved into the scheme, using cash kickbacks and intimidation. The political appetite to act is the strongest it has ever been.
The new laws and registration rules
Two changes will reshape provider obligations in the next 12 months:
- New NDIS integrity legislation — Parliament has passed reforms giving the Commission stronger banning powers, faster information-sharing across agencies, and tougher penalties for false or misleading claims.
- SIL and online platform registration from 1 July 2026 — every Supported Independent Living provider, including those previously delivering SIL to self-managed or plan-managed participants without registration, must be registered with the NDIS Quality and Safeguards Commission. Online platform providers fall in scope too.
There is also an audit-market squeeze worth flagging: QIP, one of the major JAS-ANZ approved quality auditors, will stop conducting NDIS audits after 30 April 2026. Providers whose accreditation expires after that date need to lock in a new auditor now — auditor capacity is already tightening.
Why this is a tailwind for legitimate providers
The crackdown is targeted at three behaviours: claims for services that were never delivered, inflated or duplicated billing, and exploitation of participants. None of those describe a well-run provider. What the enforcement wave actually does is:
- Removes bad-faith competitors who win contracts by undercutting on price while cutting corners on staffing and claims
- Restores participant and family trust in the broader sector, which lifts referral volumes for compliant operators
- Concentrates funding on providers who can document what they delivered, when, by whom, and at the correct rate
The providers who lose in this environment are the ones who cannot produce clean records on demand. The providers who win are the ones who treat compliance as an operational system, not a once-a-year audit panic.
Where most providers are still exposed
From what we see across the SCHADS Award and NDIS payroll work CrossVault does, the recurring weak points are:
- Timesheets that do not match the claim — shift start and end times in the roster, the timesheet, and the NDIS claim do not reconcile. This is the single fastest way to fail a Commission or NDIA audit.
- Sleepovers, broken shifts and travel calculated by hand, with no audit trail showing how the rate was derived
- Worker classifications that drift over time as staff take on new duties without their SCHADS level being updated
- Plan-managed claim narratives that are too vague to defend if the Commission asks what was actually delivered
- Sub-contractor and labour-hire arrangements where the provider claiming the funds cannot evidence supervision or quality oversight of the worker who delivered the support
None of these are exotic. They are the everyday gaps that turn into months of forensic work when an auditor lands.
A short checklist for the next 90 days
- If you deliver SIL, start your registration application now. The 1 July 2026 deadline is closer than it looks once you account for audit lead times.
- Reconcile a sample of recent claims against rosters, timesheets and progress notes. If the chain breaks anywhere, fix the workflow that caused it.
- Move SCHADS Award calculations off spreadsheets and onto a system that can show its working — sleepovers, broken shifts, overtime triggers, allowances, classifications.
- Lock in your next quality audit early, especially if your current auditor is QIP or another firm exiting the space.
- Write down your claims policy — who can submit, what evidence has to be on file, what the review step looks like. The Commission expects a documented control, not a verbal habit.