When financial mismanagement, privacy breaches and improper claims can lead to NDIS banning orders.

Summary

• The NDIS Commission issued 326 banning orders in 2025–26, up from 194 in 2024–25. That is 132 more orders, a rise of about 68%. The figures cover all grounds.
• The annual report names findings arising from fraud investigations among the issues behind the orders. It gives no count for fraud or any other issue.
• Section 73ZN of the Act lists the grounds. They include a conviction for fraud or dishonesty, and a reasonable belief that a person has contravened or is likely to contravene the Act. Poor financial records and privacy lapses are not named as grounds. Whether they matter depends on the facts and on which listed ground applies.
• In the register’s published text for 859 banning orders, about 91 (10.6%) restrict access to participants’ personal or financial information, and 115 (13.4%) restrict managing supports, services or funding. Only 3 mention fraud and 4 mention a conviction.

Banning orders by financial year

Keeping track of participant funds

NDIA guidance describes the role of a plan manager as financial administration of a participant’s plan funding. Providers send invoices to the plan manager, who verifies them with the participant and pays the provider on the participant’s behalf. Plan managers check that claims are in line with the plan, the budget and NDIS price limits, keep invoices and records for the claims they submit, and give the participant a monthly statement of spending and the remaining balance. The guidance says a plan manager should get the participant’s approval before submitting claims, so that what was delivered matches the invoice.

Paying an invoice without checking it against the support received can let an incorrect claim through and leave less funding for later supports. The NDIA gives a case in which a plan manager paid claims for more hours than were delivered, and afterwards put in a process to check every invoice.

Protecting financial and personal information

A participant’s plan, invoices and payment records can reveal personal information about the supports they receive. The NDIS Code of Conduct requires providers and workers to respect the privacy of people with disability. The NDIS Practice Standards include an Information Management outcome, which says participant information should be identifiable, accurately recorded, current and confidential, and that participants are told how their information is stored and used.

What the Act lists as grounds

Section 73ZN of the National Disability Insurance Scheme Act 2013 lets the Commissioner make a banning order against a provider (s73ZN(1)) or a worker or key personnel (s73ZN(2)) on these grounds:

• a reasonable belief that the person has contravened, is contravening or is likely to contravene the Act;
• a reasonable belief that the person has been involved in, or is likely to be involved in, another person’s contravention;
• a reasonable belief that the person is not suitable, having regard to matters in the NDIS rules;
• a reasonable belief of immediate danger to the health, safety or wellbeing of a person with disability;
• a conviction for an offence involving fraud or dishonesty; and
• insolvency under administration.

Financial mismanagement, poor records and privacy breaches are not listed by name. They could be relevant through the contravention or suitability grounds, depending on the evidence. We make no claim about how often that has happened, because the report and register do not say. The NDIA lists claiming for supports that were not provided as an example of fraud. Billing for supports not delivered is the kind of conduct that can lead to a fraud investigation, and a conviction for fraud or dishonesty is an express ground.

What the annual report and the register say

The annual report says orders were issued for a range of suitability and compliance-related issues, including findings arising from fraud investigations. It gives one total and no breakdown.

The register describes what each order restricts, which is different from why it was made. We searched that text for key phrases. One order can match several rows.

The first two rows describe restrictions placed on a person, such as not accessing a participant’s personal or financial information. They do not show that the person misused information. The register text rarely states reasons, and the word “privacy” does not appear in the text of any of the 859 orders. So the register cannot show how many orders arose from financial or privacy failures.

Illustrative risks

The table below gives examples of how billing, recordkeeping and privacy failures can affect participants. The examples are illustrative. They are not drawn from any banning order.

A participant who sees an unfamiliar charge can ask their plan manager to explain the invoice and check it against the support received. Suspected fraud or misuse of plan funds can be reported to the NDIA, and concerns about provider conduct can be raised with the NDIS Commission.

What this does not tell you

• The annual report gives one total for all grounds. We cannot say how many orders involved fraud, financial management or privacy.
• The register counts are our keyword counts of published text. They overlap, miss unusual wording, and are counts of entries, not people or providers.
• Register counts are by effective date. The annual report counts are by financial year. The two are not on the same basis and should not be compared directly.
• A restriction on accessing information is not a finding that information was misused. A mention of fraud in an order is not a conviction.
• We could not read the NDIA pages directly because the site blocks automated downloads, so we relied on search summaries of them. Check the current NDIA pages for exact wording.
• This page is general information and is not legal advice. Check the current Act and the terms of any order before relying on it.

Source and licence

Sources: NDIS Quality and Safeguards Commission, Annual Report 2025–26, table 2 and commentary (pages 59–60); the Commission’s compliance and enforcement actions register, retrieved 4 November 2026; the Commission’s NDIS Code of Conduct page and NDIS Practice Standards and Quality Indicators (November 2021, version 4); the NDIA pages What is a plan manager, Guide to working as a plan manager and What is fraud; and the National Disability Insurance Scheme Act 2013, section 73ZN (Compilation No. 28, registered 12 October 2026). Retrieved 13 November 2026. The Commission material is © Commonwealth of Australia and licensed under Creative Commons Attribution 4.0 unless stated otherwise (see the Commission’s copyright and disclaimer page). The counts, classifications and commentary on this page are our own analysis of that material, and the Commission has not reviewed or endorsed them.