The regulator's limits
The Auditor-General found the NDIS regulator only 'partly effective'. It does not have full visibility of a provider market fifteen times the size of the one it oversees, and the conflict a Royal Commission told the scheme to close is still permitted by its rules.
In October 2025 the Auditor-General found the NDIS Quality and Safeguards Commission only 'partly effective'. Two numbers sit under that verdict: 16,363 providers it directly oversees, and 254,018 more - a market fifteen times larger - that it 'does not have full visibility' of. And the one conflict of interest a Royal Commission expressly told the scheme to close, an adviser referring a participant to a service the same adviser owns, the rules still permit. The scheme they bill ran to $46.3 billion last year.
In October 2025 the Auditor-General published the first independent assessment of whether the National Disability Insurance Scheme's regulator can do its job, and found the NDIS Quality and Safeguards Commission's functions only "partly effective"01. VERIFIED The Commission oversees 16,363 active registered providers. It counts 254,018 active unregistered providers, a market more than fifteen times larger. In its own words to the Auditor-General, the Commission "does not have full visibility of the market it regulates"01. VERIFIED The scheme those providers bill ran to approximately $46.3 billion in the year to June 202504. VERIFIED Underneath the same verdict sits a second limit: a conflict of interest a Royal Commission told the scheme to end, which its rules still permit06. VERIFIED
Two markets
The NDIS runs two provider markets. Registered providers are screened, audited, and subject to the Commission's full regulatory regime. Unregistered providers can deliver and bill for most supports to self-managed and plan-managed participants without entering that regime at all. The Auditor-General's count puts the registered market at 16,363 and the unregistered market at 254,01801. VERIFIED
Both are growing, and the unregistered market is growing faster: registered providers up 15% in a year, unregistered up 26%01. VERIFIED The part of the market the regulator sees least is expanding faster than the part it oversees directly.
The phrase "does not have full visibility of the market it regulates" is the Commission's own, recorded by the Auditor-General. It is not an aspiration unmet or a backlog to be cleared. It is a structural fact about the regime: the regulator's instruments reach the smaller, registered market, and the larger market sits outside them. ANALYSIS
Running to stand still
This is not for want of effort. The Commission has scaled hard. Compliance actions finalised rose from 9,520 in 2022-23 to 35,519 in 2023-24, on the back of a workforce that grew from 595 to 1,036 staff, funded by a $142.6 million investment0203. VERIFIED Complaints and reportable incidents reached 111,345, up 78%, and banning orders rose almost 35%0203. VERIFIED The Fraud Fusion Taskforce reports hundreds of active investigations and more than 2,500 providers with problematic claiming patterns disrupted05. ESTIMATED
Set against a scheme paying $46.3 billion a year through a provider market a quarter of a million entities wide, that is a regulator running to stand still. Enforcement has roughly quadrupled in a year and the market it cannot see has grown by a quarter. The "partly effective" verdict is not a criticism of the Commission's energy. It is a description of a regime asked to police a market it was not built to see. ANALYSIS
The conflict the rules permit
The audit measured what the regulator can see. A separate limit sits in what the rules let providers do. A support coordinator helps an NDIS participant choose and arrange their services. Under the current rules, that coordinator can refer the participant to a provider the coordinator also owns or is connected to, and bill the scheme for both the coordination and the service06. VERIFIED
The conflict is structural, not occasional. The role of a support coordinator is to act in the participant's interest when choosing among providers. The moment the coordinator stands to profit from the choice, the advice and the sale are the same transaction. The participant is told where to go by the person who profits when they get there. This is the conflict that financial advice, medicine, and procurement regulate against, by separating the adviser from the seller. In support coordination the separation is not required.
The Disability Royal Commission examined this and recommended the rules be amended so coordination is independent of delivery. Recommendation 10.2 calls for support coordination to be independent of the supports it coordinates06. VERIFIED The Australian, state and territory governments responded "accept in principle", the status is recorded as "further work required", and the NDIS Commission has since run an Own Motion Inquiry into Support Coordination06. VERIFIED The bar the recommendation describes has not been written into the rules.
The NDIS Amendment Act that passed in August 2024 does move on support coordination, but in a different direction. It introduces phased mandatory registration, including for support coordinators in some categories from July 202607. VERIFIED Registration brings coordinators inside the regulator's regime, which is a gain for visibility. It is not the same thing as prohibiting self-referral. A registered coordinator can still refer to a connected provider; registration records who they are, not whether the referral is conflicted. The 2024 Act closes a visibility gap. It leaves the conflict the Royal Commission named open.
This is the seam between the two limits. A conflict that the rules permit is not a conflict an under-powered regulator can police away. ANALYSIS Closing it requires the rule the Royal Commission recommended, and that rule has not been made.
Macdara Ó Murchú
