A two-co-founder logistics startup raises a $1.4 million seed in early 2026, hires nine engineers across Sydney and Melbourne, and runs into an inventory write-down in the September quarter. Cash is tight. The founders decide to defer the June quarter SGC payment and the July BAS payment by a fortnight to keep payroll moving. The bookkeeper, distracted by a system migration, files the BAS three months late. The next quarter slips too. In April 2026 — well after both founders have personally guaranteed a $300,000 working-capital line and burned through most of the seed — a sealed envelope from the Australian Taxation Office lands on the kitchen table of the co-CEO. Inside is a Director Penalty Notice assessing her personally for $312,000 of unpaid PAYG withholding, GST and superannuation guarantee charge. The notice gives her 21 days. But the fine print explains that the period for action has already closed on most of the debt — because the company failed to lodge within three months of the due date, the debt has “locked down”. Voluntary administration will not extinguish it. The personal liability is, in substance, hers.
That fact pattern is not unusual. In the 2024–25 financial year the ATO issued more than 84,000 Director Penalty Notices, a 136% increase on the prior year, hitting directors of roughly 64,000 companies. The Inspector-General of Taxation and Tax Ombudsman announced a review of the regime in December 2025 in response to a surge in complaints. The ATO is no longer using DPNs as a last-resort tool of compliance — it is using them as a default lever, and startup directors are squarely in the firing line.
What the Regime Actually Does
Director liability for unpaid company tax is set out in Division 269 of Schedule 1 to the Taxation Administration Act 1953 (Cth). Three categories of company liability automatically become a parallel personal liability of every director, the moment the company’s payment falls due:
- PAYG withholding on Australian employees’ wages;
- the Superannuation Guarantee Charge (the penalty amount that arises when SG contributions are not paid on time); and
- net Goods and Services Tax (since 2020).
The personal liability arises automatically — it is not contingent on any notice. The DPN is the ATO’s enforcement mechanism, not the source of the debt. The director becomes liable the day the company’s due date passes; the DPN simply unlocks the ATO’s right to recover that liability from the director personally.
That distinction is the single most misunderstood feature of the regime. A founder who waits for “a letter from the tax office” before worrying about the debt is operating on a fundamentally wrong mental model.
The Two DPNs: 21-Day Versus Lockdown
There are two species of Director Penalty Notice, and the difference between them is everything.
The 21-day (or “non-lockdown”) DPN is the version that allows the director to escape personal liability. It is issued where the company reported the debt on time — that is, lodged the relevant BAS, IAS, or SGC statement within the statutory deadline — but did not pay. The director then has 21 days from the date the notice is given (s 269-25) to do one of four things: pay the company’s debt in full; place the company into voluntary administration; appoint a small business restructuring practitioner; or begin winding the company up. Doing any of these within the 21 days extinguishes the director’s personal liability.
The lockdown DPN is the version startup directors most often encounter and most badly underestimate. It applies where the company failed to lodge the relevant return within three months of its due date (s 269-30). Once lodgement is late by that margin, the only way to extinguish the personal liability is to pay the debt — by the company if it can, or by the director personally if it cannot. Voluntary administration does not help. Liquidation does not help. The debt has locked down.
The arithmetic for founders is brutal. A startup with $100,000 of monthly Australian payroll typically remits around $23,000 of PAYG withholding each month. Six months of unreported PAYG is roughly $140,000 of locked-down personal liability before SGC or GST is layered on top. A two-co-founder company with joint-and-several exposure means each director is personally on the hook for the full amount.
Why the Statistics Have Exploded
Three things have changed since 2022. First, the Single Touch Payroll system means the ATO has near real-time visibility of PAYG withholding the moment payroll is run — there is nowhere for an unreported PAYG liability to hide. Second, GST was brought inside the DPN regime by the Treasury Laws Amendment (Combating Illegal Phoenixing) Act 2020, expanding the universe of debts that can trigger personal liability. Third, the ATO formally ended its COVID-era forbearance posture in late 2023 and now treats prompt DPN issuance as its standard collection tool.
For founders, the most important consequence is that the window between missing a payment and receiving a DPN has compressed. Where the regime used to operate on a roughly six-month cadence, ATO-issued DPNs now routinely arrive within weeks of a missed BAS.
The New-Director Trap
Section 269-20 imposes liability on a person who becomes a director of a company that already has unpaid PAYG, SGC or GST liabilities — but with a 30-day grace period. A new director has 30 days from the date of appointment to ensure the historical debt is paid or that the company enters administration, restructuring or winding up. Stay in the chair beyond day 30 and the historical personal liability sticks.
This trap catches three types of founder-side appointments routinely: incoming non-executive directors after a Series A; new co-founder appointments where the original co-founder has been the sole director; and CFO promotions to the board for governance hygiene. Due diligence on the ATO ledger is the single most undervalued piece of pre-appointment work in Australian governance.
The Statutory Defences Are Narrow
Three defences exist in s 269-35. Each is interpreted strictly. Illness or another good reason for not taking part in management is the most heavily litigated and rarely succeeds. Reasonable steps to ensure compliance — a board paper trail, monthly tax reports, escalation processes — is the most useful defence and the one the ATO’s recent compliance approach has put at the centre of disputes. The third, the unpaid SGC defence where the company complied with the reasonable expectation of payment, is narrow.
For founders, the practical takeaway is that the defences reward documented governance hygiene. A director who can produce contemporaneous board minutes recording tax compliance check-ins is in a meaningfully better position than one who cannot.
What Founders Should Do Now
Lodge on time, always — even if you cannot pay. Late lodgement is the single act that converts a remediable problem into a locked-down personal debt. The default rule is to lodge every BAS, IAS and SGC statement on the due date and worry about payment terms separately. A payment arrangement with the ATO does not protect the director once the lodgement window closes; only timely lodgement does.
Set up monthly board-level tax oversight. Once a startup has employees, a single page in the monthly board pack showing PAYG, GST and SG status — paid, due, overdue — is the cheapest insurance available against a future DPN. It anchors the reasonable steps defence in real evidence.
Pre-appointment due diligence on the ATO ledger. Incoming directors should ask for, and read, the company’s most recent integrated client account statement and SG compliance summary before accepting the seat. A 30-day clock starts on appointment.
Treat Payday Super as a DPN risk vector. From 1 July 2026, SG contributions must be paid at the same time as wages rather than quarterly. The compliance frequency goes from four events per year to 26 or 52. Each missed payment is a potential SGC that, if not reported within three months, locks down personally.
If a DPN arrives, move within 21 days — but understand which type it is. The notice will state on its face whether the amounts are reported or unreported. Get advice before day five; the difference between the two outcomes is permanent.
The Bottom Line
Director Penalty Notices have moved from a rarely used recovery tool to the ATO’s default collection mechanism — 84,000 in the most recent year, with no indication the volume will retreat. For startup directors the regime is unforgiving: lodgement deadlines, not payment deadlines, determine whether the debt can be cleaned up through the company or follows the director home. Build the lodgement discipline, build the board paper trail, and treat the 1 July 2026 Payday Super transition as a moment to harden the controls — not as a deadline to slip past while you raise the next round.
Viridian Lawyers advises Australian startup founders and boards on director liability, ATO disputes, and the governance controls that prevent a DPN from arriving in the first place. If you have received a Director Penalty Notice, are joining a board with historical tax exposure, or want to harden your tax-compliance posture ahead of Payday Super, get in touch.
