AFSLs warned on offshore usage amid potential client risks

ASIC has warned financial advice licensees (AFSLs) to exercise caution when seeking offshore services, despite their affordability.

The corporate regulator’s call follows a review of 10 advice licensees that used offshore service providers (OSPs) and found weaknesses that could be exposing consumers and investors to potential harm.

OSPs included financial planning assistants, administrative support, paraplanning services, document support, and client communications.

ASIC also surveyed six OSP businesses that reported having a combined total of over 1,000 AFSLs or representatives as clients.

Key risks that ASIC said it was concerned about included confidentiality of client information, data and technology problems, risks around detection and management of a data breach, operational disruption, and loss of control of offshore people and processes.

The review, according to ASIC, found financial advice licensees and responsible entities (REs) have risk management arrangements that “varied significantly” in terms of assessing the quality of offshore services, with some lacking any framework at all and others failing to conduct any audits.

Most of the advice licensees reviewed had inadequate arrangements in place for the assessment, appointment, and ongoing monitoring of offshore outsourced services used by their representatives.

It urged advice licensees that outsource functions to:

• Have measures in place to ensure that due skill and care are taken in choosing suitable service providers.
• Monitor the ongoing performance of service providers.
• Appropriately deal with any actions by service providers that breach service level agreements or the licensee’s general obligations.

According to ASIC commissioner Alan Kirkland, AFSLs are ultimately responsible for the operation of their businesses, including when outsourcing to offshore providers, whether directly or through an intermediary.

“Advice licensees and REs can outsource services but they cannot outsource their fundamental obligations,” Kirkland said in a statement.

“When licensees neglect their responsibilities, consumers, investors, and financial services businesses can be exposed to harm, such as exposure of personal information through cyber incidents.”

The commissioner also said that AFSLs need to have the skills to independently identify risks and assess an OSP’s performance and ongoing suitability.

“The more critical the outsourced function, the greater the risks to consumers and investors,” Kirkland said.

“The risks can be exacerbated when outsourced functions are not supervised adequately, particularly if they are outsourced internationally.”

Advice practices, especially smaller ones, are often reliant on OSP services to cover operational matters like cyber security, with outsourcing becoming more essential due to the rising costs of running practices.  

“While outsourcing has traditionally been a trend only seen in large corporations, it has become a lifeline for small to medium-sized businesses looking to improve efficiency,” said Brian Jones, CEO of VAP.

Speaking with Money Management’s sister brand ifa, Fraser Jack, founder of The Cyber Collective, said: “If you don’t have things in place and they go wrong, it’s going to cost you 10 to 100 times more to fix than it would to protect.”

Kirkland echoed this sentiment: “Financial services firms cannot drop their guard. Cyber-attacks, for example, are more prevalent and growing in sophistication.

“All licensees must proactively review governance frameworks and address issues that threaten to undermine public confidence in their business and in turn, the financial system.”

ASIC said it will continue to monitor the governance and risk management frameworks within financial services entities, stating they will hold them to account “where necessary” when failures occur. They cited their enforcement actions against FIIG Securities and Fortnum Private Wealth as examples.