Customer Remediation Policy

How to use this industry policy. Adopt the structure, terms and principles as written, so that your organisation speaks the same language as the rest of the industry and as ASIC. Fill in the text in [square brackets] with your organisation's details, set the thresholds and timeframes to match your size and risk appetite, delete sections that do not apply to you (for example the superannuation section if you are not a trustee), and approve the Policy through your governance process. Regulatory requirements are summarised as at October 2026: confirm the current requirements that apply to your organisation before relying on them. This template is general information only, provided free of charge, and is used at your own risk (see the disclaimer at the end).

Document control

Item	Detail
Document	Customer Remediation Policy
Organisation	[Organisation name]
Document owner	[Head of Customer Remediation / Chief Risk Officer]
Accountable person (FAR, where applicable)	[Name and role of the accountable person with responsibility for client or member remediation programs]
Approved by	[Board Risk Committee]
Version / date approved	[1.0] / [date]
Review cycle	At least [annually], and after any change to RG 277, the breach reporting rules or a significant remediation
Parent documents	the RiskFA Risk Management Framework; the RiskFA Incident & Issues Management Standard

1. Purpose

This Policy sets the minimum requirements for how [Organisation] identifies when customers must be remediated, and how it scopes, calculates, delivers, governs, reports and closes remediation. It ensures that:

customers who have suffered, or may have suffered, loss from our misconduct or other failures are found and put back, as closely as possible, in the position they would have been in;
remediation is started promptly, without waiting for complaints or regulators;
doubt is resolved in the customer's favour, and the customer does not have to do the work;
[Organisation] never keeps a profit from its own failure; and
the Board, management and regulators can see that remediation is fair, timely, well governed and properly recorded.

The Policy gives effect to ASIC Regulatory Guide 277 Consumer remediation (RG 277) and supports the general obligation to provide financial services and credit activities efficiently, honestly and fairly (Corporations Act 2001 s912A(1)(a); National Consumer Credit Protection Act 2009 (National Credit Act) s47(1)(a)), which RG 277.4 identifies as the foundation of the remediation framework. It expands section 13 of the RiskFA Incident & Issues Management Standard, and must be read with it.

2. Scope and application

This Policy applies to all employees, contractors, directors and officers of [Organisation] and its subsidiaries, to all products, services and channels, and to misconduct or other failures of our current or former representatives, service providers, product providers, consultants and significant related entities (RG 277.23).

If [Organisation] is	How RG 277 applies (as at October 2026)
An AFS licensee (including a limited AFS licensee) or a credit licensee	RG 277 applies (RG 277.5).
A superannuation trustee (other than an SMSF trustee)	RG 277 applies: trustees hold an AFS licence (RG 277.6(a)). Section 16 of this Policy sets out the additional superannuation requirements.
An RSA provider, debt management services provider or claims handling and settling services provider	RG 277 applies to the extent described in RG 277.6(b)–(d).
Not licensed, but providing financial products, services or credit to retail customers (for example an entity required to have IDR and AFCA membership)	RG 277 can be used as good practice guidance (RG 277.7). Adopt this Policy as good practice.

RG 277 applies to remediations initiated on or after 27 September 2022. RG 256 continues to apply to remediations initiated before that date (RG 277.8). A remediation is 'initiated' when the decision is made to address the failure and the process starts; a matter waiting in a backlog has not been initiated. [Organisation] must not pick and choose between the two guides to favour itself (RG 277.9).
RG 277 primarily concerns retail customers. Other customers (for example wholesale clients) are included in scope where that is fair, assessed case by case (RG 277.11).
Where another law or legal duty conflicts with RG 277, the law prevails (RG 277.16). For unit pricing errors, ASIC RG 94 prevails over RG 277 (RG 277.18 note).
Single complaints are handled under the RiskFA Complaints Handling Policy and ASIC RG 271 Internal dispute resolution. If the complaint points to a wider issue, a remediation is started under this Policy (RG 277.32(a) note).

3. Key definitions

RG 277 uses the word 'consumer'. In this Policy 'customer' has the same meaning and includes members of a superannuation fund, policyholders, borrowers, investors and former customers.

Term	Meaning
Customer remediation (remediation)	A process, large or small, to investigate the scope of a misconduct or other failure and, if appropriate, return customers who suffered loss to the position they would otherwise have been in, as closely as possible, by monetary or non-monetary remedies or both (RG 277.2).
Misconduct or other failure	Decisions, omissions or behaviours of [Organisation] or its representatives, service or product providers, consultants or significant related entities (RG 277.23). Includes breaches of financial services or credit laws, contractual failings, negligence or fraud, failures to meet other regulatory requirements (RG 277.25), system and pricing errors, and process failures (RG 277.26). It is wider than a reportable situation (RG 277.28).
Remediation program	A remediation run with dedicated governance and resources because of its scale, age or complexity (section 7).
Remediation review period	The period over which the misconduct or other failure may have occurred and customers may have been affected. It starts when [Organisation] reasonably suspects the failure first occurred and caused loss (RG 277.49–RG 277.50).
Affected customer	A current or former customer who has, or may have, suffered loss or other detriment from the misconduct or other failure.
Beneficial assumption	An assumption that, where there is uncertainty, minimises the risk of affected customers falling out of scope and minimises the risk of under-compensation (RG 277.116). Licensees are not expected to over-compensate all customers.
Foregone returns or interest	Returns or interest the customer would have received, and interest the customer would not have incurred, but for the failure (RG 277.74).
Reasonable endeavours	The steps, decided case by case, that are reasonable to contact and pay affected customers or deliver the remedy (RG 277.153–RG 277.154).
Low-value compensation threshold	The RG 277 approach under which amounts of $5 or less (after interest) owed to former customers with no current payment information may go to a residual remediation payment instead of applying reasonable endeavours (RG 277.161).
Residual remediation payment	A payment of consolidated remediation money that could not be returned despite reasonable endeavours, made to a charity or not-for-profit organisation registered with the Australian Charities and Not-for-profits Commission (ACNC) (RG 277.194).
Unclaimed money regime	A state, territory or Commonwealth regime that accepts and holds money for the people owed it (RG 277.190).
Cohort	A group of affected customers who share features or experiences, used to triage and deliver remediation (RG 277.142).
Independent expert	A business or person external to [Organisation] and its related entities, with relevant expertise, engaged to give independent assurance over the governance, design and operation of a remediation (RG 277.220).
Incident, Issue, Root cause, Extent of condition, Reportable situation	As defined in the RiskFA Incident & Issues Management Standard.

4. Principles

RG 277 Table 1 sets out nine principles for conducting a remediation efficiently, honestly and fairly. [Organisation] adopts them as written:

#	RG 277 principle	What it means at [Organisation]
1	Return affected consumers as closely as possible to the position they would have otherwise been in had the misconduct or other failure not occurred	This is the guiding principle for every decision, whatever the size of the remediation (sections 9–11).
2	Understand the nature, extent and impact of the misconduct or other failure	Find the root cause and full extent, set the review period from the first reasonably suspected loss, and identify everyone affected (section 8).
3	Give consumers the benefit of the doubt, and minimise the risk of under-compensation	Use only assumptions that are beneficial to customers, evidence based and documented (section 10).
4	Ensure that key decisions are justified and documented	Record the approach, decisions, progress and outcomes; ASIC may ask to see them (sections 19 and 21).
5	Apply reasonable endeavours when making remediation payments	Prefer payments that need no customer action (for example EFT or PayID); pay current customers regardless of value (sections 13 and 14).
6	Be timely without sacrificing quality consumer outcomes	Start and run remediation promptly; deliver in tiers where that gets money to customers sooner (sections 6, 7 and 13).
7	Make the process easy for consumers by minimising complexity and, where possible, limiting their involvement in the process	Include affected customers automatically (no opt-in); keep calls to action rare; remediation is free to customers (sections 8 and 12).
8	Do not profit from the misconduct or other failure	Money that cannot be returned goes to an unclaimed money regime or a residual remediation payment, never back to [Organisation] (section 14).
9	Ensure the remediation has adequate resourcing, governance and accountability	Senior management commitment, trained people, oversight, independent assurance where needed, and consideration of public reporting (sections 19 and 20).

5. Three lines of accountability and roles

Line	Who	Responsibilities
First line	Business units, product owners, operations, the [Remediation team]	Identify failures, start remediation, scope, calculate, communicate, pay and close; own the remediation issue and its actions; fix the root cause.
Second line	Risk and Compliance	Own this Policy; review and challenge scope, review period, assumptions, rates and methodology; assess breach reporting and notify-investigate-remediate obligations; validate closure; report to the Board Risk Committee.
Third line	Internal Audit	Independently assess whether this Policy is designed and operating effectively, including a sample of completed remediations.

Role	Responsibilities
Board	Sets the expectation of fair and timely remediation; oversees material remediation programs and their outcomes (RG 277.213, RG 277.216).
Board Risk Committee	Approves this Policy; receives remediation reporting (section 20); approves High and Critical remediation plans above [$X] and any decision not to remediate an identified failure.
CEO and executive team	Provide adequate resources promptly (RG 277.203); remove obstacles; foster a positive remediation culture (RG 277.210).
Accountable person (FAR, where applicable)	For ADIs, insurers and RSE licensees, an accountable person must have senior executive responsibility for management of client or member remediation programs, including hardship arrangements (Financial Accountability Regime (Minister) Rules 2024 s5(2)(f)). Meets the FAR Act s21 accountability obligations, including taking reasonable steps that include appropriate procedures for identifying and remediating problems (s22(c)).
Chief Risk Officer	Ensures independent challenge; approves the methodology for High and Critical remediations; decides when an independent expert is engaged.
Head of Compliance / General Counsel	Assess breach reporting, notify-investigate-remediate obligations and legal issues (limitation periods, releases, privilege); approve customer communications for legal accuracy.
Remediation owner (accountable executive)	One senior executive per remediation, from the area where the failure arose. Accountable for the outcome, timeliness and the remediation plan. Also the Issue owner under the Incident & Issues Management Standard.
Remediation manager	Runs the remediation day to day: plan, data, calculations, communications, payments, records and reporting.
Customer advocate (if appointed)	Brings a fairness lens: reviews and challenges design and outcomes from the customer's point of view (RG 277.209).
Complaints (IDR) team	Links complaints to remediations both ways and shares IDR and AFCA outcomes with the remediation team (RG 277.180–RG 277.181).
Finance	Provisions, payment controls, reconciliations, unclaimed money lodgements and residual remediation payments.
All staff	Raise possible failures that may have caused customer loss as incidents, immediately.

6. When remediation must be started

A remediation must be initiated if [Organisation] has engaged in misconduct or other failure when providing financial services or credit activities, and the misconduct or other failure has caused, or may have caused, customer loss (RG 277.22). This applies whatever the size of [Organisation] (RG 277.39).

Start promptly when [Organisation] becomes aware of the failure. Do not wait for a complaint, for AFCA or ASIC to raise it, or for proceedings (RG 277.24; RG 277.32 note).
Remediation is required whether or not the matter is a reportable situation (RG 277.28, RG 277.309). Breaches of an industry code may also require remediation (RG 277.27).
Do not take an overly technical or legalistic approach to deciding whether a failure needs remediation; focus on good customer outcomes (RG 277.29).
Possible sources include complaints and complaint trends, whistleblower disclosures, compliance checks, audits and file reviews, breach reporting processes, data monitoring, design and distribution reviews, and referrals from ASIC, APRA, AFCA or a code monitoring body (RG 277.32–RG 277.33).

Step	Requirement	Timeframe
Record	Every possible failure that may have caused customer loss is recorded as an incident in the register, with 'customer impact' flagged.	Within [2 business days] of the date identified (Incident & Issues Management Standard section 9)
Stop the harm	Contain the failure so that no further customers are affected (for example correct the fee, fix the system, suspend the product).	Immediately
Remediation decision	The incident owner, with Compliance, records whether remediation is required, the initial estimate of customers and amounts, and the proposed scale (section 7). A decision not to remediate needs reasons and [CRO] approval.	Within [10 business days] of the date identified
Raise the remediation issue	Each remediation is tracked as a separate issue under the Incident & Issues Management Standard until complete.	With the remediation decision
Remediation plan	Plan approved (Appendix A), including methodology decisions (Appendix B).	Within [30 business days] of the remediation decision for programs

The internal timeframes are good practice set by [Organisation], not RG 277 requirements. Shorter statutory timeframes apply to the notify, investigate and remediate obligations for personal advice and mortgage broking (section 18).

7. Scale: individual remediations and remediation programs

RG 277 is scalable. If the failure affects one or a few customers and the cause is isolated, the process should be simple and prompt, using existing incident, compliance or complaints processes, and a full program is not needed (RG 277.13–RG 277.14, RG 277.36–RG 277.37). The customers must still be returned to the position they would have been in. RG 277.38 leaves the thresholds to each licensee.

Scale	Typical thresholds (set your own)	How it is run
Individual remediation	Fewer than [10] customers, total remediation under [$10,000], isolated cause	Incident owner with existing resources; simplified record (Appendix C fields marked 'all'); second line samples [10%].
Standard remediation	[10] to [1,000] customers, or total under [$1 million], or a single product or adviser	Remediation owner and manager; remediation plan; second line review of methodology; monthly reporting.
Remediation program	More than [1,000] customers, total [$1 million] or more, multiple products, brands or periods, complex calculations, vulnerable cohorts, or rated High or Critical	Dedicated team and steering committee; full plan and methodology log; CRO approval; consider an independent expert (section 19); Board Risk Committee reporting.

The remediation is also rated Critical, High, Medium or Low under the RiskFA Risk Management Framework, using the highest of the six impact categories. The rating drives escalation and reporting; it never decides whether customers are remediated.

8. Scoping the failure

8.1 Secure the evidence

Take all reasonable steps, as early as possible, to access and secure the evidence, data and records held by [Organisation] or third parties, so that nothing is lost through accidental or automatic deletion (RG 277.42). Put a hold on routine record destruction for affected records. Ask authorised representatives and former representatives for records they are obliged to provide (RG 277.43).

8.2 Root cause and full extent

Find the root cause or causes: ask why and how it happened, not only what happened (RG 277.45). Use the root cause method in the Incident & Issues Management Standard section 12.
Investigate the full extent: other products, brands, advice or services; systems, processes or policies; representatives or employees; platforms or sales channels; group entities, providers and other licensees (RG 277.47). This is the extent of condition analysis.
Use file sampling where needed to test whether the failure is wider than the evidence so far suggests (RG 277.48).

8.3 The remediation review period

The starting point is always when [Organisation] reasonably suspects the failure first occurred and caused loss to a customer (RG 277.50), not when it was confirmed or identified.
[Organisation] does not use a fixed look-back limit, or an extra approval step for review periods longer than a set number of years, to cut the review period short (good practice). ASIC's 2023 review of large financial institutions' remediation policies found that unnecessary approval processes for review periods to exceed a certain number of years could inappropriately narrow the review period.
A review period longer than seven years may indicate systemic under-investment in systems to identify failures (RG 277.51). Where records were destroyed in good faith, consider whether beneficial assumptions can identify and compensate customers beyond that point (RG 277.52, RG 277.129–RG 277.133).
No limit on the review period removes a customer's right to complain through IDR or AFCA (RG 277.53).

8.4 Identifying affected customers

Identification must be robust and inclusive (RG 277.54).
Customers likely to be in scope are included automatically. They are never asked to 'opt in' (RG 277.57; Table 1 principle 7).
A customer who asks to be included is assessed. If they are found to be affected, review the scope (RG 277.57).
Identify customers experiencing vulnerability or financial hardship early, so that their files and payments are prioritised (RG 277.66, RG 277.109).

8.5 Reviewing and testing the scope

Revise the scope when new failures, products, representatives or periods are found, and re-examine closed matters where needed (RG 277.58).
Check whether customers whose complaints were resolved through IDR or AFCA fall within the scope, and have a process for people who come forward later, including after closure (RG 277.59).
Test the scope (for example by sampling customers just outside it) before finalising it (RG 277.60).

9. Determining the outcome

The aim is to return affected customers, as closely as possible, to the position they would have been in had the failure not occurred (RG 277.62). Where that is not possible, [Organisation] does what it can to compensate for the disadvantage caused (RG 277.63).

9.1 Monetary remedies

Refund the amounts wrongly charged or not paid, plus foregone returns or interest (section 11).
Compensate indirect financial loss, such as overdraft, dishonour and late payment fees, or interest on a credit card used to pay for the product (RG 277.71; Table 2).
Where [Organisation] deals closely with individual customers, consider compensating known non-financial loss (RG 277.71).
Do not discount compensation for unrealisable benefits, such as 'peace of mind' from a mis-sold policy, or because the customer stayed in the product (RG 277.72). A partial remedy is acceptable only where the customer received a legitimate and demonstrable financial benefit (RG 277.73).
No customer's compensation is reduced below the amount wrongly taken plus an interest component because of negative investment returns (RG 277 Example 9 shows a floor of this kind as appropriate). This is [Organisation]'s policy.

9.2 Non-monetary remedies

Consider remedies such as moving the customer into a suitable product, voiding or varying a contract, waiving eligibility criteria, reassessing declined claims, correcting inaccurate information (including credit reporting information, which must be corrected and the correction notified to credit reporting bodies that received it), and free remedial advice (RG 277.88–RG 277.91; Table 2). RG 277 Table 2 lists remedies by type of failure (advice, insurance, banking systems errors, bundled fees, credit, mortgage broking, superannuation, OTC derivatives, debt management); use it as a checklist.

9.3 Other outcomes to consider

Assistance: offer to pay for independent financial, legal or tax advice where the remediation is complex, the amount is large or the customer must choose between outcomes (RG 277.92–RG 277.94).
Pausing enforcement: for credit contracts or leases, do not start or continue enforcement action or default notices until the remediation outcome is decided and any IDR or AFCA complaint is finalised, except to protect a limitation period, in which case the proceedings are stayed (RG 277.95–RG 277.97).
Limitation periods: where the remediation has affected a customer's ability to take action in time, waive the limitation period, and consider waiving limits that would stop AFCA considering a complaint (RG 277.98–RG 277.100). Discuss with the PI insurer where relevant.
Tax: tell customers that payments may have tax consequences, show the components (for example refund and interest) and the periods they relate to, and suggest they seek advice, with support for larger or complex payments (RG 277.101–RG 277.103). Consider ATO guidance and, where needed, engage the ATO early (RG 277.244–RG 277.246).

10. Methodology: file reviews and beneficial assumptions

[Organisation] decides the methodology for each remediation and records it in the methodology decision log (Appendix B). The options are data analysis, file reviews, beneficial assumptions, or a combination.

10.1 File reviews

Review files consistently and fairly, using documented review principles and templates that are not a 'tick-a-box' exercise (RG 277.106–RG 277.107).
Look beyond the face of the file where fraud or misleading conduct is indicated (RG 277.108).
Reviewers must meet the training and competence requirements for the product or service reviewed (RG 277.110). Use peer review where the nature, size or complexity of the remediation requires it, especially early in the program (RG 277.111–RG 277.112).

10.2 Beneficial assumptions

Assumptions may be used to decide who is in scope and to calculate loss, to save time and cost or to fill gaps in records (RG 277.113–RG 277.114). They may be used only if they are beneficial to customers and result in an outcome that returns customers as closely as possible to their position, and that is evidence based and well documented (RG 277.115).

Records missing because [Organisation] breached record-keeping obligations: where there are reasonable grounds to suspect loss, [Organisation] must make assumptions beneficial to customers (RG 277.127). Never assume that customers who did not complain were not affected (RG 277 Example 22).
Efficiency: beneficial assumptions may also be used where good records exist, to pay customers sooner (RG 277.134–RG 277.135).
Developing assumptions: consider variability within and between cohorts (RG 277.122). A median or mean is appropriate only in limited cases, such as when the spread of losses is low (RG 277.123). Minimise the margin of error and the risk of under-compensation (RG 277.124). Where some customers are over-compensated, the program cost savings from using assumptions should be taken into account when deciding the appropriate overall outcome (RG 277.117).
Warning signs that an assumption is not beneficial: unjustifiably narrow scoping; unjustified discounting or averaging; an outcome that commercially benefits [Organisation]; excluded evidence or ignored new information; or not using all relevant data reasonably available (RG 277.125).
Monitor: if new information shows an assumption is no longer beneficial, revisit it and consider supplementary payments (RG 277.140).
Tell customers, where appropriate, that assumptions were used in their calculation (RG 277.87, RG 277.119).
Superannuation trustees and fund managers using trust or scheme property must also consider their other legal duties, and RG 94 for unit pricing errors (RG 277.120–RG 277.121, RG 277.136).

11. Foregone returns or interest

To return customers to their position, [Organisation] must account for foregone returns or interest (RG 277.74). It may calculate actual amounts, apply beneficial assumptions, or combine them (for example actual returns while the customer held the product and an assumed rate after they left) (RG 277.75–RG 277.76).

Actual: use actual product returns or interest data, the customer's payment method and actual credit interest rate, or the returns they would have received with compliant advice or service (RG 277.80).
Compounding: decide whether simple or compound interest applies, using the known compounding period and frequency where available. Where no actual data is available, use beneficial assumptions and at least compound interest; simple interest will rarely be appropriate when assumptions are used (RG 277.78–RG 277.79).
Prescribed rates: where a prescribed rate applies, ASIC treats its use as beneficial and reasonably justified. For example, Insurance Contracts Act 1984 s57 and reg 38 of the Insurance Contracts Regulations 2017 prescribe a rate reflecting the 10-year Australian Government bond rate plus 3%, payable on the amount of the claim from the day it became unreasonable for the insurer to withhold payment (Insurance Contracts Act 1984 s57(2); RG 277.84, Example 13).
Own assumptions: where no prescribed rate applies, use a rate that is beneficial and reasonably justified, considering the context of the failure, the remediation period, and internal data from the affected cohort and reputable external sources (RG 277.85).
RBA cash rate plus 6%: ASIC has said this rate is acceptable, particularly in financial advice or investment remediations where actual foregone returns cannot be calculated, and it may continue to be used if it is beneficial to customers and justified in the circumstances (RG 277.86). It is not an automatic default for every remediation.

Situation	[Organisation]'s default approach (confirm or replace)
Fee or charge wrongly deducted from an investment or superannuation account	Actual returns of the customer's investment option over the period (RG 277 Example 11); where unavailable, a beneficial assumed rate with a documented justification (for example RBA cash rate plus 6%, Examples 16–17).
Interest underpaid on deposits, customer has since left	Actual rate while the account was open; afterwards a beneficial benchmark (for example RBA retail deposit rate data plus a buffer of [1.5%], Example 14).
Fees or interest overcharged on a loan or credit card	Refund plus the interest the customer paid or would not have incurred on that amount, at the product's actual rate, compounded at the product's frequency.
Insurance claim wrongly declined or delayed	Claim paid with interest under Insurance Contracts Act 1984 s57 and reg 38 (RG 277.84, Example 13).
Premiums paid by credit card from another provider, rate unknown	Highest purchase rate reasonably available over the period (Example 12).
Advice remediation, actual returns cannot be determined	RBA cash rate plus 6%, calculated and compounded daily, if beneficial and justified (RG 277.86, Example 17).

Pre-determined rates for products or scenarios must be approved by [second line] and reviewed at least [annually] and before each use, so that they remain appropriate in the circumstances. ASIC's 2023 review of large financial institutions' remediation policies found pre-determined rates that were not clearly subject to adequate review and controls.

12. Communicating with customers

Plan communications early. The plan must ensure customers understand what happened, receive updates, understand the outcome and what it means for them, can easily follow any necessary action with support, and know how to complain about the outcome (RG 277.145–RG 277.146).
Choose timing, frequency and channels for the cohort; use several channels and plain language. Contact preferences must not restrict the channels used if a customer does not respond (RG 277.147 and note 2).
Staff who speak to customers are trained and quality assured. Material information given verbally is confirmed in writing within 10 business days (RG 277.148).
Calls to action are rare. Do not ask customers to provide evidence of loss where beneficial assumptions can be used instead (RG 277.150–RG 277.151).
Every outcome letter explains how the amount was calculated (or how to ask for details), whether assumptions were used, how to make a complaint through IDR, and that the customer can take the complaint to AFCA (RG 277.67, RG 277.176, RG 277.184).
Communications must not be misleading or deceptive (ASIC Act 2001 s12DA, s12DB; RG 277.277). Do not describe remediation as a goodwill gesture where it compensates for a failure.
Use ASIC's Making it right: How to run a consumer-centred remediation for detailed communication guidance (RG 277.149). Appendix D is the letter checklist.

13. Contacting customers and making payments

13.1 Reasonable endeavours

Apply reasonable endeavours, decided case by case, to contact and pay every affected customer (RG 277.153–RG 277.154). Reasonable endeavours are not: putting quick closure ahead of successful contact and payment; relying on one channel when others are available and the customer has not responded; or sending cheques without tracking whether they are cashed (RG 277.154).
A fixed number of contact attempts may be used as a minimum only. ASIC's 2023 review of large financial institutions' remediation policies found that prescriptive approaches, such as a predefined number of contact attempts, may be insufficient in some circumstances.
Improve contact and payment data early: recovery teams, matching data across [Organisation], reputable data providers, the representative or introducer, and external tracing specialists for larger amounts (RG 277.157).
Where a customer is legally represented, confirm the authority promptly and direct all communication to the representative (RG 277.253).

13.2 Payment methods

Pay automatically wherever possible: credit the customer's existing account, EFT, PayID or another reputable payment system (RG 277.167).
If [Organisation] holds current payment information, pay regardless of value, whether the customer is current or former (RG 277.160). Current customers are always paid, whatever the amount (Table 1 principle 5).
If no suitable account details are held, ask the customer to nominate an account (RG 277.168).
Cheques are not the default (unless the customer asks). Where used, track cashing rates and send reminders that offer a secure way to give bank details (RG 277.169–RG 277.170).

13.3 Particular circumstances (RG 277 Table 3)

Circumstance	Approach
Customer has died	Make reasonable endeavours to pay the estate. For former superannuation members, consider paying under the original death benefit decision (see section 16).
Customer may be bankrupt	Generally pay the individual; they may need legal advice about whether the bankruptcy trustee can claim it, and [Organisation] may support that advice.
Unsuitable loan or lease	Consider the best method: reducing the loan balance or paying the customer directly.
No instructions from a current client of a licensee with a client money account	The amount may be paid into the client money account under Pt 7.8 of the Corporations Act and held for the client pending instructions.
Trading accounts	Pay the customer directly (for example to their bank account), not into the trading account.
Deregistered company	The money may be forwarded to ASIC as unclaimed money (Corporations Act s601AD(1A), (2)); if it was in liquidation, consider s544.
Pooled investment vehicles	Apply RG 277 with RG 94; RG 94 prevails if they conflict.

13.4 Segmenting, triaging and tiered delivery

For larger or complex remediations, identify cohorts and deliver in tiers so that some customers are paid while others are still being scoped (RG 277.142–RG 277.144, RG 277.155). Prioritise cohorts experiencing vulnerability or hardship, and cohorts that are simplest to pay or have contact and payment details. Tiering must never be used to delay or reduce payments to harder cohorts.

14. Low-value amounts, unclaimed money and residual remediation payments

Money that cannot be returned to customers despite reasonable endeavours cannot be kept by [Organisation] (RG 277.188).

Situation	Requirement
Former customer owed $5 or less (after interest) with no current payment information	The amount may be allocated automatically to a residual remediation payment without applying reasonable endeavours (RG 277.161). It must not be applied where current payment information is held: those customers are paid (RG 277.160). ASIC's 2023 review found policies that could result in customers whose payment details were held not receiving payments under $5.
All other customers who cannot be paid after reasonable endeavours	Lodge the money in the relevant state, territory or Commonwealth unclaimed money regime, or make a residual remediation payment (RG 277.159, RG 277.162, RG 277.188). Check each regime's rules and minimum amounts (RG 277.191, RG 277.193).
Amounts below a regime's minimum (for example ADIs cannot lodge less than $500 under the Banking Act regime)	Pay as a residual remediation payment after reasonable endeavours (RG 277.193; Banking Act 1959 s69(3) and Banking Regulation 2016 s25).
Residual remediation payment	Made to an ACNC-registered charity or not-for-profit within 12 months of the remediation being finalised (RG 277.194). If possible the recipient has a connection to the harm and is not associated with [Organisation]; it is told why it is receiving the payment; and [Organisation] does not promote it as a charitable donation (RG 277.196). It should be small if reasonable endeavours were made (RG 277.194).
Pooled funds (superannuation fund or managed investment scheme)	Residual remediation payments cannot be made from trust or scheme property; surplus amounts are held for the benefit of members of the same fund or scheme (RG 277.163, RG 277.188 note 1, RG 277.195).
A customer comes forward later	Pay what they are owed, regardless of the extra cost to [Organisation] (RG 277.197).

Customers who do not respond are told, where relevant, that unpaid money will be lodged as unclaimed money or paid as a residual remediation payment, and that they remain entitled to claim it (RG 277.189).
Administrative costs of the remediation are paid by [Organisation], never from money owed to customers (RG 277.188 note 2).
Finance reconciles, at closure, the total calculated, paid, lodged as unclaimed money, and paid as residual remediation payments, so that no amount is retained.

15. Settlement deeds and releases

Settlement deeds are generally not required in a remediation, and consent to conditions is never assumed when a customer does not respond (RG 277.198).
A deed may be used only in limited circumstances, such as a legal duty or a PI insurance condition, and only if it is efficient, honest and fair (RG 277.200). Any deed must be limited to the specific failure, must not contain confidentiality or non-disparagement clauses, and must not restrict the customer from speaking to ASIC, other agencies, an adviser, a financial counsellor, a lawyer or AFCA (RG 277.201).
Take all reasonable steps to ensure the customer's right to have the outcome reviewed is not unreasonably restricted (RG 277.202).

16. Superannuation trustees

This section applies where [Organisation] is the trustee of a registrable superannuation entity. Remediation decisions, including the manner and extent of remediation, must be made in the context of all of the trustee's legal obligations, including the trust deed, general law duties, the efficiently, honestly and fairly obligation, and the covenants in Superannuation Industry (Supervision) Act 1993 (SIS Act) s52(2) (RG 277.288).

Best financial interests: document remediation decisions and be able to show they were in the best financial interests of members (SIS Act s52(2)(c)) and complied with other obligations (RG 277.290).
Pay into the member's account: generally allocate the remediation amount to the affected member's superannuation interest where it relates to that interest, complying with the prohibitions on early release of benefits (RG 277 Table 3).
Pension members: an amount that is a contribution or rollover cannot be added to the capital of an existing pension; consider allocating to an accumulation interest or other options set out in RG 277 Table 3, and the tax and contribution cap effects (RG 277.102).
Former members: where a member has left the fund, the trustee may transfer the amount to the ATO under s22 of the Superannuation (Unclaimed Money and Lost Members) Act 1999 if it reasonably believes this is in the person's best interests (s22(1)(b)). Where recent contact details are held, take reasonable steps to notify the former member at their last known address first so they can give other instructions (RG 277.165–RG 277.166; ASIC INFO 90).
Deceased former members: consider paying in line with the original death benefit decision, binding nomination, dependants or legal personal representative, having regard to the trust deed, SIS Act, SIS Regulations and tax (RG 277 Table 3).
Fees paid to third parties: take steps to recover fees paid to third parties (for example advisers) that did not provide the agreed service. Third-party licensees remediating a fund's members should pay the fund, not the member, and the trustee reinstates the member's account promptly (RG 277 Table 3; RG 277.291).
Source of compensation: the trustee must maintain financial resources to cover operational risk (SIS Act s52(8)(b); APRA SPS 114 Operational Risk Financial Requirement) (RG 277.286). Residual remediation payments cannot be made from trust property, and low-value amounts may be retained for the benefit of members of the same fund (RG 277.163, RG 277.195).
Tax: consider the tax consequences for members carefully, including contribution caps, and communicate them (RG 277.101–RG 277.103; Table 2 superannuation row).
Unit pricing errors: follow RG 94 (RG 277.136).
Records: keep trustee minutes and member reports for at least 10 years (SIS Act s103, s105; RG 277.298).

17. Complaints, IDR and AFCA

Remediation and IDR are different. In IDR, customers raise a problem; in remediation, [Organisation] finds the affected customers itself, whether or not they have complained (RG 277.175).

When a remediation is under way, most in-scope customers have not complained, so IDR does not apply to them. But any complaint about the failure, the remediation process (for example delays) or the outcome is an IDR complaint, and RG 271 timeframes apply (RG 277.177–RG 277.179).
Where a complex complaint cannot be resolved within the RG 271 maximum timeframe because the remediation methodology is not yet settled, give the customer a delay notification with the reasons, AFCA's details and their right to go to AFCA (RG 277.182).
Complaints about matters later included in a remediation are revisited: if the customer received less than the remediation would give, consider additional compensation (RG 277.183).
Customers must be told they can have their remediation outcome reviewed by AFCA after IDR (RG 277.184). AFCA will generally not refer a post-IDR remediation complaint back to [Organisation] (RG 277.186). Consider waiving monetary, time or other limits that could prevent AFCA considering the complaint (RG 277.187).
The complaints team and remediation team share information both ways so the remediation can be tested and adjusted (RG 277.180–RG 277.181). Complaints data is reviewed for systemic issues, as RG 271 requires.
AFCA may identify systemic issues and must give particulars of them to one or more of ASIC, APRA or the Commissioner of Taxation (Corporations Act s1052E(4); RG 277.242). [Organisation] remediates in line with this Policy however the issue was identified (RG 277.241).

18. Breach reporting, notify-investigate-remediate and other bodies

18.1 Reportable situations

Many remediations arise from reportable situations. Compliance assesses reportability under the RiskFA Compliance and Breach Reporting Policy and section 10 of the RiskFA Incident & Issues Management Standard (Corporations Act s912DAA; National Credit Act s50B: within 30 days).
A breach report must include details of any remediation that has been or is being developed, including expected timeframes, and [Organisation] notifies ASIC when the remediation is complete (RG 277.258, RG 277.308). ASIC may ask for regular updates (RG 277.259) or a written statement, which may need to be audited (RG 277.260).
An unjustifiably protracted or delayed remediation may indicate a breach of the general licensee obligations (RG 277 Table 1 principle 6; RG 277.206). Conduct during a remediation that breaches the efficiently, honestly and fairly obligation may itself be a reportable situation if it is significant (RG 277.305, referring to RG 78 Table 2).
Notifying ASIC does not mean ASIC has approved the remediation (RG 277.255(b)).

18.2 Notify, investigate and remediate (personal advice and mortgage broking)

Where [Organisation] or its representative provides or has provided personal advice to retail clients about relevant financial products (Corporations Act Pt 7.6 Div 3 Subdiv C), or is a mortgage broker providing credit assistance for residential mortgages (National Credit Act Pt 2-2 Div 5 Subdiv C), and there are reasonable grounds to believe a reportable situation has arisen (a significant breach of a core obligation, or gross negligence or serious fraud), and reasonable grounds to suspect the client has suffered or will suffer loss they have a legally enforceable right to recover from [Organisation]:

Obligation	Timeframe	Source
Take reasonable steps to notify the affected client in writing of the reportable situation (in any ASIC-approved form)	Within 30 days after first knowing of, or being reckless about, the circumstances	Corporations Act s912EA(1)–(2); National Credit Act s51A
Start an investigation: identify the conduct and quantify the loss	Commence within 30 days; complete as soon as reasonably practicable	s912EB(1)–(4); National Credit Act s51B
Take reasonable steps to notify the client in writing of the investigation outcome	Within 10 days after completing the investigation	s912EB(5)
Take reasonable steps to pay the client an amount equal to the loss or damage	Within 30 days after completing the investigation	s912EB(8)
Keep records sufficient to show compliance	Ongoing (failure is an offence)	s912EC; National Credit Act s51C

Contraventions of s912EA(1) and s912EB(1), (5) and (8) are civil penalty provisions (s912EA(5), s912EB(9)).
These obligations build on, and do not replace, this Policy. If a client falls outside them at any stage, RG 277 still applies (RG 277.313–RG 277.314). Reasonable endeavours to pay may need to continue beyond the 30 days (RG 277.156).
Nothing in s912EB affects the client's right to recover loss, including through IDR or AFCA (s912EB(10); RG 277.202 note).

18.3 APRA, PI insurers and others

APRA-regulated entities assess APRA breach reporting obligations under the Incident & Issues Management Standard. APRA will generally refer breaches involving financial loss to members, policyholders or depositors to ASIC, and the two regulators may coordinate supervision of a remediation (RG 277.247–RG 277.249).
Engage the PI insurer early, to understand cover and whether it wants to review the methodology or communications, so that cover is not prejudiced (RG 277.251–RG 277.252). PI requirements must never reduce what customers are owed.
[Organisation] maintains the compensation arrangements required by Corporations Act s912B or National Credit Act s48, generally PI insurance that is adequate for the nature of the business and its potential liability for compensation claims, unless an exemption applies (RG 277.284–RG 277.285).

19. Governance, resourcing and independent assurance

19.1 Resources and capability

Allocate adequate resources promptly: money, people with the right skills and seniority, record-keeping systems and data infrastructure (RG 277.203–RG 277.204). Inadequate resources may breach Corporations Act s912A(1)(d) or National Credit Act s47(1)(l) (RG 277.205).
Train people leading remediations in RG 277, Making it right, relevant consumer laws, AFCA's approach, applicable industry codes, this Policy and IDR requirements (RG 277.207). Draw on data, behavioural insights and design expertise (RG 277.208).
Build in-house capability where possible (RG 277.219).

19.2 Oversight and accountability

Document governance arrangements and roles for each remediation and make them accessible internally (RG 277.211).
Record and report outcomes for all remediations, including small ones (RG 277.212).
Large remediations are overseen by a senior person who receives regular, direct reporting; for incorporated businesses this may include reporting to the Board or appointing a director or senior executive as responsible (RG 277.213).
Oversight may also come from an internal person removed from the remediation, such as Internal Audit or Compliance; no one oversees their own work (RG 277.214). Oversight activities include testing the design and assumptions, reviewing files, checking operational effectiveness, resourcing, data governance and a compliance attestation that the remediation was conducted consistently with RG 277 (RG 277.215).
Groups with several brands under one licence have a centralised remediation governance framework with independent oversight and regular Board reporting (RG 277.216).
Governance must include an explicit fairness test at each key decision. ASIC's 2023 review of large financial institutions' remediation policies found a general lack of focus on fairness in governance frameworks.

19.3 Conflicts of interest

Staff or providers involved in the failure must not take part in, or be able to influence, the remediation (including file reviewers, peer reviewers, decision makers and those providing oversight). Conflicts that cannot be avoided are documented and controlled or disclosed (Corporations Act s912A(1)(aa); RG 277.227–RG 277.228; RG 181).

19.4 Outsourcing

[Organisation] remains responsible for any outsourced part of a remediation. It must choose providers with due care, make sure they understand IDR triggers under RG 271, use service level agreements that reflect RG 277 and Making it right, monitor performance, and act on failures, including breach reporting (RG 277.217–RG 277.218).

19.5 Independent expert assurance

Consider engaging an independent expert for: large or complex remediations; where assumptions may materially affect scope or compensation; where it is part of an enforceable undertaking or licence condition; where public reporting is appropriate; where no one internal is sufficiently independent; or where ASIC, APRA or AFCA asks (RG 277.221). The expert is usually retained directly by [Organisation], must be and remain genuinely independent and objective, and must manage conflicts arising from the appointment (RG 277.223–RG 277.224, RG 277.229). Have regard to RG 100, RG 111 and RG 112 (RG 277.225–RG 277.226).

Typical trigger for [Organisation]: an independent expert is considered for every remediation program rated High or Critical, or above [$5 million] or [10,000] customers. This is a good-practice threshold, not an RG 277 requirement.

20. Reporting, measures and public disclosure

Second line reports remediation to the executive [monthly] and the Board Risk Committee [quarterly]. Board reports focus on customer outcomes, timeliness and accountability. Reports cover at least:

open remediations by rating, business unit and age, with customers affected and amounts estimated, paid and outstanding;
progress against plan, including original and current target dates;
methodology decisions and assumptions approved, and any changes to them;
payment success rates, uncashed cheques, unclaimed money lodgements and residual remediation payments;
complaints and AFCA matters about remediations;
regulatory notifications and engagement; and
root causes, repeat failures and whether the underlying issues are fixed.

Measure	Typical target
Remediation decision recorded within [10 business days] of the date identified	≥ [95%]
Affected customers paid automatically, without action by them	≥ [90%]
Payment success rate (by value and number) at closure	≥ [95%]
Remediation programs open more than 12 months	[0] (consistent with the Incident & Issues Management Standard)
Notify-investigate-remediate deadlines met (where applicable)	[100%]
Remediation complaints upheld at IDR or AFCA	Trending down
Residual remediation payments made within 12 months of finalisation	[100%]

These targets are common industry practice, not regulatory requirements. Set your own in line with your risk appetite.

[Organisation] considers public reporting (for example prominent disclosure on its website) for large remediations and those following public reports of loss or misconduct, and complies with its continuous disclosure and financial reporting obligations (RG 277.233). ASIC may publish details of remediations it monitors (RG 277.235, RG 277.266).

21. Records and closure

21.1 Records

Document the methodology and process, tracking key steps and decision milestones (RG 277.230), in the [remediation register / GRC system] (Appendix C) and the methodology decision log (Appendix B).
Records must allow [Organisation] to track outcomes, justify decisions, report to senior staff and ASIC, demonstrate compliance and learn after closure, and help IDR and AFCA review individual outcomes (RG 277.231–RG 277.232).
Keep remediation records for at least [7 years] after closure, or longer where required by law (10 years for SIS Act s103 and s105 records).
Outsourced or representative-held records remain [Organisation]'s responsibility and must be readily accessible (RG 277.299).

21.2 Closing a remediation

A remediation is closed only when the [Remediation owner] and second line confirm that:

all in-scope customers have been paid or provided the remedy, or reasonable endeavours have been exhausted and recorded;
unpaid amounts have been lodged as unclaimed money or paid as residual remediation payments (or are scheduled within 12 months), and the reconciliation shows no amount retained by [Organisation];
regulators have been updated as required, including notice to ASIC that a reported remediation is complete;
the root cause has been fixed and the related issue closed as complete and effective under the Incident & Issues Management Standard;
for programs, an oversight or independent assurance report (if required) has been received and actions closed; and
lessons learned are recorded and shared, and a process exists for customers who come forward after closure (RG 277.59(b)).

RiskFA Incident & Issues Management Standard (sections 10, 12 and 13) and RiskFA Risk Management Framework
the RiskFA Complaints Handling Policy, the RiskFA Compliance and Breach Reporting Policy, [Hardship and Vulnerable Customers Policy]
[Record Keeping and Data Retention Policy], [Privacy Policy], [Conflicts of Interest Policy], [Outsourcing / Third Party Risk Policy]
RiskFA Whistleblower Policy
ASIC: RG 277 Consumer remediation; Making it right: How to run a consumer-centred remediation; RG 78 Breach reporting by AFS licensees and credit licensees; RG 271 Internal dispute resolution; RG 94 Unit pricing: Guide to good practice; INFO 232 Fees for no service: Remediation; INFO 259 Complying with the notify, investigate and remediate obligations; RG 100, RG 111, RG 112, RG 181
Legislation: Corporations Act 2001 ss912A, 912B, 912DAA, 912EA–912EC; National Consumer Credit Protection Act 2009 ss47, 48, 50B, 51A–51C; ASIC Act 2001 ss12CA–12DB; SIS Act 1993 s52; Insurance Contracts Act 1984 s57; Financial Accountability Regime Act 2023

Appendix A. Remediation program plan template

Section	Content
1. Summary	What went wrong, in plain language; incident and issue IDs; rating.
2. Ownership and governance	Remediation owner, manager, steering committee, second line reviewer, customer advocate, independent expert (if any), FAR accountable person; approval path.
3. Root cause and extent	Root cause(s); extent of condition across products, brands, channels, representatives, providers and periods; how the cause has been fixed.
4. Scope	Products, customers and cohorts; review period start date and the evidence for it (date failure first reasonably suspected to have caused loss); exclusions and reasons.
5. Outcome	Monetary and non-monetary remedies; indirect and non-financial loss; foregone returns or interest method and rate; tax treatment; assistance offered.
6. Methodology	Data analysis, file reviews and beneficial assumptions; reference to the methodology decision log (Appendix B); testing and peer review.
7. Cohorts and tiers	Cohorts, priority order (vulnerable and hardship first), and planned delivery dates by tier.
8. Communications	Channels, letters (Appendix D), call scripts, contact centre support, calls to action (if unavoidable) and how complaints are handled.
9. Contact and payment	Data enhancement, reasonable endeavours steps by value band, payment methods, cheque tracking, unclaimed money and residual payment approach.
10. Regulatory	Breach report reference; notify-investigate-remediate deadlines (if applicable); ASIC, APRA, AFCA, ATO and PI insurer engagement.
11. Resourcing and budget	People, systems, provision and the cost of the remediation itself (paid by [Organisation]).
12. Timeline and milestones	Key dates with original and current targets.
13. Reporting	What is reported, to whom and how often.
14. Assurance and closure	Oversight testing, attestation, independent assurance, closure criteria and reconciliation.

Appendix B. Methodology decision log

Record every decision that affects which customers are included or how much they receive. Each entry is approved before it is applied.

Field	What to record
Decision ID and date	Unique reference; date proposed and date approved.
Decision area	Scope, review period, cohort, loss calculation, foregone returns or interest rate, assumption, threshold, payment method, communication, or closure.
Options considered	Each option and its effect on customers (numbers and amounts).
Decision and rationale	The option chosen and why it best returns customers to their position.
Evidence	Internal data, samples, external data sources and analysis relied on (RG 277.137).
Beneficial assumption test	Why the assumption minimises the risk of customers falling out of scope or being under-compensated; check against the RG 277.125 warning signs.
Fairness check	Would a reasonable customer think this is fair? Does it favour [Organisation] commercially?
Legal and other duties	Trust deed, SIS Act, RG 94, PI insurance or other constraints considered.
Approver	Name and role, in line with the approval path; second line reviewer.
Monitoring trigger	What new information would cause the decision to be revisited (RG 277.140), and the date of the last review.

Appendix C. Remediation register fields

Field	Individual	Standard and programs
Remediation ID, title and linked incident and issue IDs	✓	✓
Business unit, product, channel and service provider	✓	✓
Source of identification	✓	✓
Date identified, remediation decision date, date initiated	✓	✓
Remediation owner and manager	✓	✓
Rating and scale (individual, standard, program)	✓	✓
Root cause and extent of condition	✓	✓
Review period start and end, and evidence for the start date	✓	✓
Customers in scope (current, former, vulnerable), by cohort	✓	✓
Estimated, calculated and paid amounts (principal, foregone returns or interest, indirect loss)	✓	✓
Methodology and decision log references	Summary	✓
Communications sent and dates	✓	✓
Payment method, success rate, uncashed cheques	✓	✓
Unclaimed money lodged; residual remediation payments (recipient, amount, date)	✓	✓
Complaints and AFCA matters linked to the remediation	✓	✓
Regulatory notifications (breach report, notify-investigate-remediate dates)	If applicable	✓
Original and current target completion dates; extensions	✓	✓
Independent expert or oversight review and attestation	Not usually	✓ (programs)
Closure date, approver and reconciliation	✓	✓
Lessons learned	✓	✓

Appendix D. Customer letter checklist

Plain-language subject line that says the letter is about money or a correction owed to the customer.
What happened, when, and that it was [Organisation]'s error; an apology.
Whether the customer needs to do anything. If not, say so clearly. If action is unavoidable, make it simple, with a deadline only where essential and support offered.
The amount, broken into components (for example refund, interest or returns, indirect loss) and the periods they relate to.
How the amount was calculated, whether assumptions were used, and how to ask for more detail or provide information about other losses (RG 277.67, RG 277.119).
How and when the payment will be made (for example credited to their account on [date]).
Possible tax consequences and a suggestion to seek advice; any support offered for advice costs (RG 277.101).
For superannuation: where the amount has been credited and any contribution cap or pension effects.
If the customer does not respond (where action is needed): what will happen to the money (unclaimed money or residual remediation payment) and that they can still claim it (RG 277.189).
How to make a complaint through IDR, and that they can take it to AFCA, with AFCA's contact details (RG 277.176, RG 277.184).
Contact details, interpreter and accessibility services, and support for customers experiencing vulnerability.
No release, confidentiality or non-disparagement condition, and no statement that the payment is a goodwill gesture.
Material verbal information confirmed in writing within 10 business days (RG 277.148).
Reviewed by Legal or Compliance and tested with customers where practicable (Making it right).