Enforcement Actions

Key dates

2016-07-01

Beginning of the period during which Sunshine Loans entered into contracts containing the unlawful amendment fee.

2019-03-13

Relevant fee contraventions became civil penalty provisions; civil penalties were available only for contraventions from this date.

2020-11-01

Sunshine Loans ceased charging the amendment or rescheduling fee shortly after ASIC intervention.

2022-06-01

ASIC commenced Federal Court civil penalty proceedings against Sunshine Loans.

2024-04-12

The Federal Court found that Sunshine Loans had contravened the National Credit Code by imposing, charging and accepting the prohibited fee.

2025-03-24

The Full Federal Court dismissed Sunshine Loans' liability appeal and determined the relevant appeals in ASIC's favour.

2026-03-18

The High Court unanimously dismissed Sunshine Loans' appeal concerning the recusal issue, allowing the penalty matter to return to the Federal Court.

2026-11-06

The Federal Court ordered Sunshine Loans to pay a $5.5 million civil penalty and ASIC's costs.

Suggested considerations

• Compliance teams may wish to inventory every fee and charge applied to small amount credit contracts and map each one to an expressly permitted category under the National Credit Code.
• Lenders should consider testing repayment-date changes, hardship arrangements, restructures and other contract variations to confirm that fees are not imposed when a consumer is not in default.
• Firms should consider conducting a historical review of fee configuration, customer communications, contract templates, payment records and general ledger data to identify comparable conduct and quantify affected consumers.
• Where potentially unlawful fees are identified, firms should consider stopping the relevant charging logic, preserving records, assessing remediation and notifying relevant governance bodies and regulators where appropriate.
• Credit licensees may wish to strengthen legal review and compliance sign-off for product terms and fee changes, including documented evidence supporting the legality of each fee.
• Boards and senior management should consider whether compliance monitoring adequately tests fee restrictions for products used by financially vulnerable consumers and whether identified issues are escalated promptly.
• Firms should consider reviewing whether their dispute-resolution and remediation processes enable affected consumers to obtain redress through internal complaints handling and the Australian Financial Complaints Authority.

What changed

This is an enforcement outcome rather than a new legislative rule. The Court confirmed that small amount credit contract providers may impose only the fee categories permitted by the National Credit Code: an establishment fee, a monthly fee, a fee payable on default, or a government fee, charge or duty. A $35 fee for rescheduling a repayment where the consumer was not in default did not fall within those categories.

Key dates

2026-11-02

The FCA published an earlier statement warning about demands for repayment of disguised-remuneration scheme loans, the possible need for a Validation Order and undue pressure in debt collection.

2026-11-05

The FCA published the intervention and the restrictions agreed with Ethica Resolve Limited and West 28th Street Limited.

Suggested considerations

• Firms servicing or collecting historic disguised-remuneration loans should identify affected portfolios, pause demands and litigation activity falling within the FCA restrictions, and confirm the precise scope of any agreed requirements with the FCA.
• Ethica should complete and evidence the required consumer communications, including the explanation that payment is not currently enforceable, and maintain records of recipients, delivery attempts and unresolved cases.
• Compliance teams should review whether correspondence, telephone contact, default notices, letters of claim and court instructions could create undue pressure or inaccurately imply that immediate payment is legally required.
• Firms should establish a vulnerability-identification and support process covering consumers experiencing health, financial or comprehension difficulties, with appropriate escalation, reasonable adjustments and management information.
• Debt servicers should verify the creditor's ownership, the chain of assignment, the original lender's regulatory status and any applicable consumer-credit permissions or exemptions before pursuing repayment.
• Legal and compliance teams should assess whether any proposed enforcement requires an FCA Validation Order or other court permission, recognising that a Validation Order is not guaranteed and that the FCA has stated that the debt may remain unenforceable if required permission is not granted.
• Firms should ensure that no default judgment is sought in the affected claims and that consumers continue to receive accurate information that formal court documents should not be ignored.
• Senior management should review outsourcing, agency and oversight arrangements where an authorised firm acts for an unauthorised debt purchaser, including conduct risk, consumer-outcome monitoring and escalation to the FCA where harm may have occurred.

What changed

Ethica must write to affected consumers explaining that they do not currently have an enforceable obligation to pay and therefore do not need to make payment at this stage. Ethica must not make further demands for payment from affected consumers in the current proposed court claim while the relevant issues remain unresolved. Ethica and West 28 must not seek default judgments against consumers who have not responded to a legal claim. Ethica must identify affected vulnerable consumers and put additional protections in place.

Key dates

2021-12-20

The AFM published its exploratory report on finfluencing, identifying unlicensed advice, risky recommendations, cooperation with unlicensed firms and customer-referral fees as key pitfalls.

2026-08-31

The Rotterdam District Court reduced the Van den Brink fine by €52,500 to €142,500, citing proportionality, delayed AFM action and breach of the reasonable-time requirement under Article 6 ECHR.

2026-11-05

The AFM published the enforcement update describing the original €195,000 fine and the court's final €142,500 outcome.

Suggested considerations

• Compliance teams should consider inventorying all finfluencer, affiliate, introducer and referral arrangements, including website links, discount codes, lead forms and onboarding assistance.
• Firms should consider verifying the AFM authorisation status of every investment-service provider, platform or asset manager promoted by employees, affiliates or contracted influencers before publication or referral activity begins.
• Investment firms should consider testing whether any payment is calculated by reference to the number of referred customers, account openings, onboarding progress, deposits or invested assets, as these features create heightened Dutch inducement and conduct risk.
• Firms should consider separating permitted advertising services from customer-introduction or onboarding activities and documenting why each arrangement does not involve unauthorised investment advice, portfolio management or participation in unlicensed services.
• Marketing and compliance teams may wish to review influencer scripts, direct messages, Q&A responses and customer-support practices for advice, personalised recommendations or operational assistance that exceeds passive advertising.
• Firms should consider collecting and retaining contracts, commission calculations, communications, approval records and evidence of licence checks so that the commercial purpose and control framework for each promotion can be demonstrated.
• Governance committees may wish to treat unusually high or asset-based referral commissions, including percentages of customer deposits, as escalation indicators requiring enhanced legal and compliance review.
• Firms should consider reviewing legacy arrangements in light of the AFM's 2021 finfluencer findings and subsequent enforcement against referral-fee models, including arrangements involving execution-only services.

What changed

This is an enforcement action rather than a new rule or general licensing amendment. The AFM treated Van den Brink's combined activities—promotion through social media and a website, investor introduction, assistance with registration, responses to investor questions and acting as a contact person—as participation in illegal asset management, not merely advertising. The AFM stated that Grinta Invest had no required licence and that Van den Brink received substantial referral remuneration, including 10% of investors' deposited capital; the remuneration was relevant to the original fine.

Key dates

2026-11-04

ASIC published the enforcement notice covering 22 large proprietary companies and confirmed total payments of $4,356,000.

2025-08-01

Approximate month in which ASIC commenced its data-focused surveillance of large proprietary companies and other entities for late or missing financial reports.

Suggested considerations

• Compliance teams may wish to map every Australian entity in the corporate group against its financial reporting obligations, including changes in size, ownership, control, corporate structure and operations.
• Firms should consider maintaining a central obligations register recording each entity's financial year end, applicable reporting category, audit requirements, board approval milestones and ASIC lodgement deadline.
• Finance and governance functions may wish to schedule audit planning, management accounts, director approvals and electronic lodgement sufficiently early to address audit-related delays.
• Directors and company secretaries should consider reviewing whether any financial reports, directors' reports or auditors' reports are overdue and arranging prompt lodgement rather than waiting for ASIC contact.
• Groups may wish to document controls for identifying newly reportable entities, including entities that become large proprietary companies or become foreign-controlled.
• Compliance teams should consider retaining evidence of deadline monitoring, auditor engagement, escalation of reporting delays and remediation of overdue filings in case ASIC opens a surveillance review.
• Where ASIC has contacted an entity or an infringement notice has been paid, firms should consider confirming whether all outstanding reports have been lodged because ASIC states that its investigation may continue and payment does not resolve separate reporting obligations.

What changed

No new statutory reporting rule was introduced. ASIC has escalated enforcement of existing obligations under the Corporations Act 2001, including the requirement for large proprietary companies and other prescribed entities to prepare, audit and lodge required financial reports, directors' reports and auditors' reports within the applicable statutory period. For most entities required to lodge, the general deadline is within four months after financial year end; disclosing entities, registered schemes and registrable superannuation entities generally have three months.

Key dates

2018-08-03

iSignthis represented that less than 15% of quarterly revenue came from one-off or set-up fees; the Court found that the proportion exceeded 75% and that approximately AUD 3 million of one-off revenue and AUD 2.85 million of related one-off costs were not disclosed.

2020-05-12

iSignthis received Visa's letter communicating the finality of Visa's decision to terminate its relationship; the Court found that disclosure to the ASX was required on or shortly after this date.

2020-12-07

ASIC commenced civil penalty proceedings against iSignthis and Nickolas John Karantzis.

2022-05-11

iSignthis changed its name to Southern Cross Payments Ltd.

2022-11-04

Southern Cross Payments Ltd was delisted from the ASX.

2024-06-21

The Federal Court found that iSignthis had contravened disclosure laws and that Karantzis had breached relevant director duties.

2025-08-08

The Federal Court ordered iSignthis to pay a AUD 10 million penalty and ordered Karantzis to pay AUD 1 million and be disqualified from managing corporations for six years.

2025-09-05

iSignthis and Karantzis lodged appeals against the liability and penalty decisions.

Suggested considerations

• Firms should consider reviewing continuous-disclosure procedures against Corporations Act 2001 section 674 and ASX Listing Rule 3.1, including escalation criteria for operational, commercial and revenue information.
• Compliance teams may wish to test whether financial reporting distinguishes recurring revenue from one-off or set-up fees and discloses material associated costs consistently with market communications.
• Listed entities should consider documenting how they assess materiality, finality and reasonable grounds for delay when a major counterparty indicates that a contract or relationship may end.
• Boards and senior officers may wish to review controls ensuring that information provided to the ASX is accurate, complete and not misleading, including verification of statements made in analyst briefings and investor presentations.
• Firms should consider confirming that trading suspensions do not cause disclosure controls to stop operating and that market-sensitive developments continue to be assessed during a suspension.
• Companies may wish to retain contemporaneous records of disclosure decisions, legal advice, board or committee deliberations and communications with counterparties where disclosure timing is disputed.
• Compliance teams should consider whether director and officer accountability frameworks adequately address the risk of personal civil penalties and disqualification for failures to take reasonable steps to ensure ASX information is accurate.

What changed

The appeal did not introduce a new statutory obligation, but it confirms the substantial enforcement consequences of existing Australian continuous-disclosure and director-duty requirements. The Court upheld findings concerning iSignthis's failure to accurately disclose the extent of one-off revenue and related costs, and its failure from 12 May 2020 to disclose Visa's decision to terminate its relationship and the reasons communicated by Visa.

Key dates

2019-08-01

Start of the period in which ASIC alleges more than $600 million was invested in First Guardian and the alleged failures occurred.

2024-05-01

Falcon Capital froze or suspended redemptions from First Guardian, subject to limited exceptions.

2025-02-24

The Federal Court made interim orders freezing the assets of Falcon Capital, First Guardian and David Anderson.

2025-04-09

The Federal Court ordered Falcon Capital and First Guardian to be wound up and appointed liquidators and a receiver in related orders.

2026-10-30

ASIC announced commencement of civil penalty proceedings against David Anderson and Simon Selimaj and its application for leave to proceed against Falcon Capital in liquidation.

Suggested considerations

• Compliance teams may wish to inventory all related-party, connected-party and director-linked investments across managed investment schemes, including indirect exposures through controlled underlying funds.
• Firms should consider testing whether each private-credit, property and private-equity investment has current executed documentation, enforceable security, independent valuation support, documented approval, appropriate concentration analysis and evidence of ongoing monitoring.
• Responsible entities and trustees may wish to reassess whether investment committees exercise meaningful independent oversight, particularly where a chief executive, director or investment officer can originate, approve or vary investments without effective challenge.
• Firms should consider refreshing conflicts registers and reviewing whether conflicts were identified, disclosed, avoided or managed before investor funds were committed, including conflicts involving hospitality, alcohol-related businesses, technology ventures, property developments and payments to entities controlled by officers or associates.
• Product issuers may wish to review product disclosure statements and other investor communications for unsupported claims about robustness, diversification, security, liquidity, risk controls or investment processes, and assess whether any corrective disclosure or remediation is required.
• Platform operators, trustees and advice licensees may wish to review onboarding and due-diligence files for complex private-market products, including verification of valuations, underlying-fund registration status, custody arrangements, liquidity assumptions and the identity of related parties.
• Advice licensees may wish to test whether recommendations to transfer superannuation or establish an SMSF and invest in high-risk managed schemes were supported by documented best-interests analysis, appropriate disclosure and suitability assessments.
• Senior managers and boards may wish to preserve records demonstrating challenge, escalation, monitoring and follow-up of exceptions, red flags, valuation concerns, redemption restrictions and unusual related-party payments.

What changed

This is an enforcement action rather than a new rule or generally applicable legislative amendment. ASIC alleges that Falcon Capital, as responsible entity of the First Guardian Master Fund, failed to maintain effective investment governance, due diligence, documentation, security, conflict management and oversight; misled investors through product disclosure statements describing robust investment processes; and allowed at least $57 million to be paid to entities controlled by Anderson or Selimaj.

Key dates

2017-09-01

Start of the period identified by ASIC for the alleged directors’ and officers’ duty breaches concerning the Crown insurance arrangements; the date is approximate because ASIC states only September 2017.

2018-11-30

End of the period identified by ASIC for the alleged directors’ and officers’ duty breaches; ASIC states November 2018.

2022-03-01

ACBF entities entered liquidation; ASIC states March 2022, without specifying the exact day.

2026-02-01

The contested liability hearing concerning Jones took place in February 2026; ASIC has not specified the exact day.

2026-06-30 Deadline

Closing date for applications to the Government’s Youpla Support Program.

2026-10-30

ASIC announced the findings against Jones and Pattenden and the orders agreed with Pattenden.

2026-12-01

Payments under the Youpla Support Program are scheduled to continue being processed until this date.

Suggested considerations

• Firms should consider reviewing board and committee processes for identifying, disclosing and managing actual or potential conflicts involving directors, officers and related parties.
• Compliance teams may wish to test whether related-party insurance, reinsurance, outsourcing and service arrangements are demonstrably in the company’s interests, supported by independent analysis and properly documented board decisions.
• Boards may wish to review whether premium changes, counterparty concentration, offshore structures and insurer solvency risks are escalated promptly and communicated appropriately to affected customers.
• Insurers and other firms serving vulnerable or First Nations consumers should consider whether product governance, distribution controls and customer communications adequately address cultural, language, literacy and affordability risks.
• Companies should consider retaining evidence showing that directors challenged management assumptions, considered viable alternatives and monitored the ongoing financial and consumer consequences of material arrangements.
• Legal and compliance teams may wish to monitor the later penalty hearing for Jones and the reserved decisions concerning Jonathan Law, Michael Wilson and Geoffrey Clayton, as those outcomes may provide further indications of ASIC’s approach to individual accountability and director disqualification.
• Firms should distinguish this case from a new industry-wide rule: the immediate orders apply to Pattenden, while the broader compliance significance is the enforcement precedent and ASIC’s stated priority of protecting vulnerable consumers.

What changed

This is an enforcement outcome rather than a new rule or general compliance obligation. Pattenden is subject to a $250,000 civil penalty and a 15-year prohibition on managing corporations; Jones has been found liable, with penalties to be determined at a later hearing. ASIC’s case concerns alleged breaches of sections 180, 181 and 182 of the Corporations Act 2001 arising from insurance arrangements with Vanuatu-based Crown Insurance Services Limited, which ASIC alleged was beneficially owned and controlled by Pattenden and Jonathan Law and was not in the interests of the ACBF entities.

Key dates

2026-10-29

The SEC announced charges against BG Wealth Sharing Ltd and DSJ Exchange Pty Ltd and filed the related enforcement complaint in the U.S. District Court for the Northern District of California.

Suggested considerations

• Compliance teams may wish to review third-party crypto platforms, advisers, issuers, introducers, and promoters for unsupported claims that an SEC filing represents licensing, approval, endorsement, or authorization.
• Firms should consider independently verifying Form ADV, Form D, and other regulatory filings through official regulator databases and documenting the precise legal effect of each filing before relying on it in due diligence or investor communications.
• Marketing and financial-promotion controls may wish to test for claims of risk-free or guaranteed returns, extraordinary monthly performance, government approval, SEC registration, fake certificates, and statements that a Rule 506(c) filing authorizes operation of a crypto exchange.
• Firms with exposure to BG Wealth Sharing, DSJ Exchange, or associated promoters should consider escalating the relationship for legal, fraud, sanctions, counterparty, and suspicious-activity review and preserving relevant communications, transaction records, and onboarding materials.
• Investment advisers and other regulated firms may wish to assess whether referral, custody, payment, or platform relationships involving similar schemes create customer-protection, books-and-records, disclosure, or reputational risks.
• Compliance teams may wish to incorporate the related state and foreign warnings into typology monitoring, particularly indicators such as recruitment-based compensation, blocked withdrawals, advance exit or compliance fees, fake account balances, and periodic payments used to sustain investor confidence.

What changed

This is an enforcement action, not a new rule or generally applicable compliance requirement. The SEC alleges violations of the antifraud provisions of the Securities Act of 1933 and Securities Exchange Act of 1934 by both entities, and violations of Sections 204(a) and 207 of the Investment Advisers Act of 1940 by BG Wealth. The SEC is seeking permanent injunctions, disgorgement with prejudgment interest, civil penalties against both entities, and conduct-based injunctions against BG Wealth.

Key dates

2025-10-21

The FCA commenced High Court proceedings in the Business and Property Division against Huobi Global S.A. and persons unknown concerning alleged breaches of section 21 FSMA.

2026-02-10

The FCA publicly announced its enforcement action against HTX for unlawful cryptoasset promotions to UK consumers.

2026-10-29

The FCA announced the High Court settlement and undertakings; HTX was no longer active in the UK, with no deposits or new UK registrations permitted.

2027-10-01

The FCA publication states that cryptoassets remain largely unregulated in the UK, apart from anti-money-laundering and financial-promotion requirements, until October 2027.

2031-10-21

The court order provides that Huobi Global's undertakings continue until this date.

Suggested considerations

• Compliance teams may wish to identify all UK-facing cryptoasset communications across websites, applications, email, affiliates, influencers and social-media platforms, including communications published by overseas group entities.
• Firms should consider documenting the legal basis for each UK financial promotion under section 21 FSMA, including the firm's authorisation status, any authorised-person approval and any applicable exemption under the Financial Services and Markets Act 2000 (Financial Promotion) Order 2005.
• Overseas firms should consider geo-blocking and other durable controls for UK users, while testing whether content, account access, app availability, search visibility or social-media activity remains capable of having an effect in the UK.
• Marketing and compliance teams may wish to implement pre-publication approval, withdrawal and monitoring controls for third-party affiliates, influencers and social-media operators, with records showing who approved each communication and where it was distributed.
• Firms with existing UK users should consider reviewing account-access, deposit, withdrawal and customer-communications arrangements so that any UK exit strategy does not leave consumers exposed to continuing unlawful promotions.
• Cryptoasset businesses may wish to monitor the FCA Warning List and Firm Checker and assess whether their UK activities could also trigger UK anti-money-laundering registration or other authorisation requirements.

What changed

This is a settlement and enforcement outcome rather than a new generally applicable rule. Huobi Global is bound by court undertakings not to knowingly, directly or indirectly, communicate or cause to be communicated financial promotions contravening section 21 FSMA, including promotions on HTX websites, software applications and social-media platforms. HTX will not target, solicit or actively seek to engage UK consumers; UK consumers can no longer deposit funds or open new accounts, and residual-asset withdrawals are addressed through HTX's published arrangements.

Key dates

2026-10-23

ADGM’s Registration Authority announced the enforcement action and the total USD 88,000 penalties against MCA Auditors and its registered Audit Principal.

Suggested considerations

• Registered audit firms should consider performing a documented file-by-file review of risk assessments, fraud-risk responses, group-audit instructions and evaluations, communications with those charged with governance, and sufficient appropriate audit evidence for material balances and disclosures.
• Registered Audit Principals should consider documenting substantive involvement at planning, risk assessment, supervision, review, consultation, resolution of significant matters and completion stages, rather than relying on evidence of a final sign-off alone.
• Firms should consider mapping each engagement to the applicable requirements in the Companies Regulations (Auditors) Rules 2023 and the relevant International Standards on Auditing, with evidence of review and clearance of identified deficiencies.
• Audit firms should consider maintaining a formal root-cause analysis, remediation plan, ownership allocation, target dates and effectiveness testing process so that remediation can be demonstrated during a subsequent RA inspection.
• Audit committees and other those charged with governance at ADGM-registered entities should consider challenging the auditor on fraud risks, group-audit scope, significant judgments, material evidence and the registered principal’s oversight before approving or relying on the audit.
• ADGM audit firms should consider preparing for continued RA monitoring and inspections, including ensuring that working papers and governance communications are complete, contemporaneous, retrievable and internally consistent.

What changed

This is an enforcement action rather than a new rule or amendment. It applies the Companies Regulations (Auditors) Rules 2023, including the obligations for Registered Auditors and Registered Audit Principals to conduct audit work in accordance with applicable technical and professional standards, including International Standards on Auditing, and to exercise due skill, care and diligence. The action signals that ADGM inspections will assess the complete audit evidence trail and the registered principal’s documented involvement across the engagement, not merely the final audit opinion.

Key dates

2012-12-31

MISMEL was licensed by the DFSA as a credit rating agency.

2023-12-01

Beginning of the period during which MISMEL reported seven inadvertent data-disclosure incidents to the DFSA; the source specifies December 2023 but not an exact day.

2026-05-31

End of the incident period described by the DFSA; the source specifies May 2026 but not an exact day.

2026-10-28

The DFSA announced the enforcement action and USD 585,825 penalty against MISMEL.

Suggested considerations

• Credit rating agencies should consider mapping confidential-information flows, permitted uses, recipients and disclosure exceptions against DFSA COB 8.9.1 and COB 8.9.2.
• Compliance and technology teams may wish to test email, endpoint, access-control, data-loss-prevention and external-recipient controls using realistic scenarios involving inadvertent disclosures.
• Firms should consider documenting compensating controls and an approved replacement before disabling or materially changing any security tool, with formal risk acceptance where continuity cannot be achieved.
• Control owners may wish to review incident detection, escalation, investigation and regulatory-notification processes, including whether repeated near misses are aggregated and reported to senior management and the DFSA where applicable.
• Senior management and compliance teams should consider reviewing employee training, attestations, supervision and disciplinary arrangements so that confidentiality obligations are demonstrably enforced and not merely documented.
• Credit rating agencies may wish to retain sufficient records and audit trails to evidence the operation and testing of confidentiality controls, noting the DFSA Rulebook requirement to maintain relevant records for at least six years.
• Firms outside the credit-rating sector should consider the enforcement action as an indicator of DFSA expectations for proportionate data-confidentiality governance, although the cited COB 8.9 requirements specifically apply to credit rating agencies.

What changed

This is an enforcement action rather than a new rule or prospective regulatory amendment. The DFSA found that MISMEL failed to implement and maintain adequate systems and controls to safeguard confidential information and failed to ensure that employees did not disclose it. The relevant DFSA framework requires a credit rating agency to maintain policies, procedures and controls preventing use of confidential information for unauthorised purposes and disclosure to other persons, subject to limited exceptions such as prior written consent or a legal obligation; COB 8.9.1 also addresses pending...

Key dates

2026-10-26

ASIC announced and made the interim stop order against the Murdoch Clarke Mortgage Fund PDS.

Suggested considerations

• Firms should consider suspending affected offers, issuances, sales, transfers and distribution activity and checking all intermediary and platform instructions against the terms of the interim order.
• Compliance teams may wish to conduct a line-by-line PDS review against Corporations Act 2001 sections 1013C, 1013D and 1013F, including whether all material information, fees and costs, risks and withdrawal terms are disclosed clearly, concisely and effectively.
• Fund managers should consider identifying and describing all actual, potential and permitted related-party transactions, including the parties involved, nature of the arrangements, decision-making controls, remuneration and associated conflicts.
• Compliance teams may wish to reconcile every fee, cost, spread, margin, related-party charge and indirect cost in the PDS with constitutions, investment management agreements, responsible-entity arrangements, financial statements and actual operating practice.
• Managers should consider presenting lending, property-security, interest-only, principal-repayment, valuation, concentration, liquidity, default, impairment and loss risks in a prominent and investor-comprehensible manner rather than relying on generic risk wording.
• Firms should consider prominently distinguishing the Fund's usual withdrawal processing practice from the responsible entity's legal discretion and maximum permitted timeframe, including any suspension, gate, queue, notice, liquidity or repayment conditions.
• Distributors and advisers may wish to review current product lists, advice templates, research ratings and retail communications to ensure they do not continue promoting or recommending the Fund while the order is in force.
• Private credit managers should consider reviewing comparable PDSs and target market determinations proactively, given ASIC's stated surveillance focus and the recent pattern of interim intervention followed by required disclosure remediation.

What changed

The interim order immediately halts the relevant fundraising and secondary dealing activities under the Fund's PDS; it is not a new generally applicable rule or a final finding of contravention. ASIC identified concerns that the PDS fails to disclose related-party transactions, inadequately explains fees and costs, provides insufficient or unclear risk information, and does not adequately and prominently explain withdrawals. ASIC may make a final stop order if the concerns are not addressed in a timely manner, after Murdoch Clarke has an opportunity to make submissions.

Key dates

2023-02-28

Rex issued the profit forecast at the centre of the proceedings.

2023-04-14

The NSW Supreme Court found that Rex’s continuous disclosure breach commenced because it failed to disclose that it no longer had reasonable grounds for the forecast.

2024-12-01

ASIC commenced proceedings against Rex, the three non-executive directors, and former executive chairman and chief executive Lim Kim Hai; the source specifies December 2024 but not an exact day.

2026-06-30

The NSW Supreme Court found that Rex breached its continuous disclosure obligations but dismissed ASIC’s case against the three non-executive directors and did not establish misleading conduct by Rex.

2026-08-20

ASIC filed a Notice of Intention to Appeal the dismissal of part of its case, according to the related court-update material.

2026-10-20

Lim Kim Hai was disqualified from managing corporations for four years and ordered to pay an $800,000 pecuniary penalty after admitting involvement in Rex’s continuous disclosure breaches and breaches of directors’ duties.

2026-10-23

ASIC announced that it is seeking leave to appeal the findings concerning the three former non-executive directors.

Suggested considerations

• Firms should consider reviewing controls for monitoring earnings forecasts against current management information, operational trends and board materials, including clear escalation triggers when a forecast may no longer have reasonable grounds.
• Boards and non-executive directors may wish to ensure that material adverse trends, forecast variances and management warnings are clearly documented, discussed and escalated through formal board and disclosure committees.
• Compliance teams may wish to assess whether directors receive sufficiently clear and timely information to identify potential continuous disclosure issues, rather than relying only on aggregated financial reports or informal updates.
• Listed entities should consider documenting the basis for continuing, correcting or withdrawing earnings guidance and the decision-making process for ASX disclosure under the Corporations Act 2001 (Cth) and applicable ASX Listing Rules.
• Firms should monitor the appeal process and any appellate guidance on the relationship between corporate continuous disclosure liability under section 674A and individual directors’ duties under section 180.
• Boards may wish to review director induction and continuing education concerning continuous disclosure, reasonable grounds for forecasts, escalation responsibilities and the evidentiary importance of board records.

What changed

No new binding obligation or threshold has been introduced by this publication. ASIC is challenging the primary judge’s findings that the evidence did not establish that the three non-executive directors knew Rex no longer had reasonable grounds for its 28 February 2023 positive operating-profit forecast, or that they therefore breached their duties under section 180 of the Corporations Act 2001 (Cth).

Key dates

2026-04-21

Voluntary restrictions were imposed on Kingscrown Finance Ltd.

2026-09-25

Further voluntary restrictions were imposed on Kingscrown Finance Ltd, including limits on receiving payments from existing customers and an orderly wind-down requirement.

2026-10-07

Voluntary restrictions were imposed on MOMSB Ltd and Momentus Capital Ltd, including restrictions on new customers, new lending arrangements and certain payments from existing customers, together with independent AML-framework reviews.

2026-10-09

Voluntary restrictions were imposed on Grosvenor Funding Ltd and Grosvenor Funding (North West) Ltd, including restrictions on new customers, new lending arrangements and certain payments from existing customers, together with independent AML-framework reviews.

2026-10-15

Voluntary restrictions were imposed on Abbital Ltd, including specified conditions for taking on customers, entering into lending arrangements and accepting payments, together with an independent review of its AML systems and controls.

2026-10-23

The FCA announced the restrictions and reiterated its enhanced oversight of Annex 1 firms and due-diligence expectations for regulated firms dealing with them.

Suggested considerations

• Annex 1 firms should consider reviewing their business-wide AML risk assessment, customer and beneficial-owner due diligence, ongoing monitoring, suspicious-activity escalation, governance, management information, resourcing and independent-testing arrangements against the Money Laundering Regulations 2017.
• Annex 1 firms seeking registration or under FCA assessment should consider ensuring that policies and controls are tailored to their actual lending activities, customer base, delivery channels and growth plans, rather than relying on generic or group-level documentation.
• The six named firms should consider mapping their operational processes, customer communications, payment arrangements and lending activity to the precise terms of their voluntary restrictions and preserving evidence of compliance with those terms.
• FCA-authorised firms should consider identifying all Annex 1 counterparties and refreshing onboarding and periodic-review procedures to obtain direct confirmation of registration, conduct independent verification, understand the counterparty's business model and assess whether its AML controls create heightened relationship risk.
• Regulated firms should consider recording the rationale for accepting, continuing or restricting relationships with Annex 1 firms and escalating discrepancies between a firm's registered activities, actual activities, ownership, governance or AML framework.
• Groups with multiple Annex 1 entities should consider documenting entity-specific risk assessments and controls, since group-wide or off-the-shelf procedures may not demonstrate that each entity manages its own risks effectively.
• Lenders and their service providers should consider contingency arrangements for restricted firms, including payment handling, loan-book servicing, customer communications and orderly wind-down scenarios.

What changed

Kingscrown Finance Ltd is subject to restrictions limiting how it may receive payments from existing customers and requiring an orderly wind-down of its existing loan book. MOMSB Ltd, Momentus Capital Ltd, Grosvenor Funding Ltd and Grosvenor Funding (North West) Ltd are restricted from taking on new customers or entering into new lending arrangements, subject to the specified exceptions; restrictions also apply to accepting payments from existing customers, and the firms must obtain independent reviews of their AML frameworks.

Key dates

2024-04-01

Bank of America self-identified the inaccurate wire-transmittor information issue, according to the OCC enforcement order; the date is included as an approximate month-level historical reference represented by the first day of the month.

2024-10-01

Bank of America stopped the inaccurate transmittor-information practice in 2024; the OCC order does not provide an exact day, so this is an approximate month-level historical reference represented by the first day of the month.

2026-10-08

The OCC announced the American Express National Bank cease-and-desist order and $350 million civil money penalty.

2026-10-13

The OCC announced the Bank of America $750 million civil money penalty, described as the largest penalty in OCC history, in coordination with Treasury and FinCEN actions.

2026-10-22

The OCC published the October 2026 consolidated enforcement-actions release.

Suggested considerations

• Firms should consider reassessing whether their BSA/AML risk assessments cover the risks of all material products and services, rather than concentrating on narrower deposit activity while underweighting credit-card, charge-card, correspondent, or payment activity.
• Compliance teams may wish to test end-to-end transaction-monitoring workflows for alert generation, escalation, investigation, disposition, and SAR filing, including backlog governance, aging thresholds, management information, and evidence that suspected trade-based money laundering is escalated promptly.
• Firms should consider validating that customer identification, customer due diligence, beneficial-ownership information, and ongoing-risk-rating processes are complete, accurate, risk-based, and aligned to the institution's actual customer and product populations.
• Banks may wish to perform a targeted review of outgoing wire data to confirm that originator or transmittor names and other required fields are accurate, consistently populated, retained, and not overwritten by deficient interfaces or manual processes.
• Boards and senior management should consider documenting sufficient staffing, subject-matter expertise, training, independent testing, audit coverage, and issue-remediation ownership for BSA/AML programs.
• Institutions operating under prior supervisory findings should consider independent validation that corrective actions are complete, effective, sustainable, and supported by evidence, rather than merely implemented procedurally.
• Compliance teams should consider reviewing whether third-party, correspondent, and payment-processing arrangements create data-quality or monitoring dependencies that could delay SAR filing or impair law-enforcement traceability.

What changed

This publication announces enforcement outcomes rather than a new rule or generally applicable deadline. American Express National Bank is subject to a cease-and-desist order and a $350 million penalty for an inadequately designed and monitored BSA/AML program, inadequate resources and expertise, internal-control weaknesses, weak independent testing and training, systemic failures involving approximately $13 billion of suspected trade-based money-laundering activity, and customer identification and customer due diligence deficiencies.

Key dates

2019-05-30

The Central Bank’s ASP investigation into PTSB concluded; PTSB had admitted 42 regulatory breaches and received a €21 million fine and reprimand.

2023-12-01

The Central Bank published ASP Guidelines providing further detail on its inquiry process; the exact publication day is not specified in the source, so this date denotes December 2023 only.

2025-04-23

The Central Bank Inquiry Decision concerning PTSB and David Guinane was issued.

2026-10-22

IFSAT published its decision, upheld Mr Guinane’s appeal and overturned the Inquiry Decision; the Central Bank stated that it does not propose to appeal.

Suggested considerations

• Compliance teams may wish to record the IFSAT outcome in enforcement-risk assessments and monitor the High Court confirmation process.
• Banks and mortgage lenders may wish to review open or potential individual-enforcement matters involving historic conduct to confirm that the alleged contraventions, issues for determination, evidential basis and proposed sanctions have been clearly particularised and communicated.
• Firms may wish to preserve governance records showing how customer-impact risks, escalation decisions, approvals and follow-up controls were assessed, particularly for tracker mortgage, conduct and legacy remediation matters.
• Legal and compliance teams may wish to assess whether the reasoning reported in the decision has implications for ongoing Central Bank inquiries, including fair-notice, statutory-authority, procedural-fairness and reasons requirements.
• Firms may wish to distinguish this case from the separate PTSB entity enforcement outcome: PTSB admitted 42 regulatory breaches and received a €21 million fine and reprimand in 2019, which this publication does not overturn.
• Firms may wish to track the Central Bank’s external review of wider enforcement activities and any revisions to inquiry procedures, ASP guidance or Individual Accountability Framework implementation.

What changed

No new regulatory obligation or rule has been introduced for firms. The specific inquiry decision against Mr Guinane has been overturned, and the Central Bank does not propose to appeal the IFSAT findings. Independent reporting indicates that IFSAT found the inquiry process and reasoning legally defective, including failures to give fair notice of certain issues and to provide adequate reasons. The Central Bank will apply to the High Court for confirmation of the IFSAT decision under the Central Bank Act 1942.

Key dates

2020-11-01

Beginning of the period during which the Central Bank found Coinbase Ireland breached safeguarding and outsourcing obligations under the Electronic Money Regulations 2011.

2025-08-19

End of the enforcement period identified by the Central Bank.

2026-10-21

Central Bank of Ireland and Coinbase Ireland reached the settlement under the undisputed-facts settlement process.

2026-10-22

Central Bank published the enforcement outcome and announced the proposed reprimand and discounted monetary penalty.

Suggested considerations

• Firms should map all safeguarding responsibilities to the specific Irish or EU-authorised entity that holds the regulatory obligation and document how the entity retains effective control despite group or third-party outsourcing.
• Compliance teams may wish to assess whether the regulated entity has sufficient local expertise, decision-making authority and management information to oversee safeguarding and challenge outsourced providers on an ongoing basis.
• Firms should consider independently validating the design of safeguarding calculations, reconciliations, treasury-rebalancing processes and designated safeguarding-account funding, including testing for data, systems and mapping errors.
• Firms may wish to perform daily or otherwise risk-appropriate reconciliations between customer liabilities, safeguarding obligations and funds held in designated accounts, with documented investigation and remediation of exceptions.
• Boards and senior management should consider whether control testing covers the complete safeguarding process, including outsourced components, and whether testing is sufficiently independent and frequent to identify prolonged shortfalls.
• Firms should review escalation procedures for safeguarding incidents, control failures, underfunding and material changes to operating models, including criteria and ownership for notifying the Central Bank of Ireland.
• Authorised firms should compare their current operating model with representations, commitments and governance arrangements submitted during authorisation and assess whether any material changes were notified to the Central Bank.
• Outsourcing registers, contracts and service-level arrangements should be reviewed to confirm clear regulatory access, audit rights, information rights, incident reporting, business-continuity provisions and accountability for safeguarding outcomes.

What changed

The publication does not introduce a new statutory rule; it applies existing obligations under the Electronic Money Regulations 2011 and establishes a substantial enforcement precedent. Coinbase Ireland admitted that it lacked an adequate outsourcing-governance framework, relied excessively on a US Coinbase Group entity, lacked sufficient local skill and expertise to oversee safeguarding, used inadequately designed and tested systems that left its designated safeguarding account underfunded, and lacked adequate escalation and reporting arrangements for material safeguarding changes.

Key dates

2020-06-01

Beginning of the SFC’s alleged relevant period for coordinated trading in Taste•Gourmet shares.

2020-07-27

Taste•Gourmet shares first closed above the alleged HK$1.32 price needed, based on shares then in issue, to meet the HK$500 million market-capitalisation threshold.

2020-08-05

Taste•Gourmet announced that it had submitted a formal application to transfer its listing from GEM to the Main Board; the shares closed at HK$1.35.

2020-09-18

End of the SFC’s alleged relevant period.

2026-10-22

The SFC announced commencement of Market Misconduct Tribunal proceedings under section 274 of the Securities and Futures Ordinance.

Suggested considerations

• Firms should consider reviewing issuer-related personal-account dealing, connected-person trading and employee dealing controls for arrangements involving relatives, nominees, associates or accounts funded by another person.
• Compliance teams may wish to test surveillance for aggressive orders near the close, orders that establish or move the closing price, concentrated activity by connected accounts, wash or circular trading indicators, and trading that accounts for an unusually high proportion of daily volume.
• Listed issuers and their advisers should consider documenting the basis for any market-capitalisation or price-related listing eligibility assessment and ensuring that trading activity is not coordinated or presented as genuine investor demand.
• Broker-dealers may wish to enhance customer due diligence and transaction monitoring for sudden fund transfers followed shortly by purchases in a thinly traded issuer, particularly where the customer is connected to management or a listing applicant.
• Firms should consider preserving chat messages, emails, order records, funding records, beneficial-ownership information and communications concerning target prices or order timing when an issuer is involved in a listing transfer or other price-sensitive transaction.
• Senior management and boards may wish to review escalation procedures for suspected market manipulation and ensure that potential issues are referred promptly to legal, compliance and, where appropriate, the SFC or SEHK.
• Compliance teams should distinguish this commencement of MMT proceedings from a final determination and monitor the MMT case for findings that may further clarify evidential indicators and the treatment of non-executive participants.

What changed

This publication does not introduce a new rule or reporting deadline; it announces enforcement proceedings under section 274 of the Securities and Futures Ordinance (Cap. 571). The SFC alleges that, from 1 June 2020 to 18 September 2020, the respondents coordinated purchases, discussed a target price and order timing, used substantial fund transfers followed by share purchases, and placed aggressive orders near the close that moved or determined the closing price.

Key dates

2025-10-31 Deadline

Deadline by which the 21 companies were allegedly required to lodge their financial reports for the year ended 30 June 2025.

2025-08-01

ASIC commenced the surveillance of late and non-lodgement of financial reports referred to in the publication.

2026-10-21

ASIC published the enforcement release announcing payment of the 21 infringement notices.

Suggested considerations

• Firms should identify every Australian entity in their group that is a public company, large proprietary company, disclosing entity or registered scheme and map each entity to its applicable reporting and lodgement deadline.
• Compliance teams may wish to establish a documented annual-report timetable working backwards from the statutory deadline, including audit dependencies, board approval, director declarations, ASIC lodgement and contingency escalation.
• Groups should consider assigning entity-level accountability for lodgement rather than relying solely on a parent-company or central finance function, and retaining evidence of deadline monitoring, escalation and board oversight.
• Companies approaching a deadline may wish to assess promptly whether an extension or other available regulatory process is relevant; late lodgement does not remove the underlying breach risk once the deadline has passed.
• Firms should consider reviewing director and officer governance arrangements against Corporations Act 2001 section 344, which requires officers to take all reasonable steps to secure compliance with financial-reporting requirements, and section 180 where applicable.
• Recipients of an ASIC infringement notice should consider the statutory response options and obtain appropriate legal advice before paying, disputing or seeking additional time, while recognising that payment is not an admission or conviction.
• Groups should review whether delays in one entity indicate a broader control weakness affecting subsidiaries with different financial year ends or reporting classifications.

What changed

No new filing deadline or substantive accounting rule was introduced. ASIC has, however, materially reinforced its enforcement position under the Corporations Act 2001: companies required to lodge financial reports must meet the applicable statutory deadline, and ASIC may issue infringement notices for alleged failures. Each of the 21 companies paid $198,000 under an infringement notice; payment is not an admission of guilt or liability and does not constitute a conviction.

Key dates

2019-01-01

In 2019, Dawkins sold Vector Wealth to a director who had previously been disqualified and who subsequently described himself as the firm's CEO; the FCA found that Dawkins falsely represented that he remained in control.

2020-09-22

Kadir Kanizi was appointed as a director of Vector Wealth.

2021-01-01

The FCA's permanent restriction on marketing speculative illiquid securities, including relevant mini-bonds and loan notes, to retail investors took effect, subject to applicable high-net-worth and sophisticated-investor exemptions.

2021-09-06

The FCA approved Kadir Kanizi for his senior management role at Vector Wealth.

2025-01-28

Vector Wealth's FCA authorisation ended.

2026-10-21

The FCA published the enforcement announcement concerning Dawkins and Kanizi.

Suggested considerations

• Compliance teams may wish to review ownership, control and governance records following any acquisition or disposal, verify that the person exercising actual control is accurately disclosed to the FCA and assess whether a change-in-control notification under FSMA sections 178 to 191 was required.
• Firms should consider testing that directors, controllers and senior managers meet the applicable fit-and-proper standards and that no disqualified person is exercising management or operational control indirectly or through nominee arrangements.
• Firms that issue, approve or distribute mini-bond, loan-note or similar promotions should consider a product-level assessment of whether the instrument is a speculative illiquid security and whether the promotion is prohibited or qualifies for a valid exemption under the FCA rules.
• Financial promotion approval processes should be reviewed to ensure that risk warnings are prominent, balanced and comprehensible, and are not undermined by claims suggesting fixed returns, simplicity, safety or FCA endorsement.
• Where high-net-worth or sophisticated-investor exemptions are used, firms should consider verifying the relevant declaration and process before providing access to the promotion, rather than treating a generic self-certification as evidence that all conduct and disclosure obligations have been satisfied.
• Firms should consider documenting who reviewed the promotion, the evidence supporting the target market and exemption, the underlying use of investor funds, liquidity and default risks, and the rationale for approving the communication.
• Boards and senior managers may wish to review escalation, oversight and record-keeping arrangements for unregulated investment activity conducted alongside regulated business, particularly where the firm's FCA authorisation could give investors a misleading impression of product safety or compensation protection.
• Firms should consider confirming that senior managers understand their individual accountability for consumer communications and risk oversight, and may wish to include high-risk investment promotions in conduct monitoring and Consumer Duty assessments where relevant.

What changed

This is a final enforcement action rather than a new rule or industry-wide implementation deadline. It applies the existing prohibition in section 21 of the Financial Services and Markets Act 2000 on unauthorised financial promotions, the FCA's financial promotion rules in COBS 4, including the restrictions applying to speculative illiquid securities, and the change-in-control notification regime under sections 178 to 191 of FSMA.

Key dates

2021-04-22

Beginning of the period in which ASIC alleges the Panacea Capital Cryptocurrency Investment Fund was offered without an AFS licence.

2022-06-17

End of the period in which ASIC alleges the Crypto Fund operated without an AFS licence.

2024-03-21

ASIC announced that Brian Creigh was permanently banned from providing financial services or being involved in a financial services business.

2026-10-19

Creigh was charged in the Melbourne Magistrates’ Court and granted conditional bail.

2026-10-20

ASIC published the enforcement release announcing the criminal charges.

Suggested considerations

• Firms should consider confirming that every entity and individual providing financial product advice, dealing, arranging or other financial services in Australia holds the required AFS licence or is properly appointed as an authorised representative for the relevant activities.
• Compliance teams may wish to map digital-asset products against the financial product and financial services definitions in Chapter 7 of the Corporations Act 2001 (Cth), including where pooled investor money is used to pursue returns from a portfolio of digital assets.
• Firms should consider reviewing marketing materials, fact sheets and investor communications for unsupported claims about licensing status, capital protection, guarantees, historical performance, targeted returns and the nature of underlying investments.
• Compliance teams may wish to strengthen onboarding and ongoing due diligence for digital-asset fund operators, directors, promoters, overseas counterparties and receiving entities, including checks against ASIC banning and disqualification records.
• Firms should consider reviewing transaction-monitoring and escalation controls for investor funds moving to offshore entities or unrelated investment vehicles, with particular attention to circumstances that could raise proceeds-of-crime or fraud concerns.
• Distributors and professional intermediaries may wish to retain evidence of licence verification, product governance reviews, investor disclosures and the basis for any representations made to prospective investors.
• Firms should consider treating the charges as allegations not yet determined by a court and separating the criminal proceeding from ASIC’s earlier administrative banning action when assessing legal, conduct and reputational risk.

What changed

No new licensing rule or general obligation was introduced. The publication announces enforcement proceedings: one charge under section 911A(1) of the Corporations Act 2001 (Cth) for carrying on a financial services business without an AFS licence, and one charge under section 400.3(1) of the Criminal Code (Cth) for dealing with proceeds of crime worth $1 million or more. The matter is being prosecuted by the Commonwealth Director of Public Prosecutions following ASIC’s referral of a criminal brief.

Key dates

2023-02-28

Rex issued the ASX announcement stating that it was optimistic of achieving positive operating profit for the financial year.

2023-06-20

Rex subsequently forecast a $35 million loss, according to the independent reporting and ASIC proceedings described in the surrounding litigation.

2024-07-30

Rex shares were suspended from trading when the company entered voluntary administration.

2024-12-11

ASIC commenced proceedings against Rex, Lim Kim Hai and three former non-executive directors.

2025-09-30

Rex ceased to be listed on the ASX, following its listing from November 2005 to September 2025.

2025-12-01

Rex was acquired by United States-based Air T and subsequently renamed Regional Express Holdings Pty Ltd.

2026-05-20

Lim Kim Hai admitted all alleged contraventions against him, including the section 180(1) directors’ duty breach and involvement in Rex’s section 674A(3) continuous disclosure contraventions.

2026-08-20

ASIC filed a Notice of Intention to Appeal the dismissal of part of its case against Rex and the former non-executive directors.

Suggested considerations

• Firms should review continuous disclosure policies and test whether material profit forecasts, earnings guidance and other market-sensitive statements are supported by documented, current and objectively reasonable assumptions.
• Boards and senior executives may wish to establish clear escalation triggers requiring immediate review of prior ASX announcements when financial performance deteriorates or underlying assumptions change.
• Compliance teams should consider maintaining an auditable record of the information available to directors when announcements are approved, including management forecasts, variance analysis, board papers and dissenting views.
• Listed entities should assess whether their procedures enable rapid correction, withdrawal or clarification of announcements that become inaccurate, misleading or unsupported, rather than waiting for the next scheduled results announcement.
• Boards may wish to confirm that directors understand the interaction between the company’s continuous disclosure obligations under section 674A of the Corporations Act 2001 and their personal duty of care and diligence under section 180(1).
• Firms should consider targeted training for executive and non-executive directors on market-sensitive information, earnings guidance, reasonable grounds for forecasts and escalation responsibilities.
• Companies involved in current or prospective enforcement matters may wish to preserve relevant board, forecast, email, announcement-approval and disclosure-committee records.

What changed

This is an enforcement outcome rather than a new rule or amended obligation. The Court approved a four-year disqualification under sections 206C and 206E of the Corporations Act 2001 and an $800,000 pecuniary penalty under section 1317G(1), with payment required within 28 days of the order. The case establishes a significant practical compliance signal for listed entities: directors and senior officers may be personally exposed where they fail to take reasonable steps to ensure accurate market disclosure, including correcting guidance that has become misleading or lacks reasonable grounds.

Key dates

2026-05-01

The period identified by BaFin as involving late Commerzbank voting-rights notifications began in May 2026; the publication does not specify the precise transaction dates.

2026-06-30

The period identified by BaFin as involving late Commerzbank voting-rights notifications ended in June 2026; the publication does not specify the precise transaction dates.

2026-10-15

BaFin imposed the €320,000 administrative fine on Nomura Holdings Inc.

2026-10-20

BaFin published the enforcement notice.

Suggested considerations

• Firms should review controls for identifying when direct and otherwise reportable voting rights reach, cross or fall below applicable WpHG thresholds.
• Compliance teams may wish to test whether notifications are sent to both the relevant issuer and BaFin within four trading days, including during takeover bids and other periods of heightened market activity.
• Firms should consider reconciling cash equity, custody, group-company, agency and other reportable positions promptly enough to identify threshold events and avoid corrections after the statutory period.
• Parent companies and regulated entities should assess whether supervisory arrangements, escalation procedures, ownership of filing responsibilities and management oversight adequately prevent late or defective notifications.
• Firms with cross-border trading operations should consider a focused review of German filing procedures, including local-law interpretation, hand-offs between trading and regulatory reporting teams, and evidence retained to demonstrate timely submission.

What changed

No new statutory obligation was introduced. BaFin applied the existing requirements under sections 33 et seq. of the German Securities Trading Act (WpHG), under which shareholders must notify both the issuer and BaFin within four trading days when voting rights reach, exceed or fall below specified thresholds.

Key dates

2022-05-12

The CFTC filed its complaint against Alexandre and EminiFX, alleging fraudulent solicitation, misappropriation, and operation of an unregistered commodity pool.

2026-07-01

As of July 2026, the court-appointed receiver had returned more than $98 million to over 28,000 investors.

2026-10-19

The CFTC announced that the Southern District of New York had entered orders granting summary judgment, injunctive relief, and a civil monetary penalty against Alexandre and EminiFX.

Suggested considerations

• Compliance teams may wish to inventory products, investment clubs, managed accounts, and digital-asset offerings that pool customer contributions and obtain exposure to forex, futures, options, or other commodity interests.
• Firms should consider assessing whether their activities constitute operating a commodity pool or acting as a commodity pool operator or associated person under the Commodity Exchange Act and CFTC regulations, including whether registration or an available exemption is required.
• Firms should consider validating marketing claims about returns, automated trading, proprietary technology, trading results, and risk, with particular scrutiny of unusually high or consistent returns such as weekly performance representations.
• Compliance teams may wish to test segregation, custody, reconciliation, withdrawal, and use-of-funds controls to detect commingling, personal use of customer assets, payments to earlier investors, and unexplained transfers.
• Firms should consider maintaining evidence supporting reported performance, trading activity, investor statements, and asset ownership so that customer communications can be reconciled to underlying records.
• Digital-asset businesses may wish to review whether crypto terminology or a technology-focused structure obscures activities that remain subject to commodities, anti-fraud, registration, or customer-protection requirements.
• Firms should consider escalating suspected misappropriation, fabricated performance, or unregistered commodity-pool activity through applicable internal investigation, suspicious-activity, and regulatory-reporting processes.

What changed

This is a final enforcement outcome rather than a new rule or generally applicable regulatory amendment. The Southern District of New York entered summary judgment and injunctive relief against Alexandre and EminiFX, finding that the defendants made fraudulent representations, misappropriated investor funds, and operated as an unregistered commodity pool operator, with Alexandre acting in an unregistered associated-person capacity. The judgment imposes $228,576,962 of restitution, $15,049,500 of disgorgement subject to offset by restitution payments, and a $45,148,500 civil monetary penalty.

Key dates

2025-11-21

Daniel Juratowitch and Rachel Burdett of Cor Cordis were appointed liquidators of MWL.

2025-11-28

AFCA made a determination against MWL, which MWL failed to pay.

2026-09-16

The CSLR paid $90,031.34, including interest, in respect of the unpaid AFCA determination and notified ASIC.

2026-10-12

ASIC cancelled MWL’s Australian credit licence and commenced the specified 12-month continuation of AFCA membership.

2027-10-12 Deadline

MWL’s required continuation of AFCA membership ends, subject to any further applicable requirements.

Suggested considerations

• Credit licensees should consider maintaining controls that identify AFCA determinations, track payment deadlines and escalate any threatened or actual inability to pay to senior management and the board.
• Compliance teams may wish to assess whether unresolved AFCA determinations could trigger CSLR involvement and the consequent mandatory licence-cancellation risk under the National Consumer Credit Protection framework.
• Firms approaching licence cancellation, surrender or liquidation should consider confirming continuing AFCA membership obligations and preserving complaint-handling, client-file and remediation records for the applicable post-exit period.
• AFCA members should consider reviewing procedures for responding to complaints involving related entities, former representatives and businesses that have ceased trading or entered liquidation.
• Credit providers and intermediaries should consider monitoring ASIC enforcement involving MWL, Shield Master Fund and related entities for indicators relevant to advice referrals, distribution oversight, representative supervision and complaint remediation.
• Businesses that have paid CSLR levies or may be exposed to future CSLR funding should consider incorporating unpaid AFCA determinations and insolvency trends into conduct-risk and financial-planning assessments.

What changed

MWL’s Australian credit licence was cancelled following the unpaid AFCA determination dated 2025-11-28 and the subsequent CSLR compensation payment dated 2026-09-16. ASIC stated that it has no discretion to avoid cancellation and that the decision is not subject to merits review. MWL must nevertheless retain AFCA membership until 2027-10-12, allowing further complaints to be lodged for 12 months after the cancellation.

Key dates

2021-05-01

Shield Master Fund commenced operation; ASIC found that some SOAs nevertheless suggested Shield had generated returns or outperformed alternatives since 2016.

2023-09-18

Singh became authorised by MWL Financial Services.

2024-02-01

ASIC halted new offers of Shield investments through interim stop orders on four product disclosure statements.

2024-06-01

ASIC took action to secure assets held within Shield for the potential benefit of investors.

2024-12-23

Singh ceased being authorised by MWL.

2025-01-13

Singh became an authorised representative of Interprac Financial Planning.

2025-08-25

ASIC cancelled MWL’s Australian financial services licence and banned MWL director Nicholas Maikousis.

2025-11-21

Cor Cordis liquidators were appointed to MWL.

Suggested considerations

• Compliance teams may wish to review advice files involving rollovers or switches of superannuation into high-risk, illiquid or newly established products, including whether the advice demonstrated the client’s objectives, financial situation, needs, risk tolerance, diversification and capacity to bear loss.
• Firms should consider testing Statements of Advice for unsupported historical-performance claims, back-cast comparisons, projections, graphs and descriptions that could imply a product existed or achieved returns before its actual commencement date.
• Licensees may wish to reassess approved-product-list governance, including independent product due diligence, evidence of product track record, liquidity and valuation risk, investment-class risk ratings, concentration limits and escalation where a product is proposed for a substantial proportion of retirement savings.
• Compliance teams should consider targeted surveillance of advice involving large superannuation rollovers, replacement products, high-growth allocations and advisers or referral channels associated with MWL, Shield or similar schemes.
• Firms should review conflicts and remuneration controls, including referral arrangements, lead-generator relationships, bonuses, volume incentives and disclosures in Financial Services Guides and Statements of Advice.
• Licensees may wish to verify adviser status on ASIC’s Banned and Disqualified Register and ensure that a banned person cannot provide financial services, control a financial services business or perform functions involved in carrying on such a business during the prohibition period.
• Affected consumers and firms handling complaints should consider preserving advice records, product research, call recordings, referral documentation and transaction evidence, and directing eligible consumer complaints to AFCA while recognising that MWL remains an AFCA member.
• Superannuation trustees and product issuers may wish to assess whether comparable products, distribution models or adviser incentives create risks of misleading disclosure, unsuitable concentration or advice that is not in members’ best interests.

What changed

This is a final administrative banning decision against an individual rather than a new generally applicable rule. Singh is prohibited from providing financial services for four years and the banning order has been recorded on ASIC’s Banned and Disqualified Register. ASIC found conduct inconsistent with the best-interests duty, the appropriateness obligation and prohibitions on false or materially misleading representations: approximately 75% of certain clients’ rolled-over superannuation was recommended for investment in Shield’s Growth or High Growth Class despite the product being high...

Key dates

2021-01-01

Approximate beginning of the alleged delayed-allocation and cherry-picking conduct.

2023-10-31

Approximate end of the alleged conduct period.

2024-11-25

The SEC filed its civil complaint against Leech concerning the alleged allocation scheme.

2025-01-21

The district court reportedly stayed the SEC civil action pending resolution of the parallel criminal prosecution.

2026-06-05

The SEC instituted settled administrative proceedings against Western Asset, imposing a $100 million penalty and establishing a Fair Fund for affected investors.

2026-10-06

The SEC reported the consent resolution and final-judgment process against Leech, including a $3 million penalty, permanent injunctions and an officer-and-director bar.

Suggested considerations

• Firms should consider reviewing whether each block or derivatives trade is assigned to intended portfolios at or near execution, with documented reasons, approvals and timestamps for any necessary delay.
• Compliance teams may wish to test whether allocation systems and workflows prevent personnel from using intraday price movements, daily settlement prices or first-day performance to select recipient accounts.
• Firms should consider surveillance comparing execution time, allocation-entry time, settlement-price availability, subsequent performance and recipient portfolio across portfolio managers and strategies.
• Compliance teams may wish to investigate statistically significant differences in allocation latency, first-day gains and losses, reallocations, exception rates and benefits received by particular portfolios, fee arrangements or clients.
• Advisers should consider reconciling written fair-allocation and reallocation procedures with actual operating practices, including practices followed by chief investment officers and other highly senior personnel.
• Firms should consider preserving allocation instructions and related communications from trading platforms, order-management systems, email, messaging tools and manual worksheets in a form suitable for supervisory review.
• Compliance teams may wish to enhance escalation procedures for delayed allocations, repeated reallocations, unexplained exceptions and material performance differences among similarly situated accounts.
• Advisers should consider reviewing client disclosures and policies describing pro rata, fair or equitable allocation methodologies against the firm’s actual allocation logic and exceptions.

What changed

This is an enforcement resolution, not a new rule or prospective compliance deadline. It reinforces that delayed post-execution allocation can create an Advisers Act antifraud and fiduciary-duty violation where the decision-maker can observe market or settlement-price information before assigning trades to client portfolios. The matter also signals that written allocation policies are insufficient if firms do not operate, test and supervise them effectively, particularly for senior investment personnel.

Key dates

2021-04-20

Start of the relevant period during which Fortnum admitted the cybersecurity governance failures occurred.

2022-01-01

Independent industry reporting identified a 2022 cyber incident at a Fortnum authorised representative involving data relating to up to 9,828 clients; the ASIC publication does not specify the incident date.

2023-05-11

End of the relevant period covered by Fortnum’s admissions.

2025-07-22

ASIC commenced Supreme Court of NSW proceedings against Fortnum concerning alleged failures to manage and mitigate cybersecurity risks.

2026-10-12

The Supreme Court of NSW approved the agreed $1.35 million pecuniary penalty and ordered Fortnum to pay $250,000 toward ASIC’s costs.

2026-10-14

ASIC published the enforcement outcome and stated that this was its third cyber-resilience enforcement action against an AFSL holder, following RI Advice and FIIG Securities.

Suggested considerations

• Compliance teams may wish to map cybersecurity governance to the licensee’s obligations under section 912A of the Corporations Act 2001 (Cth), including documented ownership, escalation and board or senior-management oversight.
• Firms should consider assessing whether their cybersecurity policy applies consistently to authorised representatives, outsourced providers and other connected practices, with minimum controls, implementation evidence and exception-management processes.
• Licensees may wish to establish a documented assurance programme covering representative due diligence, cyber training, control testing, incident reporting, vulnerability management and periodic reviews of representative cyber resilience.
• Firms should consider whether they have access to suitably qualified cybersecurity expertise, either internally or through appropriately scoped external specialists, and retain evidence that advice informs the risk-management framework.
• Compliance teams may wish to test whether their risk-management system identifies and evaluates cyber risks across the entire advice network and whether monitoring results are reported to accountable senior personnel.
• Following a cyber incident or material control deficiency, firms should consider prompt escalation, preservation of evidence, assessment of notification obligations and constructive engagement with ASIC; Fortnum’s self-reporting and cooperation were identified as relevant factors in the agreed penalty.
• Firms should consider validating that cyber controls protect highly sensitive personal information, including identity documents, tax file numbers and financial-account details, and that remediation is independently verified rather than limited to policy updates.

What changed

No new rule or prospective compliance deadline was introduced. The enforcement outcome establishes a further ASIC precedent that an AFSL holder’s obligation to provide financial services efficiently, honestly and fairly and to maintain adequate risk-management systems extends to cybersecurity controls, specialist expertise and oversight of authorised representatives.

Key dates

2026-10-14

The CFPB announced the debanking investigation and enforcement initiative; the OCC released its report on the nine largest national banks on the same date.

Suggested considerations

• Compliance teams may wish to inventory account closures, service restrictions, onboarding denials, credit denials, and material service-friction decisions since 2020, with particular attention to political or religious affiliations and lawful activities in firearms, oil and gas, coal, tobacco, digital assets, and other sectors identified by the OCC.
• Firms should consider testing whether customer-facing reasons for adverse decisions accurately and specifically reflect the documented internal rationale, including compliance with ECOA and Regulation B adverse-action notice requirements and applicable FCRA adverse-action notice requirements.
• Institutions may wish to review reputation-risk policies, sector restrictions, escalation criteria, committee materials, employee guidance, and risk taxonomies to confirm that decisions are based on objective, individualized, documented, and legally supportable risk considerations rather than generalized political, social, or reputational preferences.
• Compliance teams should consider preserving relevant complaints, account-review records, escalation communications, decision logs, adverse-action notices, and policy versions in anticipation of CFPB information requests or supervisory examination.
• Banks and covered nonbanks may wish to compare complaint-portal submissions and internal complaint data against account-closure and service-denial populations to identify unexplained patterns, inconsistent reasons, or failures to provide required notices.
• Firms should consider assessing whether deposit-account and payment-service decisions create potential UDAAP exposure even where ECOA or FCRA does not directly apply, while continuing to apply legitimate safety, soundness, sanctions, fraud, AML, credit, and operational-risk controls.
• Senior compliance and legal personnel may wish to establish governance for politically sensitive or sector-based account decisions so that risk-based controls are not removed indiscriminately and exceptions are documented, consistently applied, and subject to appropriate review.

What changed

The CFPB did not issue a new regulation or impose a new compliance deadline. It announced a supervisory and enforcement initiative implementing Executive Order 14331 and responding to the OCC's report covering conduct identified between 2020 and September 2025. The CFPB stated that it will investigate potential violations of the Equal Credit Opportunity Act, including Regulation B adverse-action requirements, the Fair Credit Reporting Act adverse-action requirements, and the prohibition on unfair, deceptive, or abusive acts or practices under the Consumer Financial Protection Act.

Key dates

2024-12-01

The OCC issued the December 2024 cease-and-desist order requiring Bank of America to address deficient BSA/AML controls; the publication does not specify the precise day of issuance.

2026-10-13

The OCC announced the $750 million civil money penalty and coordinated action with FinCEN.

Suggested considerations

• Compliance teams may wish to perform a documented gap assessment against 12 CFR 21.21 and 12 CFR 21.11, including transaction monitoring, customer and activity risk coverage, escalation procedures, SAR timeliness and accuracy, and recordkeeping.
• Banks should consider testing whether potentially suspicious activity is consistently escalated to appropriately skilled investigators and whether alert disposition processes can demonstrate timely decisions on SAR filing.
• BSA officers and relevant personnel should consider competency-based training covering suspicious-activity identification, investigation, SAR preparation, trade-based money laundering indicators, and escalation responsibilities, with evidence of completion and effectiveness testing.
• Internal audit and independent testing functions may wish to assess whether their scope, expertise, sampling, issue validation, and reporting are capable of detecting systemic BSA/AML weaknesses rather than merely confirming policy existence.
• Management and boards of directors should consider reviewing BSA/AML remediation governance, resourcing, milestones, risk acceptance, issue escalation, and the treatment of repeated or overdue corrective actions.
• Banks with material trade finance, correspondent banking, card, payments, or cross-border activity should consider targeted testing for trade-based money laundering typologies and transaction-monitoring coverage gaps.
• Institutions operating under a consent order or cease-and-desist order should consider independently validating that remediation is complete and effective, rather than relying solely on management representations or closure of project milestones.
• Compliance teams may wish to compare their control framework with the broader market reading of the action: industry reporting characterized the case as a record penalty driven by systemic and longstanding failures, while professional commentary on the evolving BSA/AML framework emphasizes the distinction between establishing an effective program and maintaining it in operation.

What changed

The publication is an enforcement action, not a new generally applicable rule or safe harbor. It establishes a major OCC enforcement precedent that persistent failures to implement an effective BSA/AML program after a formal supervisory order can result in exceptionally large penalties, including where deficiencies affect transaction monitoring, SAR escalation and filing, personnel competence, training, and audit effectiveness.

Key dates

2026-10-13

The FCA and NCA arrested three suspects, searched five residential premises in London and Manchester, and seized more than 30 mobile phones, laptops and tablets in an ongoing investigation.

Suggested considerations

• Compliance teams may wish to review whether market-abuse surveillance covers relevant instruments, trading venues, employee dealing, client orders, communications and potential information-sharing networks, with risk-based scenarios for insider dealing and manipulation.
• Firms should consider testing escalation procedures for suspected inside information, including preservation of communications and devices, prompt investigation, documented decision-making and submission of suspicious transaction and order reports where required.
• Firms subject to UK anti-money-laundering requirements may wish to assess whether insider-dealing alerts are linked to customer due diligence, transaction monitoring, suspicious activity reporting and source-of-funds or source-of-wealth reviews.
• Senior management and control functions may wish to confirm that restricted lists, wall-crossing procedures, information barriers, personal-account dealing controls, conflicts controls and staff training remain appropriate for organised or externally coordinated threats.
• Firms may wish to ensure that surveillance records, alert rationales, investigation files and relevant electronic communications can be retrieved promptly if the FCA requests information or conducts an enforcement investigation.
• Relevant firms should consider reminding employees and connected persons that disclosing or using inside information, recommending transactions, or encouraging others to trade can create criminal and regulatory exposure; any communication should avoid implying that the arrested individuals have been charged or found guilty.

What changed

No new obligation, rule, threshold or compliance deadline was introduced. The publication announces an ongoing criminal investigation involving arrests, searches and evidence seizures, and confirms that the FCA is using its market-abuse and financial-crime enforcement powers jointly with the NCA. The FCA reported four insider-dealing convictions in 2025/26, including two cases producing combined prison sentences of 11 years, and fines totalling £1.77 million imposed on 12 people for insider dealing, market manipulation and misleading statements.

Key dates

2026-10-13

ASIC announced the interim stop order against Fidante Partners Limited; the order is stated to remain in force for 21 days unless revoked earlier.

Suggested considerations

• Fidante and relevant distributors should consider immediately suppressing retail issuance, PDS delivery and covered general advice activities within the scope of the stop order, while confirming the order’s operative terms and any revocation or variation.
• Fund issuers should consider conducting a documented TMD review against the product’s actual risks, liquidity and redemption arrangements, including whether capital-preservation language is compatible with exposure to global syndicated loans, asset-backed securities, derivatives and subordinated or residual CLO tranches.
• Compliance teams may wish to test whether stated risk classifications and portfolio-allocation limits are supported by the product’s loss profile, volatility, liquidity and concentration characteristics, with particular attention to any allowance for retail investors to allocate up to 50% of investable assets.
• Distributors should consider reviewing advice files, platform controls, marketing materials and distribution data to determine whether retail clients outside an appropriately defined target market may have received the product or recommendations concerning it.
• Issuers and distributors of comparable private credit products should consider benchmarking TMD descriptions of risk appetite, capital preservation, liquidity and maximum portfolio allocation against ASIC’s concerns in this action and recent private-credit stop orders.
• Compliance teams should consider preserving records of the TMD review, distribution controls, complaints, significant dealings and escalation decisions, and assessing whether changes to the product design, target market or distribution arrangements are necessary under the DDO review framework.

What changed

This is an enforcement intervention rather than a new generally applicable rule. Until the order is revoked or expires, Fidante must not deal in the Class A units, give or distribute a product disclosure statement for the product, or provide general financial product advice to retail clients recommending an investment in it.

Key dates

2026-10-13

The SFC directed SEHK to suspend dealings in Baicha shares from 9:00 am under section 8(1) of the Securities and Futures (Stock Market Listing) Rules; the SFC also announced the restriction notices and continuing investigations.

2026-09-10

The SFC directed SEHK to suspend dealings in Cloudbreak Pharma Inc. shares from 9:00 am under section 8(1) of the Securities and Futures (Stock Market Listing) Rules.

2025-04-01

Dealings in Tianju Dihe shares were suspended and remained suspended as of the SFC publication.

Suggested considerations

• Compliance teams may wish to identify any client accounts, beneficial owners, introducers, nominees or related entities connected to the Nine Entities or Three Entities and ensure that no restricted assets are dealt with or processed without prior written SFC consent.
• Affected brokers should consider implementing account-level restrictions covering trading, transfers, withdrawals, pledges, corporate actions and indirect instructions, while preserving records showing how restrictions and escalation requirements were applied.
• IPO intermediaries may wish to reperform look-through due diligence on placees and their ultimate beneficial owners, including common addresses, directors, funding sources, financing providers, nominee arrangements, subscription concentrations and links across multiple IPOs.
• Sponsors, underwriters and placing agents should consider reviewing whether subscription funding, post-listing financing, purported financial-product investments or issuer-to-placee arrangements could create undisclosed circularity or an artificial appearance of demand.
• Firms may wish to enhance surveillance for coordinated IPO applications, unusually concentrated allocations, rapid post-listing disposals, cross-account transfers, common funding sources and flows between issuers, major placees and connected parties.
• Firms with exposure to Baicha, Cloudbreak or Tianju Dihe may wish to preserve relevant onboarding, order, allocation, communications, funding, transaction-monitoring and client-instruction records and assess whether any regulatory notification or cooperation obligation is engaged.
• Boards and senior management of IPO-related businesses may wish to assess whether existing governance and escalation arrangements adequately cover suspected market manipulation, false-market risks and conflicts involving licensed representatives or connected companies.

What changed

This is an enforcement action rather than a new generally applicable rule. Under section 8(1) of the Securities and Futures (Stock Market Listing) Rules, the SFC directed SEHK to suspend Baicha dealings while its investigation continues. The SFC imposed asset-preservation restrictions on six brokers in relation to accounts associated with Sun Ran and eight related companies, and on 29 brokers in relation to accounts associated with Liu Haoran and two related entities.

Key dates

2021-10-31

The insured family lodged the storm-related home insurance claim after roof damage in October 2021.

2022-08-01

A structural engineering assessment occurred approximately eight months after the need for one was identified; the source gives August 2022 but not an exact day.

2022-12-01

After the family complained to Hollard in late 2022, Hollard offered a $1,000 goodwill payment, which was rejected; the source gives only the month and year.

2023-04-01

Hollard made its final claim decision and rejected the claim approximately 15 months after initially accepting it; the source gives April 2023 but not an exact day.

2025-04-01

ASIC commenced Federal Court proceedings alleging breaches of section 13(2A) of the Insurance Contracts Act 1984 (Cth); the source gives April 2025 but not an exact day.

2026-10-09

The Federal Court ordered Hollard to pay a $2 million civil penalty for breach of the duty of utmost good faith.

Suggested considerations

• Compliance teams may wish to review open and recently closed home and property claims for extended periods of inactivity, delayed expert assessments, repeated reassignment, late temporary accommodation and decisions inconsistent with available expert evidence.
• Insurers should consider testing whether claims systems identify deterioration risks, vulnerable customers, habitability issues and requests for emergency accommodation, and whether those matters trigger timely management escalation.
• Firms should consider documenting clear ownership, next actions, decision dates and customer communications throughout the claim, including reasons for any investigation or decision delay.
• Insurers may wish to assess whether rejection decisions are supported by appropriate technical evidence and whether new evidence is properly reconciled with earlier inspections or admissions of cover.
• Claims governance functions should consider reviewing outsourced-provider service levels, escalation controls and management information for aging claims, complaint recurrence, temporary accommodation delays and claims exceeding internal handling targets.
• Legal and compliance teams may wish to map controls against Insurance Contracts Act 1984 (Cth), section 13(2A), and Corporations Act 2001 (Cth), section 912A(1)(a), while considering ASIC's 2024 claims-handling letter, 2025 review findings and 2026 enforcement priority.

What changed

The judgment establishes a binding enforcement precedent that an insurer may incur a civil penalty under section 13(2A) of the Insurance Contracts Act 1984 (Cth) where claims handling falls materially below the duty of utmost good faith. It does not introduce a new statutory claims-handling rule or compliance deadline, but confirms that insurers must handle claims fairly, communicate clearly, progress investigations and decisions without unnecessary delay, and respond appropriately when delay risks further insured loss.

Key dates

2012-06-30

End of the financial year for the LM Managed Performance Fund audit giving rise to the disciplinary proceedings.

2018-12-05

The CADB cancelled Mr Williams’ registration as a company auditor and ordered him to pay ASIC’s costs fixed at $200,000.

2025-06-18

Justice Perry dismissed Mr Williams’ Federal Court application for judicial review of the CADB decision.

2026-10-09

The Full Federal Court dismissed Mr Williams’ appeal, upheld the primary judgment and ordered him to pay the costs of the appeal.

Suggested considerations

• Audit firms should consider reviewing engagement-partner accountability arrangements to ensure that supervision, review and final audit conclusions are documented and cannot be characterized as delegated away.
• Registered auditors should consider testing whether audit files demonstrate adequate work on matters highlighted in the underlying proceedings, including loan and receivable valuation, impairment and recoverability, going concern, related-party loans, management fees, materiality and the basis for the audit opinion.
• Compliance and quality-management teams may wish to assess whether engagement quality reviews and consultations sufficiently challenge significant judgments and unresolved audit deficiencies before the report is signed.
• Firms should consider confirming that use of specialists, junior staff, component auditors or other team members is supported by appropriate direction, supervision, review and documented auditor responsibility.
• Australian audit practices may wish to monitor CADB and Federal Court decisions for further interpretation of the requirement under section 1292 of the Corporations Act 2001 that auditor duties be performed adequately and properly.
• Companies and fund managers may wish to consider whether their auditor oversight processes identify recurring deficiencies in valuation, related-party disclosures, fee recognition, going-concern assessments and audit materiality.

What changed

No new statutory obligation or compliance deadline was introduced. The judgment leaves in place the CADB’s cancellation of Mr Williams’ registration and the earlier findings that his audit of the LM Managed Performance Fund for the year ended 30 June 2012 was not performed adequately and properly. The Full Court confirmed that no legal or jurisdictional error had been established in the CADB’s decision-making and upheld the primary judge’s recognition of the CADB’s specialist expertise, subject to procedural fairness.

Key dates

2021-04-01

BaFin issued an earlier order requiring Deutsche Bank AG to remedy shortcomings in transaction monitoring; the publication gives April 2021 but not an exact day.

2023-11-01

BaFin issued a further order requiring Deutsche Bank AG to remedy transaction-monitoring shortcomings; the publication gives November 2023 but not an exact day.

2026-09-15

BaFin issued the order setting revised deadlines for Deutsche Bank AG’s remediation of transaction-monitoring data-processing deficiencies.

2026-10-06

The BaFin order became final and binding.

2026-10-09

BaFin published the enforcement update.

Suggested considerations

• Deutsche Bank compliance and programme-governance teams should obtain the operative BaFin order and map each revised deadline to the affected transaction-monitoring component, remediation milestone, accountable owner, testing evidence, and supervisory reporting obligation.
• The bank should consider validating that the system reorganisation has not reduced coverage of payment flows, customer and relationship risk indicators, alert generation, case-management records, or escalation and reporting processes during migration.
• Compliance teams should consider documenting how changed technical requirements were translated into revised data models, monitoring scenarios, thresholds, tuning decisions, controls, and model or rule validation outcomes.
• German credit institutions should consider benchmarking their transaction-monitoring governance, data lineage, system change controls, periodic effectiveness testing, and continuous-update processes against the requirements described in sections 25h KWG and 6(2) and 10(1) GwG.
• Firms should consider retaining evidence that suspicious-activity alerts are investigated promptly and that relevant transactions are reported to the FIU where required, including evidence of controls operating during system upgrades or parallel-running arrangements.
• Boards, supervisory boards, and senior managers responsible for AML oversight should consider reviewing whether remediation reporting clearly distinguishes completed corrective actions, residual deficiencies, dependencies, deadline changes, and risks requiring escalation.

What changed

The 2026-09-15 order revises deadlines contained in BaFin’s earlier 2021 and 2023 orders because Deutsche Bank is reorganising its transaction-monitoring system in response to changed technical requirements. The publication does not disclose the revised individual deadlines, identify each remaining deficiency, or impose a new obligation applicable to all institutions.

Key dates

2026-10-01

BaFin imposed the €1.2 million administrative fine on Volkswagen AG for breach of the MAR ad hoc disclosure obligation.

2026-10-09

BaFin published the enforcement notice describing the breach and the applicable maximum fine.

Suggested considerations

• Firms should reassess controls for identifying inside information in earnings forecasts, guidance changes and material deviations from analyst or market consensus, rather than limiting the assessment to finalized financial results.
• Compliance teams may wish to establish a documented escalation process linking finance, investor relations, legal and senior management whenever proposed guidance is materially above or below prevailing market expectations.
• Firms should consider maintaining contemporaneous evidence of the information’s precision, confidentiality, expected price sensitivity, the time the disclosure obligation arose, the decision-maker, and the reasons for selecting an ad hoc disclosure or any lawful delay under Article 17 MAR.
• Issuers should distinguish a MAR-compliant ad hoc announcement from an ordinary press release and verify that dissemination arrangements meet applicable MAR and national implementation requirements before publication.
• Firms should review whether earnings calls, websites, media releases, investor presentations or selective communications could disclose or confirm inside information before the ad hoc announcement, creating additional market-abuse and insider-control risks.
• German issuers may wish to review their procedures against the relevant German Securities Trading Act provisions and BaFin expectations, including controls for timely notification, publication and retention of ad hoc disclosures.
• Boards and senior managers should consider whether training and governance adequately address the possibility that an apparently routine forecast or guidance update becomes inside information when it materially diverges from market expectations.

What changed

This is an enforcement action rather than a new rule. BaFin applied the first subparagraph of Article 17(1) of Regulation (EU) No 596/2014 (Market Abuse Regulation), which requires issuers to inform the public as soon as possible of inside information that directly concerns them. BaFin expressly identified a significant deviation between financial expectations and market expectations as information capable of meeting the inside-information test.

Key dates

2026-10-09

ADGM's Registration Authority published the enforcement action and announced total penalties of USD 100,000 against PKF and its registered audit principal.

Suggested considerations

• Compliance teams at ADGM-registered audit firms should consider performing a documented review of current audit files against the applicable ISA requirements, with particular attention to fraud-risk assessment, audit evidence, audit documentation and the basis for audit conclusions.
• Registered audit principals should consider ensuring that their involvement, review work, judgments and approval of audit reports are clearly evidenced in the engagement file rather than relying on undocumented supervision.
• Audit firms should consider reviewing engagement acceptance, staffing, supervision, consultation, quality-control and file-completion processes to determine whether they support the required standard of due skill, care and diligence.
• Firms should consider conducting a targeted look-back across comparable ADGM engagements and retaining evidence of any remediation, especially where the same audit principal, methodology or documentation weaknesses may recur.
• ADGM entities and their boards or audit committees should consider confirming that their appointed auditor is appropriately registered and that significant audit judgments, fraud-risk procedures and evidence supporting the audit opinion are adequately documented.
• Senior management and professional-indemnity stakeholders should consider the possibility of separate financial and reputational consequences for the audit firm and the responsible registered audit principal.

What changed

This publication does not introduce a new rule or compliance deadline; it applies existing requirements under the Companies Regulations (Auditors) Rules 2023 to a specific audit engagement. The RA imposed USD 65,000 on PKF and USD 35,000 on its registered audit principal, demonstrating that enforcement exposure can attach separately to both the audit firm and the responsible individual.

Key dates

2026-10-08

Federal Reserve and OCC announced coordinated enforcement actions; the OCC imposed a $350 million civil money penalty on American Express National Bank and issued a cease-and-desist order. The Federal Reserve action applied to American Express Company and American Express Travel Related Services Company, Inc.

2027-01-06 Deadline

Approximate deadline for American Express National Bank to submit the OCC-required written Action Plan within 90 days of the October 8, 2026 order, subject to the order's day-counting conventions.

Suggested considerations

• Compliance teams may wish to reassess whether the institution's BSA/AML risk assessment adequately covers its largest and most economically significant products, customer segments, transaction channels, and trade-related activity.
• Firms should consider testing whether customer identification, customer due diligence, beneficial-ownership information, and transaction-monitoring scenarios are appropriately calibrated to credit-card, charge-card, merchant, cross-border, and trade-based money-laundering risks.
• Management may wish to inventory staffing, subject-matter expertise, escalation capacity, data quality, model and rules governance, internal controls, independent testing, and BSA/AML training for employees and directors against the deficiencies identified in the coordinated orders.
• Compliance teams may wish to conduct a lookback of previously generated alerts and transactions to assess whether suspicious activity was timely investigated, escalated, documented, and reported through SARs, including whether systemic monitoring gaps affected historical activity.
• Boards and senior management should consider obtaining documented evidence that enterprise AML oversight is operating effectively at subsidiaries and that parent-level governance does not rely solely on narrow subsidiary or product risk assessments.
• Affected American Express entities should track the 90-day Action Plan submission requirement and prepare supporting remediation evidence, governance reporting, milestone tracking, and supervisory communications.
• Other regulated firms should consider treating the action as a supervisory signal that risk assessments, transaction monitoring, and SAR controls must be aligned to actual business volume and risk rather than to the products that are easiest to administer.

What changed

This is an enforcement action rather than a generally applicable new rule, but it establishes concrete remediation expectations for a large, complex card issuer. The coordinated OCC order requires American Express National Bank to submit, within 90 days of the October 8, 2026 order, an acceptable written Action Plan addressing all BSA/AML deficiencies and incorporating the order's substantive requirements; the OCC must provide prior written supervisory non-objection.

Key dates

2026-10-08

The OCC announced the cease-and-desist order and $350 million civil money penalty against American Express National Bank; the Federal Reserve announced a coordinated action against American Express Company and American Express Travel Related Services Company.

Suggested considerations

• Compliance teams may wish to reassess whether the BSA/AML risk assessment accurately reflects the institution's largest and most complex products, customer segments, payment flows, geographies, channels, and transaction types, rather than relying primarily on deposit-account risk.
• Firms should consider testing whether customer identification, customer due diligence, beneficial-ownership information, and account-risk-rating processes provide sufficiently complete and reliable data for transaction monitoring and suspicious-activity reporting.
• Banks may wish to conduct a targeted lookback for trade-based money-laundering indicators in card, merchant, payment, cross-border, and related repayment activity, including activity involving insiders or connected accounts, and document escalation and reporting decisions.
• Compliance teams should consider validating that monitoring scenarios, alert thresholds, investigative workflows, case-management controls, quality assurance, and SAR filing processes can identify and report suspicious activity within applicable regulatory timeframes.
• Boards and senior management may wish to review whether BSA/AML staffing levels, expertise, reporting lines, technology, data governance, and independent-testing coverage are proportionate to the institution's size, complexity, and risk profile.
• Firms should consider strengthening role-based BSA/AML training for employees, directors, and senior management, with evidence of completion, competency, and periodic refreshers.
• Internal audit or another suitably independent function may wish to perform end-to-end testing of risk assessment, customer due diligence, monitoring, investigation, SAR decisioning, and governance controls, with tracked remediation and board-level reporting.
• U.S. banking organizations may wish to compare their programs against the OCC's findings and the market commentary emphasizing that the principal lesson is product-risk misalignment and the need for enterprise-wide controls, not merely remediation of isolated monitoring alerts.

What changed

This is an enforcement action and supervisory precedent, not a new generally applicable rule. The OCC required American Express National Bank to remediate a BSA/AML program that was not reasonably designed to assure and monitor compliance with the BSA and its implementing regulations. The findings specifically reinforce expectations that risk assessments cover the institution's actual product mix, including credit and charge cards; customer identification and customer due-diligence procedures support effective monitoring; transaction-monitoring and suspicious-activity reporting processes...

Key dates

2026-06-30

The three Funds had $251.8 million in assets under management, according to ASIC’s background information.

2026-10-08

ASIC announced the interim stop order, which took effect to halt offers, issues, sales and transfers under the affected PDSs while the order remains in force.

Suggested considerations

• Firms should review retail private-credit PDSs against Corporations Act 2001 sections 1013C(3), 1013D and 1013F and ASIC Regulatory Guide 168, with particular attention to whether material risks and costs are presented clearly, concisely and effectively.
• Compliance teams may wish to reconcile all stated loan-portfolio and diversification metrics to current underlying data, define the calculation methodology and test whether concentration by property type, geography, borrower, security ranking, loan-to-value ratio and maturity is readily understandable.
• Firms should consider documenting all costs associated with disposing of, redeeming or transferring an interest, including circumstances in which an exit may be delayed, restricted or priced below investor expectations.
• Product issuers may wish to explain the purpose, funding, governance, triggers, permitted uses and limitations of any investor reserve, impairment or capital-loss account, including whether it provides contractual protection or merely represents an internal allocation.
• Distribution teams should consider suspending or reviewing affected marketing, application and transfer processes where a PDS is subject to a stop order, and checking that advisers and platforms are not facilitating prohibited conduct.
• Private-credit fund managers should consider broader reviews of fee structures, margin arrangements, valuation and impairment practices, liquidity, conflicts of interest and retail-client distribution, given the issues identified in independent industry reporting as part of ASIC’s broader 2026 scrutiny of the sector.
• Boards, responsible entities and compliance committees may wish to retain evidence of PDS review, data validation, legal sign-off, escalation and remediation decisions in anticipation of further ASIC surveillance or a final stop-order process.

What changed

The interim stop order applies to the PDSs for the ASCF Premium Capital Fund, ASCF Select Income Fund and ASCF High Yield Fund. While the order remains in force, ASCF cannot offer, issue, sell or transfer interests under those PDSs. This is an enforcement action rather than a sector-wide rule change; however, ASIC’s application of the Corporations Act 2001 PDS and stop-order provisions reinforces that private-credit issuers must explain loan-portfolio composition, diversification metrics, the cost of disposing of an interest and the operation of investor reserve accounts in a sufficiently...

Key dates

2016-06-17

Saad became an authorised representative of Interprac Financial Planning, according to ASIC's background information.

2021-02-01

ASIC alleges the relevant advice period began, during which Saad advised retail clients to roll over superannuation into First Guardian.

2021-12-31

Saad's authorised-representative relationship with Interprac Financial Planning ended, according to ASIC's background information.

2026-10-07

ASIC commenced Federal Court civil penalty proceedings against Osama Saad.

Suggested considerations

• Compliance teams may wish to review adviser remuneration, referral, marketing and lead-generation arrangements for direct or indirect benefits linked to product recommendations, including payments made through related entities or third parties.
• Licensees should consider testing whether any benefit could reasonably influence the choice of financial product or advice strategy, and whether the arrangement falls within the conflicted-remuneration prohibitions in Part 7.7A Division 5 of the Corporations Act 2001.
• Advice businesses should consider targeted file reviews involving rollovers from superannuation into high-risk, illiquid or complex products, including assessment of best-interests compliance under section 961B, appropriateness under section 961G and the client-interest priority obligation under section 961J.
• Firms should consider tracing the full economic flow of adviser remuneration, referral fees, marketing funding and related-party payments rather than limiting testing to amounts shown on adviser or licensee invoices.
• Australian financial-services licensees may wish to reassess oversight of authorised representatives, referral partners and externally generated leads, including conflicts registers, product research, statements of advice and evidence supporting the client's circumstances and objectives.
• Relevant businesses should consider reviewing controls against ASIC Regulatory Guide 246, Conflicted and other banned remuneration, and preserving records that demonstrate why payment structures do not circumvent the statutory prohibitions.
• Product issuers and superannuation trustees may wish to review distribution and surveillance data for First Guardian, Shield and comparable products, and consider whether affected clients require remediation or referral to the appropriate complaints process.
• Compliance teams should monitor the Federal Court proceedings and ASIC's broader First Guardian and Shield enforcement program, noting that the allegations are unproven until determined by the Court.

What changed

This is an enforcement action rather than a new rule or amended requirement. ASIC alleges that Atlas Marketing and United Capital received benefits from entities connected with First Guardian and Shield, including payments allegedly used for personal benefit and to fund marketing and lead-generation businesses that referred prospective clients to advice firms.

Key dates

2021-01-01

Beginning of the alleged cherry-picking period involving delayed allocations and disproportionate assignment of first-day gains and losses.

2023-10-31

End of the alleged cherry-picking period, described by the SEC as running through October 2023.

2024-11-01

The SEC filed its prior litigated district-court complaint against Leech; the source identifies November 2024 but does not specify the filing day.

2026-06-05

The SEC settled administrative proceedings against Western Asset, imposing a $100 million penalty, censure, cease-and-desist order, and Fair Fund process.

2026-10-06

The SEC announced its motion for entry of a consent final judgment against Leech; the judgment remains subject to court approval.

Suggested considerations

• Compliance teams may wish to review whether trade timestamps, allocation timestamps, order-entry records, and market settlement-price data permit detection of allocations made after material price movements are known.
• Firms should consider testing allocation controls for fairness and consistency across strategies, accounts, clients, and affiliated portfolios, including review of first-day gains and losses and unexplained deviations among portfolio managers.
• Firms should consider validating that written allocation, reallocation, and error-correction procedures are implemented in practice, with documented approvals, exception handling, and independent oversight.
• Compliance teams may wish to assess whether portfolio-manager trading and allocation practices diverge materially from peers or from client disclosures, and whether those differences trigger escalation, surveillance, or enhanced supervision.
• Investment advisers should consider reviewing supervisory arrangements for senior investment personnel, including evidence that surveillance alerts, exception reports, and known control weaknesses are investigated and remediated.
• Firms should consider preserving records sufficient to reconstruct the timing and rationale of trade placement, allocation, reallocation, and approval decisions, and reviewing whether disclosures accurately describe fair and equitable allocation practices.
• Affected firms may wish to monitor the court’s decision on the proposed Leech judgment and the administration of Western Asset’s Fair Fund; no general compliance deadline is stated in the publication.

What changed

This publication does not establish a new generally applicable rule; it advances a case-specific consent judgment, subject to court approval, against Leech. The proposed judgment includes a $3 million penalty, a permanent injunction against violations of the federal securities-law antifraud provisions, an officer-and-director bar, and a forthcoming associational bar. The related June 5, 2026 administrative settlement against Western Asset imposed a $100 million civil penalty, censure, and cease-and-desist order, with the penalty deposited into a Fair Fund for harmed investors.