PPSA Registrations for Startups: When Security Interests Must Be Registered on the Personal Property Securities Register

A Sydney hardware startup ships twenty prototype units to an enterprise customer in November on a “paid pilot” arrangement — the customer pays a $2,500 evaluation fee, keeps the units for a six-month trial, and either buys them out at the end or returns them. The startup’s engineering-turned-founder papers the trial in an email exchange. In February the customer files for voluntary administration. The startup’s board expects the units back or, worst case, an unsecured claim in the administration for the $50,000 book value. What the administrators tell them, a week later, is different: the twenty units are property of the insolvent estate under section 267 of the Personal Property Securities Act 2009 (Cth), because the pilot was in substance a PPS lease, no PPSR registration was ever made, and the security interest has vested in the customer immediately before the appointment. The startup gets a general unsecured claim for the value of assets it thought it still owned.

That pattern — an Australian startup granting or holding a PPSA security interest without recognising the transaction as security at all — is by a distance the most common insolvency-adjacent legal failure we see at diligence. Founders think of the Personal Property Securities Register as a bank problem: something a lender registers when it takes a General Security Agreement over the company at Series A. It is not just a bank problem. The PPSA is a substance-over-form regime that captures dozens of transactions a startup enters routinely — from a director loan secured against company IP, through hardware sold on retention of title, through equipment leased to customers, through investor SAFEs bolted onto a security package. And section 588FL of the Corporations Act 2001 (Cth) then imposes a 20-business-day registration window that, if missed, will wipe the security interest out entirely on the company’s insolvency.

What Counts as a Security Interest — Substance, Not Label

Section 12(1) of the PPSA defines a security interest as “an interest in personal property provided for by a transaction that, in substance, secures payment or performance of an obligation.” The words that do the work are in substance. Whether the parties called their document a “lease,” a “consignment,” a “licence” or a “trust arrangement” is largely irrelevant. If the arrangement, viewed commercially, gives one party rights over another party’s property until an obligation is discharged, it is a security interest.

Section 12(3) then bolts on a set of deemed security interests that are treated as security interests regardless of substance:

• The interest of a transferee under a transfer of an account or chattel paper — relevant every time a startup factors its receivables.
• The interest of a consignor under a commercial consignment — relevant to any distribution model where the startup ships goods but retains title until on-sale.
• The interest of a lessor or bailor of goods under a PPS lease — relevant to any subscription, trial, POC or evaluation arrangement that involves physical hardware.

Under section 13 PPSA, a PPS lease is a lease or bailment of goods for a fixed term of more than one year (or of serial-numbered goods — motor vehicles, aircraft, watercraft — for more than 90 days, or two years for leases entered into on or after 20 May 2017 depending on the class), where the lessor is regularly engaged in the business of leasing goods. Founders assume the “regularly engaged” limb narrows the trap to leasing companies. It does not. A hardware startup that runs three paid pilots simultaneously is, on the case law, regularly engaged in leasing.

The Two Vesting Sections That Actually Bite

Every startup founder should understand the two provisions under which an unregistered security interest converts, on insolvency, from an asset into a bad debt:

• Section 267 PPSA — vesting of unperfected security interests on insolvency. Where a security interest granted by a grantor is unperfected at the time the grantor enters administration, liquidation or bankruptcy, the interest vests in the grantor immediately before the insolvency event. Perfection ordinarily means registration on the PPSR (section 21 PPSA), though possession and, for specific classes like ADI accounts, control are alternatives (section 25 PPSA).
• Section 588FL of the Corporations Act — vesting for late-registered security interests. Even where the interest is registered, if the registration is made outside the 20 business days following the security agreement coming into force (or after the later of that period and six months before the “critical time,” being the insolvency event), the interest still vests in the grantor immediately before the insolvency event. The 20-business-day window applies to companies only, but almost every startup granting security is a company.

The upshot is a two-step failure mode. First failure: no PPSR registration at all — the secured party loses everything on the grantor’s insolvency under section 267. Second failure: registration made late — the secured party still loses everything under section 588FL unless it can persuade a court to grant an extension of time under section 588FM, and courts do so only where the delay was accidental, inadvertent or explained by “some other sufficient cause,” and where an extension will not prejudice the grantor’s creditors. Section 588FM extensions granted more than six months after the security agreement began are, in practice, rare.

The Startup Fact Patterns Where This Actually Happens

The following patterns produce the great majority of missed-registration losses we see:

• Director and founder loans on the way in. A founder loans $200,000 to the company to fund a runway extension and takes a general security agreement over company assets — or, more commonly, over specific IP. This is a Section 12 security interest and it is granted by a company. Twenty business days. Missed at least half the time.
• Convertible notes and SAFEs with security bolted on. Australian SAFE templates are unsecured. Convertible notes often are not. Where the note document grants the investor a security interest — over IP, receivables, or all-present-and-after-acquired-property — the note is a “transaction that in substance secures payment,” it is granted by a company, and section 588FL runs from the date the note is entered into, not the date of conversion.
• Venture debt. Every venture-debt package we have seen in the Australian market takes an ALLPAAP security over the borrower. The lender’s own counsel usually manages the registration, but where the funder is a US or offshore lender operating through Australian counsel, the 20-business-day window can be missed while the paper file is still crossing an ocean.
• Landlord bonds and cash security deposits. A commercial landlord that takes a cash deposit from a tenant startup, or a bank guarantee facility supported by cash held on the tenant’s balance sheet, is often relying on an implied security interest over that cash. If the deposit is held in an ADI account controlled by the landlord (or held by the landlord’s bank), the interest is perfected by control (section 25 PPSA). If it is held on the tenant’s own books with a contractual charge, registration is required.
• Hardware, prototypes and dev kits shipped to customers. Retention-of-title clauses in SaaS-plus-hardware, robotics, IoT and medical-device startups are Section 12 security interests. Bailed hardware in customer trials is either a PPS lease or a commercial consignment. Registration is required against the ACN of each customer receiving hardware.
• Equipment leased from the startup. Any subscription model where the customer pays a monthly fee and receives a physical device — from an EV-charging box to a hospital-grade sensor — is, on the fact pattern above, a PPS lease.
• Contract manufacturers and tolling arrangements. Where the startup owns raw materials or components and the contract manufacturer processes them into finished goods, the startup’s interest in the raw materials, work-in-progress and finished goods needs to be registered against the manufacturer’s ACN — the “accession” and “commingled goods” rules in Part 3.4 PPSA otherwise operate to extinguish the interest.
• IP assignments-back on termination. Founders granting IP to a joint venture on a “return-on-exit” basis have granted, on any sensible reading, a security interest in favour of themselves. This is easy to miss and expensive to fix later.

Purchase Money Security Interests and the 15-Day Rule

The PPSA gives a Purchase Money Security Interest — a PMSI, roughly, the interest of a seller or lender that funds acquisition of the specific collateral — a super-priority (section 62 PPSA) that trumps earlier-registered general security interests over the same collateral. That priority is only available if the PMSI is registered within a hard external window:

• For inventory, the PMSI must be registered before the grantor obtains possession of the collateral.
• For collateral other than inventory, the PMSI must be registered within 15 business days after the grantor obtains possession.

The 15 business days is shorter than the 20-business-day section 588FL window and runs from a different event (possession, not the security agreement). A hardware startup that supplies retention-of-title equipment to a customer on 30-day terms and registers the PMSI on day 18 has kept its interest safe against the customer’s liquidator (588FL is satisfied) but lost its super-priority against the customer’s earlier-registered banker (section 62 is not). Both windows have to be hit.

How Registration Actually Works

Registration is done through the PPSR at ppsr.gov.au. The registrant identifies:

• The grantor — for an Australian company, by its ACN (not name; the case law is now clear that a mistake in the ACN can defeat a registration under section 165 PPSA even where the company name is correctly stated).
• The secured party group — the registrant, once set up, is issued an SPG number and access code that becomes the operating handle for every registration going forward.
• The collateral class — from a fixed statutory list (accounts, inventory, motor vehicles, agriculture, general intangibles, all-present-and-after-acquired-property, and others). Miss-classification does not automatically defeat a registration but narrows the collateral captured.
• Duration — 7 years ($6.50), 7 to 25 years ($25), or indefinite ($115) at current fees. Duration should be matched to the underlying obligation; over-registration attracts a “seriously misleading” attack under section 164 PPSA.
• Serial numbers for goods that must be described by serial number (motor vehicles, watercraft, aircraft, some intellectual property) — the registration is defeated as against a purchaser who searches by serial number if the number is missing or wrong.

What Founders Should Do Now

The compliance target for a startup is boring but discrete. First: a PPSR calendar item in the operations rhythm — every security agreement the company enters into as either a grantor or a secured party gets a diarised 20-business-day and 15-business-day check. Second: a standing SPG set up with the ATO’s Digital ID / RAM authorisations already in place, so registration doesn’t depend on account-creation on day 19. Third: a counter-party register — every customer to which the startup ships hardware on retention of title, on a paid pilot, or on a subscription-with-device model gets a PPSR registration made at the point the first unit ships, not at the point insolvency looms. Fourth: at each priced round or venture-debt round, a PPSR search on the company’s own ACN — investors will run one during diligence, and the surprise of finding a director-loan security interest that predates the round (or one that vested silently under section 267 on the company’s own historical dip below solvency) is best resolved before term-sheet stage. The Series-A audit-ready cap table has an equivalent audit-ready PPSR position beside it.

The Bottom Line

The PPSA does two things a startup founder needs to internalise. It treats substance as controlling — the label on the contract is close to irrelevant, and half the transactions a growing startup enters as either lender or supplier are captured. And it runs on 20 business days — a window the company either hits or it doesn’t, with the only downstream cure a court application under section 588FM that is expensive, uncertain and often out of time. Founders who put PPSR registration on the same discipline shelf as ASIC lodgments, ATO ESS reporting and cap-table maintenance make it through diligence without a Section 267 red flag. Founders who don’t discover the regime only when a customer’s administrator explains why the startup no longer owns the units in the customer’s warehouse.

Viridian Lawyers advises Australian startups on secured-transactions compliance under the Personal Property Securities Act 2009 (Cth) and Chapter 5 of the Corporations Act 2001 (Cth), including PPSR registration strategy, PMSI perfection, section 588FM extension applications and diligence-ready secured-transactions records. If your startup is entering into a director loan, a venture-debt facility, a hardware pilot or an equipment subscription arrangement, get in touch.