Payments to foreign resident individuals for personal services Where an Australian business pays a foreign resident individual for work performed, withholding obligations can apply depending on where the work is physically performed and the nature of the engagement — this is a frequent area of confusion, since many businesses assume the location of the paying entity (Australia) is what matters, rather than where the work is actually carried out.

Payments to foreign resident contractors and companies Certain payments to foreign contractors or businesses — particularly for specific categories such as royalties, interest, or dividends — can trigger a separate withholding tax regime, generally deducted at the time of payment rather than assessed later through a tax return.

Remote employees working from overseas An increasingly common scenario: an Australian business employing someone who works remotely from another country. This raises questions not just around withholding, but potentially around payroll tax, superannuation, and even where the employment relationship is considered to be legally based — all of which can differ from how a domestically based employee is treated.

Scenario: A company assumes it qualifies as a base rate entity and franks a dividend using a 25% rate. If a review later determines the company should have been taxed at 30% for that year (because the passive income test wasn't actually met), the franking credit passed to shareholders was calculated on the wrong basis — potentially leaving the company with an under-franked distribution relative to its actual franking account position, and shareholders with an incorrect tax offset on their own returns.

Recalculate aggregated turnover annually, including all connected entities and affiliates — don't assume last year's classification automatically carries forward.
Check the passive income percentage for the specific year, particularly if the company had any unusual capital gains, large interest income, or significant rental income that year.
Confirm the franking rate applied to any dividends matches the company's actual base rate entity status for that year, not an assumed or previous year's status.
Review group structure changes, since a new connected entity or a change in shareholding can affect the aggregated turnover calculation going forward.

Most cyber insurance policies address a combination of:

• First-party costs — your own business's direct costs from an incident, including forensic investigation, data recovery, business interruption, and notification costs under the Notifiable Data Breaches scheme.
• Third-party liability — claims from customers, suppliers, or other parties affected by a breach involving their data.
• Cyber extortion — costs associated with ransomware demands, though coverage and conditions here vary considerably between insurers.
• Regulatory costs — expenses associated with responding to a regulator investigation following a breach.

Failure to maintain "reasonable" security standards. Many policies include a condition that the business maintained reasonable cybersecurity practices — outdated software, unpatched systems, or absent multi-factor authentication can give an insurer grounds to deny a claim after the fact.

Acts of war or state-sponsored attacks. Following some major global ransomware incidents attributed to state actors, insurers have increasingly excluded or limited coverage for attacks attributed to nation-states — a distinction that can be genuinely difficult to establish either way after an incident.

Prior known vulnerabilities. If a vulnerability was known and not remediated before the incident, insurers can deny coverage on the basis the business failed to act on a known risk.

Social engineering and payment redirection scams. Standard cyber policies often exclude or sub-limit coverage for scams where an employee is tricked into authorising a payment — this typically requires a specific endorsement or separate crime insurance.

1. Confirm what security standards the policy requires you to maintain, and whether your actual practices meet them.
2. Check whether social engineering and payment redirection scams are covered, or need a separate endorsement.
3. Review the sub-limits for specific claim types — a large headline coverage figure can mask much smaller sub-limits for the incidents you're most likely to face.
4. Confirm notification and reporting timeframes required under the policy, since late reporting of an incident can itself void coverage.

RBizz can connect you with insurance specialists to review your cyber coverage against your actual risk profile — get in touch before renewal.

A key person isn't necessarily the most senior title-holder — it's whoever's loss would create a genuine, material financial impact on the business. This commonly includes:

• Founders or majority shareholders, particularly where the business's client relationships, reputation, or strategic direction are closely tied to that individual
• Technical specialists or top revenue generators, whose specific expertise or client relationships aren't easily or quickly replaced
• Anyone whose departure would trigger a loan covenant issue, since many business loans and finance facilities include conditions tied to key management remaining in place

If a key person dies or becomes permanently unable to work, the business can face several compounding financial pressures simultaneously:

• Lost revenue during the disruption period, particularly where that person was directly responsible for significant client relationships or sales
• Recruitment and replacement costs, which for a genuinely specialised or senior role can be substantial and take considerable time to resolve
• Reduced creditworthiness or loan covenant breaches, if lenders had extended finance partly on the basis of that individual's ongoing involvement
• Client and supplier confidence issues, since key personal relationships often underpin commercial trust in smaller businesses specifically
• Potential need to buy out a deceased shareholder's estate, if that person held equity and the business needs to fund a buyout to keep control with the remaining owners

The business itself takes out and pays for a life insurance and/or total permanent disability policy on the key individual, with the business (not the individual's family) as the beneficiary. If the insured event occurs, the payout goes to the business, providing funds specifically intended to cover the financial disruption — recruitment costs, revenue shortfall, loan repayment, or a shareholder buyout, depending on how the policy is structured and sized.

This is a genuinely different arrangement from ordinary personal life insurance a key individual might hold privately for their own family's benefit — key person insurance is specifically structured around the business's financial exposure, not the individual's personal estate planning.

Key person insurance isn't about placing a value on someone's life — it's about ensuring the business itself has the financial resources to manage a genuinely disruptive event without that disruption compounding into a broader financial crisis for everyone else who depends on the business.

RBizz can connect you with insurance specialists to review your key person risk and appropriate cover levels — get in touch to check your current position.

Banks, regulators, and industry bodies have progressively increased expectations around businesses actively preventing these scams, rather than treating them purely as an unfortunate but unavoidable cost of doing business. This shows up in a few ways:

• Increased scrutiny of whether a business had reasonable verification processes in place when a payment redirection scam occurs, which can affect commercial disputes over who bears the loss between the parties involved.
• Growing expectation that businesses verify any change to payment details through a separate, independent communication channel — not simply by replying to the same email thread the change request arrived on.
• Reputational risk, since a business whose email systems are compromised and used to defraud its own customers or suppliers faces damage to trust and relationships, beyond any direct financial loss.

1. Never update payment details based solely on an email request. Any request to change bank account details — regardless of how legitimate the email appears — should be verified through a separate channel, ideally a phone call to a previously known, independently sourced contact number (not a number provided in the email itself, which could also be part of the fraud).

2. Establish a standard process for all payment detail changes. Rather than leaving verification to individual judgment on a case-by-case basis, have a documented internal process that requires verification before any change to a supplier's or customer's payment details is actioned.

3. Train staff specifically on recognising payment redirection attempts. Many of these scams succeed because they exploit normal business urgency (an invoice due soon, a request marked urgent) — staff trained specifically to slow down and verify in these situations are considerably less likely to fall for the scam.

4. Use multi-factor authentication and access controls on email systems. Since many of these scams begin with a compromised email account (either your own or a supplier's), securing email access reduces the risk of your systems being the point of compromise in the first place.

5. Communicate expectations to your own customers. If your business regularly invoices customers, consider explicitly communicating that you will never change payment details via email alone, and encouraging customers to verify any such request through a known phone number — this protects your customers and your business's reputation simultaneously.

For employees, work created within the course of their employment generally belongs to the employer by default, without needing a specific IP assignment clause — this is the standard position under copyright and related IP law.

For contractors, the default position is different: the contractor who actually creates the work generally retains ownership of the IP, even where they were paid specifically to create it, unless the contract explicitly assigns that IP to the paying business. This is the part that surprises many business owners — payment for services rendered doesn't, by itself, transfer ownership of the resulting intellectual property.

Without an explicit IP assignment clause in a contractor agreement:

• The business may only have an implied licence to use the work for the specific purpose it was commissioned for, not full ownership rights to modify, sublicense, or use it more broadly than originally intended.
• The contractor could potentially reuse, resell, or repurpose the work for other clients, since they retain underlying ownership.
• The business may face difficulty enforcing IP rights against a third party who copies or infringes the work, since enforcement rights generally sit with the actual IP owner, not merely a licensee.
• Selling or transferring the business can become complicated if key IP assets (software, branding, content) aren't clearly and demonstrably owned by the business itself.

Because of this risk, well-drafted restraint clauses are commonly structured with cascading or stepped provisions — offering a series of alternative geographic areas, durations, or scopes of decreasing breadth, expressed so that if the broadest version is found unreasonable, the next narrower version can still be relied upon, and so on down to a clearly reasonable minimum position.

A restraint clause without this cascading structure — a single, fixed geographic area, duration, and scope — carries considerably more risk, since there's no fallback position if a court finds the specific combination unreasonable as drafted.

A personal guarantee is a separate legal undertaking, given by an individual (typically a director or shareholder), promising to personally cover the company's obligations under the lease if the company fails to meet them. This isn't a formality — it's a direct, personal financial exposure that exists entirely independently of the company's own liability.

If the company can't pay rent, breaches the lease, or the lease is terminated early with outstanding obligations, the landlord can pursue the guarantor personally for the shortfall — potentially including remaining rent for the balance of the lease term, make-good costs, and other losses arising from the breach.

The guarantee can extend well beyond the initial lease term. If a lease includes an option to renew, or the company holds over after the lease expires, the personal guarantee may continue to apply during that extended period, depending on how it's drafted — meaning a guarantee signed years earlier can still be live long after the original lease term the director had in mind.

Guarantees don't automatically end when a director leaves the company. A director who resigns, sells their shares, or steps back from the business doesn't automatically release their personal guarantee obligations under an existing lease — the guarantee generally continues until the lease itself ends or the landlord specifically agrees to release the guarantor.

Joint and several liability is common with multiple guarantors. Where more than one director provides a guarantee, this is typically structured as "joint and several," meaning the landlord can pursue any one guarantor for the full amount owed, not just their proportional share — leaving that individual to separately seek contribution from the other guarantors if they can.

Before signing a personal guarantee for a commercial lease, it's worth having the specific document reviewed — not just the headline lease terms — to understand the actual scope, duration, and structure of the personal exposure being created.

RBizz can connect you with commercial lawyers to review lease terms and personal guarantee exposure before you sign — get in touch before your next lease negotiation.

The margin scheme can't be used in every situation. It's generally not available where:

• The property was originally purchased as a fully taxable supply where the seller was entitled to claim the full GST credit on acquisition, and the margin scheme wasn't used on that original purchase (subject to specific rules around this).
• The sale is between associated entities for a price below market value, in certain circumstances, without a proper valuation being used.

Because the availability of the margin scheme depends on the property's specific acquisition history — not just the current sale — this needs to be checked property-by-property, not assumed based on general practice.