Compliance and Breach Reporting Policy

Document control

1. Purpose

This Policy sets how [Organisation] manages its compliance obligations and how it identifies, records, assesses, reports, rectifies and remediates breaches. It ensures that:

2. Scope and application

This Policy applies to all employees, contractors, directors and officers of [Organisation] and its subsidiaries, to authorised representatives and credit representatives, and to material service providers who perform activities on our behalf. [Organisation] must report reportable situations that involve its representatives as well as its own conduct (s912D(1); s50A(1); RG 78.28).

3. Key definitions

Incident, Issue, Breach, Root cause, Extent of condition, Action, Customer remediation and Date identified have the meanings in the RiskFA Incident & Issues Management Standard.

4. Principles

1. Know our obligations. Every applicable obligation is in the obligations register, with an owner and controls.
2. Compliance is owned by the business. The first line meets the obligations; Compliance sets the framework, advises, monitors and challenges.
3. Speak up early. Anyone who sees a possible breach raises it straight away. No one is penalised for raising a genuine concern in good faith.
4. Assess every possible breach. The incident rating never decides reportability. Small dollar breaches can be significant.
5. Meet the clock. Legal deadlines run from when anyone in the organisation knows the facts, not from when a committee, the Board or a lawyer signs off (RG 78.92–RG 78.98).
6. Report when the grounds exist. Do not wait for an investigation to finish, legal advice, Board consideration or rectification if that would take us past the deadline (RG 78.60, RG 78.98).
7. Fix and remediate. Stop the breach, fix the root cause and remediate affected customers fairly and promptly.
8. Record the reasons. Every assessment, decision to report and decision not to report is recorded with its reasons.

5. Three lines of accountability

6. Roles and responsibilities

7. Regulatory and standards framework

8. The compliance function

[Organisation] has a designated compliance function, led by the [Head of Compliance], that assists senior management to manage compliance risk effectively. For ADIs and insurers this is required by CPS 220 para 43: the function must be adequately staffed by appropriately trained and competent persons who have sufficient authority to perform their role effectively, and have a reporting line independent from business lines. [Organisation] applies the same standard across the group.

9. Obligations register

The obligations register is the single source of truth for [Organisation]'s compliance obligations. It is kept in [GRC system] and contains, as a minimum, the fields in Appendix C.

10. Compliance risk assessment and the compliance plan

Compliance assesses compliance risk across the obligations register at least [annually], using incidents, breaches, complaints, audit findings, regulator feedback and regulatory change. The results drive a risk-based compliance plan, approved by the [Board Risk Committee] each [financial year], that sets out:

11. Compliance monitoring and testing

Compliance monitoring and testing gives the Board evidence that obligations are being met. It covers both control design and operating effectiveness, consistent with the RiskFA Risk Management Framework.

12. Identifying and escalating possible breaches

• Anyone who becomes aware of a possible breach must tell their manager and [Compliance] immediately, and in any case within [1 business day], and record it (or ensure it is recorded) under the RiskFA Incident & Issues Management Standard.
• Possible breaches come from any source: staff, controls and exceptions, monitoring and audits, complaints, whistleblower disclosures, service providers, representatives, regulators and AFCA.
• Record the date identified and, separately, the date of knowledge (section 3). For a body corporate, the knowledge of a director, employee or agent acting within the scope of their actual or apparent authority is attributed to the licensee (s769B; National Credit Act s324). ASIC's clock can start when a compliance officer first has the facts, not when a committee or the CEO approves the report (RG 78.92–RG 78.97, Case study 4).
• Compliance must be told of every matter that may involve a breach of a legal or regulatory obligation, whatever its incident rating.
• Representatives and material service providers must report possible breaches to [Organisation] within [2 business days] (immediately for serious matters), under their agreements (RG 78.136).

13. Assessing breaches

Compliance assesses every possible breach, and records the decision and reasons no later than day [20] after the date identified, so that any report can be lodged within the legal deadline. The worksheet in Appendix A and the decision table in Appendix B are used. Where the facts are clear, the assessment and report must be done sooner.

13.1 Steps in the assessment

1. Is there a breach or likely breach? Identify the facts, the obligation and whether it has been, or will be, breached. Where facts are still being gathered, start an investigation and track its start date (section 15).
2. Is it a core obligation? Check RG 78 Appendix 1 and the obligations register. Breaches of other obligations are still recorded, rectified and assessed for other notifications.
3. Is it an additional reportable situation? Gross negligence or serious fraud must be reported regardless of significance (s912D(2); s50A(2); RG 78.63).
4. Is it a deemed significant breach? Check the deeming categories in s912D(4) / s50A(4) (RG 78.35), then any exclusion in the regulations or ASIC Instrument 2024/620 (sections 13.2 and 13.3).
5. If not deemed significant, is it significant? Consider all the factors in s912D(5) / s50A(5) (section 13.4).
6. Is another report or notification required? For example to APRA, under the notify, investigate and remediate obligations, DDO, FAR, OAIC or AUSTRAC (sections 16 to 18).
7. Are customers affected? Identify affected customers and start remediation planning (section 19).
8. Record the decision. Record the conclusion, reasons, the date of knowledge, the reporting deadline and the approver.

13.2 Deemed significant breaches

A breach or likely breach of a core obligation is taken to be significant if it (s912D(4); s50A(4); RG 78.35):

13.3 Breaches excluded from deeming (ASIC Instrument 2024/620)

• A single breach of an enforceable paragraph of RG 271 is not deemed significant only because it is a civil penalty provision (s5; RG 78.37(c)). Multiple or systemic IDR breaches may still be significant (RG 78 Example 4(d)).
• A misleading or deceptive conduct (or false or misleading representation) breach is not deemed significant if it gives rise to only a single reportable situation, impacts only one person (or joint holders), and has not caused and is unlikely to cause any financial loss (s6; RG 78.38(a)).
• Since 27 June 2025, a breach of a core obligation that would only be deemed significant because it is a civil penalty provision or misleading conduct is also not deemed significant if all of these apply: it gives rise to a single reportable situation (or a single group of the same or substantially similar conduct within 60 days); for AFS licensees, it is not a contravention of s828C or s981M; no more than 10 persons are impacted; total financial loss is no more than $1,000 (whether or not remediated); and it is rectified, including remediation, within 60 days after it first occurred (s6 as amended by Instrument 2025/289; RG 78.38(b)).
• If further breaches or losses later emerge so that the conditions are no longer met, the matter must be reported (RG 78.39).
• An excluded breach must still be checked against the other deeming categories (for example offences and material loss) and the significance factors (RG 78.40–RG 78.41). Excluded breaches are still recorded in the breach register.

13.4 Significance factors

For a breach of a core obligation that is not deemed significant, Compliance considers all of the following, and a breach may be significant on one factor alone (s912D(5); s50A(5); RG 78.45–RG 78.47):

14. Reporting reportable situations to ASIC

14.1 What must be reported

14.2 When to report

• Lodge the report within 30 calendar days after [Organisation] first knows that, or is reckless with respect to whether, there are reasonable grounds to believe the reportable situation has arisen (s912DAA(3); s50B(4); RG 78.83).
• Where a reportable situation has already been reported, a further reportable situation with the same or substantially similar underlying circumstances may be reported within 90 days (s7 of Instrument 2024/620; RG 78.84). ASIC may direct a shorter period. The grouping test (similar, related or identical conduct and the same root cause) applies (RG 78.110–RG 78.115).
• An investigation becomes a reportable situation on day 61, and the report is due within 30 days of that date. The outcome, if it finds no reportable situation, must also be reported within 30 days of that finding (RG 78.102, RG 78.105, Example 11).
• If reasonable grounds to believe a reportable situation has arisen exist before an investigation finishes, report it then; do not wait for the investigation to end (RG 78.60, RG 78.106).
• Do not delay beyond the deadline for Board consideration, legal advice, rectification, or (for a likely breach) the breach actually occurring (RG 78.98–RG 78.99).
• For a report about another licensee's adviser or mortgage broker, also give a copy of the report to the other licensee within the same 30 days (s912DAB(5); s50C(5); RG 78.74). No report (and so no copy) is needed only if there are reasonable grounds to believe ASIC already knows of the reportable situation and has all the required information, which ASIC describes as a high threshold (s912DAB(4); s50C(4); RG 78.80).

14.3 How to report

• Reports are lodged in the prescribed form (the approved form for credit licensees) through the ASIC Regulatory Portal (s912DAA(2); s50B(3); RG 78.107). Table 8 of RG 78 lists the content; the breach register holds the same information (RG 78.145).
• Reports are approved by the [Head of Compliance] (or delegate). Critical matters are also notified to the [CEO] and [Board Risk Committee chair] before or at lodgement, but lodgement is never delayed for that purpose.
• Further reportable situations from the same root cause, rectification progress and completion of remediation are notified using the Portal update function while the original report remains open (RG 78.115–RG 78.116).
• An APRA-regulated licensee may meet the ASIC obligation by lodging a report with APRA within the same timeframe, provided the report contains all the information required by s7A of Instrument 2024/620 (s912DAA(5); s50B(6); RG 78.109). [Organisation] [does / does not] use this option.
• Related entities with the same root cause may be listed in one report (RG 78.114).

14.4 Consequences of not reporting

Failing to report a reportable situation can attract civil penalties and is a criminal offence (other than for reports about other licensees) (RG 78.123–RG 78.126). ASIC must publish information about reportable situations each financial year, within four months after the end of the financial year (s912DAD; s50D; RG 78.127).

15. Investigations

• An investigation starts, as a matter of fact, when [Organisation] begins a searching inquiry to find out whether a significant breach has occurred, for example by gathering information from staff, clients or experts. It does not depend on what the activity is called, or which team does it (RG 78.50–RG 78.56, RG 78.104, Example 10). Merely logging an incident, or short preliminary fact-finding in response to a complaint, is not usually an investigation (RG 78.51(a), RG 78.55).
• The investigation start date is recorded in the breach register, and the register flags investigations at day [30], day [45] and day [55], so that a report can be prepared if the investigation will pass 60 days.
• Investigations are started without unreasonable delay and resourced to finish promptly. Investigations open for more than [60 days] are reviewed [monthly] by the [Head of Compliance], covering progress, reasons for delay, next steps and the significance of the breach (RG 78.57–RG 78.59, RG 78 Table 10).
• Two inquiries into the same subject matter are treated as one investigation from the start of the first (RG 78 Case study 2).
• Do not wait for an investigation to finish before fixing a known deficiency or limiting harm (RG 78.58).
• Where Legal directs that an investigation be privileged, follow Legal's instructions on how it is recorded. Privilege does not change reporting deadlines.

16. Notify, investigate and remediate obligations (personal advice and mortgage broking)

These obligations apply where all four of these circumstances exist: personal advice to a retail client on a relevant financial product (or mortgage broking credit assistance for a credit contract secured by a mortgage over residential property); reasonable grounds to believe a significant breach of a core obligation, gross negligence or serious fraud has arisen; reasonable grounds to suspect the client has suffered or will suffer loss or damage as a result; and reasonable grounds to suspect the client has a legally enforceable right to recover that loss from [Organisation] (s912EA, s912EB; National Credit Act s51A, s51B; INFO 259).

17. Notifications to APRA

APRA-regulated entities assess every possible breach of a prudential requirement and every significant breach of the risk management framework for notification to APRA, in parallel with the ASIC assessment.

18. Other notifications

The RiskFA Incident & Issues Management Standard section 10 is the master table of regulatory notifications. The obligations most often triggered by breaches are:

19. Rectification, remediation and preventing recurrence

• Every breach is contained and rectified, and its root cause and extent of condition are analysed under the RiskFA Incident & Issues Management Standard (sections 11 and 12). Issues are raised for every control gap.
• Affected customers are identified and remediated fairly, consistently and promptly under the RiskFA Customer Remediation Policy and ASIC RG 277 Consumer remediation. Remediation is not delayed for commercial reasons (RG 78 Example 3(g)).
• The report to ASIC records rectification and remediation plans and dates, and ASIC is updated when they are complete (RG 78 Table 8).
• Lessons learned are used to update the obligations register, controls, training and procedures.
• Consequence management is considered for significant breaches, including for those responsible for oversight (RG 78 Table 10), under the RiskFA Consequence Management Framework.

20. Breach register and records

• All possible breaches, breaches and reportable situations are recorded in the breach register within the [GRC system], linked to the incident and issue records. ASIC expects licensees to keep a breach register that contains the information in the prescribed reporting form (RG 78.144–RG 78.145).
• The register records at least: the facts; the obligation; the date the breach occurred, date identified and date of knowledge; any investigation start and end dates; the assessment against each deeming category, exclusion and significance factor, with reasons; the decision, decision-maker and date; reporting deadlines and the dates reports and updates were lodged, with reference numbers; customers affected and remediation; rectification and root cause; and related breaches.
• Decisions not to report are recorded with the same care as decisions to report.
• Records are kept for at least [7 years], or longer where the law requires.
• Compliance tests breach register data quality and timeliness at least [half-yearly].

21. Board and management reporting

Compliance reports to the [Executive Risk Committee] [monthly] and to the [Board Risk Committee] [quarterly]. Reports focus on insight, customer impact and accountability. They cover at least:

22. Measures and key risk indicators

23. Training, culture and assurance

• All staff and representatives complete compliance and breach identification training at induction and [annually], with examples relevant to their role. People who assess breaches are trained on RG 78 and Instrument 2024/620.
• Senior management champion transparent reporting, prioritise investigations, rectification and remediation, and make clear who is accountable end to end for breach reporting (RG 78.140–RG 78.141).
• Concealing a breach, delaying escalation or discouraging reporting is a breach of this Policy and is managed under the RiskFA Consequence Management Framework. Concerns may also be raised under the RiskFA Whistleblower Policy.
• Compliance reviews the breach reporting process [annually], including the number of incidents assessed and outcomes, trends and timeliness (RG 78 Table 10).
• Internal Audit reviews this Policy and the compliance management system at least every [3 years].

24. Related documents

• the RiskFA Risk Management Framework, the RiskFA Risk Appetite Statement and [Incident & Issues Management Standard]
• the RiskFA Complaints Handling Policy and the RiskFA Customer Remediation Policy
• the RiskFA Data Breach Response Plan and the RiskFA Cyber Incident Response Plan
• [Conflicts of Interest Policy], the RiskFA Whistleblower Policy, the RiskFA Consequence Management Framework and [FAR Accountability Map]
• ASIC: RG 78 Breach reporting by AFS licensees and credit licensees, INFO 259, RG 104 AFS licensing: Meeting the general obligations, RG 205 Credit licensing: General conduct obligations, RG 271 Internal dispute resolution, RG 274 Product design and distribution obligations, RG 277 Consumer remediation
• APRA: CPS 220 / SPS 220, CPS 230, CPS 234, CPS 510 / SPS 510
• Standards: AS ISO 37301:2023 Compliance management systems, AS ISO 31000:2018 Risk management — Guidelines

Appendix A. Breach assessment worksheet

Appendix B. Reportable situation decision table

Work down the table. Stop at the first row that answers 'Report'. Record the reasons for every answer.

Appendix C. Obligations register fields