ASIC breach reporting: It’s not a walk on the beach

This article was co-authored with Simran Chawla.

One year since the implementation of the reportable situations regime, ASIC has published the first analysis into how well AFS and credit licensees are tracking on compliance in its Report 740 ‘Insights from the reportable situations regime: October 2021 to June 2022’ (the Report).¹ This regime, being a cornerstone of our financial services regulatory structure, is characterised by its arguably tighter reporting and investigation windows, lower thresholds and its extension to credit licensees.

The publication of the Report provides a data-centric snapshot of how licensees are complying with the regime as well as useful commentary that foreshadows ASIC’s key focus areas as it endeavours to support the consistent and effective implementation of the reforms. The Report is rich in trend analysis and data-supported observations, reflecting ASIC’s ongoing transition to becoming a data-driven regulator.²

Based on the key findings of the Report, we recommend that licensees take note of the following areas which we consider are likely to be ASIC’s priorities in the coming months:

• strengthening compliance with the regime, given only 6% of the licensee population as at 30 June 2022 lodged reports under the new framework;
• providing guidance to licensees to help them identify and address the root cause(s) of non-compliance accurately and consistently;
• issuing guidance to improve consistency in categorising identification triggers. For example, ASIC has observed that where a licensee’s staff identify an issue as a result of customer complaints, some licensees classified the identification trigger as ‘staff or business unit report’, instead of ‘customer complaint’;
• examining the length of time that licensees are taking to identify and start an investigation, as well as the time required for them to complete an investigation into a breach. It is ASIC’s clear expectation that licensees are to be well resourced to perform investigations in a timely manner. ASIC also stressed the significance of early identification of breaches, and the impact this has on the number of affected customers and subsequent remediation costs;
• examining whether remediation activities are initiated where a licensee has specified that the non-compliance caused financial loss to customers, and whether licensees are appropriately resourcing their remediation activities; and
• issuing guidance to address the varying approaches taken by licensees with respect to grouping multiple reportable situations into a single reportable situation.

While the data in the Report can assist licensees to partake in a benchmarking exercise against their peers, the observations in the Report are intended to be high-level, particularly given the fact that only a small number of licensees (6%) lodged a report during the reporting period. As the bulk of the data arguably came from the larger licensees (who lodged the majority of the breach reports in the reporting period), any practical challenges encountered by medium or small-sized licensees in implementing the new requirements are, arguably, yet to be documented. Licensees are also reminded to appreciate how data can shape ASIC’s priorities and to engage with the observations made in the Report to ensure their existing frameworks are aligned with the express expectations of the regulator.

As we have previously written (see here), ASIC released the final Regulatory Guide 78: Breach reporting by AFS licensees and credit licensees (RG 78) on 7 September 2021. The significant reforms came into effect on 1 October 2021 and are applicable to both financial services and credit licensees.

Should any of the above raise any concerns or queries as to their application to your circumstances, our global financial services regulatory team and risk advisory specialists are available to assist.