CPD: ASIC on outsourcing – practical lessons for every adviser and licensee

Outsourcing is part of how advice is delivered, and it is often less visible than practices realise.

Outsourcing is an integral part of advice delivery

Outsourcing has unquestionably reshaped the financial advice landscape in Australia.

The advice value chain is long and complex, with many components that are either beyond the core expertise of practice owners or are simply uneconomic for an expensive resource like an adviser to perform.

The ubiquity of outsourcing across advice (around three in four practices outsource at least one function, with 74% outsourcing IT infrastructure management alone^[1]) owes much to the substantial improvements in efficiency and service quality that it can help deliver. The licensee landscape is now very fragmented, with a skew to smaller practices – about 60% of practices have a single adviser^[2]) – which has accelerated the reliance on external providers for functions including client service, paraplanning, compliance, technology, marketing, and investment management.

But outsourcing brings risks for advisers and licensees, both reputational and regulatory, because while core elements of an advice business are being delivered by a third party, licensees and advisers are still ultimately responsible and accountable for their advice and their compliance with all applicable rules and regulations.

The trend of outsourcing to offshore providers, in their own legal jurisdictions, has brought new risks into focus, particularly around cyber risk, privacy, and data security. ASIC’s concerns about how licensees govern such providers culminated in its review of the sector, published on 10 October 2025^[3]).

The findings of that review, along with ASIC’s existing guidance about third-party providers^[4], are highly relevant to both licensees and individual advisers. This article examines what counts as outsourcing in an advice practice, what ASIC’s offshore review and guidance mean for licensees, and the practical steps advisers can take when they work with providers chosen by their licensee or practice owners. It also considers the controls licensees can use to select, oversee and review both domestic and offshore providers.

What counts as outsourcing

The range of functions and services that advice practices outsource is wide and, just like the boiling frog, it is not always obvious that it is happening.

RG 104, ASIC’s guidance on meeting the general licensee obligations, recognises that licensees can outsource administrative and operational functions^[5]. The examples it uses to illustrate its guidance include IT systems used to store records, research on financial products, call centres and periodic compliance reviews of representatives.

ASIC’s 2025 offshore review^[6] gives a more specific picture of how entrenched external providers can be across the advice value chain: financial planning assistants entering client data and researching products, paraplanning, support with insurance applications and documents, and client communications.

Investment Trends found that self-licensed firms most often outsource compliance and audit functions^[7]. Investment work is widely outsourced as well. According to Adviser Ratings’ 2025 Landscape Report^[8], 56% of practices used third-party researchers or investment consultants and only 13% had internal research teams, a trend the report links to the growth of private managed accounts, which generally rely on external investment consultants.

Sometimes, the use of providers external to the practice may not be thought of as an active decision to outsource. But an adviser who uses the licensee’s approved research or a model portfolio may be effectively outsourcing part of the investment process, whether they think of it that way or not.

An arrangement can take many forms: an individual contractor working part time, a specialist firm, a team engaged through an intermediary, or another entity in the same corporate group. It may be set up by the practice, by the licensee or by an individual representative.  The provider may work inside the practice’s systems or receive files and return finished work from their own.

That variety is often what makes outsourcing hard to see. Indeed, in ASIC’s offshore review, two of the 10 participating licensees could not identify every representative who was using an offshore provider^[9].

What counts, in practice, is whether a provider carries out a task that forms part of the practice’s or licensee’s operations, particularly where that work involves client records, advice preparation, client contact or systems used to deliver financial services. Whether licensees can see, assess and monitor arrangements like these is what ASIC’s review set out to examine^[10].

What ASIC found in its offshore review

ASIC’s review examined 10 licensees of varying sizes that used offshore service providers through an intermediary, and it spoke with six intermediary businesses that connect Australian firms with resources in the Philippines, India and Sri Lanka¹¹. Over the previous two years, more than 300 representatives of the 10 licensees had used an offshore provider, and the six intermediaries reported more than 1,000 licensees or representatives among their clients.

ASIC’s review identified five broad risks:

• Loss of control over outsourced tasks
• Protection of sensitive client information (particularly where a provider is subject to foreign laws that may conflict with Australian law)
• Detecting and managing a data breach or cyber incident when work is done offshore
• Operational disruption, and
• Weaker supervision of the people and processes involved.

Most of the gaps ASIC found related to oversight.

Four of the 10 licensees reviewed had no formal offshore outsourcing policy, including one with no policies or procedures at all for engaging providers. Seven licensees’ IT policies applied generically to all staff, with no extra requirements for offshore workers. There was no evidence of regular audits of representatives’ use of providers, and none audited system access or activity logs or had real-time alerts for access violations. Licensees and representatives tended to rely on what intermediaries said about cyber security without verifying it. Four had no policy on telling clients, or obtaining consent, before client information went to a provider¹².

ASIC’s overall concern was that most licensees lacked adequate arrangements to assess, appoint and monitor the providers their representatives used, and relied on the representatives to manage the risks.

ASIC’s offshore review was not a one-off. ASIC’s February 2026 Financial Advice Update placed it among five supervisory workstreams on advice licensees, alongside lead generation, SMSF establishment advice, internal dispute resolution and reportable situations¹³. Clayton Utz notes that across all five, ASIC has found the same pattern: licensees delegating functions without maintaining adequate oversight¹⁴.

That pattern is not limited to offshore providers. While their review examined offshore arrangements, ASIC has said a licensee’s obligations are the same whether functions are performed onshore or offshore¹⁵. The findings, and the controls they point to, are therefore relevant to all outsourcing arrangements.

Advisers: working with outsourced providers in day-to-day practice

Advisers may use outsourced services arranged by their practice or licensee, including paraplanning, client service, research and administration. The provider may be domestic or offshore. Some advisers have little involvement in selecting or contracting with it, while practice owners within larger licensees may make some of those decisions themselves. Either way, day-to-day use of the service still matters: the adviser needs to know what the provider is authorised to do and check how its work is used.

For advisers using externally provided services, a practical checklist of steps might include the following:

Understand the details of the arrangement

Confirm which provider is approved, what work it can perform and whether an intermediary or another provider is involved. Ask where client information is held or accessed, and which tools, including any AI, the provider uses with it or to produce client documents.

Use approved systems and processes

Follow the practice’s rules for sharing client information. Provide only the information needed for the task, use approved channels and raise with the licensee any request the external provider makes for wider system access or additional data.

Check the work before relying on it

Review paraplanning and research for accuracy, relevant client details, assumptions and consistency with the advice being given, and look harder where the provider has exercised judgement. Treat prepared material as work to assess, not a substitute for the adviser’s own judgement and responsibility for the advice.

Be clear about client contact

Know whether a provider will communicate directly with clients, what it may say and how enquiries or complaints should be referred. Follow the licensee’s disclosure and consent process, and be able to answer, or know who can, if a client asks where their information goes.

Raise concerns promptly

Tell the appropriate person at the practice or licensee about errors, delays, unusual access requests, suspected data incidents or work that falls outside the provider’s approved role. Record the issue and follow the firm’s process for tracking it through to resolution.

Licensees can only oversee what they know about. Advisers who simply use a provider chosen elsewhere can help by following the approved process and flagging changes in how a service is used. Practice owners who can choose or vary providers themselves should check what approval their licensee requires before engaging a new provider or changing an existing arrangement.

Licensees: putting in place controls across provider relationships

Advisers can follow approved processes and flag concerns, but the framework that makes this work has to come from the licensee, which ASIC holds to account for the work it outsources.

Under RG 104, ASIC expects a licensee that outsources functions relating to its licence to have measures in place to ensure due skill and care in choosing providers, to monitor their ongoing performance, and to respond when a provider breaches a service level agreement or creates compliance concerns¹⁶. In ASIC Commissioner Alan Kirkland’s words, licensees can outsource services but “cannot outsource their fundamental obligations”¹⁷.

ASIC’s review set out better practice across nine areas: appointing providers, disclosing their use to clients, monitoring ongoing compliance, keeping an approved panel, knowing which representatives use providers, managing cyber risk, protecting data privacy, monitoring provider system access and managing incident response¹⁸. Clayton Utz advises licensees to treat them as minimum requirements, not aspirational targets¹⁹, and the checklist below draws on them.

Keep a complete register

Record each provider and intermediary, the representatives who use them, the tasks performed, the client information and systems they can access, and any subcontractors. Include domestic providers as well as offshore ones, and support the licensee supplies itself, such as research and model portfolios. ASIC said a licensee unaware of which representatives use external providers is likely not meeting its general obligations²⁰.

Assess before approving

Consider how critical the task is, what the provider is capable of and what client information and systems it will have access to. ASIC’s better practice examples from its offshore review include appointment checklists covering IT systems, privacy law and business roles, and a panel of approved providers backed by the licensee’s own due diligence²¹. Where a provider is offshore, the regulatory environment it operates in should be assessed too (ASIC treats sending client information to an offshore provider without that assessment as poor practice). Intermediaries’ claims about cyber security should be verified, not simply accepted. Where a provider will itself provide financial services to clients on the licensee’s behalf, it will generally need to be an authorised representative or hold its own AFS licence²².

Set the standards in writing

Tell representatives which providers are approved, what they can delegate, what must be reviewed before use and how to report problems. Decide how and when clients are told about the arrangement and whether consent is required. Contracts should address use, access, retention and disposal of client information²³ and require client information to be transmitted securely, with additional precautions such as enhanced encryption where needed. That includes provider tools: the OAIC says the Privacy Act applies to all uses of AI involving personal information and recommends against entering personal information into publicly available generative AI tools²⁴. Approving a provider without knowing which tools touch client files leaves a gap in oversight, wherever the work is done.

Monitor and audit

Audit whether approved arrangements are being followed, with recorded audits at set intervals and regular review of provider access logs and actions. Where responsibility sits with a practice owner or representative, the licensee must still take reasonable steps to make sure that oversight happens.

Plan for failure and change

ASIC’s better practice examples include requiring providers to hold documented response strategies for scenarios such as ransomware and to take part in recovery testing²⁵. Review the arrangement whenever a provider changes its services, systems, location, subcontractors or use of AI tools, and make sure access can be restricted, client information recovered and the work moved if the arrangement ends.

The controls should be scaled to the task. The more critical the function, the tighter they should be. RG 104 makes it clear that what a licensee must do depends on the nature, scale and complexity of its business, including how much it outsources²⁶.

Conclusion

Outsourcing is part of how advice is delivered, and it is often less visible than practices realise.

While ASIC’s offshore review was specific to providers based outside Australia, the findings are relevant to outsourcing generally, and along with the guidance contained in RG 104, provide advisers and licensees with a clear framework for selecting, overseeing and reviewing outsourced providers, whether domestic or offshore.

Advisers can support their licensee by knowing the details of outsourced arrangements, using approved systems, checking the work and raising concerns early. Licensees need a current register, proportionate due diligence, clear standards, active monitoring and plans for failure and change. A third-party provider may do the work, but the licensee remains accountable for how it affects clients, and the adviser for the advice that results.

Take the FAAA accredited quiz to earn 0.5 CPD hour:

CPD Quiz

The following CPD quiz is accredited by the FAAA at 0.5 hour.

Legislated CPD Area: Technical Competence (0.5 hrs)

ASIC Knowledge Requirements: Securities (0.5 hrs)

please log in to start this quiz

———–

References:
[1] https://pro.adviserratings.com.au/docs/2025-Australian-Financial-Advice-Landscape.pdf
[2] https://www.ifa.com.au/adviser-numbers-drop-nearly-2-per-cent-in-q1/
[3] https://www.asic.gov.au/about-asic/news-centre/articles/review-of-offshore-outsourcing-financial-services-advice-licensees/
[4] https://www.asic.gov.au/regulatory-resources/find-a-document/regulatory-guides/rg-104-afs-licensing-meeting-the-general-obligations
[5] Ibid.
[6] https://www.asic.gov.au/about-asic/news-centre/articles/review-of-offshore-outsourcing-financial-services-advice-licensees/
[7] https://investmenttrends.com/resource/2025-adviser-business-model-report/
[8] https://pro.adviserratings.com.au/docs/2025-Australian-Financial-Advice-Landscape.pdf
[9] https://www.asic.gov.au/about-asic/news-centre/articles/review-of-offshore-outsourcing-financial-services-advice-licensees/
[10] Ibid.
[11] https://www.professionalplanner.com.au/2025/10/asic-claims-governance-gaps-in-afsls-offshoring-arrangements/
[12] https://www.asic.gov.au/about-asic/news-centre/articles/review-of-offshore-outsourcing-financial-services-advice-licensees/
[13] https://www.claytonutz.com/insights/2026/march/offshore-outsourcing-under-the-spotlight-asic-s-multi-front-focus-on-advice-licensees
[14] Ibid.
[15] https://www.asic.gov.au/about-asic/news-centre/speeches/regulatory-priorities-in-financial-advice/
[16] https://www.asic.gov.au/regulatory-resources/find-a-document/regulatory-guides/rg-104-afs-licensing-meeting-the-general-obligations
[17] https://www.asic.gov.au/about-asic/news-centre/find-a-media-release/2025-releases/25-234mr-asic-flags-risks-in-offshore-outsourcing-after-review-identifies-governance-gaps
[18] https://www.asic.gov.au/about-asic/news-centre/articles/review-of-offshore-outsourcing-financial-services-advice-licensees/
[19] https://www.claytonutz.com/insights/2026/march/offshore-outsourcing-under-the-spotlight-asic-s-multi-front-focus-on-advice-licensees
[20] https://www.asic.gov.au/about-asic/news-centre/articles/review-of-offshore-outsourcing-financial-services-advice-licensees/
[21] Ibid.
[22] https://www.asic.gov.au/regulatory-resources/find-a-document/regulatory-guides/rg-104-afs-licensing-meeting-the-general-obligations
[23] https://www.asic.gov.au/about-asic/news-centre/articles/review-of-offshore-outsourcing-financial-services-advice-licensees/
[24] https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products
[25] https://www.asic.gov.au/about-asic/news-centre/articles/review-of-offshore-outsourcing-financial-services-advice-licensees/
[26] https://www.asic.gov.au/regulatory-resources/find-a-document/regulatory-guides/rg-104-afs-licensing-meeting-the-general-obligations