The latest annual compliance survey from law firm Holley Nethercote has found licensees are reducing their spending on compliance this year.
The survey, which questioned over 200 AFSLs and Australian credit licensees, found 40 per cent said they are spending less than $100,000 on internal compliance staff. This is up from 29 per cent in last year’s survey.
Unsurprisingly, the lower spend was greatest at firms with 1–5 representatives, with 85 per cent of firms spending less than $100,000. Holley Nethercote noted this compared to 63 per cent last year.
On the other hand, no licensees with 51–100 or more than 100 representatives spent less than $100,000 on internal compliance.
Internal spending – less than $100,000
Source: Holley Nethercote, May 2025
For external compliance, the spend has fallen even further, with over half of respondents (57 per cent) spending less than $50,000 per year. This is compared to 39 per cent in 2024.
The external spend saw little variation between firm size with around two-thirds of firms of 1–5, 6–15 and 16–50 advisers each all spending less than $50,000. For larger firms with more than 100 advisers, 31 per cent had managed to reduce their external compliance to less than $50,000 compared to none in the previous year.
External spending – less than $50,000
Source: Holley Nethercote, May 2025
“While this decrease in spending is likely a reflection of less regulatory change during the period, we expect this trend to reverse in the next 18 months, as a tsunami of regulatory reforms wash over corporate Australia, relating to AML/CTF, Privacy, Delivering Better Financial Outcomes, and Digital Assets,” Holley Nethercote managing partner, Paul Derham, said.
Overall, cyber security was the number one compliance concern for licensees reflecting the speed that new threats are emerging, the firm said.
Earlier this year, Insignia and multiple superannuation funds were subjected to a targeted cyber security attack. In a statement at the time, Insignia confirmed the incident affected around 100 Expand accounts and said there had been no financial impact to its members.
It described the incident as conducted by a “malicious third-party” which involved “credential stuffing” where an unusual number of login attempts targeted the platform.
ASIC has also identified cyber security failures by licensees as a major enforcement priority this year.
Research by Adviser Ratings earlier this year echoed this, finding advisers are increasing investment in material compliance enhancements – including cyber security – by a substantial 31 per cent. This includes strengthening existing systems, enhancing staff training, developing and testing incident response plans and appropriate cyber insurance coverage.
