ASIC Corporations and Credit (Breach Reporting—Reportable Situations) Instrument 2024/620

ASIC Corporations and Credit (Breach Reporting—Reportable Situations) Instrument 2024/620

made under subsection 926A(2) of the Corporations Act 2001 and subsection 109(3) of the National Consumer Credit Protection Act 2009

Compilation No. 2 

Compilation date: 12/09/2025

Includes amendments up to: F2025L01084

About this compilation

This compilation

This is a compilation of the ASIC Corporations and Credit (Breach Reporting—Reportable Situations) Instrument 2024/620 that shows the text of the law as amended and in force on 12/09/2025 (the compilation date).

The notes at the end of this compilation (the endnotes) include information about amending laws and the amendment history of provisions of the compiled law.

Uncommenced amendments

The effect of uncommenced amendments is not shown in the text of the compiled law. Any uncommenced amendments affecting the law are accessible on the Register (www.legislation.gov.au). The details of amendments made up to, but not commenced at, the compilation date are underlined in the endnotes. For more information on any uncommenced amendments, see the Register for the compiled law.

Application, saving and transitional provisions for provisions and amendments

If the operation of a provision or amendment of the compiled law is affected by an application, saving or transitional provision that is not included in this compilation, details are included in the endnotes.

Modifications

If the compiled law is modified by another law, the compiled law operates as modified but the modification does not amend the text of the law. Accordingly, this compilation does not show the text of the compiled law as modified. For more information on any modifications, see the Register for the compiled law.

Self‑repealing provisions

If a provision of the compiled law has been repealed in accordance with a provision of the law, details are included in the endnotes.

Contents

Part 1—Preliminary

1 Name of legislative instrument

3 Authority

4 Definitions

Part 2—Declaration

5 Reportable Situations

6 Insignificant contraventions of core obligations

6A  Ongoing investigations

7 Reporting period for additional reportable situations

7A Reports submitted to APRA

8 Core obligations

9  Repeal

Endnotes

Endnote 1—About the endnotes

Endnote 2—Abbreviation key

Endnote 3—Legislation history

Endnote 4—Amendment history

Part 1—Preliminary

1 Name of legislative instrument

This is the ASIC Corporations and Credit (Breach Reporting—Reportable Situations) Instrument 2024/620.

3 Authority

This instrument is made under subsection 926A(2) of the Corporations Act 2001 and subsection 109(3) of the National Consumer Credit Protection Act 2009.

4 Definitions

In this instrument:

Australian credit licence has the same meaning as in section 5 of the Credit Act.

Corporations Act means the Corporations Act 2001.

Credit Act means the National Consumer Credit Protection Act 2009.

credit licensee means a person who holds an Australian credit licence.

financial services licensee has the same meaning as in section 9 of the Corporations Act.

Part 2—Declaration

5 Reportable Situations

(1) Part 7.6 of the Corporations Act (other than Divisions 4 and 8) applies in relation to financial service licensees as if section 912D were modified or varied by omitting paragraph 912D(4)(b) and substituting:

“(b) the breach is constituted by the contravention of a civil penalty provision under any law, other than:

(i) a civil penalty provision prescribed by the regulations for the purposes of this paragraph; or

(ii) subsection 912A(5A) to the extent that the contravention results from a contravention of subparagraph 912A(1)(g)(ia) as notionally inserted by ASIC Corporations, Credit and Superannuation (Internal Dispute Resolution) Instrument 2020/98; or”.

(2) The provisions to which Part 2-6 of the Credit Act applies apply in relation to credit licensees as if subsection 50A were modified or varied by omitting paragraph 50A(4)(b) and substituting:

“(b) the breach is constituted by the contravention of a civil penalty provision under any law, other than:

(i) a civil penalty provision prescribed by the regulations for the purposes of this paragraph; or

(ii) subsection 47(4) to the extent the contravention results from a contravention of subparagraph 47(1)(h)(ii) as notionally substituted by ASIC Corporations, Credit and Superannuation (Internal Dispute Resolution) Instrument 2020/98.”.

6 Insignificant contraventions of core obligations

(1)  Part 7.6 of the Corporations Act (other than Divisions 4 and 8) applies in relation to financial service licensees as if section 912D were modified or varied by:

(a) in subsection 912D(4), omitting “For the purposes” and substituting “Subject to subsections (4A) and (4AA), for the purposes”; and

(b) after subsection 912D(4), inserting:

“(4A) A breach of a core obligation constituted by a contravention of subsection 1041H(1) of this Act or subsection 12DA(1) or 12DB(1) of the ASIC Act is not taken to be significant if:

(a) but for this subsection, the underlying circumstances in relation to the breach:

(i) would only give rise, and would only be likely to give rise, to a single reportable situation as a result of the following:

(A) paragraph (4)(b) in so far as it relates to a contravention of subsection 12DB(1) of the ASIC Act;

(B) paragraph (4)(c); and

(ii) would not give rise, and would be unlikely to give rise, to a reportable situation other than as specified in subparagraph (i); and

(b) either:

(i) only one person (client) is, or is likely to be impacted by the contravention; or

(ii) if the contravention relates to a financial product that is, or that is proposed to be, held by more than one person (each a client) jointly, those clients are the only persons who are, or are likely to be, impacted by the contravention; and

(c) the contravention has not resulted in, and is unlikely to result in, any financial loss or damage to any person (for the purposes of this paragraph, financial loss or damage is to be taken into account regardless of whether it is, or will or may be, remediated).

(4AA) A breach of a core obligation is also not taken to be significant if:

(a) but for this subsection, the underlying circumstances in relation to the breach:

(i) would only give rise, and would only be likely to give rise, to a single reportable situation or a single group of reportable situations as a result of paragraphs (4)(b) and (c); and

(ii) would not give rise, and would be unlikely to give rise, to a reportable situation other than as specified in subparagraph (i); and

(b) the underlying circumstances in relation to the breach do not constitute a contravention of section 828C or 981M; and

(c) there are no more than 10 persons (clients) who are, or are likely to be, impacted by the single reportable situation or single group of reportable situations (where a breach relates to a financial product that is, or that is proposed to be, held by more than one person jointly, those persons are to be treated as a single client for the purposes of this paragraph); and

(d) the total financial loss or damage to all persons resulting from, or likely to result from, the single reportable situation or single group of reportable situations does not exceed $1,000 (for the purposes of this paragraph, financial loss or damage is to be taken into account regardless of whether it is, or will or may be, remediated); and

(e) the breach has been rectified (including any necessary remediation to clients) within 60 days after the reportable situation first occurred.

(4B) For the purposes of:

(a) subsection (4A)—the circumstances in which there is a single reportable situation as a result of particular conduct include circumstances in which the conduct constitutes a single contravention of two or more of the following and does not otherwise give rise to a reportable situation:

(i) subsection 1041H(1) of this Act;

(ii)  subsection 12DA(1) of the ASIC Act;

(iii) subsection 12DB(1) of the ASIC Act; and

(aa) subsection (4AA)—the circumstances in which there is a single reportable situation as a result of particular conduct include circumstances in which the conduct constitutes a single contravention of two or more provisions referred to in paragraphs (4)(b) and (c) and does not otherwise give rise to a reportable situation; and

(ab) subsection (4AA)—a single group of reportable situations means two or more single reportable situations which:

(i) each involve the same or substantially similar conduct other than the identity of the consumer and the date of the conduct; and

(ii)  occur within a period of no more than 60 days; and

(b) subsections (4A) and (4AA)—a person is impacted by a contravention of:

(i) subsection 1041H(1) of this Act or subsection 12DA(1) of the ASIC Act if they are misled or deceived as a result of the contravention; and

(ii) subsection 12DB(1) of the ASIC Act if they are the recipient of the false or misleading representation to which the contravention relates.

Note: Otherwise, impacted has its ordinary meaning.”.   

(2)  The provisions to which Part 2-6 of the Credit Act applies apply in relation to credit licensees as if subsection 50A were modified or varied by:

(a) in subsection 50A(4), omitting “For the purposes” and substituting “Subject to subsections (4A) and (4AA), for the purposes”; and

(b) after subsection 50A(4), inserting:

“(4A) A breach of a core obligation constituted by a contravention of subsection 12DA(1) or 12DB(1) of the ASIC Act is not taken to be significant if:

(a) but for this subsection, the underlying circumstances in relation to the breach:

(i) would only give rise, and would only be likely to give rise, to a single reportable situation as a result of the following:

(A) paragraph (4)(b) in so far as it relates to a contravention of subsection 12DB(1) of the ASIC Act;

(B) paragraph (4)(d); and

(ii) would not give rise, and would be unlikely to give rise, to a reportable situation other than as specified in subparagraph (i); and  

(b) either:

(i) only one person (affected consumer) is, or is likely to be, impacted by the contravention; or

(ii) if the contravention relates to any of the following that is, or that is proposed to be, entered into jointly by more than one credit activity client (each an affected consumer) of the licensee, those affected consumers are the only persons who are, or are likely to be, impacted by the contravention:

(A) a credit contract or proposed credit contract;

(B) a consumer lease or proposed consumer lease;

(C) a mortgage or proposed mortgage;

(D) a guarantee or proposed guarantee; and

(c) the contravention has not resulted in, and is unlikely to result in, any financial loss or damage to any consumer (for the purposes of this paragraph, financial loss or damage is to be taken into account regardless of whether it is, or will or may be, remediated).

(4AA) A breach of a core obligation is also not taken to be significant if:

(a) but for this subsection, the underlying circumstances in relation to the breach:

(i) would only give rise, and would only be likely to give rise, to a single reportable situation or single group of reportable situations as a result of paragraphs (4)(b) and (d); and

(ii) would not give rise, and would be unlikely to give rise, to a reportable situation other than as specified in subparagraph (i); and  

(b) there are no more than 10 persons (affected consumers) who are, or are likely to be, impacted by the single reportable situation or single group of reportable situations (where a breach relates to any of the following that is, or that is proposed to be, entered into jointly by more than one credit activity client those credit activity clients are to be treated as a single affected consumer for the purposes of this paragraph):

(i) a credit contract or proposed credit contract;

(ii) a consumer lease or proposed consumer lease;

(iii) a mortgage or proposed mortgage;

(iv) a guarantee or proposed guarantee; and

(c) the total financial loss or damage to all consumers resulting from, or likely to result from, the single reportable situation or single group of reportable situations does not exceed $1,000 (for the purposes of this paragraph, financial loss or damage is to be taken into account regardless of whether it is, or will or may be, remediated); and

(d) the breach has been rectified (including any necessary remediation to affected consumers) within 60 days after reportable situation first occurred.

(4B) For the purposes of:

(a) subsection (4A)—the circumstances in which there is a single reportable situation as a result of particular conduct include circumstances in which the conduct constitutes a single contravention of both of the following and does not otherwise give rise to a reportable situation:

(i)  subsection 12DA(1) of the ASIC Act;

(ii) subsection 12DB(1) of the ASIC Act; and

(aa) subsection (4AA)—the circumstances in which there is a single reportable situation as a result of particular conduct include circumstances in which the conduct constitutes a single contravention of two or more provisions referred to in paragraphs (4)(b) and (d) and does not otherwise give rise to a reportable situation; and

(ab) subsection (4AA)— a single group of reportable situations means two or more single reportable situations which:

(i) each involve the same or substantially similar conduct other than the identity of the consumer and the date of the conduct; and

(ii) occur within a period of no more than 60 days; and

(b) subsections (4A) and (4AA)—a person is impacted by a contravention of:

(i) subsection 12DA(1) of the ASIC Act if they are misled or deceived as a result of the contravention; and

(ii) subsection 12DB(1) of the ASIC Act if they are the recipient of the false or misleading representation to which the contravention relates.

Note: Otherwise, impacted has its ordinary meaning.”.  

6A  Ongoing investigations

(1)     Part 7.6 of the Corporations Act (other than Divisions 4 and 8) applies in relation to financial service licensees as if section 912D were modified or varied by, in paragraph 912D(1)(c), omitting “30 days” and substituting “60 days”.

(2) The provisions to which Part 2-6 of the Credit Act applies apply in relation to credit licensees as if section 50A were modified or varied by, in paragraph 50A(1)(c), omitting “30 days” and substituting “60 days”.

7 Reporting period for additional reportable situations

(1) Part 7.6 of the Corporations Act (other than Divisions 4 and 8) applies in relation to financial service licensees as if section 912DAA were modified or varied by omitting subsection 912DAA(3) (other than the heading) and substituting:

“(3) The report must be lodged with ASIC:

(a) within 30 days after the financial services licensee first knows that, or is reckless with respect to whether, there are reasonable grounds to believe the reportable situation has arisen; or

(b) if:

(i) there is a reportable situation (previous reportable situation) with underlying circumstances that are the same as, or substantially similar to, the underlying circumstances of the reportable situation (current reportable situation); and

(ii) the financial services licensee has lodged a report under this section in relation to the previous reportable situation with ASIC;

within 90 days after the financial services licensee first knows that, or is reckless with respect to whether, there are reasonable grounds to believe the current reportable situation has arisen.”.

(2)     The provisions to which Part 2-6 of the Credit Act applies apply in relation to credit licensees as if subsection 50B were modified or varied by omitting subsection 50B(4) (other than the heading) and substituting:

“(4) The report must be lodged with ASIC:

(a) within 30 days after the licensee first knows that, or is reckless with respect to whether, there are reasonable grounds to believe that the reportable situation has arisen; or

(b) if:

(i) there is a reportable situation (previous reportable situation) with underlying circumstances that are the same as, or substantially similar to, the underlying circumstances relating to the reportable situation (current reportable situation); and

(ii) the licensee has lodged a report under this section in relation to the previous reportable situation with ASIC;

within 90 days after the licensee first knows that, or is reckless with respect to whether, there are reasonable grounds to believe the current reportable situation has arisen.”.

7A Reports submitted to APRA

(1) Part 7.6 of the Corporations Act (other than Divisions 4 and 8) applies in relation to financial service licensees as if section 912DAA were modified or varied by omitting paragraph 912DAA(5)(b) and substituting:

“(b) the licensee has given a report to APRA that contains the following information in relation to the licensee and the reportable situation:

(i) the following information in relation to the licensee:

(A) the name of the licensee;

(B) the ACN or ARBN of the licensee;

(C) the licence number of the licensee;

(ii) the date of the first and, if there has been more than one occurrence, the last occurrence of the circumstances giving rise to the reportable situation;

Note: A reportable situation need not involve a breach of a core obligation: see paragraphs 912D(1)(b) to (d) and subsection 912D(2).

(iii) if the reportable situation relates to a core obligation:

(A) if paragraph 912D(3)(a) applies—the applicable obligations under section 912A or 912B; and

(B) if paragraph 912D(3)(b) applies—the provisions of this Act or the ASIC Act that the obligation relates to; and

(C) if paragraph 912D(3)(c) applies—the provisions of Commonwealth legislation that the obligation relates to; and

(D) if paragraph 912D(3)(d) applies—the provisions of Commonwealth, State or Territory legislation or the rule of common law or equity that the obligation relates to; and

(E) if paragraph 912D(3)(e) applies—the provisions of this Act or the ASIC Act that the obligation relates to;

(iv) a description of the reportable situation;

(v)  if applicable, when the licensee started and completed an investigation into the reportable situation;

(vi) the root cause of the reportable situation;

(vii) whether any similar reportable situations have occurred;

(viii) the number of complaints received by the licensee in relation to the reportable situation;

(ix) the extent or magnitude of the circumstances giving rise to the reportable situation, including an estimate of the number of impacted persons and the dollar amount involved;

(x) whether, when and how the circumstances giving rise to the reportable situation have been rectified;

(xi) whether, when and how impacted persons have been compensated or redressed;

(xii) any measures taken by the licensee to prevent future similar breaches or circumstances from occurring.”.

(2)     The provisions to which Part 2-6 of the Credit Act applies apply in relation to credit licensees as if section 50B were modified or varied by omitting paragraph 50B(6)(b) and substituting:

“(b) the licensee has given a report to APRA that contains the following information in relation to the licensee and the reportable situation:

(i) the following information in relation to the licensee:

(A) the name of the licensee;

(B) the ACN or ARBN of the licensee;

(C) the Australian credit licence number of the licensee;

(ii) the date of the first and, if there has been more than one occurrence, the last occurrence of the circumstances giving rise to the reportable situation;

Note: A reportable situation need not involve a breach of a core obligation: see paragraphs 50A(1)(b) to (d) and subsection 50A(2).

(iii) if the reportable situation relates to a core obligation:

(A) if paragraph 50A(3)(a) applies—the applicable obligations under section 47; and

(B) if paragraph 50A(3)(b) applies—the provisions of this Act, the Transitional Act or Division 2 of Part 2 of the ASIC Act and regulations made for the purpose of that Division that the obligation relates to; and

(C) if paragraph 50A(3)(c) applies—the provisions of Commonwealth legislation that the obligation relates to; and

(D) if paragraph 50A(3)(d) applies—the provisions of this Act, the Transitional Act or Division 2 of Part 2 of the ASIC Act and regulations made for the purpose of that Division that the obligation relates to; and

(iv) a description of the reportable situation;

(v)  if applicable, when the licensee started and completed an investigation into the reportable situation;

(vi) the root cause of the reportable situation;

(vii) whether any similar reportable situations have occurred;

(viii) the number of complaints received by the licensee in relation to the reportable situation;

(ix) the extent or magnitude of the circumstances giving rise to the reportable situation, including an estimate of the number of impacted persons and the dollar amount involved;

(x) whether, when and how the circumstances giving rise to the reportable situation have been rectified;

(xi) whether, when and how impacted persons have been compensated or redressed;

(xii) any measures taken by the licensee to prevent future similar breaches or circumstances from occurring.”.

8 Core obligations

The provisions to which Part 2-6 of the Credit Act applies apply in relation to credit licensees as if subsection 50A were modified or varied by omitting paragraph 50A(3)(c) and substituting:

“(c) the obligation under paragraph 47(1)(d), so far as it relates to Commonwealth legislation that is:

(i) covered by paragraph (d) of the definition of credit legislation; and

(ii) one of the following:

(A) Banking Act 1959;

(B) Corporations Act 2001;

(C) Financial Sector (Collection of Data) Act 2001;

(D) Financial Sector (Shareholdings) Act 1998;

(E) Financial Sector (Transfer and Restructure) Act 1999.”.

Part 3—Repeal

9  Repeal

This instrument is repealed at the start of 1 October 2029.

Endnotes

Endnote 1—About the endnotes

The endnotes provide information about this compilation and the compiled law.

The following endnotes are included in every compilation:

Endnote 1—About the endnotes

Endnote 2—Abbreviation key

Endnote 3—Legislation history

Endnote 4—Amendment history

Abbreviation key—Endnote 2

The abbreviation key sets out abbreviations that may be used in the endnotes.

Legislation history and amendment history—Endnotes 3 and 4

Amending laws are annotated in the legislation history and amendment history.

The legislation history in endnote 3 provides information about each law that has amended (or will amend) the compiled law. The information includes commencement details for amending laws and details of any application, saving or transitional provisions that are not included in this compilation.

The amendment history in endnote 4 provides information about amendments at the provision (generally section or equivalent) level. It also includes information about any provision of the compiled law that has been repealed in accordance with a provision of the law.

Misdescribed amendments

A misdescribed amendment is an amendment that does not accurately describe how an amendment is to be made. If, despite the misdescription, the amendment can be given effect as intended, then the misdescribed amendment can be incorporated through an editorial change made under section 15V of the Legislation Act 2003.

If a misdescribed amendment cannot be given effect as intended, the amendment is not incorporated and “(md not incorp)” is added to the amendment history.

Endnote 2—Abbreviation key

Endnote 3—Legislation history

Endnote 4—Amendment history