ASIC Corporations and Credit (Amendment) Instrument 2025/289

Explanatory Statement

ASIC Corporations and Credit (Amendment) Instrument 2025/289

This is the Explanatory Statement for ASIC Corporations and Credit (Amendment) Instrument 2025/289.

The Explanatory Statement is approved by the Australian Securities and Investments Commission (ASIC).

Summary

1.              ASIC Corporations and Credit (Amendment) Instrument 2025/289 (the Amending Instrument) amends ASIC Corporations and Credit (Breach Reporting–Reportable Situations) Instrument 2024/620 (the Principal Instrument) to:

(a) expand the types of reportable situations that are exempt from being reported to ASIC;

(b) extend the allowable length of an investigation before it must be reported to ASIC from 30 days to 60 days; and

(c) clarify the requirements for entities that report to APRA.

Purpose of the instrument

1.              The Principal Instrument was made in response to concerns that deemed reportable situations (i.e. reportable situations that are automatically reportable) led to a large volume of breaches being reported to ASIC that have limited intelligence value.
2.              The operation of section 912D of the Corporations Act and section 50A of the Credit Act mean that any breach of the prohibitions on misleading and deceptive conduct or false and misleading representations in subsection 1041H(1) of the Corporations Act and subsections 12DA(1) and 12DB(1) of the Australian Securities and Investment Commissions Act 2001 (the MDC provisions) are deemed to be a ‘significant’ breach of a ‘core obligation’. 
3.              The Principal Instrument operates to exempt licensees from reporting breaches of the MDC provisions that are one reportable situation, impact one consumer or involve a relevant product that is jointly held and impacts the holders of that product, cause no financial loss or damage, or likely financial loss or damage, and are not otherwise a reportable situation.

Further exemptions for breaches not deemed to be significant

1.              ASIC notes that, even with the exemptions currently provided through the Principal Instrument, there are still some reports of breaches to ASIC that have limited intelligence value.
2.              The Amending Instrument inserts further notional subsections to provide additional relief from reporting breaches of the MDC provisions and certain contraventions of civil penalty provisions (CPP) where:

(a) the breach has been completely rectified within 60 days from when it first occurred (this includes paying any necessary remediation), and

(b) the number of impacted consumers does not exceed 10,

(c) total loss across all impacted consumers (including where the loss has been remediated) does not exceed $1000, and

(d)     the breach is not a contravention of the client money reporting rules and clearing and settlement rules.

1.              The relief strikes a balance between reducing the reporting burden on licensees, while upholding the objectives of the reportable situations regime.
2.              The requirement that the breach is rectified (including any necessary remediation) within 30 days from when it first occurred (i.e. from the first instance) encourages licensees to have good internal systems that quickly detect and rectify problems (including paying any necessary remediation). Regulatory Guide 78 Breach reporting by AFS licensees and credit licensees (RG 78) and the prescribed form, available from the ASIC Regulatory Portal provide guidance on ways licensees may rectify the root cause or causes of a breach (e.g. process change or staff training).
3.              Breaches covered by the relief may still be reportable under other circumstances in section 912D of the Corporations Act and section 50A of the National Credit Act. For example, these breaches may satisfy the ‘significance test’ regarding the number and frequency of similar breaches under section 912D(5)(a) of the Corporations Act and section 50A(5)(a) of the National Credit Act.

Ongoing investigations

1.          Section 912A(1)(c) provides that, where a licensee conducts an investigation into whether there is a reportable situation and the investigation continues for more than 30 days, the investigation is a reportable situation that must be reported to ASIC.
2.          We are giving relief so that only investigations ongoing for more than 60 days, instead of 30 days, are reportable to ASIC. This relief will reduce the reporting burden on industry so that if an investigation is completed within 60 days and no reportable situation is identified, a report does not have to be submitted.

Reports to APRA

1.          A small number of reportable situations that must be reported to ASIC are also breaches that must be reported to APRA by APRA-regulated institutions.
2.          To reduce the reporting burden on licensees, s912DAA(5) of the Corporations Act and s50B(6) of the National Credit Act states that a report is taken to be lodged with ASIC if the licensee has given a report to APRA that contains all of the information that is required under s912DAA(5) of the Corporations Act and s50B(6) of the National Credit Act section in relation to the reportable situation. The prescribed form available in ASIC’s Regulatory Portal is designed so as to address this required information.
3.          Where a licensee reports a breach to APRA that must also be reported to ASIC, APRA’s form asks the licensee to complete an additional form which, through a number of specific questions, requires the licensee to provide information about a number of topics that align with (but are not exactly the same as) the information collected via ASIC’s Regulatory Portal.
4.          The Amending Instrument clarifies that the information provided by a licensee to APRA in the form required by APRA is sufficient for the purposes of s912DAA(5) and s50B(6) and that licensees do not need to submit a separate report to ASIC.
5.          The Amending Instrument does not preclude licensees from submitting a separate report via ASIC’s portal, for example, if they wish to track all their reportable situations within the ASIC portal.

Consultation

1.          Before making the Amending Instrument, ASIC consulted publicly (in CS 16 Reportable situations – additional relief) on the proposal to provide additional relief. We received 13 submissions. Industry broadly welcomed the relief.
2.          We also undertook targeted consultation with the ASIC Simplification Consultative Group.
3.          Issues raised in consultation included:

(a) Not all conditions under the criteria should have to be met for relief to apply (e.g. relief should apply to any breach rectified within 30 days regardless of the impact on consumers or financial impact). We did not accept these submissions, as it is important that certain breaches are reported even if they have been rectified.

(b) Changing the rectification period to start from the time the licensee becomes aware of the breach, rather than when the breach occurred. We did not accept these submissions, because it is important that licensees have processes in place to identify breaches quickly. However, we did increase the time allowed for rectification to 60 days to account for situations where breaches may be discovered through a monthly audit, with some additional time allowed to then rectify the breach.

(c) Adjustments to the existing criteria (e.g. increasing the threshold for number of impacted consumers and total financial loss, or increasing the time allowed for rectification). In response to these submissions, we broadened the types of reports that are exempt by also increasing the number of impacted consumers from 5 to 10, and increasing the total financial loss or damage to consumers from $500 to $1000.

(d) Increasing the allowable length of time for a licensee to investigate whether a reportable situation has occurred before the investigation must be reported to ASIC. In response, we decided to also give relief so that only investigations ongoing for more than 60 days, instead of 30 days, are reportable to ASIC. This relief will reduce the reporting burden on industry so that if an investigation is completed within 60 days and no reportable situation is identified, a report does not have to be submitted, while still incentivising licensees to undertake timely investigations.

(e)     Three individual consumers were opposed to any additional relief on the basis that some licensees still engage in misconduct.

1.          ASIC also undertook targeted consultation on our proposal to align the requirements for reporting to both APRA and ASIC. We received two submissions. Both submissions generally agreed with our proposal, subject to minor technical changes, some of which we have adopted.

Operation of the instrument

1.          Items 1-8 of Schedule 1 retain the modified significance thresholds under the Principal Instrument for breaches of the MDC provisions, and insert further notional subsections to provide additional relief from reporting certain breaches of the MDC provisions and certain contraventions of CPPs where:

(a) the breach has been completely rectified within 60 days from when it first occurred (this includes paying any necessary remediation), and

(b) the number of impacted consumers does not exceed 10, and

(c) total loss across all impacted consumers (including where the loss has been remediated) does not exceed $1000, and

(d)     the breach is not a contravention of the client money reporting rules and clearing and settlement rules.

1.          The additional relief is only available where there is a single reportable situation or single group of reportable situations. A single group of reportable situations arises where the reportable situations involve the same or substantially similar conduct (other than the identity of the consumer and the date of the conduct) and occur within 60 days of the first reportable situation. Similar conduct means conduct involving the same or very similar factual circumstances (e.g. similar representations made about the same type of product(s) and/or service(s)).
2.          Item 9 of Schedule 1 inserts a new section 6A in the Principal Instrument to change the allowable length of an investigation before it must be reported to ASIC from 30 days to 60 days.
3.          Item 10 of Schedule 1 insets a new section 7A in the Principal Instrument to clarify that the information provided by a licensee to APRA in the form required by APRA is sufficient for the purposes of s912DAA(5) and s50B(6) and that licensees do not need to submit a separate report to ASIC.

Legislative instrument and primary legislation 

1.          The subject matter and policy implemented by the Instrument is more appropriate for a legislative instrument rather than primary legislation because the Instrument amends and repeals the principal instruments, which are themselves legislative instruments.

Duration of the instrument

1.          The duration of the Amending Instrument aligns with the duration of the Principal Instrument.

Legislative authority

1.          The Instrument is made under subsection 926A(2) of the Act and subsection 109(3) of the Credit Act.
2.          The Instrument is a disallowable legislative instrument.

Statement of Compatibility with Human Rights 

1.          The Explanatory Statement for a disallowable legislative instrument must contain a Statement of Compatibility with Human Rights under subsection 9(1) of the Human Rights (Parliamentary Scrutiny) Act 2011. A Statement of Compatibility with Human Rights is in the Attachment.

Attachment

Statement of Compatibility with Human Rights

This Statement of Compatibility with Human Rights is prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.  

ASIC Corporations and Credit (Amendment) Instrument 2025/289

Overview

1. ASIC Corporations and Credit (Amendment) Instrument 2025/289 amends ASIC Corporations and Credit (Breach Reporting–Reportable Situations) Instrument 2024/620 to:

(a) expand the types of reportable situations that are exempt from being reported to ASIC;

(b) extend the allowable length of an investigation before it must be reported to ASIC from 30 days to 60 days; and

(b) clarify the requirements for entities that report to APRA.

Assessment of human rights implications

2. This instrument does not engage any of the applicable rights or freedoms.  

Conclusion

3. This instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.