ASIC RG 132 — ASIC Regulatory Guide – RG 132 Funds management: Compliance and oversight

Page 1 REGULATORY GUIDE 132 Funds management: Compliance and oversight June 2025 About this guide This guide is for:  responsible entities of registered managed investment schemes;  corporate directors of retail corporate collective investment vehicles (retail CCIVs); and  Australian passport fund operators. Parts of this guide are also relevant for:  wholesale scheme operators;  corporate directors of wholesale corporate collective investment vehicles (wholesale CCIVs);  investor directed portfolio service (IDPS) operators; and  managed discretionary account (MDA) providers. Aspects of this guide are also relevant to those with oversight responsibilities, including compliance committees, independent oversight entities, compliance plan auditors and annual implementation reviewers. It gives guidance on the compliance and oversight obligations these entities must meet under the Corporations Act and other legal obligations. Page 2 REGULATORY GUIDE 132: Funds management: Compliance and oversight © Australian Securities and Investments Commission June 2025 Page 2 About ASIC regulatory documents In administering legislation ASIC issues the following types of regulatory documents. Consultation papers: seek feedback from stakeholders on matters ASIC is considering, such as proposed relief or proposed regulatory guidance. Regulatory guides: give guidance to regulated entities by:  explaining when and how ASIC will exercise specific powers under legislation (primarily the Corporations Act)  explaining how ASIC interprets the law  describing the principles underlying ASIC’s approach  giving practical guidance (e.g. describing the steps of a process such as applying for a licence or giving practical examples of how regulated entities may decide to meet their obligations). Information sheets: provide concise guidance on a specific process or compliance issue or an overview of detailed guidance. Reports: describe ASIC compliance or relief activity or the results of a research project. Document history This guide was issued in June 2025 and is based on legislation and regulations as at the date of issue. In April 2026, we made amendments to reflect renamed Regulatory Guide 181 AFS licensing: Managing conflicts of interest (RG 181). Previous versions:  Superseded Regulatory Guide 132, issued July 2018, updated July 2022  Superseded Policy Statement 132, issued August 1998, updated November 1998, rebadged as a regulatory guide 5 July 2007  Superseded Regulatory Guides 116, 117, 118, 119 and 120, issued April 2004, replaced by Regulatory Guide 132 July 2018 and withdrawn Disclaimer This guide does not constitute legal advice. We encourage you to seek your own professional advice to find out how the Corporations Act and other applicable laws apply to you, as it is your responsibility to determine your obligations. Page 3 REGULATORY GUIDE 132: Funds management: Compliance and oversight © Australian Securities and Investments Commission June 2025 Page 3 Contents A Overview ........................................................................................... 4 Who this guide applies to................................................................... 4 Compliance management systems ................................................... 8 Compliance plans .............................................................................. 9 Oversight.......................................................................................... 11 Australian passport funds ................................................................ 13 Other relevant obligations ................................................................ 14 B Compliance management systems .............................................. 17 What is a compliance management system? .................................. 17 Key features of a compliance management system ........................ 19 C Compliance plans .......................................................................... 31 Content of compliance plan ............................................................. 31 Establishing adequate compliance controls in the compliance plan .................................................................................................. 32 Group compliance risks and controls .............................................. 40 Registered scheme and retail CCIV level compliance risks and controls ............................................................................................ 49 Additional compliance risks and controls for Australian passport funds ................................................................................................ 61 D Oversight ........................................................................................ 64 Compliance committee .................................................................... 64 Compliance plan auditor .................................................................. 67 Oversight of Australian passport funds ............................................ 70 Key terms ............................................................................................... 73 Related information ............................................................................... 77 Page 4 REGULATORY GUIDE 132: Funds management: Compliance and oversight © Australian Securities and Investments Commission June 2025 Page 4 A Overview Key points An effective and responsive compliance management system that is planned, implemented, evaluated and improved (as needed) will allow an Australian financial services (AFS) licensee to demonstrate its commitment to complying with its obligations under the Corporations Act 2001 (Corporations Act) and Australian Securities and Investments Commission Act 2001 (ASIC Act). Further, compliance plans are required for registered managed investment schemes (registered schemes) and retail corporate collective investment vehicles (retail CCIVs) (‘investment funds’). Compliance plans must meet the requirements of the Corporations Act. This is one part of a fund operator’s compliance management system. Oversight of the fund’s operation is as follows: • for registered schemes—the compliance committee or the external directors of the responsible entity and compliance plan audit; • for CCIVs—the external directors of the corporate director and compliance plan audit; and • for Australian passport funds—additionally, the independent oversight entity and annual implementation review. The compliance and oversight arrangements should reflect the values, objectives and strategy of the responsible entity, corporate director, wholesale scheme operator, investor directed portfolio service (IDPS) operator or managed discretionary account (MDA) provider. Who this guide applies to RG 132.1 This guide is for: (a) responsible entities of registered schemes; (b) corporate directors of retail CCIVs; and Note: This guide applies to all types of registered schemes and retail CCIVs, even if we have given other guidance on specific compliance obligations for that type of investment fund. (c) Australian passport fund operators. RG 132.2 Parts of this guide are also relevant to: (a) operators of managed investment schemes that are unregistered because of s601ED(2), who hold an AFS licence in relation to the issue of Page 5 REGULATORY GUIDE 132: Funds management: Compliance and oversight © Australian Securities and Investments Commission June 2025 Page 5 interests or other financial services provided in the operation of the scheme (‘wholesale scheme operators’) (see Section B); Note: In this guide, references to sections (s), divisions (Div) and parts (Pt) are to the Corporations Act, unless otherwise specified. References to regulations (reg) are to the Corporations Regulations 2001 unless otherwise specified. (b) corporate directors of wholesale corporate collective investment vehicles (wholesale CCIVs) (see Section B); (c) IDPS operators (see Section B); and Note: For more information for IDPS operators, see Regulatory Guide 148 Platforms that are managed investment schemes and nominee and custody services (RG 148). (d) MDA providers (see Section B). Note: For more information for MDA providers, see Regulatory Guide 179 Managed discretionary accounts (RG 179). RG 132.3 In this guide, as illustrated in Figure 1: (a) ‘investment funds’ refers to registered schemes and retail CCIVs; (b) ‘investment fund operators’ refers to responsible entities of registered schemes and corporate directors of retail CCIVs; (c) ‘Australian passport fund’ refers to a registered scheme or sub-fund of a retail CCIV that is also registered as a passport fund under the Asia Region Funds Passport; (d) ‘wholesale CCIVs’ and ‘wholesale unregistered schemes’ refer to funds that are operated by corporate directors and wholesale scheme operators, respectively, and have wholesale members only; and Note: See the key terms for the definitions of ‘wholesale scheme operator’ and ‘wholesale unregistered scheme’. (e) ‘IDPSs’ and ‘MDAs’ refer to funds that are operated by IDPS operators and MDA providers, respectively. Page 6 REGULATORY GUIDE 132: Funds management: Compliance and oversight © Australian Securities and Investments Commission June 2025 Page 6 Figure 1: Who this guide applies to Note: See RG 132.3 for the information in this figure (accessible version). Investment fund operators Investment funds Responsible entities Corporate directors Corporate directors Wholesale scheme operators IDPS operators MDA providers Eligible to be registered as an Australian passport fund under the Asia Region Funds Passport Wholesale unregistered schemes IDPSs MDAs Wholesale CCIVs Retail CCIVs Registered schemes Sub-funds are eligible to be registered as an Australian passport fund Page 7 REGULATORY GUIDE 132: Funds management: Compliance and oversight © Australian Securities and Investments Commission June 2025 Page 7 RG 132.4 Table 1 sets out the topics covered in this guide, and which entities the guidance applies to. Table 1: Who this guide applies to Guidance in this guide Registered schemes Wholesale unregistered schemes Retail CCIVs Wholesale CCIVs IDPSs MDAs Australian passport funds Compliance management systems (Section B) Yes Yes Yes Yes Yes Yes Yes Compliance plans (Section C) Yes No Yes No No No Yes Compliance committees (Section D: RG 132.185– RG 132.197) Yes—if less than half the responsible entity’s directors are external directors No No No No No Yes—if the Australian passport fund is a registered scheme that is required to have a compliance committee Compliance plan audits (Section D: RG 132.198– RG 132.214) Yes No Yes No No No Yes—if the registered scheme or retail CCIV has a passport fund as a sub-fund Annual implementation reviews and independent oversight entities (Section D: RG 132.215– RG 132.228) No—unless the registered scheme is an Australian passport fund No No—unless a sub- fund of the CCIV is an Australian passport fund No No No Yes Page 8 REGULATORY GUIDE 132: Funds management: Compliance and oversight © Australian Securities and Investments Commission June 2025 Page 8 RG 132.5 Aspects of this guide are also relevant to those with oversight responsibilities, such as: (a) directors of the responsible entity of a registered scheme, and the corporate director of a retail CCIV (see Sections B, C and D); (b) staff involved in undertaking or monitoring compliance activities (see Sections B and C); (c) members of compliance committees (compliance committee members) and independent oversight entities (see Sections B, C and D); (d) compliance plan auditors (see Sections C and D); and (e) annual implementation reviewers (see Sections C and D). Compliance management systems RG 132.6 An AFS licensee has an obligation to: (a) do all things necessary to ensure its financial services are provided efficiently, honestly and fairly (see s912A(1)(a)); (b) comply with the financial services laws (see s912A(1)(c)); and (c) comply with the conditions on its AFS licence (see s912A(1)(b)). RG 132.7 In Regulatory Guide 104 AFS licensing: Meeting the general obligations (RG 104), we set out our general guidance for AFS licensees on what is required to meet the broad compliance obligations under s912A. RG 132.8 This guide contains additional tailored guidance to help responsible entities, corporate directors, wholesale scheme operators, IDPS operators and MDA providers meet their broad compliance obligations. RG 132.9 We have also provided guidance for fund operators on their requirement to have adequate risk management systems under s912A(h): see Regulatory Guide 259 Risk management systems of responsible entities (RG 259). Importantly, compliance and risk management obligations are not mutually exclusive. Therefore, this guide should be read together with RG 259. RG 132.10 A responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider must have measures in place for ensuring it complies with its obligations as an AFS licensee, including the broad compliance obligations, on an ongoing basis: see condition 4 of the standard licence conditions in Pro Forma 209 Australian financial services licence conditions (PF 209). RG 132.11 An effective and responsive compliance management system that is planned, implemented, evaluated and improved (as needed) will allow a responsible Page 9 REGULATORY GUIDE 132: Funds management: Compliance and oversight © Australian Securities and Investments Commission June 2025 Page 9 entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider to demonstrate its commitment to complying with its obligations under the Corporations Act and ASIC Act. RG 132.12 Australian Standard AS ISO 37301:2023 Compliance management systems—Requirements with guidance for use provides guidance for an effective compliance management system within an organisation. Based on this guidance, we consider that the key features of an effective compliance management system include: (a) an understanding of the context in which the managed investment scheme, CCIV, IDPS or MDA operates; (b) clear articulation of the values, objectives and strategy of the responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider. The compliance management system must reflect the values, objectives and strategy of the responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider; (c) identification of compliance obligations, risks and objectives; (d) clarity about the roles and responsibilities of those people involved in the compliance management system; (e) organisational support for the compliance management system; (f) compliance controls that respond to the identified compliance obligations, risks and objectives; (g) appropriate documentation and record keeping; (h) monitoring and review of the compliance management system for continual improvement; and (i) procedures where non-compliance occurs. RG 132.13 Compliance and risk management are not mutually exclusive, but operate together. A responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider can choose to implement: (a) integrated compliance and risk management systems; or (b) a compliance management system and distinct risk management systems. Note: For our detailed guidance on compliance management systems, see Section B. Compliance plans RG 132.14 In addition to its broad compliance obligation as an AFS licensee, an investment fund operator has a duty to: (a) ensure that the investment fund’s compliance plan meets the requirements of the Corporations Act; and (b) comply with the compliance plan (see s601FC(1)(h) and 1224D(2)(g)). Page 10 REGULATORY GUIDE 132: Funds management: Compliance and oversight © Australian Securities and Investments Commission June 2025 Page 10 RG 132.15 The compliance plan must set out adequate measures that the investment fund operator will apply when fulfilling its responsibilities in relation to the investment fund to ensure compliance with the Corporations Act and the fund’s constitution: see s601HA and 1226A. RG 132.16 The Corporations Act does not specify what constitutes adequate measures (although for a registered scheme s601HA provides a non-exhaustive list of matters for which there must be adequate arrangements—an approach intended to provide flexibility for responsible entities to create compliance controls that are tailored for the particular scheme). An investment fund operator will therefore need to develop and implement an appropriate set of compliance controls to address the compliance risks faced in operating the investment fund. Note: In this guide, we use the term ‘compliance controls’ instead of ‘compliance measures’, as this reflects AS ISO 37301:2023. Compliance controls may be in the form of a process, activity or measure. RG 132.17 Compliance plans and the compliance controls set out in them are an integral component of effective compliance management systems, and play a key role in protecting investors and promoting investors’ interests. RG 132.18 When we look at compliance plans, we look at whether: (a) the compliance controls in the compliance plan are aligned with the responsible entity’s values, objectives and strategy, taking into account the nature, scale and complexity of the particular investment fund; (b) the compliance controls reflect the actual procedures, processes and practices of the investment fund operator and the investment fund; (c) there is a clear and demonstrated nexus between the compliance obligations and compliance controls; (d) the compliance controls are set out with enough certainty to allow the investment fund operator, ASIC and the auditor of the compliance plan to assess whether the operator has complied with the compliance plan; (e) the compliance plan is written in a clear manner so that it is usable by its target audience; (f) the compliance plan provides for identified functional roles for carrying out a particular compliance control and the monitoring of that compliance control; (g) the frequency and quantity of compliance controls, and their monitoring, are sufficient to effectively manage the compliance risks; (h) compliance with the compliance controls is monitored, the processes for monitoring performance of the compliance controls are described with sufficient details and certainty to ensure whether they will be or have Page 11 REGULATORY GUIDE 132: Funds management: Compliance and oversight © Australian Securities and Investments Commission June 2025 Page 11 been complied with, and any non-compliance is reported to the compliance committee, the board or ASIC as required; and (i) the compliance plan is maintained so that the compliance controls, and the performance of those compliance controls, are adequate in light of any changes to the investment fund, the investment fund operator or the environment in which they both operate. RG 132.19 Compliance risks may apply across all of the investment funds operated by the investment fund operator. We refer to these types of risks as group compliance risks. Group compliance risks to be addressed in a compliance plan generally arise from issues relating to: (a) requirements that apply because the investment fund operator is an AFS licensee, including requirements in relation to financial resources, conflicts of interest, complaints handling, breach reporting and competency; or (b) management of staff, finances and other processes at the investment fund operator level, such as meetings of directors, training, recruitment and experience, cyber resilience, accounts and record keeping, and disclosure and reporting. RG 132.20 For different types of investment funds, there will also be compliance risks driven by the nature, diversity and structure of assets invested in. When we look at a compliance plan, we will look for these to be addressed. Note: For the matters that we consider when we look at compliance plans, see Section C. The particular compliance controls adopted will depend on the specific nature of the investment fund and its business. Oversight RG 132.21 The directors of the fund operator are ultimately responsible for ensuring that the operator complies with its obligations. However, in addition to the directors, oversight and assurance of the operator’s compliance occurs through: (a) the compliance committee (required for registered schemes where less than half of the directors of the responsible entity are external directors). The compliance committee is responsible for assessing whether the compliance plan is adequate, monitoring the responsible entity’s compliance with the compliance plan, reporting breaches to the responsible entity and, if the responsible entity is not taking action to adequately deal with a reported breach, reporting the matter to ASIC; and (b) the compliance plan auditor. The compliance plan auditor conducts an annual audit to assess whether the investment fund operator has Page 12 REGULATORY GUIDE 132: Funds management: Compliance and oversight © Australian Securities and Investments Commission June 2025 Page 12 complied with the compliance plan and whether the compliance plan continues to meet the requirements of the Corporations Act. RG 132.22 Australian passport funds are also required to have an independent oversight entity and annual implementation review: see RG 132.31–RG 132.32. Note: For more information on oversight of investment funds and Australian passport funds, see Section D. Compliance plan audit RG 132.23 An investment fund operator must ensure that at all times a registered company auditor, an audit firm or an authorised audit company is engaged to audit compliance with the investment fund’s compliance plan: see s601HG(1) and 1226F(1). RG 132.24 Under s601HG(3) and 1226G, the auditor of a compliance plan must: (a) examine the compliance plan; (b) carry out an audit of the investment fund operator’s compliance with the compliance plan during the financial year; and (c) give the investment fund operator a report that states the auditor’s opinion on whether: (i) the investment fund operator has complied with the compliance plan during the financial year; and (ii) the plan continues to meet the requirements of the Corporations Act. RG 132.25 The appointment of a compliance plan auditor, who audits the compliance plan annually, serves as an independent external oversight of the investment fund operator’s compliance arrangements to ensure the compliance plan continues to meet the requirements of the Corporations Act. Note: For our expectations about audits of an investment fund’s compliance plan, see Section D. Compliance committee RG 132.26 A responsible entity of a registered scheme must establish a compliance committee if less than half of its directors are external directors: see s601JA. The compliance committee must have at least three members, and the majority must be external members: see s601JB. Note: At least half of the directors of the corporate director of a retail CCIV must be external directors: see s1224G(1). This means that a retail CCIV is not required to establish a compliance committee. Page 13 REGULATORY GUIDE 132: Funds management: Compliance and oversight © Australian Securities and Investments Commission June 2025 Page 13 RG 132.27 Section 601JC provides that the compliance committee must: (a) monitor to what extent the responsible entity complies with the compliance plan, and report on its findings to the responsible entity; (b) report to the responsible entity any breaches of the Corporations Act or the constitution that the compliance committee becomes aware of or suspects; (c) report to ASIC if the committee is of the view that the responsible entity has not taken, or does not propose to take, appropriate action to deal with a reported breach of the Corporations Act or the constitution; and (d) assess at regular intervals whether the compliance plan is adequate, report to the responsible entity on that assessment, and make recommendations to the responsible entity about any changes that it considers should be made to the compliance plan. RG 132.28 Regardless of whether there is a compliance committee, the board of directors remains ultimately responsible for ensuring that the responsible entity complies with its obligations. The compliance committee assists the board by operating, in part, as an intermediary between the responsible entity’s compliance function and the board in relation to compliance monitoring, assessment and reporting. However, it is important that the compliance function has a direct reporting line to the board to ensure that the board is made fully aware of any compliance issues, so that the board can effectively carry out its governance responsibilities. RG 132.29 If a registered scheme does not have a compliance committee, we will look for the external directors to be particularly vigilant and actively engaged with compliance issues. Note: For information on the appointment and conduct of compliance committees, see Section D. Australian passport funds RG 132.30 For Australian passport funds, in addition to the compliance plan requirements under the Corporations Act, the Australian Passport Rules require the operator of the fund to have a compliance framework that ensures adequate compliance with relevant laws and regulations: see section 8(2)(d) of the Australian Passport Rules. Note 1: The Australian Passport Rules are the Corporations (Passport) Rules 2018 made under s1211 and 1211A by the Australian Minister responsible for the Asia Region Funds Passport. Under s1211(2), the Australian Passport Rules must be substantially the same as the Passport Rules set out in Annex 3 to the Memorandum of Cooperation on the Establishment and Implementation of the Asia Region Funds Passport (Memorandum of Cooperation). Page 14 REGULATORY GUIDE 132: Funds management: Compliance and oversight © Australian Securities and Investments Commission June 2025 Page 14 Note 2: For the matters that we will look to be addressed in an Australian passport fund’s compliance plan, see Section C. RG 132.31 An Australian passport fund is also subject to oversight by an independent oversight entity: see section 14 of the Australian Passport Rules. For Australian passport funds, the independent oversight entity is each of the external directors of the Australian passport fund operator or, if there is a compliance committee, the compliance committee. RG 132.32 In addition to the compliance plan audit requirements under the Corporations Act, an Australian passport fund is subject to an annual implementation review: see section 15 of the Australian Passport Rules. Note: For information on our expectations for the conduct of the annual implementation review and the oversight functions of the independent oversight entity, see Section D. Other relevant obligations RG 132.33 The compliance and oversight obligations set out in this guide interact with other obligations under the Corporations Act for a responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider. This guide should be read in conjunction with those other regulatory guides. Table 2 identifies related guidance that may be relevant. Table 2: Other relevant obligations Obligation and Corporations Act reference Further guidance Explanation Establishing and registering an investment fund: see s601EA and 1222A Regulatory Guide 131 Funds management: Establishing and registering a fund (RG 131) Information Sheet 272 How to register a corporate collective investment vehicle and sub-fund (INFO 272) RG 131 sets out how we assess whether the compliance plan meets the requirements of the Corporations Act when deciding whether we will register a managed investment scheme or Australian passport fund. INFO 272 provides guidance on how to establish and register a CCIV and sub-funds of a CCIV. Constitutions: see s601GA, 601GB, 1223B, 1223G and 1223H Regulatory Guide 134 Funds management: Constitutions (RG 134) The constitution of a registered scheme or retail CCIV sets out some or all of the rights, duties and liabilities of the investment fund operator in its operation of the fund. The investment fund operator must ensure that the fund’s compliance and oversight arrangements are sufficient to ensure compliance with the fund’s constitution. Page 15 REGULATORY GUIDE 132: Funds management: Compliance and oversight © Australian Securities and Investments Commission June 2025 Page 15 Obligation and Corporations Act reference Further guidance Explanation General obligations as an AFS licensee: see s912A Regulatory Guide 104 AFS licensing: Meeting the general obligations (RG 104) Responsible entities, corporate directors, wholesale scheme operators, IDPS operators and MDA providers have an obligation as an AFS licensee to comply with the financial services laws and the conditions of their licence. RG 104 describes how we assess compliance with most of the general obligations under s912A. This guide expands on our general guidance for AFS licensees in RG 104 to cover the specific compliance and oversight obligations for responsible entities, corporate directors, wholesale scheme operators, IDPS operators and MDA providers. Adequate risk management systems: see s912A(1)(h) Regulatory Guide 259 Risk management systems of fund operators (RG 259) Responsible entities, corporate directors, wholesale scheme operators, IDPS operators and MDA providers have an obligation to have adequate risk management systems. RG 259 outlines our expectations of responsible entities and corporate directors when complying with the risk management obligation. Where business risks may affect compliance with compliance obligations, we will look for them to be addressed as part of the compliance management system. Adequate financial resources: see s912A(1)(d) Regulatory Guide 166 AFS licensing: Financial requirements (RG 166) Responsible entities, corporate directors, wholesale scheme operators, IDPS operators and MDA providers have an obligation to have adequate financial resources to provide the financial services covered by their AFS licence. RG 166 sets out the financial requirements that must be met by AFS licensees. Organisational competence: see s912A(1)(e) Regulatory Guide 105 AFS licensing: Organisational competence (RG 105) Responsible entities, corporate directors, wholesale scheme operators, IDPS operators and MDA providers have an obligation to maintain competence to provide the financial services covered by the licence. RG 105 describes how we assess compliance with the organisational competence obligation. Page 16 REGULATORY GUIDE 132: Funds management: Compliance and oversight © Australian Securities and Investments Commission June 2025 Page 16 Obligation and Corporations Act reference Further guidance Explanation Managing conflicts of interest: see s912A(1)(aa) Regulatory Guide 181 AFS licensing: Managing conflicts of interest (RG 181) Responsible entities, corporate directors, wholesale scheme operators, IDPS operators and MDA providers are required to have in place adequate arrangements for managing conflicts of interest. RG 181 supplements the guidance in this guide by setting out:  our general approach to compliance with the statutory obligation in s912A to manage conflicts of interest;  guidance for licensees generally on controlling and avoiding conflicts of interest; and  guidance for licensees generally on disclosing conflicts of interest. Page 17 REGULATORY GUIDE 132: Funds management: Compliance and oversight © Australian Securities and Investments Commission June 2025 Page 17 B Compliance management systems Key points An effective and responsive compliance management system that is planned, implemented, evaluated and improved (as needed) will allow a responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider to demonstrate its commitment to complying with its obligations under the Corporations Act and ASIC Act: see RG 132.34– RG 132.44. AS ISO 37301:2023 provides guidance for an effective compliance management system within an organisation. Based on this guidance, we consider that the key features of an effective compliance management system include: • an understanding of the context in which the managed investment scheme, CCIV (and each sub-fund of the CCIV), IDPS or MDA operates (see RG 132.45–RG 132.48); • clear articulation and reflection of the values, objectives and strategy of the responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider (see RG 132.49–RG 132.51); • identification of compliance obligations, risks and objectives (see RG 132.52–RG 132.58); • clarity about the roles and responsibilities of those people involved in the compliance management system (see RG 132.59–RG 132.70); • organisational support for the compliance management system (see RG 132.71); • compliance controls that respond to the identified compliance obligations, risks and objectives (see RG 132.72–RG 132.74); • appropriate documentation and record keeping (see RG 132.75– RG 132.77); • monitoring and review of the compliance management system for continual improvement (see RG 132.78–RG 132.80); and • procedures where non-compliance occurs (see RG 132.81). Compliance management and risk management are not mutually exclusive, but operate together. What is a compliance management system? RG 132.34 A compliance management system is an integrated system comprised of written documents, functions, processes, controls and tools that help an organisation comply with its legislative requirements, industry codes, standards of good corporate governance, best practices, ethics and community expectations. Page 18 REGULATORY GUIDE 132: Funds management: Compliance and oversight © Australian Securities and Investments Commission June 2025 Page 18 RG 132.35 An effective and responsive compliance management system that is planned, implemented, evaluated and improved (as needed) will allow a responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider to demonstrate its commitment to complying with its obligations under the Corporations Act and ASIC Act. This includes the broad compliance obligation applicable to all AFS licensees, as well as compliance obligations specific to the fund operator and the particular AFS licence they hold. RG 132.36 The international standard for compliance management systems regards ‘compliance’ as ‘an outcome of an organisation meeting its obligations’: see AS ISO 37301:2023. This standard is based on the principles of good governance, proportionality, integrity, transparency, accountability and sustainability. The standard does not prescribe the particular arrangements that must be established, but rather provides guidance on the key considerations that should be addressed in developing a compliance management system. Interaction between compliance and risk management systems RG 132.37 A risk management system is a system involving coordinated activities to direct and control an organisation with regard to risk: see Australian Standard AS ISO 31000:2018 Risk management—Guidelines. Risk management systems include all structures, systems and subsystems, policies, procedures and staff that an organisation uses to identify, assess and treat risks or to monitor and review the relevant controls or measures. RG 132.38 Compliance risk is the potential for losses and legal penalties due to failure of the organisation to meet its obligations, including legislative requirements, industry codes, standards of good corporate governance, best practices, ethics and community expectations. RG 132.39 An effective compliance management system enables an organisation to demonstrate its commitment to meeting its compliance obligations. Compliance and risk management are not mutually exclusive, but operate together. RG 132.40 RG 259 provides guidance on how responsible entities may comply with their obligation under the Corporations Act to maintain adequate risk management systems. It provides examples of the risks that we consider most relevant to responsible entities and the schemes they manage. These include strategic risk, governance risk, operational risk, market and investment risk, and liquidity risk. This guide should be read in conjunction with RG 259. Page 19 REGULATORY GUIDE 132: Funds management: Compliance and oversight © Australian Securities and Investments Commission June 2025 Page 19 RG 132.41 Compliance risk may be thought of as a subset of operational risk—that is, the risk that a responsible entity may not comply with financial services laws in conducting its financial services business: see RG 259.118. The compliance function may be more effective where the risk is specific and can be managed through a set of controls. However, the compliance function also has a broader role in focusing on the question of whether an activity should be undertaken, not just whether it is allowed by law. RG 132.42 Our intention with this guide is to expand on the good practice guidance for identifying, assessing and managing risks we outlined in RG 259 by setting out the key features that we look for a responsible entity, wholesale scheme operator, IDPS operator or MDA provider to build into their system, processes and procedures for managing compliance risk. RG 132.43 In building its compliance management system, we will look for an entity to consider if the compliance function is given sufficient recognition, stature and authority as a separate risk discipline. A responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider can do this by implementing: (a) integrated compliance and risk management systems; or (b) a compliance management system and distinct risk management systems. Note: AS ISO 37301:2023 states that ‘while maintaining its independence, it is preferable that compliance management is integrated with the organization’s other managements processes and its operational requirements and procedures’. Key features of a compliance management system RG 132.44 Developing a compliance management system that reflects AS ISO 37301:2023, as a standalone system or one that is integrated with risk management systems, involves consideration of issues such as: (a) the context in which the managed investment scheme, CCIV (and each sub-fund of the CCIV), IDPS or MDA operates (see RG 132.45– RG 132.48); (b) the values, objectives and strategy of the responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider (see RG 132.49–RG 132.51); (c) what compliance obligations, risks and objectives exist (see RG 132.52–RG 132.58); (d) the roles and responsibilities of those people involved in the compliance management system (see RG 132.59–RG 132.70); (e) the organisational support required for the compliance management system (see RG 132.71); Page 20 REGULATORY GUIDE 132: Funds management: Compliance and oversight © Australian Securities and Investments Commission June 2025 Page 20 (f) compliance controls that will respond to the identified compliance obligations, risks and objectives (see RG 132.72–RG 132.74); (g) appropriate documentation and record keeping (see RG 132.75– RG 132.77); (h) monitoring and review of the compliance management system for continual improvement (see RG 132.78–RG 132.80); and (i) procedures where non-compliance occurs (see RG 132.81). Operational context RG 132.45 AS ISO 37301:2023 outlines the broad range of external and internal issues that affect the organisation’s ability to achieve its intended compliance outcomes. Accordingly, we do not take a ‘one-size-fits-all’ approach to what is required for a compliance management system. We acknowledge that what a responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider should do to comply with its compliance and oversight obligations will vary according to the nature, scale and complexity of its organisation and activities. RG 132.46 In assessing that nature, scale and complexity, we will look for the responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider to at least consider: (a) the number of managed investment schemes, CCIVs (and sub-funds of CCIVs), IDPSs or MDAs managed and the size of their funds under management; (b) whether the fund is a managed investment scheme, CCIV, IDPS or MDA, whether it is a registered scheme or a retail CCIV and whether it (or, for a CCIV, a sub-fund) is also registered as an Australian passport fund; (c) the investment strategies and business activities of the managed investment scheme, CCIV or MDA, and the investment choices available through an IDPS, including the extent to which it will use leverage; (d) whether the fund is, or will be, listed or traded on a financial market; (e) the types of investments and investment location; (f) the distribution model and investor base; (g) the activities—including the investment approach—the managed investment scheme, CCIV, IDPS or MDA engages in; (h) the extent to which the responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider delegates material operational activities, and the level of supervision of their delegates; Page 21 REGULATORY GUIDE 132: Funds management: Compliance and oversight © Australian Securities and Investments Commission June 2025 Page 21 (i) the diversity and structure of the operations (including the geographical spread of operations and the extent to which the responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider outsources any of its functions); (j) the volume and size of the transactions the responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider is responsible for; (k) whether the responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider’s main business is undertaking funds management; and (l) the number of people in the responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider’s organisation. RG 132.47 We will look for the responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider to also consider the external environment in which the business and the fund operate, including: (a) the business, financial, competitive, political, economic, social, cultural, technological and environmental factors that the business faces; (b) expectations of external stakeholders (including members) about the operation of the business; (c) legal and regulatory changes that affect the operation of the business and the fund; and (d) new product offerings in the market that compel a responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider to compete more effectively. RG 132.48 In developing its compliance management system, we will look for the responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider to also consider the extent to which compliance will be integrated with other functions, such as governance, risk, audit and legal. Values, objectives and strategy RG 132.49 As noted in AS ISO 37301:2023, a compliance management system should reflect the organisation’s values, objectives and strategy. Those values, objectives and strategy should be documented and implemented in the compliance management system in practice, so that the compliance management system is in alignment with the articulated values, objectives and strategy. Page 22 REGULATORY GUIDE 132: Funds management: Compliance and oversight © Australian Securities and Investments Commission June 2025 Page 22 RG 132.50 Implementing the values, objectives and strategy into the compliance management system may involve: (a) fostering an awareness of, and organisational response to, compliance issues, so that compliance requirements are ‘front of mind’ for directors and all employees, and are included in decision making across the organisation; (b) tailoring compliance processes and structures to the managed investment scheme, CCIV, IDPS or MDA and its operator, rather than generic policies designed merely to satisfy a regulatory requirement; (c) training staff to understand the responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider’s compliance framework, supporting, recognising and/or rewarding staff who demonstrate their commitment to compliance, and encouraging reporting of non-compliance and errors more broadly; and (d) providing adequate resources for the compliance management system. RG 132.51 The responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider can outsource certain compliance activities, but cannot outsource responsibility for compliance. Identifying compliance obligations, risks and objectives RG 132.52 In planning its compliance management system in accordance with AS ISO 37301:2023, a responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider should: (a) undertake a structured and systematic process to consider its compliance obligations; (b) identify and assess the risks of not meeting compliance obligations; and Note: For information on identifying and assessing risks, see Section C of RG 259. (c) establish compliance controls designed to meet these risks. RG 132.53 This will likely involve considering the following general questions: (a) What are the responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider’s obligations under the Corporations Act, the constitution and any Product Disclosure Statement (PDS), IDPS Guide, MDA contract or Financial Services Guide (FSG)? What outcomes are the Corporations Act and constitution designed to deliver? (b) What risks to ongoing compliance are posed by the operations of this particular managed investment scheme, CCIV and sub-fund of a CCIV, IDPS or MDA, given its nature, environment, size, members (or clients), asset types and investment strategy? Page 23 REGULATORY GUIDE 132: Funds management: Compliance and oversight © Australian Securities and Investments Commission June 2025 Page 23 (c) What is the likelihood and impact of failing to deliver a particular compliance outcome against other outcomes? How should compliance efforts be focused? (d) What compliance controls will deliver the intended outcome? (e) How will the responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider ensure any service provider meets its compliance objectives, compliance standards and commitment to compliance? (f) How will the compliance controls and outcomes be assessed? What does success look like? RG 132.54 We do not consider that any one particular approach for identifying and assessing compliance risks will be the most appropriate and applicable to the operation of all managed investment schemes, CCIVs, IDPSs and MDAs. RG 132.55 Compliance risks can be identified through, for example, evidence-based methods that rely on reviewing audit reports, post-event reports, historical data or risk registers to identify existing and emerging compliance risks that the responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider may face. A systematic team approach may be used, involving focus groups and brainstorming, to identify compliance risks. RG 132.56 It is important that compliance controls to address compliance risks are tailored for, and embedded into every aspect of, the business of the responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider. Operating systems and processes should be designed with compliance in mind. This is more than just a ‘tick the box’ exercise. RG 132.57 It would be prudent for the responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider to document its risk assessment process. Documenting the reasons for assessments, including the thinking that leads to decisions about identified risks, provides a useful context for future risk assessment. This can also assist in reviewing and evaluating whether the compliance controls implemented in response to those risks are adequate. RG 132.58 As the business evolves over time, it may face a range of new or changed compliance obligations and risks. The previous compliance management system may no longer remain appropriate, and we will look for it to be updated to address the new obligations or risks faced by the managed investment scheme, CCIV, IDPS or MDA. For example, adding sub-funds to a CCIV may mean there is a need to update the compliance management system of the corporate director. Page 24 REGULATORY GUIDE 132: Funds management: Compliance and oversight © Australian Securities and Investments Commission June 2025 Page 24 Roles and responsibilities for compliance management systems RG 132.59 A common model of compliance is the ‘three lines of defence’ model, which involves: (a) responsibility at the operational level for carrying out appropriate compliance controls to ensure compliance with the law, the compliance plan and the constitution; (b) an independent compliance function within the organisation having oversight of compliance throughout the organisation; and (c) independent oversight, including internal and external audit functions, providing independent assurance over the compliance framework. RG 132.60 AS ISO 37301:2023 suggests that responsibilities and authorities for relevant roles should be assigned and communicated within the organisation. The compliance management system should include details of the functions, roles and responsibilities of persons involved in planning, implementing and overseeing the compliance management system. It should articulate how the various oversight bodies interact. RG 132.61 When we look at a compliance management system, we will look at whether it provides for: (a) staff who perform compliance management functions to have the appropriate knowledge and skills; (b) decision making that takes into account the compliance management system; (c) key staff to take responsibility for compliance risks and developing controls and processes to manage them; (d) regular reviews; (e) regular monitoring and reporting on compliance risks by the staff responsible for those risks; and (f) regular testing and reporting on compliance controls by the staff responsible for those controls. The directors RG 132.62 The active involvement of, and supervision by, the directors of the responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider in the compliance management system is important to the system being effective and responsive. In setting out the role and responsibilities of the directors in the compliance management system, Page 25 REGULATORY GUIDE 132: Funds management: Compliance and oversight © Australian Securities and Investments Commission June 2025 Page 25 we will look for the responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider to consider issues such as: (a) How will the directors be involved in planning and approving the compliance management system? What periodic reporting will the directors receive on the performance of the compliance management system? (b) Are the resources allocated to implement, evaluate and improve the compliance management system adequate and appropriate? (c) How are expectations around compliance communicated clearly, proactively and regularly across all levels to ensure that they are front of mind? How is the performance of senior management and relevant staff against compliance obligations measured and rewarded? How is an environment where staff feel safe to report non-compliance or raise weak compliance issues promoted? (d) How do the directors ensure that non-compliance is dealt with appropriately? (e) How do the directors ensure that roles in relation to the compliance management system have clearly defined responsibilities and authority? (f) Are the reporting procedures clear, timely, effective and regularly reviewed? Compliance committee RG 132.63 Where a compliance committee exists, we will look for its functions and responsibilities as part of the compliance management system to be clearly explained and documented. Note: For more information on the role of the compliance committee, see Section D. Compliance and assurance staff RG 132.64 Many responsible entities, corporate directors, wholesale scheme operators, IDPS operators and MDA providers have a discrete compliance function, such as a compliance officer or manager, with responsibility for reporting and monitoring on obligations. We do not necessarily expect all operators to have a discrete compliance function, but we will look for sufficient resources to be dedicated to compliance activity and for accountability for compliance functions to be clear. This will allow operators flexibility as to how resources are organised internally to achieve compliance objectives. RG 132.65 The responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider’s compliance and assurance staff may be responsible for: (a) identifying compliance obligations; Page 26 REGULATORY GUIDE 132: Funds management: Compliance and oversight © Australian Securities and Investments Commission June 2025 Page 26 (b) integrating compliance obligations and relevant compliance controls into processes and procedures; (c) maintaining compliance obligations and relevant compliance controls in response to changes in circumstances; (d) providing training and guidance on compliance obligations and the compliance management system for other staff; (e) assisting to embed the compliance management system into the responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider’s operations; (f) responding to non-performance, including escalating to senior management, the compliance committee and the directors, where appropriate; (g) analysing compliance performance indicators and identifying compliance trends; and (h) providing advice and guidance on compliance. RG 132.66 Where there is a discrete compliance function, a robust conflicts management process and demonstrated competence, integrity and commitment to compliance are needed to ensure this role is performed to a high standard. We will generally look for the discrete compliance function to have direct access to the board and, where one exists, the compliance committee to ensure it has enough authority within the rest of the organisation. RG 132.67 The internal compliance function will generally be responsible for day-to- day monitoring of the compliance management system and checking adherence to the compliance management system. Because of this, there is substantial risk if the same person carries out a specific compliance function and is also responsible for auditing, reviewing or monitoring adherence to that compliance function. Generally, we will look for a clear separation between these roles and for this be documented in the compliance management system. RG 132.68 Many responsible entities, corporate directors, wholesale scheme operators, IDPS operators and MDA providers will have an internal audit, review or monitoring role in their compliance management system. Both the compliance and audit roles play valuable and distinct roles in ensuring that the compliance management system is effective and responsive. Responsibility for outsourced operations RG 132.69 Many responsible entities, corporate directors, wholesale scheme operators, IDPS operators and MDA providers outsource some part of their operations. Where this occurs, the operator remains responsible for meeting its compliance obligations. If any operations are outsourced, effective due Page 27 REGULATORY GUIDE 132: Funds management: Compliance and oversight © Australian Securities and Investments Commission June 2025 Page 27 diligence is important to ensure that compliance objectives, compliance standards and commitment to compliance will be achieved. RG 132.70 We encourage all responsible entities, corporate directors, wholesale scheme operators, IDPS operators and MDA providers to include provisions in their service agreements to ensure their compliance objectives, compliance standards and commitment to compliance will be met. Organisational support for the compliance management system RG 132.71 AS ISO 37301:2023 discusses appropriate organisational support for the establishment, implementation, maintenance and continual improvement of the compliance management system. In ensuring the compliance management system provides for adequate organisational support, the responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider could consider various types of support— including resources, training, mentoring, communication and guidance. The level of support required will depend on the nature, scale and complexity of the responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider, the relevant managed investment schemes, CCIVs, IDPSs or MDAs and its compliance management system. Compliance controls RG 132.72 As noted in AS ISO 37301:2023, the compliance management system should include compliance controls that respond to the identified compliance obligations, risks and objectives. RG 132.73 Compliance controls could include: (a) avoiding the compliance risk by not undertaking the relevant activities that give rise to the risk; (b) preventing the eventuation of the risk through specific actions, such as developing rules and documented policies and procedures; and/or (c) reducing or mitigating the consequences or impact of realised risks (e.g. through contingency, emergency or business continuity plans). RG 132.74 In deciding what compliance controls to adopt, we will look for the responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider to consider whether: (a) the compliance controls are aligned with its values, objectives and strategy, taking into account the nature, scale and complexity of the particular managed investment scheme, CCIV (and each sub-fund of the CCIV), IDPS or MDA; Page 28 REGULATORY GUIDE 132: Funds management: Compliance and oversight © Australian Securities and Investments Commission June 2025 Page 28 (b) the compliance controls reflect the actual procedures, processes and practices of the responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider and the managed investment scheme, CCIV, IDPS or MDA; (c) there is a clear and demonstrated nexus between the compliance obligations and compliance controls; (d) the compliance controls are set out with enough certainty to assess whether the responsible entity, corporate director, wholesale scheme operator, IDPS operator or MDA provider has performed the compliance controls; (e) the compliance controls are written in a clear manner so that they are usable by the target audience; (f) the compliance controls establish identified functional roles responsible for carrying out a particular compliance control and the monitoring of that compliance control; (g) the frequency and quantity of compliance controls, and their monitoring, are sufficient to effectively manage the compliance risks; (h) performance of the compliance controls is monitored, the processes for monitoring