The Code of Conduct is the single most consequential document in your practice. Get it right and it is invisible. Get it wrong and it surfaces as an OMARA complaint, a disciplinary finding, or a professional indemnity claim. This checklist walks through every major obligation in the current Code, section by section, so you can run a self-audit before the regulator ever does.
It is written for the agent, not the applicant — practical, current as at 2026, and structured so you can tick each area off against your own files.
First, confirm which Code applies
The Code of Conduct in force is the one that commenced on 1 March 2022, prescribed by the Migration (Migration Agents Code of Conduct) Regulations 2021. It replaced the older Schedule 2 Code and is a legislative instrument in its own right, which means it carries the full weight of delegated legislation rather than sitting as guidance. If you are still working from a pre-2022 internal compliance manual, that is your first finding — rebuild it against the current Code.
The Code is structured into Parts: preliminary provisions, your general duties as an agent, the agent–client relationship (where most day-to-day obligations live), and miscellaneous and transitional provisions. Most of what you will be audited on sits in the agent–client relationship Part.
Always cross-check the exact wording on the official source before you rely on it. The authoritative texts are the Federal Register of Legislation and the OMARA Code of Conduct page, including OMARA's published guidance documents.
1. Client agreements and fee disclosure
Before you give immigration assistance (beyond an initial consultation), you must have a written service agreement in place that sets out the work to be done and what it will cost. Fees must be reasonable and clearly itemised, disbursements must be identified, and you must give the client invoices and receipts. The Code also includes a duty not to receive amounts from a client before a service agreement is entered into, so as a general rule you should not be taking client money before the agreement is concluded.
- Is there a signed, written service agreement on every active file?
- Are fees itemised by stage or service, not a single opaque figure?
- Are disbursements (visa application charges, third-party costs) listed separately from your professional fees?
- Is every variation to scope or fee confirmed to the client in writing?
- Are receipts issued for money received, and invoices for fees charged?
This is the area clients complain about most, so it is worth getting forensically right. We cover the mechanics — what a compliant agreement must contain and how to disclose fees defensibly — in our deep dive on fee disclosure and client agreements.
2. File notes and record keeping
The Code requires you to make records of oral communications with clients about immigration assistance, including the instructions a client gives you. In practice that means a contemporaneous file note for every phone call, meeting and significant verbal instruction — created at the time, not reconstructed months later when a complaint lands.
On retention, the Code requires you to take all reasonable steps to ensure a client file is kept for seven years after the date of the last action on the file. Build your archiving and destruction policy around that period (confirm the current figure on the OMARA/Home Affairs website before finalising any destruction schedule).
- Does every file carry contemporaneous notes of calls, meetings and verbal instructions?
- Are notes dated, attributed to an author, and time-stamped?
- Do you have a documented seven-year retention policy and a safe destruction process?
- Could you reconstruct the advice given on any file from the records alone?
If your file notes live in your memory or in scattered emails, that is a gap. See our full guide to migration agent file note requirements for what a defensible note looks like.
3. The clients' account (client money)
Client money must be paid into an account with a financial institution, and money that is not client money must not be paid into that account. The principle is separation: the client's money is the client's until you have earned it or are entitled to disburse it. Commingling client funds with practice operating funds is one of the fastest routes to a serious disciplinary outcome.
- Is client money held in a dedicated account, separate from your operating funds?
- Is there a ledger showing, per client, what is held and why?
- Are withdrawals tied to invoices actually issued and work actually done?
- Can you reconcile the account at any time and produce a per-client balance?
Verify the precise account-handling and accounting requirements that apply to your circumstances on the official Code text, as the obligations can turn on how and when you take funds.
4. Conflicts of interest
You must inform clients of conflicts of interest. The discipline is to identify a conflict early, disclose it in writing, and decline or manage the matter where the conflict cannot be properly handled. Common triggers: acting for both a sponsor and a visa applicant, referral arrangements that pay you, and acting for family members with divergent interests.
- Do you run a conflict check before opening every new matter?
- Are disclosed conflicts recorded in writing on the file?
- Do you have a clear rule for when you decline rather than manage a conflict?
5. Competence, CPD and your professional library
You must maintain sufficient skills and knowledge to give immigration assistance professionally and competently, and maintain — or have access to — a professional library of up-to-date material relevant to giving immigration assistance (including the Act and regulations). Competence is also tied to your continuing professional development obligations for re-registration.
As at 2026, you must obtain 10 CPD points each year to stay registered, completed in the 12 months immediately before you submit your registration application. A new CPD instrument applies from 1 April 2026 (Migration Agents (CPD Activities, Approval of CPD Providers and CPD Provider Standards) Instrument 2026, LIN 26/001). Among its changes, it introduces mandatory CPD activities on Ethical Standards and on the Code of Conduct each registration period, and caps online CPD at 6 points within any 24-hour period. Confirm the current points total, the mandatory-activity and online-cap rules, and the transitional arrangements on the OMARA CPD rules page before you plan your year — and complete your CPD well before your registration expiry so you can lodge on time.
- Are you on track for the required CPD points for your current registration year (confirm the current figure and the mandatory-activity mix on the OMARA website)?
- Do you keep evidence of every completed activity?
- Is your professional library current — legislation, policy, key decisions?
We break down the new framework in our 2026 CPD requirements guide.
6. The consumer guide and consumer guidance
You must give the client a copy of the consumer guide before you give immigration assistance. This is not optional and not something to backfill — it should be part of your standard onboarding pack, with a file note recording when and how it was provided.
- Is the current consumer guide issued to every new client before work starts?
- Is provision recorded on the file?
- Are you using the current version published by OMARA?
7. Confidentiality
You owe clients a duty of confidentiality. That extends beyond not gossiping — it covers how client data is stored, who can access it, and how it moves between you, the Department and third parties. With more practices using cloud tools, your data-handling and access controls are now part of your confidentiality compliance.
- Is client data access restricted to those who need it?
- Are disclosures to third parties authorised by the client?
- Are your storage and communication channels secure?
8. Dealing with the Department and the regulator
You must deal honestly with the Department of Home Affairs and respond to requests for information or documents from the regulator. Misleading the Department, lodging knowing falsehoods, or ignoring OMARA correspondence are among the most serious breaches an agent can commit.
- Is every submission to the Department accurate and supportable from the file?
- Do you respond to OMARA requests promptly and completely?
- Can you evidence the instructions behind any representation you have made?
9. Complaints handling
Handle client complaints fairly and keep a record of them. A documented complaints process — acknowledgement, investigation, response, and a file note of the outcome — both satisfies your obligations and protects you if a matter escalates to OMARA. Treat every complaint as a future exhibit.
- Do you have a written complaints procedure clients can access?
- Is every complaint logged, investigated and responded to in writing?
- Do you review complaints for systemic issues, not just one-offs?
How compliance tooling supports each area
Most Code breaches are not bad intent — they are gaps that open up when a busy practice relies on memory, email threads and spreadsheets. Purpose-built case-management software closes those gaps by making the compliant action the default action:
- File notes — capture contemporaneous, time-stamped notes against the matter, so the record exists at the moment of the call.
- Client agreements and fee disclosure — generate itemised agreements and invoices from templates, with variations tracked.
- Clients' account — a per-client ledger keeps client money visibly separate and reconcilable.
- Conflict checks — screen new matters against existing parties before you open a file.
- CPD logging — record activities and points against the current requirements as you go, not in a panic before re-registration.
- Retention — files stay intact and searchable across the seven-year window.
If you are weighing up platforms, it is worth comparing how each handles these obligations natively rather than as bolt-ons. See how the options stack up against Migration Manager and AgentCIS, and read our roundup of the best software for registered migration agents in 2026.
Run the audit, then keep it living
Print this checklist, run it against five live files, and note every gap. The pattern across most practices is the same — agreements and fee disclosure are mostly fine, but file notes, the clients' account ledger and the complaints register are where audits find trouble. Fix the systemic gaps once, and bake the controls into how you work so they never reopen.
Always verify specific figures, retention periods and section references against the official Code on the Federal Register of Legislation and the OMARA website before relying on them — the Code and CPD framework can change, and you are the one accountable for getting it right.
LodgeHQ is built for registered migration agents who want compliance to be the path of least resistance — file notes, client ledger, conflict checks and CPD logging in one place. Start a free trial and turn this checklist into a system that runs itself.