Simon Carrodus

On 5 May 2021, the Federal Court handed down a landmark decision in Australian Securities and Investments Commission v RI Advice Group Pty Ltd (2022) FCA 496 by declaring that RI Advice Group Pty Ltd (RI Advice) had breached its obligation to:

1. provide financial services efficiently, honestly, and fairly, and
2. have in place adequate risk management systems, by failing to have adequate cybersecurity risk management controls in place. This was a landmark decision as it was the first time that an AFS licensee had been found to be in breach of the requirement for AFS licensees to provide financial services efficiently, honestly, and fairly by not having adequate cybersecurity risk management systems.

In this article, we explore:

1. What happened?
2. What did the Court say?
3. What does this mean for AFS licensees?
4. How The Fold can help.

What happened?

RI Advice, as the AFS licensee of more than 100 authorised representative (AR) practices, provided financial services to approximately 60,000 retail clients.

Between June 2014 and May 2020, a number of separate cybersecurity incidents occurred at the AR practices. These cybersecurity incidents involved:

1. the hacking of an AR practice’s Google email account
2. the hacking of an AR practice’s third party website provider (which hosted the AR practice’s knowledge centre)
3. a hacker sent an email to a client, from the email address of an employee of the AR practice, requesting money
4. an AR practice’s reception desk computer being subject to ransomware delivered by email, resulting in certain files being encrypted and made inaccessible
5. an AR practice’s server being hacked by brute force through a remote access port, resulting in files being held ransom and 220 client files becoming encrypted and unrecoverable
6. an AR practice being hacked through brute force and being undetected for several months, resulting in thousands of client files becoming compromised and personal information stolen – this also resulted in phishing emails being sent to clients
7. the hacking of an AR practice’s email and an email being sent to the AR practice’s bookkeeper requesting that funds be transferred to a Turkish bank, and
8. the hacking of an employee of an AR practice’s email resulting in 150 phishing emails being sent to the AR practice’s clients requesting that they access a Dropbox folder.

While RI Advice had organised some cyber security training sessions for its ARs and had implemented some information security controls s, RI Advice conceded that these steps were inadequate to manage its cyber security risk across its AR practices.

It was also identified that at one particular AR practice up to 90% of the desktops did not have up to date anti-virus software, no scans were scheduled during the week for antivirus software, no offsite backup had been performed and password and security details were found in text files on the server desktop.

In June 2018, RI Advice engaged cyber security consultants and independent experts to investigate specific incidents and to identify and implement measures to address cybersecurity risks. RI Advice also updated its cyber security policies and introduced measures that required its authorised representatives hold cyber insurance. However, RI Advice but admitted that it took too long to implement these measures across its practices.

On 21 August 2020, ASIC commenced proceedings against RI Advice for an alleged failure to:

1. provide financial services efficiently, honestly, and fairly
2. comply with the conditions of its AFS licence
3. comply with financial services laws, and
4. have available adequate resources provide the financial services and carry out supervisory arrangements.

ASIC and RI Advice ultimately settled the matter, with RI Advice admitting to the Court on 7 April 2022 that it had contravened its obligations to:

1. provide financial services efficiently, honestly, and fairly, and
2. have in place adequate risk management systems.

What did the Court say?

Efficiently, honestly, fairly

Although RI Advice admitted to contravening section 912A(1)(a) of the Corporations Act, it disagreed with ASIC’s argument regarding what was the appropriate test for determining whether a breach of this section had occurred.

RI Advice argued that the “public expectation” test (as submitted by ASIC) was not the appropriate test for determining whether an AFS licensee had breached the efficiently, honestly, and fairly obligation.

Justice Rofe agreed with RI Advice, stating that:

“In a technical area such as cybersecurity risk management, the reasonable standard of performance is to be assessed by reference to the reasonable person qualified in that area, and likely the subject of expert evidence before the Court, not the expectations of the general public”.

RI Advice also argued that, while they admitted to contravening the efficiently, honestly, and fairly provision, it did not mean that they had not acted “honestly”.

Justice Rofe agreed with RI Advice stating that a party could contravene the efficiently, honestly, and fairly obligation without having acted dishonestly.

Adequate risk management systems

RI Advice also admitted to contravening the requirement under the Corporations Act to have in place adequate risk management systems. Justice Rofe provided some guidance around what constituted “adequate risk management systems”.

On the question of “adequacy”, her Honour clarified that the Court’s assessment of adequate risk management systems (including those of AFS licensee) will be informed by evidence from relevantly qualified experts in the field.

Outcome

As a result of RI Advice admitting to contravening sections 912A(1)(a) and (h) of the Corporations Act, the Court ordered that RI Advice must:

1. Engage a cybersecurity expert to identify what further documentation and controls in respect of cybersecurity and cyber resilience are necessary for RI Advice to manage risk across its AR practices, and
2. Pay $750,000 towards ASIC’s costs.

What does this mean for AFS licensees?

The RI Advice case clarifies that each AFS licensee must have in place cybersecurity risk management systems across their AR network to protect themselves and their clients from cybersecurity attacks. This includes:

1. up-to-date anti-virus software
2. regular virus scans across the whole AR network
3. up-to-date cybersecurity and cyber resilience training for directors, employees and ARs
4. an AFS licensee cybersecurity policy which ARs are required to implement and comply with as a part of their AR agreement. The cybersecurity policy should address:
   1. Data protection
   2. Password protection and storage, and
   3. Process for dealing with spam and suspected phishing emails.

This case also makes it abundantly clear that the cyber resilience of an AFS licensee’s AR network is the responsibility of the AFS licensee and not the individual AR practice. Determining whether a breach of your AFS licensee obligations requires technical knowledge and expertise in cybersecurity.

How The Fold can help

If you are concerned that your cybersecurity risk management systems and policies may not be adequate, we are here to help.

Through our relationship with some of the best cybersecurity firms in Australia, The Fold Legal can conduct a coordinated cybersecurity health check. We will:

1. Update or create your cybersecurity and cyber resilience policies;
2. Conduct cybersecurity penetration tests of your risk management systems;
3. Provide advice on any identified cybersecurity breaches and how they impact your AFS licensee obligations; and
4. Conduct a full cybersecurity review to ensure that you are running a “best-in-practice” AFS licensee business.
By Simon Carrodus and Glenjon Aligiannis.

The post “Have you tried turning it off and on again?” – A review of the decision in ASIC V Ri Ad appeared first on AdviserVoice.

Simon Carrodus

On 28 March 2022 the Australian Securities and Investments Commission (ASIC) released Report 722 ‘ASIC Enforcement Update July to December 2021’ (Report 722).

In this article, we:

1. review the key data points in Report 722 and compare them against the previous update – ‘ASIC Enforcement Update January to June 2021’ (Report 699)
2. provide you with our insights and commentary;
3. review the relevant data for financial services specifically, and
4. provide you with our contact details in case you have any questions!

Key data points from Report 722 and Report 699

The second half of 2021 was another busy year for ASIC’s Enforcement Team. Here at The Fold Legal, we pay attention to ASIC’s biannual Enforcement Updates to monitor themes and trends. And of course we like to share our analysis with you.

Below are the figures for the second half of 2021 identified in Report 722 compared against the first half of 2021 as outlined in Report 699:

*Only two (2) people were imprisoned, although ASIC obtained six (6) custodial sentences. For consistency, we have only included the number of people imprisoned, in keeping with Report 699.

What does this tell us?

From the table above, we can see that in the second half of 2021, ASIC increased its activity within the market in the following areas:

1. individual charges in criminal proceedings
2. criminal charges laid, and
3. civil penalty cases commenced.

ASIC also appears to have experienced an increasingly successful end to 2021, by securing an increase in:

1. non-custodial sentences;
2. the value of the civil penalties imposed by the courts (an increase of over 180%); and
3. individuals disqualified or removed from directing companies.

Given this data, we expect the next Enforcement Update to indicate a proportionate increase in these areas for the first half of 2022. This is because ASIC has:

1. commenced 21 civil penalty proceedings, an increase of 9 since the first half of 2021, and
2. seen the number of civil penalty proceedings before the courts increase by 12.

We also can expect that ASIC will continue to conduct its investigations at a similar pace – around 50 investigations per half-year.

What does this mean for the financial services industry?

Report 722 showed a small, but important, decline in enforcement activity across the financial services industry more broadly.

When comparing the reported figures in Report 722 to those in Report 699, we see the trends outlined in the table further below.

NOTE:

1. The figures represented are the differences between the two Reports. For example, the first reported number of -3 for ‘Credit’ means that there were 3 fewer criminal credit case outcomes in Report 722 vs Report 699, and
2. Insurance was not addressed in Report 699:

From this we can see that:

1. ‘Financial advice’, ‘Investment management’ and ‘Other financial services’ saw moderate to significant increased enforcement activity during the latter half of 2021, and
2. ‘Credit’ and ‘Superannuation’ saw significant declines in enforcement activity during the same period.

These trends accord with what we are seeing in the market at the moment. Financial advice continues to be a strong area of interest to ASIC with an uptick in the number of administrative proceedings brought by the regulator.

What next?

We anticipate that the next Enforcement Update from ASIC will show that it has been an equally busy, if not busier, period than the second half of 2021. This is due to:

1. the increased number of civil penalty proceedings commenced
2. the increased number of civil penalty proceedings before the courts currently, and
3. the consistently high number of investigations commenced during the latter half of 2021.

This is in line with what we are seeing, and we encourage our clients to seek professional advice as early as possible when they receive a communication from ASIC.

If you’ve had contact from ASIC and are unsure of what to do, please contact us. We deal with ASIC every day and will be happy to navigate your through the process.

By Simon Carrodus and Glenjon Aligiannis

The post Who watches The Watchmen? We do – a review of the ASIC Enforcement Update appeared first on AdviserVoice.

Simon Carrodus

On 2 August 2021, the Federal Court handed down its decision in the matter of Australian Securities and Investments Commission v RI Advice Group Pty Ltd (No 2) (2021) FCA 877.

Background

The Australian Securities and Investments Commission (ASIC) commenced proceedings against RI Advice Group Pty Ltd (RI Advice) for an alleged failure to comply with section 961L of the Corporations Act 2001 (Cth) (Corporations Act) by failing to take ‘reasonable steps’ to ensure that its authorised representative (Mr John Doyle) complied with his obligation to:

1. Act in the best interests of the client (section 961B of the Corporations Act)
2. Provide personal advice that is appropriate for the client (section 961G)
3. Warn the client where personal advice is based on incomplete or inaccurate information (section 961H), and
4. Prioritise the client’s interests where there is a conflict of interest between the interests of the adviser and the client (section 961J).

Mr Doyle admitted to each of the alleged contraventions of the Corporations Act.

ASIC’s case against RI Advice

In summary, ASIC’s case against RI Advice was that:

1. RI Advice knew or ought to have known that Mr Doyle was not meeting RI Advice’s standards and was not complying with its business rules, and that there was a substantial risk that he was breaching his legal obligations
2. Despite repeated warning signs, RI Advice failed to take any significant steps to investigate Mr Doyle until mid-2015, after ANZ, which owned RI Advice at the time, reviewed a selection of Mr Doyle’s advice files and gave them the worst possible rating on its advice scorecard;
3. As a result, ANZ undertook further file reviews, which identified similar issues with Mr Doyle’s other client
4. By failing to take reasonable steps, RI Advice effectively ensured that Mr Doyle’s clients and their investments would stay with RI Advice as Mr Doyle’s clients would not be made aware of the inappropriate advice they had received, and
5. RI Advice permitted Mr Doyle to keep advising clients where there was a substantial risk that he would breach the best interest obligation.

Lessons for AFS licensees

“Although the duty in s 961L is broad, the case law has begun to fill in the contours of what is expected of a licensee by way of compliance with the provision.”

In making its decision, the Federal Court supported the proposition that whilst AFS licensees are legally obliged under section 961L to take reasonable steps to ensure that their representatives (including authorised representatives) comply with sections 961B, 961G, 961H and 961J (Relevant Sections), they are not required to take optimal steps in ensuring compliance with those sections.

This is a particularly interesting statement from the Federal Court as it creates a scale that the Federal court will use when assessing the steps taken by an AFS licensee to comply with the Relevant Sections. This scale is divided into four parts:

1. Steps at the higher end, considered “optimal” (read as best practice)
2. Steps which, although not optimal, are reasonable
3. Steps which are not reasonable in ensuring that representatives comply with the Relevant Sections, and
4. Steps which were not taken by the AFS licensee but, had they been taken, would have been reasonable in ensuring that representatives complied with the Relevant Sections.

Distinguishing between the first two categories is unnecessary as any steps taken by an AFS licensee that are considered to be optimal will mean that it is automatically categorised as reasonable.

With this in mind, The Fold Legal considers it to be of significant importance for AFS licensees to be able to:

1. Distinguish between steps that are reasonable, and those that are not reasonable, in ensuring that representatives comply with the Relevant Sections
2. On an ongoing basis, consider whether a step that was once reasonable may no longer be reasonable as the business evolves (particularly as the business grows or down-sizes), and
3. Consider which steps they are not taking, which, had they been taken, may be reasonable in ensuring that their representatives comply with the Relevant Sections.

The Federal Court also outlined that the steps an AFS licensee must take to ensure its representatives are complying with the Relevant Sections are dependent on the specific obligation that the AFS licensee is attempting to comply with. This means that what is reasonable in ensuring that a representative complies with the best interest duty may not be reasonable in ensuring that a representative prioritises the client’s interests over their own.

Unfortunately, there are an enormous number of compliance measures, actions and steps that an AFS licensee must consider and take in attempting to ensure that its representatives comply with the Relevant Sections. Each of these steps falls into one of the four categories outlined above.

Unlike the safe harbour steps outlined in section 961B(2) of the Corporations Act, there is no clear pathway for compliance for section 961L, which makes it still particularly tricky for AFS licensees to navigate safely.

Penalties

The penalties for failing to comply with section 961L can be significant. Recently, on 6 February 2022, the Federal Court penalised RI Advice $6 million for their repeated failure to comply with section 961L, even though RI Advice had taken steps to remediate all clients affected by Mr Doyle’s conduct. The Federal Court determined that a substantial penalty was warranted in this case, signifying the importance of understanding the obligation to take reasonable steps pursuant to section 961L.

AFS licensees will need to take into consideration the following when determining whether any step, measure or action is to be implemented or taken:

1. The number of representatives of the AFS licensee
2. The composition of the AFS licensee’s representatives (either employed advisers or authorised representatives), and
3. The structure of the AFS licensee (is it a vertically integrated model or not?).

Here at The Fold Legal, we try to make the complex simple. We have advised many AFS licensees on the steps, measures and actions they should take (and not take) to ensure compliance with section 961L.

If you are concerned about your obligations as an AFS licensee or would like to review the steps you are taking to comply with section 961L, please get in touch. We are here to help.

By  Simon Carrodus and Glenjon Aligiannis

The post Who Would Be An AFSL? – The Court’s Review Of Section 961L appeared first on AdviserVoice.