AI file notes for mortgage brokers: what compliance actually requires

What the NCCP Act needs your file to prove

The responsible lending obligations for a broker sit in Part 3-1 of the National Consumer Credit Protection Act 2009. Before you provide credit assistance you must make a preliminary assessment that the loan is not unsuitable (ss 115 and 116). To do that you must make reasonable inquiries about the client's requirements and objectives (s 117(1)(a)), make reasonable inquiries about their financial situation (s 117(1)(b)) and take reasonable steps to verify that financial situation (s 117(1)(c)). Section 118 sets out when a contract must be assessed as unsuitable. ASIC's expectations on inquiries and verification are in RG 209.

Under s 120 the client can ask for a written copy of the preliminary assessment for up to seven years after the date of the credit quote. That is why seven years is the working minimum for the whole file. None of these sections mention file notes by name. The file note is simply where most of the evidence ends up, because requirements and objectives come out in conversation. A fact find says "purchase OO, $720k". The note says why they want a 3 year fixed split, that she is going on parental leave in March, and that you talked through what that does to servicing.

For an AI-drafted note, the NCCP test is practical. Does the note capture what the client actually said their objectives were, in their terms? Does it record the inquiries you made and what you did about anything that did not add up? If it reads like a meeting summary with a list of topics, it does not help you under s 117. We go through the structure in how to write a compliant NCCP file note.

BID and what RG 273 says about records

Since 1 January 2021 a mortgage broker must act in the best interests of the consumer when providing credit assistance (s 158LA, or s 158LE for credit representatives) and must give priority to the consumer where there is a conflict (s 158LB, or s 158LF). ASIC's guide is RG 273, and its record-keeping section runs from RG 273.162 to RG 273.172.

RG 273.165 lists the records ASIC expects brokers to keep. They include records of relevant conversations with the consumer (RG 273.165(e)), the options and recommendation you presented and the reasons why, including a detailed description of your decision-making process (RG 273.165(g)), and any conflict you identified and how you handled it (RG 273.165(h)). RG 273.167(b) names file notes as an accepted form of record. RG 273.169 says contemporaneous notes are more effective. RG 273.168 says how long to keep BID records may vary with the loan term, any IO period and whether the client refinances.

Two of those points bear directly on AI. The first is contemporaneous. A draft that lands a few minutes after the call, and is reviewed the same day, is a stronger record than a note typed from memory on Friday. The second is decision-making process. A transcript only contains what was said out loud. If you ruled out two lenders on policy before the call, or picked the second cheapest option because of turnaround time, the AI cannot know that unless you said it. You have to add it at review. Our plain-English walkthrough is RG273 and the best interests duty explained.

A worked example

This is what a reviewed AI-drafted note should look like. The clients are invented. The lines marked [added at review] are the broker's own additions, which is the part an audit cares most about.

Your aggregator or licensee decides which tools you can use

A credit licensee must do all things necessary to ensure its credit activities are engaged in efficiently, honestly and fairly (NCCP Act s 47(1)(a)) and must take reasonable steps to ensure its representatives comply with the credit legislation (s 47(1)(e)). For BID there is a specific version in s 158LE(2) and s 158LF(2). A tool that handles client conversations falls inside that supervision duty. So if you are a credit representative, the approval decision belongs to your licensee, which for most brokers is the aggregator.

Policies differ between aggregators and they are changing quickly, so we will not guess at yours. Ask for the current AI or technology policy in writing. The usual questions it answers are:

• Is there an approved software list, and a process for getting a new tool reviewed?
• Are public or consumer AI chatbots banned for client data?
• Does client data have to stay in Australia?
• Where must the final note live? Most aggregators audit from their own CRM, so the note has to end up there.
• Do clients need to be told AI is used to prepare records?

If you hold your own ACL, you are the approver. Write down the due diligence you did, the decision and a review date. ASIC's REP 798 (October 2024), which reviewed AI use by 23 licensees including credit licensees, said existing licensee obligations apply to AI and called for proper and ongoing due diligence on third-party AI suppliers.

On industry body guidance: the MFAA published a discussion paper, "Embracing the future: Towards the safe and ethical use of AI for the mortgage broking industry", with an accompanying checklist on 24 July 2024. It is worth reading if you are an MFAA member, and it raises privacy, accountability and keeping a human in the process as the main concerns. It is a discussion paper and does not replace your licensee's policy.

Privacy Act and APP 8: where does the data go?

A loan conversation covers income, debts, family plans and sometimes health. If the Privacy Act 1988 applies to your business, the Australian Privacy Principles apply to every tool that touches that information. If you are under the small business threshold, check your aggregator agreement, which usually requires you to comply anyway. The Privacy (Tax File Number) Rule 2015 applies to anyone holding TFNs regardless of size, and payslips and tax returns are full of them.

APP 8 is the one that catches offshore AI tools. Before you disclose personal information to an overseas recipient, you must take reasonable steps to ensure the recipient does not breach the APPs. Under s 16C of the Privacy Act, if the overseas recipient does something that would breach the APPs, you are accountable as if you did it. Most global note-takers store data in the United States or Europe. Ask two questions: where is the data stored, and where is the AI model actually run? Australian hosting removes most of the APP 8 question, which is why many licensees require it.

The other APPs matter too. APP 1 expects your privacy policy to be current, including likely overseas recipients. APP 5 requires you to tell clients who you disclose their information to. APP 6 limits use to the purpose of collection, so a vendor training its model on your client's call is a problem and "no training" should be in the contract. APP 11 requires reasonable security and deletion when the information is no longer needed. The OAIC's guidance on commercially available AI products (21 October 2024) names note-taking tools as in scope and recommends against entering personal information into publicly available generative AI tools.

Recording consent by state

Many AI note-takers work by recording the call or joining the video meeting as a bot. That brings in state surveillance and listening devices laws, which carry criminal penalties and have nothing to do with ASIC.

Brokers write loans across state lines all the time, and you often do not know where the client is sitting. The safe rule is one national rule: tell every client at the start of every call, get a yes, and note it. Details are in is it legal to record phone calls in Australia?, and you can check a specific call with the can I record this call tool.

The difference between the two kinds of tool is covered in do AI note-takers record your calls?.

What an aggregator audit looks for in a file note

A file review reads the notes in date order and expects them to tell the story of the file. The full list of documents is in our mortgage broker compliance audit checklist. For the notes themselves, reviewers look for:

• One note per substantive contact. First meeting, recommendation discussion, any change to the loan, approval, settlement.
• Dated and attributed. The date of the conversation, who was on it, and who wrote the note.
• Specific objectives. In the client's terms and ranked, matching the fact find and the preliminary assessment.
• Figures that agree with the application. Income, loan amount, LVR and expenses in the note should match what was submitted, or the difference should be explained.
• Reasons. Why this lender and product, why others were ruled out, and the cost position (RG 273.54). On a refi, the switching costs (RG 273.58).
• Conflicts. Recorded, or a line that none was identified.
• No signs of later editing. A note changed after the fact without a trail undermines the rest of the file.

AI drafts fail this list in predictable ways. They get figures wrong, especially when two numbers are said close together. They attribute a statement to the wrong borrower. They write a generic objective like "clients want a competitive rate". They leave out anything that was not said on the call. And if every note in your file has the same phrasing, a reviewer will assume nobody read them. The fix is the review step: check figures against the fact find first, rewrite the objectives if they are vague, add your reasoning, then lock the note. You can test a note against the NCCP file note compliance checklist or run a file through the audit readiness checker.

Due-diligence checklist for an AI file note tool

Where CallNote sits

We built CallNote for the note itself. It never records calls, never joins a meeting as a bot and never stores call audio. It takes a transcript that already exists (pasted, uploaded from Teams, Zoom or Meet, forwarded by email, or sent automatically from Dialpad or Aircall) or a voice memo you dictate after a face-to-face meeting, and drafts a file note in about two minutes. There is an NCCP template, or you can paste one of your own past notes and it builds a template with your headings and shorthand. You review the draft, then publish it seals it with a SHA-256 checksum. Amendments are append-only and every action is in the audit log. Data is hosted in Sydney, encrypted, and not used to train AI.

The limits: CallNote has no native integration with Mercury, Salestrekker or other broker CRMs, so the note gets there by copy and paste or PDF. It pushes to HubSpot, Notion and Slack, and Zapier covers other systems where they support it. It does not do product comparison, servicing or the preliminary assessment. If you want a tool that records the call for you, this is the wrong product. Pricing is $149 a month Solo or $99 per seat a month for teams. More detail is on the mortgage brokers page, and other options are compared in best file note software for mortgage brokers.

Common questions