media release

IR 04-53 ASIC provides guidance on breach notification requirements of AFS licensees

Published

The Australian Securities and Investments Commission (ASIC) has today issued guidance on the breach notification requirements for holders of an Australian financial services (AFS) licence.

Under the Corporations Act 2001 (the Corporations Act), AFS licensees are required to identify breaches or likely breaches, give proper consideration to whether the breach is significant, and, where required, provide timely notifications to ASIC. Whether a breach or likely breach is significant will depend on individual circumstances.

This guide gives licensees examples of some breaches which may be significant. It also provides useful guidance on how to report a breach to ASIC, as well as the information that should be included in a breach report.

In judging whether a breach or likely breach is ‘significant’, licensees must have regard to the following factors:

  • the number or frequency of similar previous breaches;
  • the impact of the breach or likely breach on the licensee’s ability to provide the financial services covered by the licence;
  • the extent to which the breach or likely breach indicates that the licensee’s compliance arrangements are inadequate; and
  • the actual or potential financial loss to clients of the licensee arising from the breach or likely breach.

‘It is important that licensees report significant breaches to ASIC as early as possible, even where the licensee is gathering further information on the breach. There are penalties for not complying with this requirement, so if there is any doubt about whether to report a breach, we recommend that licensees err on the side of caution and report the breach to ASIC’, ASIC Executive Director of Financial Services Regulation, Mr Ian Johnston said.

Background

Under s912D of the Corporations Act, licensees are required to notify ASIC in writing of any significant breaches or likely breaches of their obligations, as soon as practicable and in any event within five business days of becoming aware of the breach or likely breach.

End of release


Breach reporting for AFS licensees, an ASIC guide (updated May 2006) is no longer current. The current guidance is in RG 78.