admin

AFS Licensees must have processes, procedures or arrangements for ensuring that, as far as reasonably practicable, they comply with their obligations as a licensee (refer ASIC RG 104.23) and those measures should be documented (RG 104.26) APRA-regulated insurers must have mechanisms in place for monitoring and ensuring ongoing compliance with all prudential requirements (CPS 220 paragraph 35(f)). Insurers under the GI Code of Practice must have appropriate systems and processes in place to enable the Code Governance Committee to monitor compliance with the Code. (paragraph 180). Insurance brokers and their authorised representatives under the Brokers Code of Practice must have in place policies and procedures for their organisation and embed a culture that reflects the Code in the way they provide services and deal with others (paragraph 8.2(a)(iii)). If you don’t use an Obligations register to record your obligations, its likely: you have a reactive approach to compliance; compliance is seen as a series of random tasks and activities; providing evidence of compliance becomes a lengthy ‘search for a document’ process’; that compliance is not embedded within your business; there is a lack of assurance that you are complying with your obligations; and there is a heightened risk of non-compliance with unresolved incidents and breaches leading to increased operational risk, regulatory risk and regulatory scrutiny. The purpose of an Obligations register Irrespective of the source of an obligation, all obligations can be adequately managed by being recorded in an Obligations register. I adopt 2 approaches when designing an Obligations register for my clients (AFS Licensees such as brokers, underwriting agencies & TPAs; APRA regulated insurers and insurance service providers): I design the Obligations register within the Risk & Compliance Manual. This ensures that the obligation has context with a narrative explaining the source of the obligation and how it may operate with other obligations; or a stand-alone register, typically for larger organisations. Irrespective of the approach, the purpose of an Obligations Register is to identify obligations (irrespective of source) and capture those in a single register. Sources of obligations can arise under: Legislation such as Corporations Act, ASIC Act, Privacy Act, Autonomous Sanctions, Act, Competition and Consumer Act; APRA Prudential Standards such as CPS 230 (Operational risk) and CPS 234 (Information Security); ASIC Regulatory Guides such as RG 271 (Dispute resoultion) and RG 166 (Licensing financial requirements); Industry Codes – GI Code and Insurance Brokers Code; Binder Agreements; or Material Service Provider agreements. The [key] control environment Once Obligations have been captured in the register, Key controls are then assigned to each obligation, designed to ensure that each obligation is adequately managed. From this exercise, it is apparent that a Key control may adequately manage multiple obligations. This drives efficiency in business process and better customer experiences. Assigning key controls to each obligation enables a shift from a focus on obligations to a focus on the control environment. An annual control testing program ensures that key controls are tested from 2 perspectives: that they have been designed effectively (fit-for-purpose); and […]

I’m sometimes asked about the nature of work that I do or more accurately ‘what do your compliance services cover’. I thought it would be useful to share a ‘week in my life’. At the heart of my services is the expert knowledge and advice I provide on compliance, specifically across general insurance, for firms that operate within that sector, typically: insurers underwriting agencies lloyds coverholders TPAs (insurance claim managers) insurance brokers service suppliers and providers claimant intermediaries distributors Compliance is in respect of complying with financial service laws including those impacting AFS licensees, Authorised reps, Lloyds coverholders/security, APRA prudential standards, sanctions, privacy and the GI Code and Brokers Code of Practice. Including ASIC Regulatory Guides and other regulatory and Code materials. In a typical week, my work will fall within 1 of the 5 following areas. 1. AFS Licensing This is a broad category covering: new licence applications; variations to existing AFS Licenses such as to remove a key person condition, or add a new authorisation such as retail clients or claims handling; and changes to license, such as adding Responsible Managers. Licence work is very rewarding as often it signifies a key milestone in the client’s journey. It is a privilege to conduct such work for my clients. Licensing work is time-consuming and requires information to be provided and presented in a manner as required by ASIC however I enjoy the opportunity to work for the client on such an important piece of work. 2. Compliance documents and frameworks The documented evidence (as required under ASIC RG 104) is the output of the consideration of what a business is authorised to do, how it does it and developing an operating rhythm that provides: adequate compliance measures that manage the firms obligations (including under binder agreements or Auth Rep agreements); assurance to board, management, business partners (such as insurers) and regulators that obligations are being adequately managed; indicators of areas of potential concern; and data (incidents, complaints, control testing, monitoring etc) The documents I provide are all individually developed and include: tailored Risk and Compliance manual (~ 35 pages, an all-in-one document that represents the business from a compliance perspective and can also be used as a training tool); Monitoring Program (monitoring employees, Authorised Reps, Distributors and/or Material Service Providers); Obligations register covering relevant (to your business) financial service laws, Prudential Standards and Codes. This enables you to assign key controls, accountability and control testing to your obligations Registers inlcuding complaints; incidents and breaches; conflicts of interest and training; and ad hoc, tailored policies & documents. All documents are tailored to your business – what it does, how it does it and who does it. 3. Training and education Training is becoming an often requested compliance service that I provide with delivery through online, face-to-face or a combination of both. I really love engaging with your business and having fun and meaningful conversations with your people addressing compliance issues that are of concern (or confusing) to them. All training […]

ASIC has released proposed updates to its conflicts management guidance for financial services businesses. Media Release 25-150MR Regulatory Guide 181 Licensing: Managing conflicts of interest (RG 181) was last updated in August 2004. The proposed changes will align the guidance with developments in law and policy and have been informed by ASIC’s private markets surveillance work. ASIC Commissioner Kate O’Rourke said: ‘Conflicts management is a core obligation for financial services businesses and helps promote consumer protection and market credibility. ‘Conflicts of interest are more than mere moral dilemmas. They can undermine trust, integrity and performance, causing serious harm to consumers, investors and overall market confidence.’ The updated guidance sets out how Australian financial services (AFS) licensees should comply with their conflicts management obligation and explains: how the law applies, including its scope and interaction with other related obligations the types of conflicts AFS licensees need to identify and manage to meet their obligation the need to have robust and tailored arrangements that are adequate to manage conflicts, and how licensees can effectively manage conflicts. Consultation CP 385 was released 30 July 2025. Comments close 5 September 2025. Draft Regulatory Guide 181 July 2025 – AFS Licensing: Managing conflicts of interest Your obligation If you are an AFS licensee, or an AFS licence applicant, you must comply with your general licensing obligations under s912A of the Corporations Act 2001 (Corporations Act). This includes your obligation to have in place adequate arrangements for managing conflicts of interest that may arise wholly, or partially, in relation to activities undertaken by you or your representative in the provision of financial services as part of your financial services business (‘the conflicts management obligation’): see s912A(1)(aa). Scope of the obligation The conflicts management obligation is broad and is intended to apply widely—it is not limited in its application. It applies to all conflicts of interest other than those wholly outside the financial services business of you or your representative. It applies to conflicts of interest that arise within the financial services business. It also applies to conflicts that arise between something within thefinancial services business and something outside it. For example: (a) a conflict between the financial services business and corporate lending business within a conglomerate firm; or (b) a conflict between the financial services business and an employee’s personal or financial interest outside it. Complying with your obligation If ASIC have reason to believe you are not complying with your conflicts management obligation, ASIC may take administrative action. This could include suspending or cancelling your AFS licence or imposing additional licence conditions: see ss915C(1) and 914A(1). Depending on the severity, a breach of your conflicts management obligation may result in civil penalties for individuals or for corporations. What is a conflict of interest? A conflict of interest can arise where there are competing financial interests, personal interests, business or related party interests—whether direct or indirect—or competing loyalties and obligations. In some circumstances, a combination of these may give rise to a conflict. You should take […]

What is the obligation? Under s912B of the Corporations Act, AFS licensees must have arrangements for compensating retail clients for losses they suffer as a result of a breach by the licensee or its representatives of their obligations in Ch 7 of the Corporations Act. (also refer ASIC RG 126) This obligation does not apply to APRA regulated insurers (see reg 7.6.02AAA(3)) but does apply to Underwriting Agencies, Insurance Brokers, Insurance Claim Managers and Claimant Intermediaries who hold an AFS Licence. These arrangements must: satisfy the requirements in the Corporations Regulations, which are that licensees must obtain PI insurance that is adequate, considering the nature of the licensee’s business and its potential liability for compensation claims (see reg 7.6.02AAA); or be approved by ASIC as alternative arrangements For the purposes of this article, I will be focusing on PI insurance under reg 7.6.02AAA. What this means for AFS Licensees and consumers ASIC’s approach to administering the compensation requirements means that all AFS licensees that provide financial services to retail clients must have PI insurance that meets the minimum standards, unless an exemption applies. Tt is important, however, to recognise the limitations of PI insurance as a consumer protection mechanism. PI insurance is not designed to protect consumers directly and is not a guarantee that compensation will be paid. It is designed to protect the insured (i.e. the AFS licensee) against the risk of financial losses arising from poor quality services (e.g. poor advice or execution of services) and other misconduct by a financial services provider (e.g. fraud by its representatives). The insurance is not intended to cover product failure or general investment losses, claims for loss solely as a result of the failure (e.g. insolvency) of a product issuer or where a return on a financial product has not met expectations. Nor is it intended to underwrite the products of a product issuer. ASIC recognise that the PI insurance that is currently available in the market is unlikely to provide a source of funds when an AFS licensee has become insolvent before the claim was brought. Ideally, insurance policies would continue to cover the licensee after it has become insolvent or otherwise ceased business, but ASIC understands that this insurance is generally not available in the current market to the average licensee. ASIC also recognise that insurers may exclude some areas of cover in policies for risk management reasons. (see RG 126.8 – 126.11) Disclosure to retail clients AFS Licensee must disclose to retail clients the kind of compensation arrangements they have in place and whether these arrangements comply with s912B: see regs 7.7.03A and 7.7.06B. The disclosure must be presented as a statement in your Financial Services Guide (FSG) or website disclosure information and the FSG or website disclosure information of your representatives. (RG 126.19) Adequate PI Insurance What is adequate? (See Section C RG 126) The Corporations Regulations require you to hold PI insurance that is adequate, considering: (a) your liability for claims brought through the Australian Financial […]

ASIC expects that financial firms (including those providing general insurance products and services – insurers, Underwriting Agencies, TPAs, Insurance brokers and Claimant Intermediaries) to have adequate compliance measures for ensuring that, as far as reasonably practicable, licensees comply with their obligations as a licensee, including the general obligations in section 912A(1) Corporations Act. (refer RG 104 Section B) ‘compliance measures’ refer to your processes, procedures or arrangements for ensuring compliance with your AFSL obligations. This includes people, systems and policies and processes. Documenting your measures Documentation helps you demonstrate whether or not you are complying with the general obligations. When you document your measures, ASIC expects this will include details of who is responsible, the timeframes involved and associated record keeping and reporting. (RG 104.26) It follows that your documented compliance measures should be tailored to your business based upon the nature, scale and complexity’ of your business. Care needs to be taken in adopting an ‘off-the-shelf’, ‘one-size-fits-all’ compliance manual. Implementing, monitoring and reporting on your measures It is not enough just to document your measures. You also need to fully implement them. This means you need to put them into practice and integrate them into the day-to-day conduct of your business. For measures to work effectively in practice, you need people at all levels of your business, including your senior management, to understand them and be committed to their success. Integrating your measures into the culture of your business helps ensure they are effective on an ongoing basis. You also need to monitor and report on your compliance, including reporting relevant breaches to ASIC. ASIC expects that you will keep records of your monitoring and reporting, including records of reports on compliance and breach notifications. (refer RG 104.27 – RG 104.29) Reviewing your measures Regularly reviewing your measures will help to ensure they remain effective. In some cases, it may be sensible for you to consider external review. Where compliance issues have arisen (such as major breaches or repeated compliance failures), external compliance review is particularly appropriate. You need to review your measures when there are changes to your obligations, your business or the environment in which you operate. ASIC expects that you will have a process for identifying changes that may impact on the effectiveness of your measures. Your compliance measures Compliance with your obligations as a licensee is central to the protection of consumers and the promotion of market integrity. Having effective compliance measures is a way for you to ensure you comply with your obligations as a licensee, including identifying and appropriately dealing with instances of non-compliance. Compliance measures also help you demonstrate to ASIC that you can comply and are complying with your obligations. (RG 104.41) What your compliance measures need to cover ASIC considers that the broad compliance obligations (s912A(1) are both stand-alone obligations and obligations that encompass the other general obligations. For this reason, ASIC expect your measures for ensuring compliance with the broad compliance obligations will cover all of your obligations as […]

Many Insurance brokers operate as an Authorised Representative (AR) under the AFS licence of another insurance broker. The risks for the Licensee, from its AR network, are clear and generally well understood: The licensee has obligations in respect of its AR’s, including: take all reasonable steps to ensure that the AR complies with the financial services laws (s912A(1)(ca) Corporations Act; ensure that its AR’s are adequately trained and are competent to provide the financial services (s912A(1)(f)); and NIBA members must ensure that their AR’s comply with the Insurance Brokers Code of Practice (Part 8.1) Generally, the Licensee will: conduct extensive due diligence before appointing an AR under s916A Corporations Act including checking with any previous licensee that the AR was authorised by; provide a risk and compliance framework; provide training; provide systems to facilitate compliance; sign off on marketing materials, disclosure documents and other such collateral; have adequate compliance resources to carry out supervision of the ARs (s912A(1)(d) Corps Act); provide specialist skill sets such as cybersecurity (refer Fortnum case below) monitor and supervise; provide advice and ongoing support; and manage incidents, reportable situations and complaints. Contagion risks A significant risk that must be considered and managed is contagion risk. This is the risk where inadequate compliance arrangements for one AR, will quickly spread to other ARs, resulting in regulatory and reputational impacts for the Licensee and all AR’s in the newtork. This was the case in proceedings recently filed in the NSW Supreme Court by ASIC against Fortnum Private Wealth Limited alleging it failed to properly manage and mitigate cybersecurity risks. ASIC alleges Fortnum did not meet its obligations as an AFS licensee because it failed to have adequate policies, frameworks, systems and controls in place to deal with cybersecurity risks. As a result, ASIC claims Fortnum exposed the company, its authorised representatives (ARs) and clients of its ARs to an unacceptable level of risk of a cyber-attack or a cybersecurity incident. (refer ASIC Media Release 25-143MR). Obligations of an Authorised Representative An AR must assist the Licensee in meeting the Licensee’s financial service obligations (and under the Code) however, the AR has independent and seperate obligations, as an AR, under financial services laws, including: must not hold out that they have an AFS Licence (s911C Corporations Act); must comply with licence conditions imposed by regulations (s914(8) Corps Act and Reg 7.6.04) , specifically: – can only sub-authorise individuals with the Licensee’s consent (note that an AR is not permitted to sub-authorise a company, it can only sub-authorise individuals); – refer to its AR number in all business documents including registered business office and website; – provide a copy of its authorisation on request, to any person, free of charge and as soon as practicable after receiving the request, but no later than 10 business days; provide retail clients with a FSG (s941B); obtain the retail client’s informed consent to any commission payment where personal advice will, or will likely, be provided before insurance is issued or sold (s963BB Corps Act and […]