If your institution enrols international students, 2026 is not a quiet year. Four meaningful changes to Australia’s CRICOS and ESOS framework have come into force — covering agent commissions, automatic registration cancellations, new PRISMS reporting obligations, and stricter entry criteria for providers wanting to join the register.
Some of these changes affect your admin processes directly. Others affect how your Student Management System needs to work. A few will require immediate action if you haven’t already reviewed your position.
This article walks through each change, explains what it means in practice, and tells you exactly what your SMS needs to do to keep your institution compliant.
A quick reset: what CRICOS compliance actually requires
The Commonwealth Register of Institutions and Courses for Overseas Students (CRICOS) is the official Australian Government register of providers and courses approved to teach international students on student visas. If your course isn’t on CRICOS, you cannot legally enrol a student visa holder in it — full stop.
Compliance with CRICOS sits within the broader ESOS (Education Services for Overseas Students) framework, which is governed by the ESOS Act 2000 and the National Code of Practice for Providers of Education and Training to Overseas Students 2018 (National Code 2018). Your ongoing obligations include:
- Issuing and managing Confirmations of Enrolment (CoEs) through PRISMS
- Reporting enrolment changes, non-commencements, and non-compliance events to PRISMS on time
- Monitoring student attendance and academic progress
- Managing student transfers, deferrals, and suspensions within the rules
- Maintaining and regularly updating your details on the CRICOS register
- Meeting Tuition Protection Service (TPS) requirements
- Reporting agent commissions when requested
Breaches of ESOS obligations are treated seriously. Consequences range from formal warnings and conditions placed on your registration through to suspension and cancellation — and reputational damage in a sector where trust from students and agents is everything.
The four CRICOS changes you need to know in 2026
1. The National Code now bans agent commissions for onshore transfers
In January 2026, the National Code 2018 was amended to prohibit the payment of commissions to education agents — monetary or non-monetary — for recruiting students who are transferring from another Australian provider. The ban applies to all transfers where the student accepted enrolment after 31 March 2026.
The intent is clear: regulators want to remove the financial incentive for agents to facilitate unnecessary or inappropriate student transfers — particularly where the move may not be in the student’s best interest.
What this means for your institution: If you work with education agents and recruit transfer students, you need to review your agent agreements immediately. Commission structures that applied to onshore transfer recruitment are no longer permissible under the National Code.
What this means for your SMS: Your system needs to be able to flag transfer student enrolments and distinguish them from new enrolments. If ASQA requests commission data (more on this below), you need a clean audit trail that shows which enrolments were transfers and what payments, if any, were made.
2. CRICOS registrations are now automatically cancelled after 12 months without delivery
From 1 January 2026, any CRICOS provider that has not delivered a CRICOS-registered course to an overseas student at an onshore location for 12 consecutive months will have their registration automatically cancelled.
This is a significant hardening of the rules. Previously, inactive registrations were reviewed on a case-by-case basis. Now, if there is no evidence of actual delivery, the registration ends — automatically, without further process.
What this means for your institution: If any part of your CRICOS registration is at risk of falling into a 12-month delivery gap — whether due to low international enrolments, a course under review, or a location not currently operating — you need to monitor this closely and plan accordingly.
What this means for your SMS: You need to be able to query your enrolment data and quickly confirm whether each CRICOS-registered course-location combination has had at least one active international enrolment within the last 12 months. This should be a standard dashboard view, not a manual spreadsheet exercise.
3. New PRISMS reporting: agent commissions and English test score IDs
Two new data reporting obligations are now in effect through PRISMS:
Agent commission reporting: Following ESOS Act amendments, the Department of Education can now request detailed information about all monetary and non-monetary payments made to education agents. The first reporting period covers payments from 1 January 2026 to 30 June 2026, with providers given at least 30 days’ notice to complete submissions once a request is made. PRISMS has been updated to accept this data.
English test score IDs: Amendments to the ESOS Regulations now require providers to submit the unique identifier for each accepted student’s English language test result alongside their other enrolment data. PRISMS is expected to be updated in April 2026 to collect these identifiers. Once that update is live, providers will be expected to submit this data going forward.
What this means for your institution: Your admissions and compliance teams need to be collecting English test score IDs at the point of offer acceptance, not retrospectively. Agent payment records need to be structured and searchable — not buried in email threads or spreadsheets.
What this means for your SMS: Your system needs dedicated fields for English test score IDs at the student record level, and the ability to export or submit these to PRISMS. For agent commissions, you need structured payment records linked to individual enrolments — categorised by enrolment type (new vs transfer) — that can be extracted on request.
4. Stricter entry requirements for new CRICOS providers
The 2025 legislative changes tightened the pathway for new providers wanting to join the CRICOS register:
Two-year domestic delivery requirement: Most new private VET providers (excluding TAFEs) must now demonstrate at least two years of domestic delivery before applying to teach international students. This is designed to ensure providers have operational maturity before exposing international students to a new and unproven institution.
Increased scrutiny of ownership structures: Regulators now more closely examine relationships between providers and education agents when assessing CRICOS applications. If a provider and its recruitment agents have shared ownership or control arrangements, this will be a material factor in the fit and proper person assessment.
New ministerial powers: The Minister for Education can now pause the making or processing of CRICOS applications. This gives regulators a circuit-breaker during periods of heightened risk or when systemic issues are identified in the market.
What this means for existing providers: These changes are primarily aimed at new applicants, but existing providers should treat them as a signal about the direction of regulatory intent. If your institution has agent relationships that involve any shared ownership or control, document and review them carefully.
What your SMS needs to do to keep up
The 2026 changes place new data collection, reporting, and monitoring demands on CRICOS providers. Many of these are manageable — but only if your Student Management System is set up to handle them. Here’s a practical capability checklist:
| SMS capability | Why it matters for CRICOS 2026 | Priority |
|---|---|---|
| PRISMS integration | All CoE creation, SCV reporting, and enrolment status changes must flow directly to PRISMS. Manual PRISMS updates are slow, error-prone, and scale badly. | Critical |
| English test score ID field | New ESOS Regulations require test score IDs to be submitted with enrolment data from April 2026. Your SMS needs this field at student record level. | Critical |
| Transfer vs new enrolment tagging | The agent commission ban only applies to onshore transfers. Your SMS must distinguish these enrolment types to produce a clean audit trail. | Critical |
| Agent commission recording | Payments to agents must be structured and linked to individual enrolments. Your SMS should hold payment records — not just agent contact details. | High |
| 12-month delivery monitoring | A dashboard view showing active enrolments by CRICOS course-location combination, with date of last active enrolment, prevents accidental registration cancellation. | High |
| CoE lifecycle management | Complete CoE history including Student Course Variations (SCVs), course shortening/extension, and non-commencement events — all timestamped. | High |
| Attendance and progress tracking | National Code obligations require monitoring of attendance and academic progress for student visa compliance. This data needs to live in or feed into your SMS. | High |
| Automated PRISMS reporting alerts | Deadlines for reporting non-commencement (within 5 days) and non-compliance events are strict. Automated alerts when a student triggers a reporting obligation reduce missed deadlines. | High |
| Australian data hosting | Student visa data is sensitive government-adjacent data. Confirm your SMS vendor hosts all data on Australian servers. | High |
| Audit trail for ESOS reviews | ASQA and TEQSA can request documentation at any time. Every action taken on a student record should be timestamped and attributable to a user. | Medium |
Getting PRISMS right: the non-negotiable foundation
PRISMS — the Provider Registration and International Student Management System — is the government’s central database for international student management. Every obligation you have as a CRICOS provider is ultimately expressed through PRISMS: CoE creation, enrolment changes, non-compliance reporting, SCV submissions. If your SMS doesn’t integrate with PRISMS, everything defaults to manual entry.
The Department of Education has been developing a PRISMS API integration capability since 2022, which will eventually allow providers to submit data directly from their SMS without logging into PRISMS separately. In the meantime, your SMS should at minimum:
- Generate PRISMS-ready data exports in the correct format for all required submissions
- Create alerts when time-sensitive reporting obligations are triggered — non-commencement is reportable within five business days, so you can’t rely on manual checks
- Maintain a complete record of what was reported, when, and by whom, for audit purposes
- Flag inconsistencies between CoE end dates and student visa expiry dates before they become compliance issues
| Compliance Risk to Watch |
|---|
|
One of the most common PRISMS compliance failures is delayed or missing Student Course Variation (SCV) reports. Whenever a student’s CoE changes in length — due to an intervention strategy, course credit, deferral, or early completion — an SCV must be lodged in PRISMS. Failure to do so is a breach of Section 19(1)(e) of the ESOS Act. Your SMS should automatically trigger an SCV workflow whenever a relevant change is made to a student’s enrolment, not leave it to staff to remember. |
Questions to ask your SMS vendor right now
If you’re evaluating a new SMS or reviewing your current platform against the 2026 changes, these are the questions that matter:
| Question | Why it matters |
|---|---|
| Does the system have a dedicated English test score ID field at student record level? | Required for PRISMS submission from April 2026 under the updated ESOS Regulations. |
| Can the system distinguish between transfer and new enrolments at intake? | Essential for the agent commission ban audit trail and PRISMS categorisation. |
| Can it store and report structured agent commission data linked to individual enrolments? | Needed if the Department of Education requests payment data under the new ESOS powers. |
| Does it flag CRICOS course-location combinations with no active enrolments in the past 12 months? | Protects against the new automatic registration cancellation rule. |
| How does it handle SCV reporting workflows? | Manual SCV reporting is a leading cause of ESOS compliance breaches. |
| Where is the data hosted? Are the servers in Australia? | Data sovereignty is a baseline requirement for sensitive visa-related student data. |
| Does it integrate with PRISMS directly, or does it generate formatted exports? | Either can work, but direct integration reduces manual handling and error rates. |
| What happens when ASQA or TEQSA requests an audit of international student records? | You should be able to produce a complete, timestamped record for any student within hours, not days. |
The bottom line
CRICOS compliance has always been demanding. In 2026, it’s become more so — with automatic registration cancellations, new agent reporting obligations, additional PRISMS data requirements, and a regulatory environment that is clearly moving toward greater scrutiny rather than less.
The providers that navigate this well are the ones treating compliance as a systems problem, not just an admin task. If your SMS can’t automatically flag a 12-month delivery gap, can’t store English test score IDs, or requires manual PRISMS entry for every SCV, you’re carrying compliance risk that doesn’t need to exist.
The changes are significant, but they’re also knowable and manageable — provided your technology is set up to handle them.
| See how it works in practice |
|---|
|
Book a walkthrough to see how an integrated SMS handles CRICOS compliance, PRISMS reporting, CoE lifecycle management, and the 2026 ESOS changes — all from a single dashboard. → Book a free demo |
