ASIC issues warning on breach reporting

Australian financial services licensees must submit written breach reports to the corporate regulator within 10 business days of detecting a breach or likely breach, the Australian Securities and Investments Commission (ASIC) said.

ASIC Deputy chairman Peter Kell stressed that licensees should not wait until after it has carried out an investigation to check whether the breach is significant to inform ASIC about the breach.

In a speech to the Risk Management Association Australia Chief Risk Officers Forum, Kell said ASIC is focusing on this issue after recent problems with breach reporting.

"We have seen instances where efforts to rectify a breach, even if well intentioned, have taken so long that they have compromised ASIC's ability to investigate and take action once the incident was finally reported," Kell said.

VIEW ALL

View all

"This is a highly undesirable outcome for both the regulator and the financial services sector."

Kell said licensees should inform ASIC when it discovers a breach that has already occurred, or discovers a likely breach, where it finds out it will not be able to comply with an obligation before the breach has actually occurred.

Licensees should not wait until its board of directors or legal advisers have mulled over the breach, or taken measures to fix the breach, before reporting it to ASIC.

They should also have robust internal systems to ensure those responsible for compliance become aware of the breaches in a timely way, Kell said.