Fortnum Private Wealth penalised $1.35 million for cybersecurity failures

Key dates

2021-04-20

Start of the relevant period during which Fortnum admitted the cybersecurity governance failures occurred.

2022-01-01

Independent industry reporting identified a 2022 cyber incident at a Fortnum authorised representative involving data relating to up to 9,828 clients; the ASIC publication does not specify the incident date.

2023-05-11

End of the relevant period covered by Fortnum’s admissions.

2025-07-22

ASIC commenced Supreme Court of NSW proceedings against Fortnum concerning alleged failures to manage and mitigate cybersecurity risks.

2026-10-12

The Supreme Court of NSW approved the agreed $1.35 million pecuniary penalty and ordered Fortnum to pay $250,000 toward ASIC’s costs.

2026-10-14

ASIC published the enforcement outcome and stated that this was its third cyber-resilience enforcement action against an AFSL holder, following RI Advice and FIIG Securities.

Suggested considerations

• Compliance teams may wish to map cybersecurity governance to the licensee’s obligations under section 912A of the Corporations Act 2001 (Cth), including documented ownership, escalation and board or senior-management oversight.
• Firms should consider assessing whether their cybersecurity policy applies consistently to authorised representatives, outsourced providers and other connected practices, with minimum controls, implementation evidence and exception-management processes.
• Licensees may wish to establish a documented assurance programme covering representative due diligence, cyber training, control testing, incident reporting, vulnerability management and periodic reviews of representative cyber resilience.
• Firms should consider whether they have access to suitably qualified cybersecurity expertise, either internally or through appropriately scoped external specialists, and retain evidence that advice informs the risk-management framework.
• Compliance teams may wish to test whether their risk-management system identifies and evaluates cyber risks across the entire advice network and whether monitoring results are reported to accountable senior personnel.
• Following a cyber incident or material control deficiency, firms should consider prompt escalation, preservation of evidence, assessment of notification obligations and constructive engagement with ASIC; Fortnum’s self-reporting and cooperation were identified as relevant factors in the agreed penalty.
• Firms should consider validating that cyber controls protect highly sensitive personal information, including identity documents, tax file numbers and financial-account details, and that remediation is independently verified rather than limited to policy updates.

What changed

No new rule or prospective compliance deadline was introduced. The enforcement outcome establishes a further ASIC precedent that an AFSL holder’s obligation to provide financial services efficiently, honestly and fairly and to maintain adequate risk-management systems extends to cybersecurity controls, specialist expertise and oversight of authorised representatives. Fortnum admitted that, from 2021-04-20 to 2023-05-11, it lacked an adequate cybersecurity policy, adequate processes and frameworks to monitor the cyber resilience of its authorised representatives, sufficient specialised cybersecurity expertise and adequate cybersecurity risk-management systems. ASIC stated that Fortnum has since introduced mandatory cyber controls, annual reviews, enhanced training and specialist cyber exper

Who is affected

• Australian financial services licensees operating authorised representative networks
• Financial advice licensees and dealer groups holding identification documents, tax file numbers and financial account information
• Authorised representatives and financial advisers operating under an AFSL
• Retail clients of Australian financial advice practices

Related regulations

• Corporations Act 2001 (Cth), section 912A(1)(a)
• Corporations Act 2001 (Cth), section 912A(1)(h)
• ASIC Regulatory Guide 104 Licensing: Meeting the general obligations
• ASIC Regulatory Guide 175 Licensing: Financial product advisers—conduct and disclosure