Who's allowed to run payroll in Australia?

Software: no licence, but a gated channel

Single Touch Payroll works by sending tax and super information from STP-enabled payroll or accounting software to the ATO when payroll is run — the software channel is how the mandatory reporting obligation is discharged. Digital service providers (DSPs) reach that channel through the ATO's digital wholesale services via Standard Business Reporting (SBR), and access comes with a condition: the DSP Operational Security Framework (OSF).

The OSF is the ATO's minimum security bar, aimed at reducing identity theft, tax refund fraud and system hacks. Its mandatory controls include:

• Data encryption, and data hosted in Australia by default
• Unique user logins for all software products
• Multi-factor authentication — mandatory for most products, namely cloud-based or online software
• Audit logging of user access and transactions
• Entity validation — confirming the registered entity using the software is legitimate

Enforcement is by access: the ATO states it will "restrict or de-whitelist DSP products that fail to conform" to the framework. The technical bar also moves unilaterally — from 31 January 2026, software interacting with ATO systems must use TLS 1.3.

The employer-facing face of all this is the ATO's STP product register: a catalogue of commercially available products that have met the OSF security requirements and are authorised to use ATO digital wholesale services (sending data directly, or via a Sending Service Provider or Super Gateway). Employers choosing software are pointed at the register — or told they can ask a third party, "such as a registered tax or BAS agent or a payroll service provider", to report for them.

Sending Service Providers: the intermediary path

The ATO recognises "STP sending service providers" (SSPs) as their own DSP capability category: providers whose product is transmitting STP data to the ATO on behalf of others. The ATO maintains a separate SSP register of "products which can submit conforming data to the ATO", and treats reporting through an SSP as a normal configuration — "the digital service provider you use for your payroll can advise you if you report through a sending service provider".

The mechanics on the employer side: an employer reporting STP through an SSP must notify the ATO of the SSP's software ID — a one-time notification by an authorised representative through Access Manager (existing arrangements had to be notified by 30 June 2026; that deadline has passed and the requirement is simply in force). Registered agents lodging on behalf of employers notify their own software ID.

Why this path matters: direct SBR integration means carrying the OSF and whitelisting burden yourself; riding an SSP (or an existing STP-enabled DSP) means your product computes and the intermediary owns the ATO-facing transmission channel. And on the TPB side, pure transmission is not a regulated tax-practitioner service: transmitting data to the ATO through STP-enabled software is expressly not a BAS service where the transmission "does not require the interpretation or application of a taxation law or a BAS provision" — and that holds even where the sender transforms the format of the data, provided the software embeds a client-verification workflow:

• present the client (or an authorised person) with the data collated into the form about to be transmitted;
• give them a mechanism to review it, and to verify its correctness and appropriateness for transmission; and
• have the software retain evidence of that verification.

Lodging on an employer's behalf: registered agents only

Once someone else does the lodging for a fee, it's a regulated agency. The ATO's guidance for STP intermediaries is blunt: "You must be a registered agent" — registered with the Tax Practitioners Board, linked to the client in ATO systems, with the agent's unique software ID notified to the ATO.

The legal frame is the Tax Agent Services Act 2009 (TASA): it is unlawful to charge or receive a fee for a service you know, or ought reasonably to know, is a tax agent service unless you're registered (s 50-5). A BAS service is the subset of tax agent services confined to BAS provisions — and the BAS provisions are where payroll lives. They include the PAYG withholding system (Parts 2-5 and 2-10 in Schedule 1 to the Taxation Administration Act 1953), and the TPB's examples make STP explicit: "providing a payroll service which involves interpreting and applying a taxation law, including reporting of employee payroll information through the use of or set up of single touch payroll (STP) enabled software" is a BAS service.

Superannuation work connected to payroll is in BAS-agent scope by force of the Act itself: TASA s 90-10(1AB) makes superannuation-guarantee services BAS services "to the extent that [they relate] to a payroll function or payments to contractors", and s 90-10(1AA) does the same for SGC statements and advice, super payments through a clearing house, TFN declarations, TPAR lodgement and ABN applications.

For payroll's usual span, BAS agent registration is generally the right (and narrower) ticket; full tax agent registration matters only where the work strays beyond BAS provisions — say, substantive income-tax or FBT-law advice. Individual BAS agent registration requires at least a Certificate IV in bookkeeping or accounting, a Board-approved GST/BAS course, and 1,400 hours of relevant experience in the past four years (1,000 for voting members of a recognised professional association). Companies and partnerships register instead by maintaining "a sufficient number of registered individuals" to provide services competently and supervise the work.

The boundary: calculating pay can itself be regulated

Here's the part platforms most often get wrong. There is no payroll-specific registration statute — the TPB says so plainly ("there are no separate or specific legislative provisions relating to whether payroll service providers need to be registered under the TASA"). But registrability turns on what the service does, and the TPB's examples put ordinary payroll computation inside the line:

• "Ascertaining the withholding obligations for employees of your clients" — a BAS service.
• "Calculating leave payments and determining the withholding" with reference to the period and applicable tax rates — a BAS service.
• Advising about or confirming a client's withholding obligations for its employees — a BAS service.

A commercial gross-to-net service inescapably determines withholding, so the standard third-party payroll offering is TPB-registrable territory even if the client lodges everything themselves — the trigger is that the client can reasonably be expected to rely on the computed figures, for a fee. Two aggravators to note: the fee "does not necessarily have to be separately charged" (bundling payroll inside a platform subscription still counts), and a disclaimer "alone will not be determinative" of whether reliance was reasonable.

What genuinely isn't regulated

The honest residue of "no licence to compute" is a narrower band. TPB registration is not required for:

• In-house payroll — including intra-group cost-recovery or shared-services arrangements, and salaried employees doing payroll for their own employer
• Mechanical work without interpretation — data entry that doesn't require interpreting a taxation law, coding transactions to instructions provided, processing of payments, bank reconciliations
• Pure transmission through SBR2/STP-enabled software, with the client-verification workflow above
• Selling non-customised software — "even if the software includes tax calculators or lodgement feature", the provider is "merely… providing a tool" (configuring a system to deliver a specific tax outcome, or client-specific help-desk tax advice, crosses back over the line)
• State and territory obligations — determining payroll tax or WorkCover entitlements is outside the TASA entirely
• Working under the supervision and control of a registered practitioner, as employee or contractor — the TPB's stated alternative to registering yourself

Quick answers

Related