ATO GST Audits and Operation Protego: What Australian Businesses Need to Know in 2026

The ATO is not simply reviewing GST claims. It is actively investigating them, prosecuting them, and in some cases referring them to the Australian Federal Police. Operation Protego, the ATO’s dedicated taskforce targeting large-scale GST fraud, has already resulted in criminal proceedings involving refund fraud claims between $1.3 and $1.8 million, with maximum penalties reaching 10 years’ imprisonment. For businesses that find themselves among the ATO audit targets in this environment, the stakes could not be higher.

What makes the current climate particularly challenging is that legitimate businesses are being caught in the same compliance net as deliberate fraudsters. Unusual refund profiles, newly registered entities, and cross-border GST arrangements are all drawing heightened scrutiny, regardless of intent. An accounting review alone is rarely sufficient once the ATO begins asking questions.

This analysis explains how Operation Protego works, who it targets, and how an audit can escalate into a criminal investigation. It also covers your legal rights during the process, director liability exposure, and why engaging a tax lawyer early is often the most consequential decision a business can make.

What Is Operation Protego and Why It Still Matters

Operation Protego is an ATO taskforce targeting large-scale GST refund fraud, operating within the Serious Financial Crimes Taskforce (SFCT), established on 1 July 2015. The SFCT brings together the ATO, the Australian Federal Police and other Commonwealth agencies to pursue serious financial crime.

The operation gained significant momentum after a February 2024 internal investigation in which the ATO examined 150 of its own staff members for alleged involvement in a GST fraud scheme. That investigation exposed system-level vulnerabilities and prompted more aggressive detection controls and cross-agency coordination. For background on how the operation got its name, see Why It’s Called Operation Protego.

The ATO’s public position is explicitly zero-tolerance. Prosecutions are pursued not merely to recover amounts owed but to produce visible consequences, including imprisonment, restitution orders and travel restrictions, that deter would-be offenders. Deputy Commissioner Pennie Snowden has stated publicly that lodging a BAS without operating a genuine business constitutes fraud with serious consequences.

Enforcement activity is not historical. In July 2026, charges were laid against a former Commonwealth public servant over alleged GST refund fraud totalling more than $1.3 million, with conduct alleged to span 2020 to 2022. Multiple other convictions followed in July and August 2026. The ATO is actively pursuing conduct from several years ago, meaning businesses cannot treat past periods as settled simply because no contact has been received yet.

The Australian National Audit Office conducts performance audits of the ATO’s fraud control arrangements, which is likely to increase the consistency and rigour with which the ATO applies its GST compliance program over time.

How Operation Protego Differs from a Standard ATO Audit

What distinguishes Operation Protego from a routine compliance review is not degree but kind. A standard ATO audit operates under the Taxation Administration Act 1953 and produces administrative outcomes: amended assessments, penalties and interest. Serious as those can be, they carry no criminal consequences.

Operation Protego investigations can escalate into joint ATO and Australian Federal Police (AFP) criminal investigations. When that happens, the governing framework shifts to the Criminal Code Act 1995 and the procedural rules of the criminal justice system. The stakes change categorically. Under section 134.2 of the Criminal Code, obtaining a financial advantage by deception carries a maximum penalty of 10 years’ imprisonment. That outcome is not comparable to an administrative shortfall penalty.

AFP involvement also changes what cooperation means in practice. Statements made to ATO compliance officers during a standard review do not carry the same legal weight or attract the same procedural protections as conduct during a criminal investigation. Rights that exist in a criminal context, including the right to silence and protections against self-incrimination, do not apply in the same way during an administrative audit. This is why the timing of legal advice is material, not incidental.

A further risk is the absence of obvious signalling. Businesses and individuals targeted under Operation Protego may not receive prompt notice that AFP has become involved. The transition from administrative review to criminal investigation can occur while a subject reasonably believes they are responding to a routine compliance matter. For a detailed breakdown of how this escalation unfolds in GST refund cases, the ATO GST Refund Crackdown Australia: Operation Protego and What To Do resource sets out the specific conduct patterns the ATO and AFP are targeting.

Who the ATO Is Targeting: High-Risk Business Profiles

Understanding which businesses fall within the ATO’s enforcement crosshairs is the first step in assessing real exposure.

The ATO’s published enforcement priorities identify three primary risk profiles attracting GST audit scrutiny: businesses with unusual refund patterns relative to apparent trading activity; newly registered entities lodging BAS refund claims shortly after ABN registration; and businesses with cross-border GST issues involving imports, exports or non-resident vendor arrangements.

Newly registered businesses with immediate refund claims represent the most heavily scrutinised category. The profile is consistent across recent enforcement activity, including July 2026 prosecutions involving alleged false GST claims submitted between 2020 and 2022. The ATO focuses specifically on ABN registrations where the entity shows no operational footprint: no employees, no suppliers, no verifiable client relationships, and no bank activity consistent with the refund amounts claimed. A large input tax credit claim filed weeks after registration, with nothing to corroborate genuine trading, is a direct audit trigger.

Cross-border GST issues create a separate category of heightened risk. Importers, exporters and businesses with non-resident vendor arrangements face scrutiny where GST registration, invoicing or remittance obligations have not been applied consistently. The ATO’s data-matching capabilities extend to customs records and international treaty exchanges, so cross-border discrepancies are more likely to surface than many businesses assume.

Legitimately compliant businesses are not immune. Capital-intensive start-ups and significant exporters can generate refund-heavy BAS profiles that match the same risk indicators the ATO uses to identify fraud. Being correct on the law is necessary but not sufficient. The audit risk is real regardless, and documentation is what separates a resolved review from a prolonged dispute.

This is one reason ATO enforcement activity in 2026 warrants attention well before any formal contact arrives. Businesses that fit these profiles should be treating record-keeping as a legal priority, not an administrative one.

From Audit Letter to Criminal Investigation: Understanding the Escalation Pathway

Being on the ATO’s radar does not automatically mean a business is facing criminal prosecution. The ATO operates a tiered response model, and the majority of Operation Protego-connected matters are resolved through amended assessments, repayment arrangements and administrative penalties rather than criminal referral. Understanding where a matter sits in that hierarchy is the first analytical question.

Escalation to AFP involvement is more likely where the ATO identifies deliberate deception rather than inadvertent error. The conduct that triggers criminal referral has consistent hallmarks: fabricated invoices, fictitious ABN registrations, multiple false BAS lodgements, and the use of third parties to submit fraudulent claims on behalf of others. Recent AFP enforcement action describes offenders inventing fake businesses, registering ABNs and lodging fictitious BAS statements to generate false refunds. A business with genuine trading activity and documentation errors occupies very different legal ground.

Critically, by the time a business becomes aware of AFP interest, the ATO has typically already gathered substantial evidence internally. Warrant executions and arrests follow internal investigation, not precede it. This means the window for early intervention may be narrower than it appears.

The historical reach of Operation Protego investigations is also longer than many businesses expect. A July 2026 prosecution covered alleged conduct from 2020 to 2022, indicating that the standard two-to-three-year review window does not constrain the ATO’s investigative reach in fraud cases.

For any business receiving a formal audit notice, the immediate question is whether it reflects a routine compliance review or an SFCT-connected investigation. Those notices can look similar on their face. Understanding the difference between an ATO review, audit or investigation is not an accounting question; it requires legal analysis of the notice scope, language and context before any response is made.

Documentation Red Flags the ATO Looks For

Knowing what escalates an audit matters less if you cannot identify the specific documentation gaps that draw initial scrutiny. The ATO’s risk-scoring is systematic, and certain patterns consistently trigger closer examination.

ABN registrations with no operational footprint are among the most visible red flags. The ATO expects contemporaneous records of genuine trading activity during the period in which refund claims were lodged: contracts, supplier invoices, customer transactions, bank statements and payroll records. An ABN with no supporting evidence of actual operations during the relevant period is treated as a primary indicator of a potentially fictitious entity, not simply a poorly organised one.

BAS claims disproportionate to business scale are a separate but related trigger. Large input tax credit claims lodged shortly after registration, with no corresponding taxable supplies, are a consistent pattern in fraudulent schemes. The ATO’s automated systems flag this imbalance without requiring a human reviewer to initiate scrutiny.

Cross-referencing between income tax and GST data compounds the risk for businesses with inconsistencies across their lodgements. Where the business activity declared for income tax purposes does not align with GST activity reported on BAS lodgements, that gap is identified through automated risk-scoring. The two data sets are cross-referenced as a matter of routine.

Export documentation gaps create a distinct problem for cross-border transactions. Under the GST Act, claiming GST-free status for exports requires substantiation. Inadequate records of that status can render a previously compliant position indefensible under audit, regardless of the underlying commercial reality.

Agent involvement does not transfer legal responsibility. Businesses that used tax agents or BAS agents to lodge returns remain the responsible entity. The ATO may investigate whether the agent received accurate information from the client, and ATO audits are not always routine matters that seem procedural at first can develop legal dimensions that require more than an accounting response.

Innocent Errors Versus Fraud: Where the Legal Line Falls

Identifying documentation gaps is one thing. Understanding what those gaps mean legally is another.

The criminal offence under section 134.2 of the Criminal Code Act 1995 requires the prosecution to prove that a defendant obtained, or attempted to obtain, a financial advantage knowing they were not entitled to it. That knowledge element is not a formality. It is the line that separates a prosecutable fraud from an administrative correction.

A business that miscalculated its GST liability, applied the wrong tax treatment to a supply, or claimed input tax credits on the basis of a genuine misreading of the law is in a materially different legal position from one that submitted false claims with knowledge of their falsity. Both may generate an amended assessment. Only the second carries criminal exposure.

The difficulty is that the ATO does not always know which category it is dealing with at the outset of an audit. A business with an unusual refund profile may face an implicit presumption of irregularity, even where the underlying position is correct or the errors were inadvertent. Rebutting that presumption requires active engagement: contemporaneous documentation, coherent explanations, and where necessary, legal argument about the applicable GST treatment.

Businesses with imperfectly documented but legitimate GST positions have access to voluntary disclosure processes and amended assessment mechanisms that carry significantly different consequences from a fraud finding. Those options remain available, but they need to be approached carefully.

This is where why legal advice changes the outcome becomes concrete. Statements made to the ATO during a compliance review, including informal explanations offered in good faith, can affect both the administrative outcome and any potential criminal dimension of the matter. Understanding what to say, what to produce, and in what sequence is not an accounting question.

Cooperation, Legal Professional Privilege and Your Rights During an ATO Audit

Understanding where cooperation ends and self-exposure begins is one of the most practically important questions a business can face during an ATO audit.

Businesses subject to formal ATO information-gathering notices have genuine legal obligations to respond. Those obligations are real and enforceable. But they operate alongside legal rights that do not disappear simply because the ATO has issued a notice.

Legal professional privilege is the most significant of those rights. Confidential communications between a client and their lawyer, made for the purpose of obtaining legal advice or for use in litigation, are generally not required to be disclosed to the ATO, even under a formal information-gathering notice. This is a recognised principle across all Australian jurisdictions, and it applies in tax compliance contexts as it does elsewhere. It is not absolute; communications made to facilitate ongoing unlawful conduct fall outside its protection. But where privilege applies, the ATO cannot lawfully compel production of those communications.

The practical risk lies in how businesses respond before they understand these boundaries. Providing documents voluntarily without legal review, or making oral statements to ATO officers without appreciating how those statements may be used, can lock in positions that are difficult to walk back. The distinction between cooperation and unnecessary self-exposure is not always visible without legal analysis.

Where an audit is connected, or may become connected, to an AFP investigation, additional rights become relevant. The privilege against self-incrimination and the right to silence carry legal weight in a criminal investigation context that they do not carry in a purely administrative compliance review. This is another reason why knowing the nature of the investigation matters before deciding how to respond.

A taxation lawyer can identify which documents must be produced, assess which communications attract privilege, and structure a response that satisfies legal obligations without creating unnecessary exposure.

Director Liability: Where GST Fraud Allegations Meet Director Penalty Notices

The rights and obligations discussed above apply equally to the individuals behind a company. For directors, the exposure can be more direct than many expect.

Under the director penalty notice (DPN) regime in the Tax Administration Act 1953, company directors can be held personally liable for a company’s unpaid GST net amounts. This is a civil recovery mechanism that operates independently of any fraud investigation targeting the company itself. The two processes run in parallel, not in sequence.

Where Operation Protego scrutiny results in amended GST assessments against a company, those liabilities can form the basis of DPNs issued directly to the company’s directors. The ATO’s published practice confirms it manages simultaneous enforcement action against both the company and its directors as parallel debtors. A director cannot assume that resolving the company’s position will automatically extinguish personal exposure.

Directors of newly registered companies with unusual refund profiles face a compounded risk. The company’s GST position may be actively under investigation while the director simultaneously carries personal liability exposure if the resulting assessment remains unpaid. That combination creates pressure that can narrow options quickly if not addressed early.

The interaction between a criminal GST fraud investigation at the company level and a director’s personal tax position is legally complex. The criminal exposure is not the same as the civil DPN liability, and the defences available differ between them. Advice that addresses only the company’s audit position, or only the DPN, is unlikely to be complete.

Understanding how the DPN regime works in detail matters here because directors who grasp both tracks of exposure early are better placed to respond coherently. Legal advice that treats the company’s GST audit and the director’s personal liability as a single integrated problem, rather than two separate issues, is more likely to produce a strategically sound outcome.

Cross-Border GST Issues and Heightened Audit Risk

Cross-border GST is a distinct enforcement focus within Operation Protego, separate from the director liability issues discussed above. The ATO applies particular scrutiny to businesses claiming GST-free treatment for exports, entities with non-resident vendor or customer arrangements, and businesses registered under the non-resident vendor GST registration rules.

The underlying problem is that the GST treatment of exports, imports and internationally supplied services is genuinely complex. Errors made in good faith, such as misapplying the GST-free rules to an export that did not satisfy the substantiation requirements under the GST Act, can produce refund profiles that the ATO’s automated systems flag at an Operation Protego level. The business may have no fraudulent intent, but the data pattern looks the same.

Non-resident businesses supplying digital products or remote services to Australian consumers have formal registration, lodgement and remittance obligations under the low-value imported goods and remote services rules. Where those obligations have not been consistently met, the compliance gap can attract audit attention regardless of whether the underlying supplies were correctly characterised.

The ATO’s detection capability in this area is broader than many businesses assume. Data matching extends to customs records, international transaction data, and information obtained through Australia’s network of tax treaties and automatic exchange agreements. Cross-border GST discrepancies that a business might consider unlikely to surface are, in practice, routinely identified.

For any business with material cross-border GST exposure, a legal review of the GST treatment applied to international transactions, conducted before the ATO makes contact, is a practical risk management step. It allows errors to be identified and addressed through voluntary disclosure rather than under the pressure of an active audit.

Why Early Legal Advice Matters More Than an Accounting Review

Regardless of the GST issue involved, whether it is a straightforward export documentation gap or a complex cross-border supply arrangement, the response strategy needs to be legally sound from the outset. That requires more than an accounting review.

An accountant’s role in an ATO audit is to prepare, organise and present financial information. That role does not extend to advising on legal rights, asserting privilege, assessing criminal exposure or developing a dispute strategy. Those are legal questions, and they require a tax lawyer.

Operation Protego investigations sit at the intersection of tax administration and criminal law. The relevant framework includes the Criminal Code Act 1995, AFP investigative powers and the procedural rights of individuals under Australian criminal procedure. A maximum penalty of 10 years’ imprisonment under section 134.2 of the Criminal Code is not an accounting problem. An accountant is not qualified to advise on it, and involving only an accountant at this stage can leave a business’s legal position exposed before any formal response has been made.

Timing matters considerably. Engaging a taxation lawyer before responding to an ATO audit notice, and before providing documents or oral statements under compulsion, allows the legal response strategy to be set while options remain open. Once statements are made and documents produced, the business’s position is largely fixed.

Early legal engagement also enables a business to identify which communications attract legal professional privilege, frame its compliance history accurately and proactively, and explore administrative resolution options including voluntary disclosure before the ATO issues formal findings.

A tax disputes lawyer also advises on objection rights under Part IVC of the Tax Administration Act 1953, review and appeal pathways, and the interaction between an amended assessment and any potential criminal referral. These are not matters an accountant can address.

Remediation Options for Businesses With Legitimate but Imperfect GST Compliance

Businesses with inadvertent GST errors have genuine remediation options, but accessing them effectively requires more than a straightforward accounting correction.

Voluntary disclosure is the most significant tool available. Where a business identifies and discloses a GST error before an audit commences, the ATO’s penalty remission framework provides for substantial reduction in administrative penalties. Disclosure made after an audit has commenced but before a formal amended assessment is issued still attracts remission, though at a lesser rate. The timing of disclosure is therefore material to the financial outcome.

The practical tools in an administrative resolution pathway include:

• Amended BAS lodgements to correct overclaimed input tax credits, incorrect GST-free classifications, or under-reported taxable supplies
• Instalment arrangements to manage the resulting liability where a lump sum payment is not practicable
• Written submissions addressing the circumstances and nature of the error, which can support penalty remission applications

Each of these steps requires careful management. Where Operation Protego is in the background, the language used in a voluntary disclosure or written submission can inadvertently constitute an admission that the ATO treats as consistent with deliberate conduct rather than innocent error. The line between correcting a mistake and making a damaging concession is not always obvious, and it is not a distinction an accountant is positioned to navigate.

For businesses that have already received a formal amended assessment, the objection process under Part IVC of the Taxation Administration Act 1953 provides a statutory avenue to dispute the ATO’s findings. If the objection is disallowed, further review is available through the Administrative Review Tribunal or the Federal Court, depending on the nature of the dispute and the amounts involved.

How a Tax Lawyer Can Help With an ATO GST Audit or Operation Protego Investigation

Navigating those remediation options effectively is one reason legal advice matters at the outset, not after the ATO’s position has hardened.

Chris Garlick is a taxation lawyer who advises and represents individuals and businesses across ATO audits, reviews and tax disputes, including GST compliance matters, audit responses, objections and proceedings before the Administrative Review Tribunal and the Federal Court.

For clients who have received ATO contact connected to Operation Protego or a broader GST compliance review, legal advice focuses on three things: understanding the actual nature and scope of the investigation, identifying the client’s legal rights and obligations, and developing a response strategy that holds together across both the administrative and potential criminal dimensions. Those dimensions do not always move at the same pace, and a strategy that addresses only one of them can create problems in the other.

Legal assistance is available across the full audit lifecycle. That covers the initial ATO correspondence, managing information requests, responding to formal audit findings, dealing with amended assessments, lodging objections and, where necessary, pursuing or defending litigation.

For company directors, the analysis integrates two questions that are often treated separately: the company’s GST exposure and the director’s personal liability position under the director penalty notice regime. Addressing them in isolation produces incomplete advice.

Businesses with cross-border GST issues, unusual refund profiles or newly registered entities facing ATO scrutiny are encouraged to seek legal advice promptly. Waiting for the ATO to finalise its position before engaging a taxation lawyer consistently narrows the options available and reduces the scope for proactive management of the matter.

To discuss an ATO audit or GST compliance matter, contact Chris Garlick directly to make an enquiry.

Key Takeaways for Businesses Facing ATO GST Scrutiny

The practical implications of everything covered in this post reduce to five points worth keeping clearly in mind.

Operation Protego is current, not historical. Prosecutions continued into July 2026, covering conduct from 2020 to 2022. The ATO is not winding this program down; it is integrated with the Serious Financial Crimes Taskforce and subject to independent ANAO oversight, both of which reinforce sustained enforcement pressure.

Three business profiles carry the highest audit risk: unusual or refund-heavy BAS patterns, newly registered entities with early refund claims and no operational footprint, and businesses with cross-border GST obligations. If your business fits any of these profiles, ATO contact should be treated as serious from the outset, regardless of whether you believe your position is correct.

An accounting review is not a substitute for legal advice where criminal exposure is possible. The maximum penalty under section 134.2 of the Criminal Code is 10 years’ imprisonment. An accountant can organise records; a tax disputes lawyer can assess legal exposure, identify whether privilege applies and build a coherent response strategy across both the administrative and criminal dimensions.

Timing matters significantly. Businesses that obtain legal advice before responding to ATO notices retain options that become unavailable once positions are stated, documents are produced without review, or the investigation advances without legal oversight.

Legitimate businesses with compliance gaps are not without options. Voluntary disclosure, penalty remission and formal objection rights under Part IVC of the Tax Administration Act 1953 are all available, but they require careful legal management to be used effectively without inadvertently creating additional exposure.