ASIC Breach reporting relief

ASIC has published ASIC Corporations and Credit (Amendment) Instrument 2025/289 which gives further relief for Australian financial services and credit licensees under the reportable situations regime in addition to previous relief. Background.

ASIC has broadened the types of reports that are exempt by increasing:

  • the time allowed for investigation (from when the breach first occurred) from 30 days to 60 days;
  • the number of impacted consumers from five to 10;
  • the total financial loss or damage to consumers from $500 to $1000.

The breach must be rectified within 60 days of the reportable situation first occurring (rectification includes paying any necessary remediation and process change, or staff training).

If a breach satisfies all these thresholds, it is not deemed reportable to ASIC provided the breach is not a contravention of the client money reporting rules and clearing and settlement rules.

If a report is required, ASIC has clarified that a report is taken to be lodged with ASIC if a licensee has submitted a breach report to the Australian Prudential Regulation Authority (APRA) that contains all the information APRA has requested even if the information requested does not exactly align with ASIC’s breach reporting form.

The additional relief was made in response to concerns that some deemed reportable situations (i.e. misleading and deceptive conduct or false and misleading representations that are automatically reportable) led to a large volume of breaches being reported to ASIC that have limited intelligence value.

The initial relief operated to exempt licensees from reporting breaches of the misleading and deceptive conduct provisions that are one reportable situation, impact one consumer or involve a relevant product that is jointly held and impacts the holders of that product, cause no financial loss or damage, or likely financial loss or damage, and are not otherwise a reportable situation.

Breaches covered by the relief may still be reportable under other circumstances in section 912D of the Corporations Act and section 50A of the National Credit Act. For example, these breaches may satisfy the ‘significance test’ regarding the number and frequency of similar breaches under section 912D(5)(a) of the Corporations Act and section 50A(5)(a) of the National Credit Act.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

David Jacobson

Author: David Jacobson
Principal, Bright Corporate Law
Email:
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

 

Your Compliance Support Plan

We understand you need a cost-effective way to keep up to date with regulatory changes. Talk to us about our fixed price plans.