Operational Resilience / Outsourcing in Australia

Key dates

2026-12-04 Deadline

ASIC consultation on CS 69 and the proposed RG 172 update closes at 5pm AEDT.

Suggested considerations

• Market licensees should consider submitting responses to CS 69 by 5pm AEDT on 4 December 2026, addressing whether the proposed methodology is workable for their business model and venue type.
• Compliance teams may wish to map current financial-resources calculations against the proposed six-month minimum and identify whether all venue, group, outsourcing and related-party operating costs are included.
• Licensees should consider separating liquid resources supporting continuity and recovery from capital buffers supporting positive net assets and loss absorption, and documenting the legal availability of each resource.
• Market operators may wish to perform severe-but-plausible recovery and orderly-wind-down scenarios, including critical-service recovery, prolonged disruption, higher professional costs and support for affected users.
• Significant market venues should consider developing or enhancing scenario analysis, stress-testing governance, assumptions, frequency, management information and escalation thresholds.
• Finance and compliance functions may wish to prepare evidence linking financial-resources calculations to specific balance-sheet items and to the methodologies and assumptions reported under section 792F.
• Boards and senior management should consider reviewing dividend, distribution, intra-group funding and other capital-management controls to prevent actions that could cause or reasonably be expected to cause a financial-resources shortfall.
• Licensees should consider establishing documented monitoring, notification and remediation processes for actual or prospective shortfalls, including assessment of notification obligations under section 792B and restoration timeframes agreed with ASIC.

What changed

The consultation proposes revised RG 172 guidance supporting the existing obligation in section 792A(1)(d) of the Corporations Act 2001 to maintain sufficient resources to operate a market properly. A licensee would assess resources for all of its activities, not only a particular venue, and would generally need resources sufficient to cover at least six months of operating expenses; the assessment should include relevant service and outsourcing costs, including related-party arrangements.

Key dates

2021-04-20

Start of the relevant period during which Fortnum admitted the cybersecurity governance failures occurred.

2022-01-01

Independent industry reporting identified a 2022 cyber incident at a Fortnum authorised representative involving data relating to up to 9,828 clients; the ASIC publication does not specify the incident date.

2023-05-11

End of the relevant period covered by Fortnum’s admissions.

2025-07-22

ASIC commenced Supreme Court of NSW proceedings against Fortnum concerning alleged failures to manage and mitigate cybersecurity risks.

2026-10-12

The Supreme Court of NSW approved the agreed $1.35 million pecuniary penalty and ordered Fortnum to pay $250,000 toward ASIC’s costs.

2026-10-14

ASIC published the enforcement outcome and stated that this was its third cyber-resilience enforcement action against an AFSL holder, following RI Advice and FIIG Securities.

Suggested considerations

• Compliance teams may wish to map cybersecurity governance to the licensee’s obligations under section 912A of the Corporations Act 2001 (Cth), including documented ownership, escalation and board or senior-management oversight.
• Firms should consider assessing whether their cybersecurity policy applies consistently to authorised representatives, outsourced providers and other connected practices, with minimum controls, implementation evidence and exception-management processes.
• Licensees may wish to establish a documented assurance programme covering representative due diligence, cyber training, control testing, incident reporting, vulnerability management and periodic reviews of representative cyber resilience.
• Firms should consider whether they have access to suitably qualified cybersecurity expertise, either internally or through appropriately scoped external specialists, and retain evidence that advice informs the risk-management framework.
• Compliance teams may wish to test whether their risk-management system identifies and evaluates cyber risks across the entire advice network and whether monitoring results are reported to accountable senior personnel.
• Following a cyber incident or material control deficiency, firms should consider prompt escalation, preservation of evidence, assessment of notification obligations and constructive engagement with ASIC; Fortnum’s self-reporting and cooperation were identified as relevant factors in the agreed penalty.
• Firms should consider validating that cyber controls protect highly sensitive personal information, including identity documents, tax file numbers and financial-account details, and that remediation is independently verified rather than limited to policy updates.

What changed

No new rule or prospective compliance deadline was introduced. The enforcement outcome establishes a further ASIC precedent that an AFSL holder’s obligation to provide financial services efficiently, honestly and fairly and to maintain adequate risk-management systems extends to cybersecurity controls, specialist expertise and oversight of authorised representatives.

Key dates

2021-10-31

The insured family lodged the storm-related home insurance claim after roof damage in October 2021.

2022-08-01

A structural engineering assessment occurred approximately eight months after the need for one was identified; the source gives August 2022 but not an exact day.

2022-12-01

After the family complained to Hollard in late 2022, Hollard offered a $1,000 goodwill payment, which was rejected; the source gives only the month and year.

2023-04-01

Hollard made its final claim decision and rejected the claim approximately 15 months after initially accepting it; the source gives April 2023 but not an exact day.

2025-04-01

ASIC commenced Federal Court proceedings alleging breaches of section 13(2A) of the Insurance Contracts Act 1984 (Cth); the source gives April 2025 but not an exact day.

2026-10-09

The Federal Court ordered Hollard to pay a $2 million civil penalty for breach of the duty of utmost good faith.

Suggested considerations

• Compliance teams may wish to review open and recently closed home and property claims for extended periods of inactivity, delayed expert assessments, repeated reassignment, late temporary accommodation and decisions inconsistent with available expert evidence.
• Insurers should consider testing whether claims systems identify deterioration risks, vulnerable customers, habitability issues and requests for emergency accommodation, and whether those matters trigger timely management escalation.
• Firms should consider documenting clear ownership, next actions, decision dates and customer communications throughout the claim, including reasons for any investigation or decision delay.
• Insurers may wish to assess whether rejection decisions are supported by appropriate technical evidence and whether new evidence is properly reconciled with earlier inspections or admissions of cover.
• Claims governance functions should consider reviewing outsourced-provider service levels, escalation controls and management information for aging claims, complaint recurrence, temporary accommodation delays and claims exceeding internal handling targets.
• Legal and compliance teams may wish to map controls against Insurance Contracts Act 1984 (Cth), section 13(2A), and Corporations Act 2001 (Cth), section 912A(1)(a), while considering ASIC's 2024 claims-handling letter, 2025 review findings and 2026 enforcement priority.

What changed

The judgment establishes a binding enforcement precedent that an insurer may incur a civil penalty under section 13(2A) of the Insurance Contracts Act 1984 (Cth) where claims handling falls materially below the duty of utmost good faith. It does not introduce a new statutory claims-handling rule or compliance deadline, but confirms that insurers must handle claims fairly, communicate clearly, progress investigations and decisions without unnecessary delay, and respond appropriately when delay risks further insured loss.

Key dates

2026-04-30

APRA issued its letter to banks, insurers and superannuation trustees calling for a step-change in governance, risk management, assurance and operational resilience for AI-related risks.

2026-05-08

ASIC issued its open letter to all licensees and market participants urging urgent strengthening of cyber resilience as frontier AI intensifies the global cyber-risk environment.

2026-06-01

ASIC and APRA began the June–July 2026 series of nine industry roundtables on frontier-AI preparedness and resilience; the source identifies June as the starting month but does not provide an exact day.

2026-07-31

ASIC and APRA completed the June–July 2026 roundtable period; the source does not provide an exact closing day.

2026-08-27

ASIC published the joint warning and related information paper and preparedness checklist, urging entities to move from awareness to action.

Suggested considerations

• Firms should consider presenting the ASIC and APRA roundtable themes, together with the available board and executive preparedness checklist, to the board and relevant risk or technology committees.
• Compliance teams may wish to map frontier-AI cyber and operational risks to existing obligations and controls under APRA CPS 230 Operational Risk Management, APRA CPS 234 Information Security, APRA CPS 220 Risk Management where applicable, and the entity's ASIC licence, governance and cyber-resilience arrangements.
• Firms should consider identifying critical assets, systems, data flows and material third-party dependencies, including common providers and concentration points that could create sector-wide disruption.
• Technology and security teams may wish to test patching, identity and privileged-access controls, attack-surface reduction, backup integrity, recovery-time priorities and incident-response playbooks against AI-accelerated attack scenarios.
• Boards and executives should consider documenting risk appetite, incident escalation authority, recovery priorities, internal and external communication strategies and decision rights before a frontier-AI-related crisis occurs.
• Firms should consider testing response and recovery arrangements under compressed timeframes and retaining evidence of exercise results, lessons learned, remediation owners and completion status.
• Entities using or procuring AI should consider applying existing model, data, supplier, change-management and assurance controls to internally developed models, vendor tools and embedded AI functionality, including defensive-AI tools used for threat intelligence, vulnerability detection, code review or incident response.
• Procurement and outsourcing functions may wish to strengthen supplier assurance, obtain relevant information on providers' AI and cyber controls, map material dependencies and assess substitutability and exit arrangements.

What changed

The regulators have consolidated a cross-sector expectation that entities address frontier-AI risk through cyber fundamentals, critical-asset identification, timely patching, strong identity and access controls, attack-surface reduction, reliable backups, tested response and recovery arrangements, and third-party risk management.