You open your email and there it is: a formal notice from ASIC. Or the ACCC. Or the ATO. The language is careful, formal, and completely unhelpful in telling you what this actually means for your business.
The question that lands in your mind immediately: "Can I push back on this?"
The short answer: yes, you can challenge both how a regulator investigates you and the decisions they make. But you cannot simply tell them to stop because you disagree. You need to understand the pathways available, act early, and choose the right ground to stand on.
This article walks you through what's realistic when a regulator turns its attention to your business. Not theoretical doctrine. Practical guidance on how you protect your position, when you escalate, and how you make those decisions without making things worse.
Key Takeaways
You can challenge regulatory investigations and enforcement decisions, but only through the right pathway: negotiation, internal review, merits review in a tribunal, or judicial review in a court.
Cooperation does not mean surrender, you can comply with mandatory notices while still questioning scope, timing, and procedural fairness, and you can negotiate enforcement outcomes before they become formal proceedings.
Courts review legality, not merits, judicial review asks whether the regulator followed the rules and acted within their powers, not whether their decision was "right" on the facts.
The first 72 hours matter, how you handle documents, communications, and internal discussions in the opening days of an investigation can shape everything that follows.
Commercial reality governs legal strategy, the decision to challenge should be driven by business impact, cost, timing, and regulator relationships, not emotion or principle alone.
Early legal advice changes outcomes, waiting until the regulator has made a final decision or until enforcement proceedings are filed often means you have missed the best opportunities to influence the process.
When a Regulator Comes Knocking: What's Really Happening
A regulatory investigation is not the same as being sued. It is not even the same as being accused. It is the regulator gathering information to decide whether you have done something wrong, whether enforcement is warranted, and what action they might take.
That could be ASIC looking at financial services conduct. The ACCC examining competition law compliance. The ATO auditing tax positions. AUSTRAC reviewing anti-money laundering systems. AHPRA investigating professional conduct. Or a work health and safety regulator responding to an incident.
The regulator has statutory powers to compel answers, demand documents, and conduct interviews. They also have discretion about how they use those powers. That discretion is where the room to challenge exists.
But here is what most business owners miss: the investigation phase is often where the real decisions get made. By the time a formal enforcement action is proposed, the regulator has already formed a view. If you wait until then to push back, you are playing catch-up.
The earlier you understand what is happening and how to respond, the more control you have over the outcome.
Regulators have broad powers during investigations, but those powers are not unlimited. Understanding where the boundaries are, and when the regulator has stepped outside them, is the first step in knowing whether you can challenge.
Do You Have to Comply with Every Request? Understanding Your Obligations
When a regulator serves you with a formal notice requiring information or documents, that is usually a compulsory notice. Ignoring it is a criminal offence. Miss the deadline, and you are exposed to penalties and prosecution.
The ACCC's section 155 notice is a classic example. It can demand documents, answers to questions, and sworn statements. Same with ASIC notices under the Corporations Act and ASIC Act. The ATO has similar powers under taxation law. AUSTRAC can compel production under anti-money laundering legislation.
So the answer to "do I have to comply?" is almost always yes, if the notice is validly issued.
But compliance does not mean blindly handing over everything without question. You can ask for clarification. You can request extensions if the timeframe is genuinely unworkable. You can query the scope if the notice is so broad it amounts to a fishing expedition.
What you cannot do is simply refuse to engage because you think the investigation is unfair or because you believe you have done nothing wrong. That is not a legal defence to a compulsory notice.
If you think the notice itself is invalid, because it is outside the regulator's powers, or because it has been issued in bad faith, or because it breaches procedural fairness, that is a different conversation. That is when you start looking at formal challenge pathways. But that is rare, and it requires early legal advice.
The practical reality: most notices are valid. Your focus should be on managing the response strategically, not refusing to comply.
What does strategic compliance look like?
You preserve documents immediately. You control who speaks to the regulator. You avoid volunteering information beyond what is asked. You get legal advice on scope, privilege, and how to frame answers. You ensure that what you provide is accurate, complete, and does not inadvertently create new problems.
And if the regulator is making unreasonable demands, asking for documents that do not exist, imposing deadlines that are physically impossible, or seeking material that is clearly not relevant, you raise those issues formally and contemporaneously. Not by ignoring the notice. By engaging with the regulator and, if necessary, seeking a review or court intervention.
If you receive a compulsory notice, get legal advice within 24 hours. Do not start gathering documents and drafting responses on your own. What you say and how you say it can have long-term consequences, including in future enforcement proceedings.
Can You Challenge the Investigation Process Itself?
Yes, but the question is when and how.
Challenging an investigation while it is ongoing is difficult. Regulators have broad discretion during the investigative phase. Courts are reluctant to intervene before a final decision is made, because they do not want to micromanage the regulator's work.
But there are exceptions.
If the regulator is acting outside their statutory powers, for example, demanding information they have no legal authority to seek, you can challenge that. If they are conducting the investigation in a way that breaches procedural fairness, for example, refusing to let you respond to allegations or ignoring relevant evidence you have provided, that may be grounds for intervention.
The most common scenario where businesses push back during an investigation is not through court proceedings, but through direct engagement with the regulator. That might mean:
- Asking the regulator to narrow the scope of a document request.
- Seeking an extension of time where the deadline is unrealistic.
- Providing submissions on why the investigation should be discontinued or refocused.
- Requesting clarification on the issues the regulator is examining, so you can respond properly.
This is not about being obstructive. It is about ensuring the process is fair, proportionate, and focused on genuinely relevant issues.
If the regulator refuses reasonable requests, or if their conduct crosses into bad faith or procedural unfairness, you then have a decision to make: do you escalate to a formal challenge, or do you continue to engage and preserve your position for later review?
That decision depends on the strength of your legal grounds, the business impact of the investigation, and whether escalating now will genuinely improve your position or just antagonise the regulator.
In some cases, the right move is to comply under protest, document the issues, and raise them later if the regulator proceeds to enforcement. In other cases, immediate court intervention is warranted.
The key is making that decision with clear legal advice, not emotional reaction.
Regulators expect businesses to engage constructively during investigations. You can question scope and process without being labelled uncooperative, but you need to do it professionally and with a clear understanding of your legal position.
When and How You Can Challenge an Enforcement Decision
Once the investigation concludes, the regulator decides what to do next. That might be:
- Closing the matter with no action.
- Issuing an infringement notice (essentially a fine).
- Imposing licence conditions or suspending a licence.
- Accepting an enforceable undertaking (a negotiated settlement).
- Commencing civil penalty proceedings in court.
- Referring the matter for criminal prosecution.
If you disagree with that decision, your options depend on what type of decision it is and which regulator made it.
Some decisions can be reviewed on their merits by a tribunal. That means the tribunal reconsiders the decision from scratch, looking at the evidence and the facts, and decides whether the regulator got it right. The Administrative Appeals Tribunal (AAT) hears merits reviews of many Commonwealth regulatory decisions.
Other decisions cannot be reviewed on their merits. Your only option is judicial review in a court. That is very different.
Judicial review does not ask whether the regulator's decision was correct. It asks whether the decision was legally valid. Did the regulator follow the right process? Did they act within their powers? Did they consider the things they were required to consider? Did they give you procedural fairness?
If the answer to any of those questions is no, the court can set the decision aside and send it back to the regulator to be remade. But the court will not substitute its own view of what the right decision should be.
This is a critical distinction that many businesses miss. If you think the regulator got the facts wrong, or weighed the evidence incorrectly, judicial review will not help you unless there was also a legal error in how they reached that conclusion.
Before you decide to challenge a decision, you need to understand:
- Whether merits review is available (it often is not).
- Whether you have grounds for judicial review (most disputes about "fairness" are not legal grounds).
- Whether the costs and time involved in a challenge are proportionate to the outcome you are seeking.
- Whether there is a negotiated pathway that achieves a better result.
Many enforcement decisions can be resolved through negotiation before they reach court. Enforceable undertakings, for example, allow a business to commit to compliance measures and avoid formal proceedings. The terms are negotiated. You can often secure an outcome that avoids admissions of liability and limits reputational damage.
If the regulator has proposed a penalty or licence condition, you may be able to negotiate the terms, the amount, or the timing. That requires understanding what the regulator's real concerns are and addressing them in a way that satisfies their enforcement objectives.
This is not about rolling over. It is about understanding when a negotiated outcome delivers more value than a contested hearing.
Before you decide to challenge an enforcement decision in court, ask your legal team to walk you through the realistic best-case and worst-case outcomes. Challenging for principle alone is expensive and often counterproductive.
Judicial Review in Practice: What a Court Can and Cannot Do for You
Judicial review is the most misunderstood option available to businesses facing regulatory decisions.
It is governed by the Administrative Decisions (Judicial Review) Act 1977 (Cth) for most Commonwealth decisions, or by equivalent state and territory legislation, or by the court's inherent jurisdiction. The Constitution also entrenches a minimum level of judicial review that cannot be legislated away.
But here is what judicial review is not: it is not an appeal. It is not a rehearing. It is not an opportunity to re-argue the merits of the case.
What it is: a check on whether the regulator acted lawfully.
The grounds for judicial review are narrow and technical:
- Breach of natural justice or procedural fairness. Did the regulator give you a fair opportunity to be heard? Did they fail to disclose critical information or consider your submissions?
- Error of law. Did the regulator misinterpret the legislation or apply the wrong legal test?
- Jurisdictional error. Did the regulator make a decision they had no power to make?
- Taking into account irrelevant considerations, or failing to consider relevant matters. Did the regulator focus on the wrong things or ignore something they were legally required to consider?
- Unreasonableness (in the legal sense). Was the decision so unreasonable that no rational decision-maker could have reached it? This is an extremely high bar.
If you succeed in judicial review, the usual outcome is that the court sets aside the decision and sends it back to the regulator to remake it according to law. The court does not make the decision for the regulator.
That means you may win the legal argument but still end up with the same substantive outcome once the regulator remakes the decision properly.
So when does judicial review make sense?
When the legal error is fundamental and likely to change the outcome. When the procedural unfairness was serious and the regulator's decision might have been different if they had followed the right process. When the business impact of the decision is significant enough to justify the cost and time of court proceedings.
Judicial review is also sometimes used strategically to buy time, to force the regulator to reconsider, or to create leverage for a negotiated settlement.
But it is not a tool for correcting every disagreement. If your case is "the regulator weighed the evidence differently to how we would have weighed it", that is not a ground for judicial review. If your case is "the regulator followed the wrong process, ignored our evidence, and applied the wrong legal test", that might be.
The decision to pursue judicial review should be made with a clear-eyed assessment of your legal grounds, your prospects of success, the costs involved, and what you are realistically trying to achieve.
Judicial review is a powerful accountability mechanism, but it is not a second chance to argue the facts. If you want the decision reconsidered on its merits, you need merits review (where available) or a negotiated resolution, not judicial review.
Balancing Legal Rights with Commercial Realities
You have a legal right to challenge a regulatory investigation or enforcement decision. That does not mean you should.
Every challenge decision needs to be assessed through a commercial lens, not just a legal one.
How much will this cost? Judicial review proceedings in the Federal Court can easily run to hundreds of thousands of dollars, depending on complexity. Merits review in a tribunal is usually cheaper, but still significant. Negotiation and settlement discussions cost far less.
How long will this take? Court proceedings take months, often years. Tribunal reviews are faster, but still not quick. A negotiated enforceable undertaking can be resolved in weeks.
What is the reputational impact? Some businesses prefer to resolve matters quietly, without the publicity of court proceedings. Others see value in contesting publicly to defend their reputation. There is no universal answer; it depends on your industry, your stakeholders, and the nature of the allegations.
What is the relationship cost? If you operate in a heavily regulated industry, your ongoing relationship with the regulator matters. Challenging them in court does not necessarily burn that relationship, but it changes it. Some regulators respect businesses that stand their ground on principle. Others become more adversarial. You need to understand the culture and priorities of the regulator you are dealing with.
What is the precedent risk? If you lose, you may set a precedent that affects your industry or your future dealings with the regulator. If you win, you may establish a principle that benefits you long-term. Both possibilities matter.
The board's question is always: "Should we fight this?"
The answer depends on:
- The strength of your legal grounds. If you have a clear procedural fairness argument or a strong legal error, your prospects improve.
- The business impact if you do nothing. If the regulator's decision threatens your licence, your market position, or exposes you to significant penalties, the cost of fighting may be justified.
- The alternative pathways. Is there a negotiated outcome that delivers 80 per cent of what you need without the cost and risk of litigation?
- Your risk tolerance. Some businesses are willing to take on regulatory litigation as part of defending their market position. Others prefer certainty and closure.
There is no formula. Every case turns on its own facts and its own commercial context.
What matters is that you make the decision deliberately, with full information, and with a clear understanding of what you are trying to achieve.
Involve your board early in the decision to challenge a regulator. This is not just a legal question. It is a strategic business decision that affects risk, reputation, and resources.
Practical Steps in the First Week of an Investigation or Enforcement Notice
The decisions you make in the first few days after receiving a regulatory notice can determine how the rest of the matter unfolds.
Here is what you do, and what you avoid, in the first 72 hours.
Preserve all relevant documents immediately. Issue a litigation hold. Suspend any document destruction policies. Ensure that emails, files, and records that might be relevant are preserved. Destroying documents after you know an investigation is underway can be a criminal offence and will destroy your credibility with the regulator.
Control internal communications. Do not let staff email each other speculation, theories, or post-hoc explanations of what happened. Those emails can be compelled by the regulator and used against you. Brief your team on what they can and cannot discuss.
Do not provide informal responses or explanations to the regulator without legal advice. It is tempting to pick up the phone and "explain" the situation. Do not. Anything you say can be used in enforcement proceedings. Get advice first.
Identify who will be the single point of contact with the regulator. Usually that is your lawyer, or a senior executive supported by a lawyer. Do not have multiple people responding to the regulator in different ways.
Read the notice carefully and understand the deadline. Mark it in your calendar. If the deadline is unrealistic, seek an extension immediately, in writing, with reasons. Do not wait until the day before it is due.
Get legal advice within 24 hours. This is not a matter you handle in-house unless you have specialist regulatory experience on your team. The stakes are too high.
Assess privilege. Legal advice and lawyer-client communications are privileged. Internal business communications usually are not. Structure your response so that privileged material stays protected.
Do not destroy, alter, or create documents to "help" your case. This should be obvious, but it happens. If you are caught, the consequences are severe.
Understand what the regulator is actually investigating. Sometimes the notice is broad, but the real focus is narrow. Understanding what they are looking for helps you manage the response and assess risk.
Start thinking about your end goal. Is it to make this go away quietly? To contest the allegations? To negotiate a resolution? Your strategy from day one should align with that goal.
Most businesses do not fail because they lack a legal defence. They fail because they mishanage the early days: they over-disclose, they create unhelpful documents, they antagonise the regulator, or they ignore deadlines.
The first week is not about solving the problem. It is about protecting your position so that you have options later.
Treat every document you create during an investigation as if it will be read by the regulator, the court, and your shareholders. If you would not want it seen, do not write it.
When You Need Specialist Litigation Help
Not every regulatory matter needs a litigator. If the regulator is conducting a routine compliance review, your in-house team or compliance advisors can usually manage it.
But there are triggers that should bring litigation expertise into the room.
You have received a compulsory notice with a tight deadline and significant scope. Managing these notices properly requires understanding what must be disclosed, what can be withheld on privilege grounds, and how to frame responses that do not create admissions or new problems.
The regulator has indicated they are considering enforcement action. Once enforcement is on the table, you are no longer in compliance mode. You are in dispute mode. The skills required are different.
You are considering challenging a decision or process. Whether that is judicial review, merits review, or negotiating an enforceable undertaking, you need someone who understands both the legal pathways and the practical realities of regulatory litigation.
The matter has reputational, financial, or strategic significance. If the outcome could affect your licence, your market position, your directors' personal liability, or your relationship with key stakeholders, you need senior litigation advice.
The regulator's conduct has been procedurally unfair or legally questionable. If you think the regulator has overstepped, ignored your submissions, or failed to follow the rules, you need someone who can assess whether you have grounds to challenge and what the process for doing so looks like.
You are facing the possibility of civil penalties, enforceable undertakings, or court proceedings. At this stage, you are past the point of compliance advice. You need a litigation strategy.
Litigation firms that specialise in regulatory disputes bring something distinct: they understand how regulators think, how enforcement decisions get made, and how to position a business for the best possible outcome, whether that is through negotiation, review, or court proceedings.
They also understand cost. A good litigator will tell you when fighting is worth it and when it is not. They will give you a realistic assessment of your prospects, your options, and the commercial trade-offs involved.
If you are dealing with a significant regulatory matter, the earlier you bring in that expertise, the more control you have over the outcome.
Regulatory investigations and enforcement actions are not routine legal matters. The right litigation support changes outcomes, not by fighting every issue, but by helping you make better decisions earlier.
Challenging a Regulator: What It Takes
You can challenge a regulatory investigation or enforcement action. But challenging well requires clarity, timing, and strategy.
Clarity about what you are challenging and on what grounds. Timing, because the best opportunities to influence outcomes are early, before positions harden. Strategy, because the decision to challenge is not just legal, it is commercial, reputational, and relational.
Most businesses that succeed in regulatory disputes do not do so by winning in court. They do so by understanding the process, engaging constructively, preserving their legal position, and choosing the right moments to push back.
The right legal team will not tell you to fight everything. They will help you understand where you have leverage, where the risks outweigh the benefits, and how to protect your business while managing the dispute.
Litigation is not the collection of all possible issues. It is a targeted analysis of the right issues, prosecuted at the right time, with a clear view of what you are trying to achieve.
If you are facing a regulatory investigation or enforcement action, the first question is not "can I challenge this?" The first question is "should I, and if so, how?"
The answer to that question determines everything that follows.
Disclaimer: This article provides general information only and does not constitute legal advice. Every regulatory matter depends on its specific facts and circumstances. If you are dealing with a regulatory investigation or enforcement action, seek specialist legal advice immediately.
