How to build a B2B cold email list in Australia

Two registers, two different answers

Every Australian B2B list starts with the same question: which register actually has the data. Two public sources cover it, and they are not interchangeable.

The ASIC company dataset, published on data.gov.au and updated weekly, lists every registered company: name, Australian Company Number, type, class, status, registration date, and current name. As at August 2026, ASIC had 3,789,244 companies on the register. That number includes dormant, shelf and non-trading companies, because ASIC records registration status, not trading activity, and ASIC itself notes the published dataset is a snapshot in time rather than the live register.

The ABN Bulk Extract, published by the Australian Business Register and administered by the ATO, is the wider and more operational file. It covers every entity type: companies, sole traders, partnerships and trusts alike, and carries the Australian Business Number, entity type, legal and trading names, the state and postcode of the main business location, the linked ACN where one exists, and GST registration status and date. What it does not carry is direct contact details, financials or headcount, so it is a starting frame, not a finished list. The Australian Bureau of Statistics counts things differently again: 1,271,197 actively trading companies at 30 June 2026, against ASIC's 3.79 million registered, because ABS only counts businesses that are active for GST or another ATO role. The gap between those two numbers is the dormant and non-trading share of the ASIC register, and it is why an ASIC pull alone overstates a usable list several times over.

Filter to the size band that can actually buy

A raw register pull is not a target list, it is a population. Most Australian entities are too small to be a realistic B2B buyer: of 2,814,778 actively trading businesses at 30 June 2026, 1,818,575 employ nobody at all, and a further 689,600 employ between one and four people. The businesses with a real buying process, a budget line and someone whose job is to evaluate a vendor, sit mostly in the bands above that.

The Australian Bureau of Statistics' own size bands are the sanity check against whatever the register pull produces: 232,912 businesses with 5 to 19 employees, 68,325 with 20 to 199, and 5,366 with 200 or more. Businesses with 20 or more employees total 73,691, and that is the addressable band for most B2B outbound. If a filtered list comes out far above or below that order of magnitude for a given industry and state, the filter logic is wrong somewhere, not the underlying data.

Filter by industry, and know where the data stops

Neither the ASIC dataset nor the ABN Bulk Extract ships with a clean, ready-made industry filter. What exists instead is the Australian Bureau of Statistics' own published breakdown by industry division, which is a separate, top-level count rather than a field on any individual record: Construction leads at 478,651 businesses, followed by Professional, Scientific and Technical Services at 366,289, and Administrative and Support Services at 130,330. That last division is the one that contains Employment Placement and Recruitment Services and Labour Supply Services, but ABS does not publish the split between those two classes in its business-count release, so a list built for a recruitment-sector campaign cannot lean on a single published number for that class. It has to be filtered from the raw register data directly, by matching company and trading names and activity descriptions against the target sector, then sanity-checked against the division-level total.

The same caution applies to combining an industry filter with a size filter. ABS does not publish a cross-tab of industry by employee band in this release, so a claim like "businesses with 20 or more staff in professional services" has to be built by applying both filters to the underlying register pull, not read off as a single published figure. Treat the division totals as an upper bound to check a list against, not a number to filter a list down to directly.

Add hiring signals before you add volume

Company size is a static filter. A hiring signal is a timing one, and the two do the most work together. A business that has just posted three roles in a function your product or service touches is telling you, in public, that it is investing there right now, which is a stronger reason to reach out than size alone.

The practical approach is to layer public job postings against the size-filtered list rather than build a separate hiring-only list. A mid-sized business with an open role in the relevant department moves up the priority order; the same business with no recent postings does not disappear from the list, it just sends later or with different framing.

The reasoning is straightforward once it is stated. A vacancy is a public admission that the current setup is not enough, and it usually comes with a budget attached, since a business rarely posts a role it has not funded. A cold message that references the specific gap the vacancy points at reads as observed rather than generic, and it lands closer to the moment the business is actually deciding how to solve the problem.

Finding and verifying the people

Neither register carries a named contact. The ASIC dataset stops at the company; the ABN Bulk Extract stops at the entity and its location. Finding the actual decision maker, and a working email address for them, is a separate step that sits on top of the register data, not inside it.

Verification matters more than volume at this stage. A list of a thousand plausible-looking addresses that bounce a third of the time damages sender reputation faster than it produces replies, and a bounce rate that high also makes it harder to tell a genuinely bad target from a genuinely bad email guess. Verify before the first send, not after the first campaign.

The ASIC and ABN records also serve a second purpose here, past the initial pull. The Australian Company Number and Australian Business Number in each record are the stable keys that let a list-building process merge a name found on a company website back to the correct entity, rather than to a similarly named business in another state. A large business can appear more than once across both registers under different trading names, and deduplicating on the ACN or ABN, not on the company name as written, is what keeps one business from being contacted twice under two different-looking records.

The line the Spam Act draws around scraping

The Spam Act 2003 requires consent to send, and it separately prohibits the tooling used to find addresses. Sections 20 to 22 prohibit supplying, acquiring or using address-harvesting software, or a list of addresses harvested by that software, where the person doing it is in Australia or carries on business there. A scraping tool built to pull email addresses off websites at scale is exactly the kind of tool those sections target, regardless of where the scraper is physically run from, if the business using it carries on business in Australia.

The practical implication is to build the list from the registers and from a person's own published professional presence, checked individually or through a verification step that confirms a specific address for a specific role, rather than a harvesting tool that pulls addresses in bulk from arbitrary web pages. The distinction is not pedantic. It is the line the Act draws.

Inferred consent, record-keeping and unsubscribe

Section 16 of the Spam Act requires the recipient's consent before a commercial electronic message is sent. Consent does not have to be express. Schedule 2, clause 4 allows consent to be inferred where an electronic address is conspicuously published, it would be reasonable to assume the publication happened with the account-holder's agreement, the publication is not accompanied by a statement declining unsolicited messages, and the message itself is relevant to the recipient's work-related business, functions or duties. A role email published on a company's own site, contacted about something relevant to that role, sits inside this. The same address contacted about something unrelated to the person's job does not.

Because the consent basis for each contact rests on facts about how and where the address was found, recording that basis at the point the record enters the list is the only way to defend it later. Section 17 requires the sender to be clearly and accurately identified, with a real way to contact them. Section 18 requires a functional unsubscribe facility that works for at least 30 days after the message is sent, and Schedule 2, clause 6(1) requires an unsubscribe request to take effect within 5 business days. Build the suppression list first, wire the unsubscribe link to it immediately, and treat every bounce and opt-out the same way: out of the active list and not sent to again.