Sarah Court

ASIC strengthened consumer protection in 2025-26, delivering 150 administrative enforcement outcomes targeting misconduct across Australia’s financial, credit and corporate sectors.

Demonstrating the critical role administrative enforcement tools play in disrupting rogue operators and protecting consumers, investors and small businesses, between 1 July 2025 and 30 June 2026, ASIC:

• removed or restricted 87 individuals and businesses from providing financial services
• removed or restricted 27 individuals and businesses from providing credit services
• disqualified 36 individuals from managing corporations

Overall, ASIC’s administrative enforcement activity remained strong in 2025–26, with financial services removals and restrictions reaching the highest level in the past five-years and director disqualifications rising sharply from the 2024-25 financial year.

ASIC Chair Sarah Court said Australian financial services licence cancellations and director disqualifications were among ASIC’s most efficient enforcement tools.

‘These administrative powers are critical levers that allow ASIC to act quickly and decisively to stop misconduct, protect consumers, investors and small businesses, and efficiently remove unsuitable operators from the market.

‘They can often be deployed more swiftly than or ahead of court action to help prevent further harm, drive behavioural change and strengthen trust and confidence in Australia’s financial and corporate markets.

‘Every banning order, licence cancellation and director disqualification removes a pathway for rogue operators to continue earning a living from misconduct. By removing high-risk participants from the market, we are disrupting misconduct at its source and making it harder for those who disregard the law to continue operating.’

ASIC’s latest data shows that 61% of financial services outcomes and 89% of credit-related outcomes resulted in permanent banning orders or licence cancellations with:

• 77 permanent bannings and cancellations from credit and financial services (31 individuals and 46 organisations)
• 6 banned for 10 years from credit and financial services
• 31 banned for less than 10 years
• 18 of the 36 director disqualifications were for the maximum period of five years available under the Corporations Act.

Some of ASIC’s most significant enforcement outcomes in 2025-26 included:

• Permanent ban – Abdullah Popal: ASIC permanently banned Mr Popal from providing financial services and engaging in credit activities following fraud convictions involving the dishonest transfer of almost $90,000 from former clients.
• Permanent ban – Barry King: ASIC permanently banned former financial adviser after finding he misappropriated client funds and provided false documents.
• Maximum director disqualification – Kylie Campbell: ASIC disqualified the former Victorian property development director from managing corporations for the maximum period of five years following the failure of companies that left substantial debts and losses to creditors.
• Shield and First Guardian Master Funds: ASIC has banned 15 advisers linked to the Shield Master Fund or the First Guardian Master Fund in the last financial year and taken further action against licensees, a director of a licensee and a responsible manager.

‘ASIC will continue to take decisive action against individuals and businesses that fail to meet their legal obligations,’ the Chair said.

‘Administrative enforcement outcomes are a powerful way to protect consumers and investors, deter misconduct and maintain confidence in Australia’s financial, credit and corporate markets.

‘If you misuse a position of trust, fail to meet your obligations or engage in misconduct, ASIC can and will act to remove you from the market.’

Background

¹Source: ASIC Annual Reports
²The categories are not mutually exclusive, and some individuals/businesses may appear in more than one category where multiple administrative actions have been taken.

Banning orders prohibit individuals from providing financial services or engaging in credit activities and are used where ASIC identifies serious misconduct or conduct demonstrating a person is not fit to participate in the industry.

Licence cancellations remove a business’s legal authority to provide financial services or credit activities and are used where an entity has failed to meet its obligations or no longer meets the standards required of a licensee.

Director disqualifications prevent individuals from managing corporations for up to five years and are commonly used where ASIC identifies repeated company failures, misconduct affecting creditors or employees, or conduct showing a person is unfit to manage a company. This provision is a key regulatory tool to deter director misconduct and allows for a timely and efficient enforcement outcome when compared to similar criminal and civil remedies. Any person who continues to be involved in the management of a company while disqualified commits an offence which carries a maximum penalty of five years’ imprisonment.

Sarah Court

ASIC has delivered one of its strongest enforcement periods on record, securing major penalties and driving tens of millions in payments back to Australians in the first half of 2026.

From January to June 2026, ASIC secured court orders totalling $480 million^# in civil penalties against major banks, super trustees, market participants and financial services firms, including Union Standard, HSBC, Westpac, Macquarie Securities, and Mercer Super.

Together with the $350 million ordered in the first half, ASIC’s civil penalties orders now total $830 million for the 2025-2026 financial year.

In connection with ASIC’s work, $644 million^* is being paid back to Australians, including more than $61 million announced in the first half of 2026, on top of the $583 million announced between June and December 2025.

ASIC Chair Sarah Court said, ‘Our enforcement work is focused on misconduct that causes real harm and we are delivering results, forcing change, strengthening accountability, and returning money to consumers and investors.

‘We are pursuing cases that expose serious failures in systems, governance and conduct, from scams and hardship failures to market infrastructure, superannuation, private credit, financial reporting, and digital assets.’

ASIC’s criminal enforcement program also continues to deliver, with recent court outcomes and investigations achieving significant jail sentences holding those who broke Australia’s financial services laws to account.

In May, former Sydney fund manager Rodney Forrest was resentenced by the Full Federal Court to five years and three months jail imprisonment for a $3 million insider trading scheme involving Platinum Asset Management shares. Former financial advisor Anthony Torre was sentenced in January to six years in prison for fraud involving the misappropriation of superannuation funds. Remedy Housing officials Brent Smith, Mahmoud Khodr, and Fue Mano were sentenced to lengthy prison in March for dishonesty offences.

Overall, there has been an uplift in ASIC’s criminal convictions and custodial sentences with 25 criminal convictions, of these 21 were custodial sentences, including 11 individuals sentenced to imprisonment.

ASIC’s enforcement and regulatory figures from July 2025 to June 2026 reveals:

• $830 million in civil penalties imposed by courts
• $643.5 million to be delivered back to tens of thousands of customers and investors as part of remediation, refunds, and payments in connection with ASIC’s work
• ASIC launched more than 250 investigations
• 25 criminal convictions comprised of 21 custodial sentences (including 11 individuals sentenced to imprisonment) and four were non-custodial sentences
• 32 new civil proceedings were filed, 18 new criminal prosecutions commenced, and 25 criminal convictions were recorded against individuals
• $12 million in infringement notices and $137,315 in criminal fines.

Some of the major civil penalties follow ASIC’s successful enforcement action against:

• Union Standard International Group was ordered to pay a record $300 million penalty for serious contracts for difference (CFD) misconduct and failures affecting retail investors
• HSBC Bank Australia admitted scam protection failures, with ASIC securing a $35 million penalty. Macquarie Securities was ordered to pay a $35 million penalty for systemic failures that led to the misreporting of millions of short sales and inaccurate market data.
• Westpac was ordered to pay a $26 million penalty for widespread failures in responding to customer hardship requests
• Walker Stores (Snaffle) was ordered to pay a $33.5 million penalty for unlawful credit practices that overcharged consumers almost $20 million in excess interest
• Mercer Super was ordered to pay $10.3 million in penalties for systemic reporting failures, including failing to report significant breaches to ASIC

In connection with its work, ASIC also:

• ASIC secured nearly $40 million in refunds to CFD investors
• Following ASIC’s investigation, HSBC has established a large-scale remediation program that, to date, has paid around $21.5 million in compensation, with further payments to come before the end of July 2026. HSBC has also recovered $6.5 million and returned those funds to customers.

‘ASIC has delivered record penalties and strong criminal outcomes, but enforcement is not just about punishment. It is about detecting misconduct sooner, preventing harm where we can, and securing remediation for those affected,’ the Chair said.

‘Our focus is on protecting investors, returning money where possible, and holding lawbreakers to account. Where we see serious harm or risks to market integrity, we will act quickly and use the full range of regulatory and enforcement tools available to us.’

Background

^#The figure of $480 million reflects civil penalties ordered by courts between 1 Jan 2026 and 30 June 2026. It does not include proposed or agreed civil penalties that remain subject to court approval in 2026.

^*The figure of $644 million reflects announcements in the reporting period in connection with ASIC’s work. Payments may occur before or after the reporting period and totals may be updated as programs progress.

ASIC Media Release outlining penalties secured:

• 26-136MR ASIC secures $10.3 million in penalties against Mercer Super for systemic reporting failures
• 26-126MR $35 million penalty sought as HSBC admits to scam protection failures, and implements compensation plan
• 26-117MR Federal Court orders record $300 million penalties in ASIC’s case over ‘egregious’ Union Standard and CFD operator misconduct
• 26-107MR Federal Court orders Westpac to pay $26 million penalty for hardship failures
• 26-099MR Federal Court orders $33.5 million penalty against Snaffle operator for inflating prices and overcharging on credit contracts
• 26-084MR Federal Court orders Money3 to pay $1.55 million penalty for responsible lending breaches
• 26-097MR ASIC appeals $7 million penalty in Cigno Australia, BSF Solutions, and directors’ case
• 26-068MR Electro Optic Systems Holdings ordered to pay $4 million penalty for continuous disclosure breaches
• 26-055MR Binance Australia Derivatives ordered to pay $10 million penalty for onboarding failures causing millions in client trading losses
• 26-050MR Supreme Court orders Macquarie Securities to pay $35 million penalty in short sale misreporting case

ASIC Media Releases outlining remediation back to customers

• 26-004MR ASIC secures nearly $40 million in refunds to investors and drives change after CFD sector falls short
• 26-127MR Federal Court orders $35 million penalty against HSBC for scam protection failures

Simone Constant

ASIC is warning superannuation trustees to address stark and persistent failures to protect retirement savings, including gaps in the monitoring of harmful advice fee deductions, unusual fees and investment patterns, and high-risk superannuation switching activity.

ASIC Report 833 Safeguarding super: How well are platform trustees monitoring risks to retirement savings? (REP 833) details findings from a review of six platform trustees entrusted with over $300 billion in retirement savings — about three quarters of total funds managed by platform trustees.

ASIC Commissioner Simone Constant said there was no excuse for the troubling lack of protections put in place by some trustees.

‘It’s clear some trustees are not doing enough to protect their members, despite repeated warnings from ASIC and APRA about the dangers of poor oversight. Nor have they learned lessons from the collapses of the Shield Master Fund and First Guardian Master Fund, which cost more than 11,000 Australians around $1 billion in retirement savings.

‘In one disturbing case, a trustee failed to take further action for 13 months after becoming aware of suspicious activity from a representative of an advice licensee. During that time, another representative of that licensee submitted applications to rollover superannuation balances containing the falsified signatures of a deceased adviser.

‘Many of the clear gaps in oversight are deeply concerning and difficult to justify. Trustees should not expose their members’ retirement savings to unacceptable risks in the pursuit of volume growth.

‘In this age of rapidly evolving technology and data-driven intelligence, it is extraordinary to see some trustees not carrying out any checks in a month despite a 75% adverse finding rate, and others being comfortable with limited, almost entirely manual indicators to monitor potential harm,’ Commissioner Constant said.

ASIC’s review identified the following areas requiring immediate attention from trustees:

• Persistent gaps in advice fee controls, which in some cases have regressed over the past two years. One trustee proposed a fee cap of $30,000 — well beyond caps identified in ASIC Report 781 Review of superannuation trustee practices: Protecting members from harmful advice charges (REP 781).
• Limited checks of advice documents with half of the trustees reporting they did not conduct any checks for at least one of the months in ASIC’s review period.
• Insufficient focus on understanding the advice licensees’ business models, including whether they use lead generators or other third‑party referral sources.
• Inadequate monitoring of key risk indicators, such as member churn, patterns in fees, holding limits and unusual fund flows.

Amid continued growth in demand for platform funds, Commissioner Constant said it had never been more important for platform trustees to take the necessary steps to uphold confidence.

‘In the 10 years to June 2025, superannuation platforms have experienced extraordinary growth, with a more than three-fold increase in member benefits, from $123 billion to $396 billion, compared to the sector which more than doubled. Over the same period, advice fees charged from superannuation platforms have increased four-fold to $2.3 billion.

‘We acknowledge that much of this growth has been driven by the segment’s innovative retirement options, and by Australians looking for more control over their superannuation investments. But this only underscores the importance of prudent trustee oversight that monitors for harmful risks to retirement savings. Trustees are accountable to their members for this and their members deserve to have confidence in their stewardship.

‘Despite being well aware of the dangers of poor oversight — from the Royal Commission’s exposure of fees for no service to the egregious conduct exposed in the Shield and First Guardian failings — some trustees failed to establish basic protections, like looking into an advice licensee’s business model before they are onboarded. This is a clear breach of trust,’ Commissioner Constant said.

ASIC REP 833 includes a list of calls to action across key focus areas (see Table 1) for all trustees to consider.

‘All superannuation trustees should immediately review and consider areas for improvement before risks translate to serious harms for Australians and their hard-earned retirement savings,’ Commissioner Constant added.

‘Scrutinising fees that appear designed to bypass controls, and other processes to identify unusual activity such as high‑risk superannuation switching from lead generators, are among actions trustee can take to protect their members.

‘Where trustees have concerns about potential misconduct, they should immediately report it to ASIC for further investigation.’

ASIC has shared information about features associated with some lead generation services in financial advice and superannuation that may expose consumers to a risk of significant losses.

Commissioner Constant added that where appropriate, ASIC would consider enforcement action, noting ASIC’s separate actions against Equity Trustees Superannuation Limited concerning the Shield Master Fund (25-176MR) and the First Guardian Master Fund (26-101MR), as well as actions against Diversa Trustees Limited (25-296MR), Macquarie Investment Management Limited (26-053MR), and Netwealth (25-307MR).

‘Where we identify significant non-compliance, we will not hesitate to exercise our regulatory powers, including enforcement action,’ she said.

Background

ASIC reviewed a sample of six platform trustees (and a corresponding fund) representing $305 billion in member benefits and 977,000 member accounts as at December 2025.

ASIC and the Australian Prudential Regulation Authority (APRA) have been concerned about gaps in trustees’ oversight of advisers, advice licensees and investments that are made available to members.

These issues concern all participants in the superannuation sector. However, recent high‑profile cases of misconduct involving the Shield Master Fund and First Guardian Master Fund have exposed particular weaknesses in parts of the platforms segment.

ASIC has launched civil penalty proceedings against Equity Trustees (25-176MR) and Diversa Trustees (25-296MR) for alleged failures relating to their oversight of the Shield and First Guardian investments, respectively.

ASIC launched a second case against Equity Trustees last month, alleging failures in care, skill and diligence concerning the decision to allow members to invest in the First Guardian (26-101MR).

ASIC is seeking compensation for members for losses resulting from the alleged failures by Equity Trustees and Diversa, as well as declarations and civil penalties.

In March 2026, the Federal Court declared Macquarie Investment Management Limited (MIML) contravened the Corporations Act by failing to place the Shield on a watch list for heightened monitoring (26-053MR). MIML paid approximately $321 million to affected members in September 2025.

Last December, Netwealth also agreed to pay over $100 million in compensation to more than 1,000 Australians who invested their superannuation in the First Guardian and has admitted it contravened the Corporations Act (25-307MR).

Downloads

• Report 833 Safeguarding super: How well are platform trustees monitoring risks to retirement savings? (REP 833)

More information

• Report 781 Review of superannuation trustee practices: Protecting members from harmful advice charges (REP 781)
• Lead generation and how it works (Moneysmart)
• 26-029MR ASIC commences new review of advice licensees that use lead generation services
• Exposing high-pressure cold calling tactics and social media click-bait leading to superannuation switching

ASIC is warning consumers who have joined ‘share trading’ or ‘stock tips’ messaging app groups that scammers are using these forums to push investments on fake crypto-asset trading platforms.

These fake platforms show profits and trades, but in fact, there is no real trading, and the site contains fake data. Any money deposited into these platforms goes straight to the scammers.

The fake platforms ask for fees to release assets or proceeds. These fees go straight to the scammers and no assets are released.

ASIC has previously warned about a rise in scammers using messaging apps such as WhatsApp to conduct widespread, coordinated pump and dump schemes targeting retail investors. These schemes are illegal.

How the scam works

• Scammers initially target victims through social media advertisements and posts claiming to offer trading tips on shares.
• Victims are invited to messaging apps claiming to share recommendations from well-known figures, who the scammers impersonate.
• Scammers recommend victims invest via a fake crypto asset trading platform that the scammers have set up. The screen may show profits and trades, but in fact, there is no real trading, and the platform contains fake data.
• When the victim tries to withdraw their assets, scammers ask for withdrawal fees, claiming it is necessary to unlock their investment.
• Victims are unable to recover their assets as the money ‘invested’ goes straight into the scammer’s bank account and not towards any real investment.
• Scammers are also using this tactic to target victims of pump and dump schemes, using money recovery scams to prey on people hoping to get their money back.

Young people being targeted

While anyone can be targeted for these scams, recent Moneysmart research found there is widespread exposure to crypto trading advertisements on social media. A survey of 1,127 Australians aged between 18 and 28 found that:

• 23% own crypto assets (e.g. cryptocurrencies, NFTs).
• Of these people, two-thirds (66%) have a short-term/speculative approach to managing their crypto investments.
• 29% said they conduct short-term trading based on social media influencers.
• Overall, 72% of Gen Z survey respondents said they have seen social media ads about crypto. 41% said they have even been contacted by someone about investing in crypto.

Registered virtual asset service businesses

Businesses providing virtual asset services, such as exchanging money for virtual assets (such as crypto), must be registered with AUSTRAC and comply with Australia’s anti-money laundering and counter-terrorism financing (AML/CTF) obligations.

AUSTRAC maintains the Virtual Asset Service Provider Register (VASPR) can be used to check whether a business is registered.

Protect yourself

STOP – Don’t give personal information or act on investment advice you have come across on social media, including in messaging app groups. Don’t feel pressured to invest. If you have any doubts, stop communicating with them.

CHECK – Ask yourself if you really know what you are investing in? Check the AUSTRAC VASPR to confirm if the entity is a registered virtual asset service provider. Do an internet search to see if there are warnings about the website or platform.

PROTECT – Act quickly if something feels wrong. If you have shared personal or financial information or transferred money, contact your bank immediately. Help others by reporting scams to Scamwatch.

Investor information

Before investing, Australians can make these simple practical checks to help reduce the risk of investment and fake crypto asset scams:

• go to ASIC’s Check before you invest page to see how you can check if the company or person is licensed or authorised to offer the investment.
• check ASIC’s investor alert list to help keep you informed about investments that could be fraudulent, a scam or unlicensed.
• Check AUSTRAC’s VASPR to confirm if the entity is a registered virtual asset service provider.

For more information about how to spot a crypto scam, visit ASIC’s Moneysmart website.

What to do if you think you’ve been scammed

If you think you may have been targeted by an investment scam or have experienced cybercrime and lost money online, contact your bank immediately.

Visit the Moneysmart What to do if you’ve been scammed page for tips on what steps to take and to protect yourself from follow up scams. The National Anti-Scam Centre has urged Australians who have had money stolen by scammers to be alert to recovery scams.

For crisis support to help with emotional distress about scams contact Lifeline on 13 11 14 or access support via the online chat. Beyond Blue also provides support for anxiety and depression 1300 22 4636 or chat online at Beyond Blue.

Help others by reporting to Scamwatch. Reports can be made anonymously.

Examples of fake investment advice

Example 1: Whatsapp scam message

Example 2: Whatsapp scam message

Example 3: Scam message

Example of fake trading platform

Example: Fake trading platform

Joe Longo

New research released ysterday by ASIC shows that Australia is well-placed to harness an ongoing surge of financial innovation.

The Innovation in Financial Technology and RegTech research, conducted by the Digital Finance Cooperative Research Centre (DFCRC) for ASIC, lays out how Fintech and Regtech innovations are evolving across the world.

It highlights that artificial intelligence is becoming embedded in everyday financial operations, including credit underwriting, claims processing, portfolio management and disclosure.

ASIC Chair Joe Longo said, ‘Australia has long been a laboratory for innovation, gifting the world groundbreaking technologies from wi-fi to the cochlear implant. The same spirit exists in our financial system.

‘For example, Australia is a global leader in some areas, including its “world-class” payments infrastructure, and pioneering ‘buy now pay later’ sector.’

Mr Longo said that as the pace of change accelerates, industry and regulators will need to work together to ensure that Australia not only keeps up but stays ahead.

‘ASIC has often said we want to identify opportunities to back innovation in Australia, and it is clear that innovation can significantly improve productivity in our financial system, boost Australia’s economy and lead to better consumer experiences,’ said Mr Longo.

‘As a regulator, ASIC’s role is to make sure that when innovation happens, it happens safely and responsibly, with the wellbeing of end consumers at the forefront of everyone’s minds. Good regulation is good for consumers – and good for business.’

‘That’s why ASIC will continue to prioritise simple, principles-based regulation through our regulatory simplification initiative. We will continue to engage with industry to strike the right balance between protecting consumers, bolstering market integrity and promoting innovation.’

Commissioning the research forms part of ASIC’s strategy to support responsible innovation in Australia’s financial system. It will inform ongoing industry engagement, including through the ASIC Digital Finance Advisory Panel (DFAP) and targeted roundtables.

Download

Innovation in Financial Technology and RegTech

Background

Innovation in Australia

In 2025, Australian startups raised more than $5 billion in venture capital (VC) funding, the third best year on record, and up by almost half since 2018, just behind France and Germany.

For every $1 billion of VC money invested since 2000, Australia has produced 1.22 unicorns which is a higher ratio than any other country and almost twice the number for the United States.^[1]

Innovation Hub

Since 2015, ASIC’s Innovation Hub has helped innovative FinTech and RegTech businesses navigate the Australian regulatory framework. It also provides a platform for domestic and international engagement on financial innovation and RegTech-related developments.

ASIC supports the goal of responsible innovation by:

• providing informal assistance to innovative businesses on their potential regulatory obligations and the licensing process
• administering the Enhanced Regulatory Sandbox (ERS; where the legislation provides a limited licensing exemption for eligible fintechs to test innovative business models), and
• driving information sharing and cooperation through our external Digital Finance Advisory Panel (DFAP), and other regular engagement with industry and peer regulators, both domestic and international.

In November 2025, ASIC Chair Joe Longo announced that ASIC would review and re-launch the ASIC Innovation Hub, with a focus on seeking out ways ASIC can support financial market innovations in Australia.

This review concluded in March 2026, where we identified several areas where it can improve and several areas where ASIC will take the lead on navigating the structural change that system-wide innovation brings, so that Australia’s markets are fit for the future.

The DFCRC published another report (The Economic Impact Potential of Digital Finance Innovation in Australia Report) in March 2026.

Project Acacia

Earlier this week the RBA and DFCRC released the final report of Project Acacia, Exploring the role of digital money in wholesale tokenised asset markets. ASIC was one of the participating agencies in the project and continues to work with the RBA and other agencies on some further work flowing from the report.

Regulatory Simplification

In May 2026, we published our Regulatory simplification progress report, demonstrating ASIC’s commitment to make regulation clearer, more accessible and easier to navigate.

In September 2025, we published our regulatory simplification report. The report sets out ASIC’s progress on initiatives and seeks a broad range of views on how we can more efficiently and effectively administer the law in the areas we regulate, how we can make it easier to interact with us, and how we can simplify guidance, legislative instruments and forms.

Opportunities to reduce red tape through law reform are also on the table. Our efforts to simplify regulation of the financial sector will deliver benefits for consumers, businesses and investors, while contributing to the Government’s productivity agenda.

———-

Notes:
[1] ‘Australia’s startup scene is thriving at last’ (16 April 2026) The Economist

Kate O’Rourke

ASIC has outlined key focus areas for its financial reporting, audit and sustainability reporting activities in the 2026-27 financial year, including updates to its surveillance programs.

‘Our surveillance programs reinforce the importance of high-quality reporting and audit. Reliable financial information is critical to transparency in Australia’s capital markets and informed investment decisions by investors,’ said ASIC Commissioner Kate O’Rourke.

Financial reporting focus areas

In keeping with ASIC’s enduring financial reporting focus areas, we will monitor areas where significant judgement from preparers of financial reports is required. This includes revenue recognition, assessment of asset impairment, recognition and measurement of financial instruments.

For 2026-27, ASIC will review the financial reports of listed and unlisted companies, registrable superannuation entities (RSEs) and managed investment schemes (MISs).

ASIC will also review the disclosures of companies that have provisions for decommissioning and site-restoration costs. This will include assessing disclosures against new guidance issued by the AASB (illustrative example D of AASB 137 Provisions, Contingent Liabilities and Contingent Assets).

Audit focus areas

For 2026-27, ASIC will review 25 audit files. While ASIC will maintain its focus on listed and unlisted companies and RSEs, it will also include a selection of MISs.

Like in 2025-26, ASIC will select audit files from a mix of sources:

• where there has been a material correction to a financial report or where ASIC is concerned that a financial report may be materially misstated,
• based on other internal or external data (including independence threats), which indicates a risk to audit quality, or
• from a random selection process.

In responding to ASIC’s audit findings, audit firms indicate the remedial actions they intend to take. In 2026-27, we will monitor and report on firms’ implementation of those actions.

Separately, ASIC is engaging with the six largest firms to understand the firm-wide actions taken in response to Report 817 Building trust: Auditors’ compliance with independence and conflict of interest obligations.

Compliance activities

ASIC will continue to focus on non-lodgement of financial reports by large proprietary companies.

ASIC will also review compliance by registered company auditors with their obligations to lodge their annual statements. These obligations are fundamental requirements that support audit quality and auditor competence.

Sustainability reporting and assurance focus areas

ASIC has taken a range of steps to support entities’ compliance with the sustainability reporting framework, including guidance, relief and new educational materials. These are on our sustainability reporting webpage.

ASIC has updated its FAQs relating to the review and audit of sustainability reports in response to changes in the law and to address stakeholder questions, and have also provided sustainability reporting relief to related schemes. We are continuing to update our register of relief decisions to include ASIC’s decisions on individual sustainability reporting relief applications. ASIC has also shared preliminary observations on lodged sustainability reports. These observations will assist 30 June reporters as they prepare to lodge their sustainability report for the first time.

The Government has announced in the Budget that it proposes to commence consultation on reforms to reduce reporting burden while maintaining core sustainability reporting requirements, and ASIC will participate in that consultation process. Ahead of any reforms, ASIC’s administration of the mandatory climate reporting framework will continue, with a focus on the sustainability reports being submitted by Group 1 entities, and engagement with large audit firms on assurance methodologies as appropriate.

Background

ASIC’s reporting surveillance programs aim to foster high-quality, consistent and comparable financial information to help investors make informed decisions, ultimately supporting the integrity of Australia’s capital markets.

The objectives of these surveillance programs are outlined on ASIC’s audit inspection and surveillance programs webpage. Financial reporting misconduct, including non-lodgement of financial reports, and auditor misconduct are enforcement priorities for ASIC.

ASIC’s enduring focus areas relevant to the 2026-27 financial year are outlined on the sustainability reporting, financial reporting and audit focus areas webpage.

In 2025, ASIC released:

• Report 816 ASIC’s review into the financial reporting and audit of superfunds (REP 816)
• Report 817 Building trust: Auditors’ compliance with independence and conflict of interest obligations (REP 817)
• Report 819 ASIC’s oversight of financial reporting and audit 2024-2025 (REP 819).

These reports summarise findings from ASIC’s surveillance programs and other complementary work for the period 1 July 2024 to 30 June 2025. They highlights areas where the quality of financial reporting and audits can be improved.

If you aren’t on top of your cyber resilience already, the time to act and prepare is right now.

ASIC is calling on all licensees and market participants to urgently strengthen their cyber resilience measures, as frontier artificial intelligence (AI) intensifies the global cyber risk environment.

While cyber risk has always existed, misuse of frontier AI models such as Anthropic’s Claude Mythos could expose cyber security vulnerabilities at an unprecedented speed, scale, and sophistication.

In an open letter to Industry ASIC has urged entities to act now and not wait for advanced AI tools to uplift their cyber security fundamentals and ensure their systems can withstand AI-accelerated threats.

The letter, issued by ASIC Commissioner Simone Constant, emphasises the need for urgent, focused action using a principles-based, model-agnostic approach, reminding industry that cyber resilience must be treated as a core licensing obligation, not simply an IT issue.

Commissioner Constant said, ‘Cyber risk has entered a new era. The advent of frontier AI models creates opportunity, but also materially increases risk, with the ability to expose vulnerabilities far faster than many realise.

‘In this new world, weaknesses that once seemed isolated can now have a system-wide domino-effect, enabling new forms of exploitation that were previously out of reach for most malicious actors.’

Today’s letter follows ASIC’s recent court outcome against FIIG Securities Limited (26-021MR), which reinforced the legal case for cyber risk management controls to be demonstrably effective and proportionate to the size, nature and complexity of a business.

Ms Constant continued, ‘Entities need to have robust incident response plans. Whether an entity faces a basic phishing attempt or a more sophisticated cyber attack, the underlying cyber risk management principles of govern, protect, detect, respond remain the same.

‘Appropriate cyber risk management starts at the leadership of licensees and participants. Boards and executives must ensure systems are tested, weaknesses are addressed early and that action is taken before threats can be exploited.

‘The clock is at a minute to midnight – if you aren’t on top of your cyber resilience already, the time to act and prepare is right now.’

ASIC is urging entities to take the following steps now:

• reassess your cyber plans and refocus efforts on the most critical risks in today’s threat environment
• confirm your cyber risk, governance and overall risk and decision-making frameworks consider the cumulative impact of interrelated vulnerabilities and facilitate clear decision making and escalation at the pace necessary to manage risk
• identify and protect critical assets and systems, with a clear understanding of what matters most to your business and customers
• strengthen cyber security fundamentals by regularly reviewing and validating core controls
• minimise attack surfaces by reducing exposure of systems and services to untrusted networks
• regularly review user access and reassess privileges, to protect against unauthorised access Insider threats are increasing and entities should monitor for warning signs and act to restrict access where concerns are identified
• patch systems promptly, recognising that AI is accelerating vulnerability discovery and exploitation
• review and strengthen patch management processes, considering challenges daily patching may present to identification, testing, and governance of critical updates
• implement layered, defence-in-depth architectures that assume breach and restrict lateral movement
• prepare for incident response by maintaining and exercising incident response plans and playbooks including business continuity plans and identification of highest priority services, channels and platforms
• actively manage third-party risks, particularly where services introduce concentration or systemic exposure
• use AI for defensive purposes, where appropriate, including identifying vulnerabilities and securing software before release.

Entities are required to table the letter at their ultimate board and risk governance committees.

All ASIC-regulated entities should use practical guidance from trusted sources to strengthen cyber defences, including the Australian Signals Directorate (ASD).

ASIC also encourages the use of the Australian Government’s free and anonymous Cyber Health Check, which provides a tailored action plan with simple, actionable steps to improve cyber security.

ASIC will continue to work closely with other regulators, agencies and industry to monitor cyber risks and promote consistent expectations across the financial system.

Downloads

Letter to industry

Background

ASIC is working closely with other regulators – including global peers – to monitor developments in AI, assess impacts on the local market and proactively address emerging vulnerabilities.

ASIC’s regulatory resources include further information about cyber security and cyber resilience:

• Cyber resilience good practices
• Cyber risk: Be prepared
• Resources on cyber resilience

Entities may wish to also refer to APRA’s  recent letter to industry on Artificial Intelligence (AI).

ASIC recommends organisations and investors to consider advice from the ASD’s Australian Cyber Security Centre, subscribe to ASD alerts and consider the ASD partnership program where appropriate.

The ASD provides easy to understand advice about what to do when organisations and investors suffer a data breach via their Report and recover webpage.