ASIC director requirements and what directors of Australian companies must do

What the law requires of you as a director

When a company appoints you as a director, the appointment is not just a title on a letterhead. The Corporations Act 2001 (Cth) (the Act) attaches a set of obligations to the office that sit on you personally: you must be eligible to hold the role, hold a director ID, keep ASIC's records accurate, run the company's affairs to a legal standard, and avoid letting the company trade while it is insolvent. The Act is administered by ASIC, the Australian Securities and Investments Commission, which also maintains the public company register that lenders, investors and buyers check before they deal with your business.

Getting these obligations wrong matters for small business in two ways. Administratively, a stale ASIC record causes delays and awkward questions when you raise money, sell the business or apply for finance. Legally, a breach of a director's duties can mean penalties, disqualification, and personal exposure for company debts.

This guide sets out who the obligations apply to, what each duty requires, what happens if you breach, and the practical steps to stay on top of it.

Who these obligations apply to

The director obligations in the Act apply to anyone appointed as a director of a company registered with ASIC. That includes a founder of a two-person Pty Ltd and a director of a listed group. Most of the obligations start at appointment, and some continue after you leave the role.

The rules that decide whether your company's structure is compliant:

Minimum number of directors: a proprietary company must have at least one director, under s 201A(1) of the Act. A public company must have at least three directors, not counting alternate directors, under s 201A(2).
Residency requirement: the director of a proprietary company must ordinarily reside in Australia (s 201A(1)). A public company must have at least two directors who ordinarily reside in Australia (s 201A(2)).
Crowd-sourced funding: a proprietary company with CSF shareholders must have at least two directors, and at least one of them (or a majority, if there are more than two) must ordinarily reside in Australia, under s 201A(1A).
Secretaries: a proprietary company is not required to have a secretary, but any secretary it does appoint must ordinarily reside in Australia (s 204A(1)).

What does "ordinarily resides in Australia" mean? It is a question of fact about where a person actually lives on an ongoing basis. It is not answered by citizenship, by holding a visa, or by owning property here. A director who lives overseas for most of the year may not satisfy it even if they are an Australian citizen. This is the requirement that most often catches cross-border structures: an overseas parent company incorporating an Australian subsidiary still needs at least one director living in Australia, unless it uses a different structure.

Be eligible to hold the office

Before a person can be appointed, the law imposes minimum eligibility rules under s 201B of the Act:

Age: only an individual aged 18 or over may be appointed as a director (s 201B(1)). A company cannot appoint a company, a trust or another body as its director.
No disqualification: a person disqualified from managing corporations under Part 2D.6 of the Act can only be appointed with permission from ASIC under s 206GAB, or leave from a court under s 206G (s 201B(2)).

The company must also receive a signed consent from the person before they are appointed (s 201D(1) of the Act), and must keep that consent in its records (s 201D(2)). Failing to obtain or keep the consent is a strict liability offence, meaning the company can be penalised without proof that anyone intended to break the law. The practical point: a director's signed consent is a record, not a formality, and it belongs in the company's files alongside the appointment resolution.

Hold a director ID

Every director of an Australian company needs a director identification number, usually called a director ID, issued by the Australian Business Registry Services (ABRS). The director ID is attached to you as an individual, not to the company. You apply once and keep the same number across every company you direct, and it is separate from the company's own identifiers such as its ACN.

The current rules are set out in Part 9.1A of the Act. If you are appointed without already holding a director ID, the practical guidance from ABRS is to apply before your appointment where you can, and applications are made online using a digital identity such as myID. The Registrar can also direct you to apply, and you must then apply within the period stated in the direction, or within 28 days if no period is stated (s 1272D of the Act). Failing to apply when directed is a strict liability offence, and the same provision is a civil penalty provision, so non-compliance can attract a penalty as well as an offence.

Because the timing rules have changed over the years, with the obligation applying differently depending on when you were appointed, it is worth checking the current ABRS guidance before you finalise an appointment rather than assuming a past deadline still applies.

Keep ASIC's register accurate: the 28-day rule

The company, not the individual director, is responsible for keeping ASIC's records up to date, but it is a director-level obligation in practice: the notices are usually lodged by a director, and a stale register becomes the director's problem when due diligence starts.

Under s 205B of the Act, the company must lodge a notice with ASIC within 28 days of:

New appointments: a director or secretary being appointed (s 205B(1)).
Changes of details: any change to a director's or secretary's personal details, such as a name or address change (s 205B(4)).
Cessations: a person ceasing to be a director or secretary (s 205B(5)).

The notice must be in the prescribed form, and each of these is a strict liability offence. The 28-day clock runs from the event itself: an appointment, a change, a resignation. If details change and no one files, the register quietly goes stale, and the gap usually surfaces at the worst moment, such as a funding round or a sale, when the buyer's due diligence finds a former director still listed and wants to know why.

Exercise care and diligence

Directors must exercise their powers and discharge their duties with the degree of care and diligence that a reasonable person would use in the company's circumstances, holding the same office (s 180(1) of the Act). This is a civil obligation, and it comes with its own statutory business judgment rule: under s 180(2), a director who makes a business judgment in good faith, for a proper purpose, without a material personal interest, after informing themselves to the extent they reasonably believe appropriate, and with a rational belief the judgment is in the company's best interests, is taken to have met the standard.

In practical terms for a small business, care and diligence looks like:

Financials: reviewing budgets and cash flow regularly rather than once a year.
Contracts: reading and understanding material contracts before signing.
Records: keeping decisions documented, such as director resolutions for major purchases, leases or share issues.
Questions: asking when something does not look right, and getting an answer before proceeding.

Act in good faith and for a proper purpose

Under s 181(1) of the Act, directors must exercise their powers and discharge their duties in good faith in the best interests of the company, and for a proper purpose. In plain terms, decisions should benefit the company as a whole, not one founder, one shareholder group, or a related party. This matters in startups where the same person is director, shareholder, employee and sometimes lender. Holding multiple roles is not itself a problem, but each decision must be tested against the company's interests, and conflicts must be identified and managed rather than ignored.

Do not misuse your position or information

Section 182(1) of the Act prohibits a director, secretary, officer or employee from improperly using their position to gain an advantage for themselves or someone else, or to cause detriment to the company. Section 183(1) prohibits improperly using information obtained in the role for the same ends. Notably, the information duty under s 183 continues after you stop being a director, so confidential information learned in the role does not become freely usable when you resign.

These duties bite in everyday small-business situations: a director who runs a second business and steers a contract to it, or who uses customer data gathered as director for a side venture, is squarely in the zone.

Prevent insolvent trading

The most serious personal exposure for directors is insolvent trading. Under s 588G(1) of the Act, a director must prevent the company from incurring a debt where:

Insolvency: the company is insolvent at the time the debt is incurred, or becomes insolvent by incurring it; and
Suspicion: there are reasonable grounds for suspecting the company is insolvent, or would become insolvent.

The duty does not depend on the director actually knowing the company was insolvent; it depends on what a reasonable director in the circumstances should have suspected. If the company later goes into liquidation, the liquidator can use a breach of the duty to recover compensation from the director personally for the loss caused to creditors (s 588J of the Act), and the breach can also attract penalties and disqualification.

There are statutory defences, set out in s 588H of the Act, including that the director had reasonable grounds to expect, and did expect, that the company was solvent, that the director reasonably relied on a competent and reliable person to provide adequate information about solvency, that the director did not take part in management because of illness or another good reason, and that the director took all reasonable steps to prevent the company incurring the debt.

For founders, the practical translation is: watch cash flow, act early when it tightens, and document what you did and why. Informal arrangements such as "we will just lend the company money and sort it out later" become very hard to defend if the company fails.

Sign company documents the right way

Directors also need to understand how the company validly signs documents, because a document signed the wrong way can be unenforceable, or at least slow down a deal while the other side's lawyers ask questions.

Under s 127(1) of the Act, a company executes a document without a common seal if it is signed by:

Two directors: both directors of the company.
Director and secretary: a director and a company secretary.
Sole director: for a proprietary company with a sole director who is also the sole secretary, or that has no secretary, that director alone.

A deed executed under s 127(3) does not require witnessing when executed this way, and signatures can be given electronically under the technology neutral signing provisions in Part 1.2AA of the Act. If your company regularly signs leases, finance documents or contracts, it is worth confirming that your signing process matches your structure, for example sole director versus two directors, before a deal depends on it.

What happens if you get it wrong

The consequences of non-compliance scale with the seriousness of the breach:

Civil penalties: breaches of the conduct duties (ss 180 to 183) and the insolvent trading duty (s 588G) are civil penalty provisions. A court can make a declaration of contravention and order a pecuniary penalty, which is a debt payable to ASIC on behalf of the Commonwealth (s 1317GAA of the Act).
Compensation orders: the court can order a director to compensate the company or, in insolvency, to compensate for losses caused to creditors, for example under s 588J.
Disqualification: the court can disqualify a director from managing corporations.
Criminal liability: where a failure of good faith, use of position or use of information is dishonest or reckless, the conduct becomes a criminal offence under s 184 of the Act.

Enforcement is a matter of ASIC's priorities and the seriousness of the conduct, which is why the practical exposure is assessed case by case, and why legal advice is warranted as soon as a problem appears.

A practical compliance checklist

Working through this list once a quarter will keep most small companies out of trouble:

Eligibility: confirm every director is aged 18 or over, is not disqualified, and has signed a consent that is kept on file.
Director IDs: confirm each director holds a director ID, and apply before any new appointment.
ASIC notices: lodge notices within 28 days of any appointment, change of details, or cessation.
Decisions: keep a record of board decisions, especially major purchases, leases, share issues and funding approvals.
Solvency: review cash flow and liabilities monthly, and document the review, so solvency decisions are traceable.
Signing: know your company's signing rules and use them consistently.

When a lawyer should be involved

Director compliance is usually straightforward while the structure is simple, and that is exactly when it is cheapest to get right. Legal input earns its keep in specific situations:

Residency planning: overseas founders, or an Australian subsidiary of a foreign parent, need advice on the resident director requirement before anything is lodged with ASIC.
Nominee directors: appointing a local director purely to satisfy the residency rule is risky unless the person genuinely participates in governance; advice can make the arrangement sound or point to a better structure.
Insolvency risk: if the company is near insolvency, a lawyer can advise on restructure options, available defences, and how to document decisions defensibly.
Governance documents: constitutions, shareholders agreements, director appointment and removal rules, and indemnity and insurance arrangements are where disputes and exposures are designed out or designed in.
ASIC contact or claims: if ASIC is asking questions, or a liquidator or creditor is pursuing a director, engage a lawyer before responding.

The 28-day clock and the risk that follows

If you take one action this week, check your company's ASIC record and confirm three things: that every listed director is current, that each of them holds a director ID, and that no appointment, change or resignation has slipped past its 28-day window. The notice deadlines are the obligation most often missed, because they are administrative and nothing appears to happen when you miss them. The register simply goes stale, and it is discovered later by someone with leverage.

The duty with the heaviest consequences is the one that also gets missed most often in substance: allowing the company to keep trading when there are reasonable grounds to suspect it is insolvent. That is a personal financial risk no startup plan accounts for. The two are connected. Companies that treat their ASIC notices and their solvency reviews as recurring tasks rather than one-off events are the ones whose directors can defend every decision they made.