ASIC RG 255 — ASIC Regulatory Guide – RG 255 Providing digital financial product advice to retail clients

Page 1 REGULATORY GUIDE 255 Providing digital financial product advice to retail clients August 2016 About this guide Digital advice (also known as robo-advice or automated advice) is the provision of automated financial product advice using algorithms and technology and without the direct involvement of a human adviser. This regulatory guide brings together some of the issues that persons providing digital advice to retail clients need to consider when operating in Australia—from the licensing stage (i.e. obtaining an Australian financial services (AFS) licence) through to the actual provision of advice. Page 2 REGULATORY GUIDE 255: Providing digital financial product advice to retail clients © Australian Securities and Investments Commission August 2016 Page 2 About ASIC regulatory documents In administering legislation ASIC issues the following types of regulatory documents. Consultation papers: seek feedback from stakeholders on matters ASIC is considering, such as proposed relief or proposed regulatory guidance. Regulatory guides: give guidance to regulated entities by:  explaining when and how ASIC will exercise specific powers under legislation (primarily the Corporations Act)  explaining how ASIC interprets the law  describing the principles underlying ASIC’s approach  giving practical guidance (e.g. describing the steps of a process such as applying for a licence or giving practical examples of how regulated entities may decide to meet their obligations). Information sheets: provide concise guidance on a specific process or compliance issue or an overview of detailed guidance. Reports: describe ASIC compliance or relief activity or the results of a research project. Document history This guide was issued in August 2016 and is based on legislation and regulations as at the date of issue. In June 2021 we made minor updates to Table 1 in the Appendix to reflect changes to requirements for ongoing fee arrangements. We also updated RG 255.51 to reflect changes to the training, education and ethical standards for financial advisers. In March 2022 we updated one of the sample questions at RG 255.41 and RG 255.115 (including its note) to reflect the breach reporting reforms that commenced on 1 October 2021. Disclaimer This guide does not constitute legal advice. We encourage you to seek your own professional advice to find out how the Corporations Act and other applicable laws apply to you, as it is your responsibility to determine your obligations. Examples in this guide are purely for illustration; they are not exhaustive and are not intended to impose or imply particular rules or requirements. Page 3 REGULATORY GUIDE 255: Providing digital financial product advice to retail clients © Australian Securities and Investments Commission August 2016 Page 3 Contents A Overview ........................................................................................... 4 Digital advice in Australia................................................................... 4 Scope of this regulatory guide ........................................................... 5 Other relevant guidance .................................................................... 7 B Digital advice and the AFS licensing regime ................................ 8 When is an AFS licence required? .................................................... 8 AFS licensing arrangements............................................................ 11 C General obligations applying to digital advice licensees .......... 17 General obligations as an AFS licensee .......................................... 17 Adequate resources ......................................................................... 18 Adequate risk management systems .............................................. 20 Adequate compensation arrangements ........................................... 22 D Providing scaled advice in the best interests of the client ....... 24 Scaled advice and the best interests duty ....................................... 24 Appendix: Other ASIC guidance .......................................................... 32 Key terms ............................................................................................... 35 Related information ............................................................................... 39 Headnotes and legislation ............................................................... 39 ASIC publications ............................................................................ 39 Non-ASIC publications..................................................................... 40 Page 4 REGULATORY GUIDE 255: Providing digital financial product advice to retail clients © Australian Securities and Investments Commission August 2016 Page 4 A Overview Key points The provision of digital advice has grown rapidly in Australia since 2014, with a number of start-up Australian financial services (AFS) licensees and existing AFS licensees developing digital advice models. ASIC supports the development of a healthy and robust digital advice market in Australia. This regulatory guide brings together some of the issues that persons providing digital advice to retail clients need to consider when operating in Australia—from the licensing stage (i.e. obtaining an AFS licence) through to the actual provision of advice. Digital advice in Australia RG 255.1 Digital advice (also known as ‘robo-advice’ or ‘automated advice’) is the provision of automated financial product advice using algorithms and technology and without the direct involvement of a human adviser. It can comprise general or personal advice, and range from advice that is narrow in scope (e.g. advice about portfolio construction) to a comprehensive financial plan. RG 255.2 The provision of digital advice has grown rapidly in Australia since 2014, with a number of start-up Australian financial services (AFS) licensees and existing AFS licensees developing digital advice models. We expect this growth to continue. RG 255.3 ASIC supports the development of a healthy and robust digital advice market in Australia. In an environment where only around 20% of adult Australians seek personal advice, we think that digital advice has the potential to be a convenient and low-cost option for retail clients who may not otherwise seek advice. Note 1: ‘Personal advice’ is defined in s766B(3) of the Corporations Act 2001 (Corporations Act) as: ‘financial product advice given or directed to a person (including by electronic means) in circumstances where the provider of the advice has considered one or more of the client’s objectives, financial situation and needs; or a reasonable person might expect the provider to have considered one or more of these matters’. Note 2: In this guide, references to ‘client’ mean ‘retail client’, as defined in s761G of the Corporations Act and Div 2 of Pt 7.1 of Ch 7 of the Corporations Regulations 2001 (Corporations Regulations). Page 5 REGULATORY GUIDE 255: Providing digital financial product advice to retail clients © Australian Securities and Investments Commission August 2016 Page 5 RG 255.4 We have spoken with a number of AFS licensees and their authorised representatives that provide digital advice to retail clients. We have also spoken with start-up financial technology (fintech) businesses that are considering whether to become an AFS licensee or an authorised representative of an AFS licensee. From these discussions, it has become clear that industry would benefit from additional guidance that deals specifically with digital advice. Note: In this guide, we use the term ‘digital advice’ to mean digital advice provided to retail clients. RG 255.5 To assist those providing, or intending to provide, digital advice—and to ensure a level playing field in the industry—ASIC has developed this regulatory guide. Scope of this regulatory guide RG 255.6 This regulatory guide generally builds on existing ASIC guidance and does not introduce new regulatory concepts. This is because the law is technology neutral, and the obligations applying to the provision of traditional (i.e. non- digital) financial product advice and digital advice are the same. RG 255.7 This guide brings together some of the issues that you will need to consider if you want to provide digital advice when operating in Australia—from the licensing stage (i.e. obtaining an AFS licence) through to the actual provision of advice. We see this guide as a convenient starting point for those seeking to understand their regulatory obligations in relation to providing digital advice. RG 255.8 Our guidance focuses on the obligations of those providing, or wanting to provide, digital advice. Businesses that provide associated services (e.g. technology or compliance services) may also find this guidance useful. RG 255.9 Those who provide combined (or hybrid) financial product advice models (i.e. advice models that incorporate elements of both digital advice and non- digital advice) should also consider our guidance. RG 255.10 We also provide guidance on some of the issues that are unique to providing digital advice compared with traditional financial product advice. These include: (a) how the organisational competence obligation in s912A(1)(e) of the Corporations Act applies to digital advice licensees (see RG 255.48– RG 255.54); Note: In this guide, we use the term ‘digital advice licensee’ to refer to an AFS licensee offering digital advice to retail clients. It may be the licensee itself or its authorised representatives that provide the advice service. (b) the ways in which digital advice licensees should monitor and test their algorithms (see RG 255.72–RG 255.74); and Page 6 REGULATORY GUIDE 255: Providing digital financial product advice to retail clients © Australian Securities and Investments Commission August 2016 Page 6 (c) the minimum steps that digital advice providers should take to comply with the best interests duty in s961B of the Corporations Act when providing ‘scaled advice’ (i.e. personal advice that is limited in scope) to retail clients (see Section D). Note 1: In this guide, ‘digital advice provider’ refers to the person to whom the obligations in Div 2 of Pt 7.7A of the Corporations Act apply when personal advice is provided through a computer program—that is, the legal person that provides the digital advice (e.g. a corporate licensee or authorised representative). Note 2: References in this guide to sections (s), parts (Pts), and chapters (Chs) are to the Corporations Act, unless otherwise specified. Regulatory framework and our guidance RG 255.11 Generally, Australia’s financial services regulatory regime is principles based and does not prescribe the steps that an AFS licensee needs to take to comply with the law. RG 255.12 From our engagement with industry—including digital advice providers and prospective providers—it is clear that industry would like, and would benefit from, guidance about how the regulatory obligations apply to digital advice providers and certainty about what providers need to do to comply. We have therefore issued this guide, which aims to assist industry to understand ASIC’s approach in regulating digital advice. RG 255.13 In this guide, we have deliberately used terms such as ‘must’, ‘required to’, ‘expect’ or ‘should’: (a) When we use the terms ‘must’ or ‘required to’, we are referring to obligations that you must comply with as a matter of law. For example, as an AFS licensee under the Corporations Act, you are required to have adequate risk management systems: s912A(1)(h). However, this obligation does not apply in certain circumstances: see RG 255.55(j). (b) When we use the terms ‘expect’ or ‘should’, we consider that these are the ways in which you should—and generally would—comply with your obligations under the law. For example, we expect AFS licensees to have a structured and systematic process for identifying, evaluating and managing risks. RG 255.14 In most cases—and unless there are exceptional circumstances—AFS licensees will be able to comply with the law by adhering to the ways we think that you can comply with the law. Failure to do the things we expect is more likely to result in further regulatory inquiry from ASIC. However, if you think you can comply with your obligations under the law in another way, we suggest that you contact us. We recognise that digital advice will continue to be a developing area, and we are happy to hear about new or alternative ways in which AFS licensees and their authorised representatives consider they are able to comply with the law. Page 7 REGULATORY GUIDE 255: Providing digital financial product advice to retail clients © Australian Securities and Investments Commission August 2016 Page 7 Communication in a digital context RG 255.15 Communicating with clients is an important element of providing digital advice. Because there is no ‘natural person’ (i.e. human adviser) directly involved in providing the advice, it is especially important for digital advice providers to carefully consider their website design and digital communications and disclosure. Providers should take a user-focused approach and put the client’s needs first when designing their communications and disclosure. RG 255.16 We recognise that the digital advice environment is still evolving, and that what constitutes effective communication will vary across the different electronic devices used (i.e. it is highly context specific). For these reasons, we encourage a culture of ongoing testing and enhancement. Note: Digital advice providers may find it helpful to use technology capabilities and other methods to test how clients engage with a digital advice tool. Other relevant guidance RG 255.17 This regulatory guide should be read in conjunction with other ASIC regulatory guides that may be relevant to providing digital advice. A summary of the other relevant guidance issued by ASIC is contained in Table 1 in the appendix. Page 8 REGULATORY GUIDE 255: Providing digital financial product advice to retail clients © Australian Securities and Investments Commission August 2016 Page 8 B Digital advice and the AFS licensing regime Key points Under the Corporations Act, you are required to hold an AFS licence, or to be an authorised representative of an AFS licensee, if you are carrying on a financial services business, unless an exemption applies. Existing AFS licensees wanting to provide digital advice will need to consider whether their current licensing arrangements enable them to do so. Start-up fintech businesses wanting to provide digital advice must apply for their own AFS licence or become an authorised representative of an AFS licensee. To assist those wanting to provide digital advice, we have provided some practical guidance on when an AFS licence may be required and the AFS licensing process. For those opting to become an authorised representative, we have set out some questions you may want to ask your prospective licensee before deciding to seek authorisation. The guidance and information in this section mostly builds on existing ASIC guidance. We will also require that a digital advice licensee has at least one responsible manager who meets the minimum training and competence standards for advisers (i.e. natural persons who provide financial product advice to retail clients). A transition period of six months will apply. When is an AFS licence required? RG 255.18 If you are carrying on a business of providing a financial service, such as financial product advice, unless an exemption applies, you must hold an AFS licence or act as an authorised representative of an AFS licensee: see Regulatory Guide 36 Licensing: Financial product advice and dealing (RG 36) at RG 36.13. You must comply with your obligations as an AFS licensee or authorised representative: see Section E of RG 36 and Regulatory Guide 104 AFS licensing: Meeting the general obligations (RG 104). RG 255.19 If you provide financial product advice to retail clients, you must also comply with certain conduct and disclosure obligations under Pt 7.7, and Div 2 of Pt 7.7A: see Sections D and E of Regulatory Guide 175 Licensing: Financial product advisers—Conduct and disclosure (RG 175). Providing factual information RG 255.20 You are not required to hold an AFS licence, or act as an authorised representative of an AFS licensee, to give factual information to clients. RG 255.21 Factual information is objectively ascertainable information, the truth or accuracy of which cannot reasonably be questioned: see RG 36.23. Good quality factual information can often be useful for clients wishing to better Page 9 REGULATORY GUIDE 255: Providing digital financial product advice to retail clients © Australian Securities and Investments Commission August 2016 Page 9 understand the financial products or strategies available to them: see Regulatory Guide 244 Giving information, general advice and scaled advice (RG 244) at RG 244.24. Note: It is good practice to take reasonable steps to ensure that a client understands upfront that only factual information is being provided, and not general or personal advice. This will avoid confusion and help the client to understand what service they are getting: see RG 244.31. RG 255.22 In Example 1, an AFS licence is not required because financial product advice is not being provided. Example 1: Providing factual information digitally Scenario Liam and Joe are operating a website named ‘Find a product’ that sets out information about the features of various financial products. Liam and Joe do not provide any recommendations or opinions (which may take the form of ratings) in relation to the products on their website. Commentary Liam and Joe do not require an AFS licence because they are not providing financial product advice. Liam and Joe have not provided any recommendation or statement of opinion that may cause a person to make a decision about a particular financial product or class of financial product. The website does not provide a recommendation or opinion about which product is preferable. Providing financial product advice RG 255.23 You are required to hold an AFS licence, or be an authorised representative of an AFS licensee, if you carry on a business in Australia of providing financial product advice that is a financial service under the Corporations Act, unless an exemption applies: s911A. RG 255.24 If a communication is a recommendation or a statement of opinion, or a report of either of these things, that is intended to, or can reasonably be regarded as being intended to, influence a client in making a decision about a particular financial product or class of financial product (or an interest in either of these), it is financial product advice: s766B (see RG 244.27). RG 255.25 Under the Corporations Act, all financial product advice is either ‘personal advice’ or ‘general advice’. RG 255.26 Personal advice is financial product advice given or directed to a person (including by electronic means) in circumstances where: (a) the person giving or directing the advice has considered one or more of the client’s objectives, financial situation and needs (other than for complying with the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, or regulations or rules under that Act); or (b) a reasonable person might expect the person giving or directing the advice to have considered one or more of these matters: s766B(3). Page 10 REGULATORY GUIDE 255: Providing digital financial product advice to retail clients © Australian Securities and Investments Commission August 2016 Page 10 RG 255.27 All other financial product advice is general advice: s766B(4). RG 255.28 In Examples 2 and 3, the digital advice provider must hold an AFS licence because general advice or personal advice is being provided. Example 2: Providing general advice digitally Scenario TechCorp makes available a smartphone application (app) that recommends clients invest in a limited number of model portfolios. The portfolios have been created based on factors such as asset class, the allocation of growth assets, the rates of risk and return and the investment horizon. TechCorp also provides qualitative commentary on various stocks within the portfolios, including the stock’s performance, dividend yield and suggestions of stocks that are appropriate for a first-time investor. TechCorp does not ask clients for any personal information. Clients are presented with the four portfolio options and are able to choose which portfolio best suits their needs. Commentary TechCorp is providing general advice and not factual information because the app includes recommendations and statements of opinion that are intended to influence a client in relation to making a decision about a particular financial product or class of financial product. TechCorp is not, however, providing personal advice because the app does not take into account the client’s relevant circumstances (i.e. their objectives, financial situation or needs). Example 3: Providing personal advice digitally Scenario Digital X is a start-up fintech company that provides digital advice. The advice is limited to portfolio construction investment advice on exchange- traded funds (ETFs). Digital X determines the client’s investment profile by asking the client a number of questions about their financial situation and goals. Clients who are not filtered out of the model are aligned with one of a limited number of ETF portfolios based on their investment profile. Digital X’s algorithm then automatically recommends to the client an investment strategy based on their personal profile, and a Statement of Advice (SOA) is generated and provided. Commentary Digital X is providing personal advice. Through its algorithm, Digital X has considered one or more of the client’s relevant circumstances (e.g. their objectives, financial situation and needs) when recommending a financial product. RG 255.29 For more guidance on the differences between giving factual information, general advice and personal advice, see Section B of RG 175 and RG 244. Page 11 REGULATORY GUIDE 255: Providing digital financial product advice to retail clients © Australian Securities and Investments Commission August 2016 Page 11 Exemptions and relief from holding an AFS licence RG 255.30 Depending on your circumstances, you may be exempt or have relief from the requirement to hold an AFS licence: see 911A(2) and RG 36.34. For example: (a) ASIC has given relief to providers of generic financial calculators from the requirement to hold an AFS licence with an advice authorisation: see Section F of Regulatory Guide 167 Licensing: Discretionary powers (RG 167) and ASIC Corporations (Generic Calculators) Instrument 2016/207. A generic financial calculator is a facility, device, table or other thing that: (i) is used to make a general numerical calculation or find out the result of a numerical calculation about a financial product; and (ii) does not advertise or promote one or more specific financial products: see RG 167.54. Note: See RG 167.54–RG 167.58 for a more detailed explanation of a generic financial calculator. (b) You are not considered to be providing financial product advice if your conduct consists only of providing a recommendation or statement of opinion about the allocation of the funds among the general asset types listed in reg 7.1.33A. This exemption does not apply if the recommendation or statement of opinion relates to specific financial products or specific classes of financial product: see RG 36.34(k). AFS licensing arrangements RG 255.31 If you want to carry on a business of providing digital advice, you must hold an AFS licence or be an authorised representative of an AFS licensee from the day you start your business, unless an exemption applies: see the AFS licensees page on ASIC’s website at www.asic.gov.au. RG 255.32 Many digital advice providers will be existing AFS licensees who already hold a licence with the ‘financial product advice’ authorisation. RG 255.33 Start-up fintech businesses wanting to provide digital advice to retail clients must either become an authorised representative of an AFS licensee or obtain their own licence. Existing AFS licensees RG 255.34 If you already hold an AFS licence and you are authorised to provide financial product advice, your AFS licensing arrangements may not need to change to provide financial product advice digitally. Note: You may want to check you have the correct AFS licence authorisations to provide the financial products and services of your proposed business. Page 12 REGULATORY GUIDE 255: Providing digital financial product advice to retail clients © Australian Securities and Investments Commission August 2016 Page 12 RG 255.35 You will still need to review your business arrangements, however, to ensure you are maintaining compliance with your general obligations: see RG 104 and Section C. RG 255.36 You also need to be aware that we require digital advice licensees to have at least one responsible manager who meets the minimum training and competence standards that apply to advisers (i.e. natural persons who provide financial product advice to retail clients): see RG 255.48–RG 255.54. Becoming an authorised representative RG 255.37 For new or start-up fintech businesses, you may consider becoming an authorised representative of an AFS licensee or applying for your own AFS licence. RG 255.38 An AFS licensee may authorise a person to provide financial services on its behalf. Any person who acts on behalf of an AFS licensee is called a ‘representative’: see s910A of the Corporations Act. RG 255.39 If you would like to provide a financial service, such as digital advice, as an authorised representative on behalf of an AFS licensee, you must hold a written authorisation from that licensee: see s916A of the Corporations Act. RG 255.40 If you are considering becoming an authorised representative of an AFS licensee, there are some things you should consider before approaching a licensee. These include: (a) the type of financial services you are proposing to offer; (b) the type of licence authorisations the AFS licensee would need for you to operate your business as an authorised representative of the licensee; and Note: The AFS licensee must have a licence authorisation to provide financial product advice to clients: see Section B of RG 36, and Regulatory Guide 2 AFS Licensing Kit: Part 2—Preparing your AFS licence application or variation application (RG 2) at RG 2.60. Depending on the business you intend to operate, the licensee may also need licence authorisations to:  deal on behalf of clients, which includes arranging (see Sections C and D of RG 36 and RG 2.68–2.69); or  operate managed discretionary account (MDA) services (see RG 255.46, RG 2.83– RG 2.84 and Regulatory Guide 179 Managed discretionary account services (RG 179)). (c) what compliance assistance you require (e.g. if you are new to financial services and will need additional assistance to understand the compliance obligations). RG 255.41 We have set out below some questions you may want to ask your prospective AFS licensee if you are considering offering digital advice as an authorised representative of a licensee. Page 13 REGULATORY GUIDE 255: Providing digital financial product advice to retail clients © Australian Securities and Investments Commission August 2016 Page 13 Sample questions to ask prospective AFS licensees • What is your main financial services business? • Do you operate your own financial services business or do you only obtain your revenue by appointing authorised representatives? • Does your AFS licence include the authorisations that my business needs to provide digital advice and any related services? • What experience do you have with innovation and digital advice? • What monitoring and testing will you carry out in relation to my advice algorithms? Note: Testing should be carried out before any digital advice is provided to clients, and on an ongoing basis after that. Testing should look at the output of the algorithms and consider whether the advice provided to clients is legally compliant. • How many other authorised representatives do you have? • What compliance assistance will you provide? • Will you provide my business with any training? • Will you provide enough monitoring and supervision to ensure that my business is operating within the law? • Do you have compliance procedures for record keeping? • How many notifications of reportable situations have you lodged with ASIC in the past two years? • Have you been the subject of any ASIC or other regulatory agency’s surveillance, investigation, enforceable undertaking or enforcement action? Becoming an AFS licensee RG 255.42 As a new or start-up fintech business, you may prefer to obtain your own AFS licence or apply for a limited AFS licence. RG 255.43 Our guidance on applying for an AFS licence is set out in our AFS Licensing Kit (Regulatory Guides 1–3). The AFS Licensing Kit explains the licence application process and the ‘proof’ documents you may need to support your application. RG 255.44 Depending on your business, you may decide to apply for a limited AFS licence. As a limited AFS licensee, you may be authorised to give financial product advice about: (a) self-managed superannuation funds; (b) a client’s existing superannuation holdings in certain circumstances; and (c) ‘class of product’ advice about a range of products (i.e. superannuation, securities, general insurance, life risk insurance, basic deposit products, and simple managed investment schemes). Note: See Limited financial services on ASIC’s website. Page 14 REGULATORY GUIDE 255: Providing digital financial product advice to retail clients © Australian Securities and Investments Commission August 2016 Page 14 Additional information we may request RG 255.45 RG 2 explains what information you need to provide to ASIC as part of your AFS licence application. Depending on the nature, scale and complexity of your business, we may ask you for additional information about: (a) the human resources you will have with the technological knowledge and skills to: (i) generally understand the technology and algorithms used to provide the digital advice; and (ii) review the digital advice generated by algorithms (see RG 255.60– RG 255.64); (b) if you are providing personal advice, the level of human review that will be undertaken on the advice generated (see RG 255.109–RG 255.112); (c) if you outsource any functions, the measures you will put in place to ensure that: (i) due skill and care are taken in choosing suitable service providers; and (ii) you can and will monitor the ongoing performance of service providers (see RG 255.67–RG 255.68); (d) the procedures you have in place to monitor and test algorithms (see RG 255.72–RG 255.74); (e) the arrangements you will put in place to comply with your record- keeping obligations; (f) the risk management and security arrangements you will have in place to ensure that client information is stored and transmitted securely (see RG 255.70–RG 255.79); and (g) how you have determined that your professional indemnity (PI) insurance cover is adequate (see RG 255.80–RG 255.85). RG 255.46 Some digital advice providers may require an authorisation to provide MDA services if they are managing a portfolio of assets for retail clients on an individual basis. RG 255.47 If you intend to provide MDA services to clients, you may also need to provide ASIC with a statement called an ‘MDA Operator Capacity Statement C9 Proof’: see Regulatory Guide 3 AFS Licensing Kit: Part 3—Preparing your additional proofs (RG 3) at RG 3.62. This proof should explain whether clients will hold interests in their own name (e.g. with their own holder identification number (HIN)) or, if not, what custodial arrangements will be set up to hold assets on behalf of clients: see RG 3.62(e). Note: RG 179 sets out how ASIC regulates MDA services provided to retail clients. Page 15 REGULATORY GUIDE 255: Providing digital financial product advice to retail clients © Australian Securities and Investments Commission August 2016 Page 15 Meeting the organisational competence obligation RG 255.48 Under the Corporations Act, AFS licensees are required to: (a) maintain competence to provide the financial services covered by their licence (s912A(1)(e)); and (b) ensure that their representatives are adequately trained and competent to provide those financial services (s912A(1)(f)). RG 255.49 Regulatory Guide 105 AFS licensing: Organisational competence (RG 105) describes what we look for when we assess compliance with the organisational competence obligation in s912A(1)(e). RG 255.50 RG 105 requires an AFS licensee to demonstrate that: (a) each responsible manager meets one of the five options for demonstrating appropriate knowledge and skills; and (b) together, the responsible managers have appropriate knowledge and skills to cover all the financial services and products offered by the licensee. Note: Each responsible manager needs to be able to demonstrate one of the five options in Table 1 of RG 105. The five options are different combinations of training, qualifications and experience for demonstrating that responsible managers have knowledge and skills appropriate to their role: see RG 105.47–RG 105.72. RG 255.51 Natural persons who provide personal advice to retail clients on financial products—other than basic banking products, general insurance, consumer credit insurance or a combination of any of these products—are required to meet certain training and education standards, and new ethical standards. In general, they will be required to hold a bachelor’s degree or equivalent qualification, pass an examination, complete a professional year (for new entrants to the industry), meet continuing professional development requirements, and comply with a code of ethics. Note 1: In March 2017, reforms were introduced into the Corporations Act by the Corporations Amendment (Professional Standards of Financial Advisers) Act 2017 to raise the education, training and ethical standards of financial advisers). For more detail see Professional standards for financial advisers on ASIC’s website. Note 2: Natural persons who provide retail clients with general advice, or with personal advice on basic banking products, general insurance, consumer credit insurance or a combination of any of these products, are required to meet the minimum training and competence standards for advisers currently set out in Regulatory Guide 146 Licensing: Training of financial product advisers (RG 146). RG 255.52 In a digital advice context, the financial product advice is generated by algorithms, so there is no natural person directly involved in providing the advice. As such, the training and competence standards do not apply. RG 255.53 For a digital advice licensee to meet the organisational competence obligation in RG 105, we require that the licensee has at least one responsible manager who meets the training and competence standards. Page 16 REGULATORY GUIDE 255: Providing digital financial product advice to retail clients © Australian Securities and Investments Commission August 2016 Page 16 This will ensure that at least one responsible person within a digital advice licensee satisfies this level of training and competence. RG 255.54 In most cases, at least one responsible manager of an existing AFS licensee will meet the training and competence standards. In a small number of instances, however, a licensee may not have a responsible manager who meets these standards. This is because the responsible manager was previously able to demonstrate their competence under RG 105 by showing they had relevant experience over the previous 10 years. Page 17 REGULATORY GUIDE 255: Providing digital financial product advice to retail clients © Australian Securities and Investments Commission August 2016 Page 17 C General obligations applying to digital advice licensees Key points All AFS licensees have a number of general obligations under s912A(1) of the Corporations Act. In RG 104, we describe what ASIC looks for when assessing compliance with these general obligations, including the AFS licensee’s ‘broad compliance obligations’. What you need to do to comply with your general obligations as an AFS licensee will vary according to the nature, scale and complexity of your business. To assist digital advice licensees, whose business models are different to AFS licensees offering traditional financial product advice, we have provided additional guidance on the obligations to: • have adequate financial, technological and human resources to provide the financial services covered by their AFS licence and to carry out supervisory arrangements (s912A(1)(d)); and • establish and maintain adequate risk management systems (s912A(1)(h)). We have also provided some additional guidance on the obligation to have adequate compensation arrangements where financial services are provided to retail clients: s912B. General obligations as an AFS licensee RG 255.55 If you are an AFS licensee, you have general obligations under s912A(1) of the Corporations Act to: (a) do all things necessary to ensure that the financial services covered by your licence are provided efficiently, honestly and fairly (s912A(1)(a)); (b) have adequate arrangements in place for managing conflicts of interest (s912A(1)(aa)); (c) comply with the conditions on your licence (s912A(1)(b)); (d) comply with the financial services laws (s912A(1)(c)); (e) take reasonable steps to ensure that your representatives comply with the financial services laws (s912A(1)(ca)); (f) have adequate financial, technological and human resources to provide the financial services covered by your licence and to carry out supervisory arrangements (s912A(1)(d)). This obligation does not apply Page 18 REGULATORY GUIDE 255: Providing digital financial product advice to retail clients © Australian Securities and Investments Commission August 2016 Page 18 if you are regulated by the Australian Prudential Regulation Authority (APRA), unless you hold a registrable superannuation entity (RSE) licence from APRA and are also authorised to operate registered managed investment schemes; (g) maintain the competence to provide the financial services covered by your licence (s912A(1)(e)); (h) ensure that your representatives are adequately trained and competent to provide those financial services (s912A(1)(f)); (i) if you provide financial services to retail clients, have a dispute resolution system (s912A(1)(g)); and (j) establish and maintain adequate risk management systems (s912A(1)(h)). This obligation does not apply if you are regulated by APRA, unless you are an RSE licensee authorised to operate registered managed investment schemes and the risk does not relate solely to your operation of a regulated superannuation fund. RG 255.56 What you need to do to comply with your obligations will vary according to the nature, scale and complexity of your business: see RG 104.21–RG 104.22. RG 255.57 In RG 104, we describe what ASIC looks for when assessing compliance with these general obligations—including the ‘broad compliance obligations’ (such as those listed at RG 255.55(a), RG 255.55(c) and RG 255.55(d)). There are also other regulatory guides that are relevant to the general obligations: see Table 1 in the appendix. RG 255.58 In this section, we focus on guidance about compliance with some of the general obligations that are the most relevant for digital advice licensees. Adequate resources RG 255.59 Having adequate resources is crucial to an AFS licensee’s ability to demonstrate that it has the capacity to carry on its financial services business. Failure to have adequate resources creates an unacceptable risk that the licensee may not comply with some, or all, of its obligations: see RG 104.88. Human resources RG 255.60 As a digital advice licensee, you should ensure that there are people within your business who: (a) have an understanding of the technology and algorithms used to provide digital advice; and (b) are able to review the digital advice generated by algorithms. Note 1: Depending on the nature, scale and complexity of your digital advice business, you may wish to outsource functions of your business. If you choose to outsource Page 19 REGULATORY GUIDE 255: Providing digital financial product advice to retail clients © Australian Securities and Investments Commission August 2016 Page 19 functions relating to digital advice algorithms and the review of advice generated by algorithms, we expect you to have people within the business who have an understanding of these functions in order to meet your general obligations: see RG 255.67–RG 255.68 Note 2: The people listed in RG 255.60(a) and RG 255.60(b) do not need to be the same people. RG 255.61 Digital advice is provided through the use of technology. As such, we expect digital advice licensees to have at least one person who has a general understanding of the technology and algorithms used to provide digital advice. We do not expect all digital advice licensees to understand the specific computer coding of an algorithm—however, we expect your understanding to include having people within the business who understand the rationale, risks and rules behind the algorithms underpinning the digital advice. RG 255.62 Failure to have at least one person with the skills and experience needed to understand the technology and algorithms underpinning the digital advice increases the risk that clients are exposed to poor quality advice or that there are issues with your systems. RG 255.63 As a digital advice licensee, you should also conduct regular reviews of the digital advice generated by algorithms to ensure that it is legally compliant: see RG 255.109–RG 255.112. It is therefore essential that you have at least one person who has the appropriate skills and experience to thoroughly review the quality of digital advice provided. RG 255.64 The size and complexity of your business will affect the extent of the human resources needed to satisfy RG 255.60. Technological resources RG 255.65 As a digital advice licensee, you should have sufficient technological resources to: (a) maintain client records and data integrity; (b) protect confidential and other information; (c) meet current and anticipated future operational needs, including in relation to system capacity; and (d) comply with all obligations under the law. RG 255.66 You should also have adequate business continuity, backup and disaster recovery plans for any systems that support the delivery of digital advice to clients. Page 20 REGULATORY GUIDE 255: Providing digital financial product advice to retail clients © Australian Securities and Investments Commission August 2016 Page 20 Outsourcing functions that relate to your AFS licence RG 255.67 We understand that many digital advice licensees may wish to outsource functions that relate to their digital advice business. Where functions are outsourced, we expect that: (a) you will have measures in place to ensure that due skill and care are taken in choosing suitable outsourced service providers; and (b) you can and will monitor the ongoing performance of outsourced service providers. Note: As a matter of good practice, digital advice licensees should discuss the requirements of this regulatory guide with any outsourced service providers involved in their digital advice business. RG 255.68 Digital advice licensees who outsource functions remain responsible for the financial services provided to clients: s769B. Note: See RG 104.33–RG 104.36 for more information on outsourcing. RG 255.69 Example 4 highlights that AFS licensees who outsource functions remain responsible for the financial services provided to clients. Example 4: Outsourcing the development of algorithms Scenario An existing AFS licensee is looking to offer digital advice. It decides to outsource the development of its digital advice offering to Company A. Company A builds the digital advice platform, including the algorithm underpinning the digital advice. Commentary The digital advice licensee is the person providing the advice and will be responsible for monitoring the performance of the algorithm and ensuring that the best interests duty and related obligations are satisfied. Although digital advice licensees who outsource functions may not understand the specific computer coding of an algorithm, we expect licensees to understand the rationale, risks and rules behind the algorithm. Company A is not required to hold an AFS licence because it is not providing financial produce advice to clients. Adequate risk management systems RG 255.70 You have a general obligation to establish and maintain adequate risk management systems: see s912A(1)(h). This obligation does not apply in certain circumstances if you are a body regulated by APRA. The general obligation is the same whether you are providing traditional financial product advice or digital advice. RG 255.71 We expect you to have a structured and systematic process for identifying, evaluating and managing risks: see RG 104.59–RG 104.66. Page 21 REGULATORY GUIDE 255: Providing digital financial product advice to retail clients © Australian Securities and Investments Commission August 2016 Page 21 Monitoring and testing algorithms RG 255.72 As part of your risk management systems, you should regularly monitor and test the algorithms that underpin the advice. The extent of your arrangements will depend on the nature, scale and complexity of your digital advice business. RG 255.73 We have set out our expectations for digital advice licensees in relation to monitoring and testing algorithms. Ways in which digital advice licensees should monitor and test algorithms We expect you to: • have appropriate system design documentation that clearly sets out the purpose, scope and design of the algorithms. Decision trees or decision rules should form part of this documentation, where relevant; Note: A ‘decision tree’ uses a tree-like graph or model to display decisions and their possible consequences. • have a documented test strategy that explains the scope of your testing of algorithms. This should include test plans, test cases, test results, defect resolution (if relevant), and final test results. We expect robust testing of algorithms to occur before digital advice is first provided to a client, and on a regular basis after that; • have appropriate processes for managing any changes to an algorithm. This includes having security arrangements in place to monitor and prevent unauthorised access to the algorithm; • be able to control, monitor and keep records describing any changes made to algorithms over the past seven years. One way of doing this may be to store different versions of the algorithm electronically; Note: Where personal advice is provided to retail clients, a digital advice licensee must ensure that records are retained for seven years that show how the licensee has complied with the best interests duty and related obligations in Div 2 of Pt 7.7A: see s912G. This requirement was implemented by Class Order [CO 14/923] Record-keeping obligations for Australian financial services licensees when giving personal advice. • review and update algorithms whenever there are factors that may affect their currency (e.g. market changes and changes in the law); • have in place controls and processes to suspend the provision of advice if an error within an algorithm is detected and that error is likely to result in client loss and/or a breach of the Corporations Act; • have in place adequate resources, including human and technological resources, to monitor and supervise the performance of algorithms through an adequate and timely review of the advice provided; and • have in place an appropriate internal sign-off process to ensure that the steps above have been followed. RG 255.74 We also expect you to have in place robust compliance arrangements to regularly monitor and test the quality of digital advice provided to clients. This means that a sample of the advice provided should be reviewed by a suitably qualified individual for compliance with the law: see RG 255.109– RG 255.116 for more information on reviewing digital advice. Page 22 REGULATORY GUIDE 255: Providing digital financial product advice to retail clients © Australian Securities and Investments Commission August 2016 Page 22 Cyber risks and information security RG 255.75 As a digital advice licensee, you should be mindful of additional risks such as malicious cyber activity. RG 255.76 While this is not an issue that is unique to digital advice services, digital advice providers may be more likely to be targeted by hackers. RG 255.77 We expect digital advice licensees to assess their cyber security using recognised frameworks, such as the National Institute of Standards and Technology’s Framework for improving critical infrastructure cybersecurity, or the Australian Signals Directorate’s Strategies to mitigate targeted cyber intrusions, or equivalent. RG 255.78 We also expect you to assess your information security arrangements against recognised security standards, such as: (a) Australian Standard AS ISO/IEC 27001:2015 Information technology— Security techniques—Information security management systems— Requirements; or (b) International Standard ISO/IEC 27001:2013 Information technology— Security techniques—Information security management systems— Requirements, or equivalent. RG 255.79 With more businesses moving to ‘cloud’ technology (i.e. internet-based computing), the threat of malicious cyber activity is real. We expect digital advice licensees to have in place adequate security compliance measures, such as Cloud computing security for tenants, published by the Australian Cyber Security Centre, or equivalent. Note: In March 2015, ASIC published Report 429 Cyber resilience: Health check (REP 429), which highlights the importance of cyber resilience to ASIC’s regulated population. In March 2016, ASIC published Report 468 Cyber resilience assessment report: ASX Group and Chi-X Australia Pty Ltd (REP 468). REP 468 provides some examples of emerging good practices implemented by a wider sample of organisations operating in the Australian financial services sector. Adequate compensation arrangements RG 255.80 Under s912B, AFS licensees that provide financial services to retail clients must have arrangements for compensating clients for loss they suffer as a result of a breach by the licensee or its representatives of their obligations in Ch 7 of the Corporations Act. RG 255.81 Unless an exemption applies, these arrangements must: (a) satisfy the requirements in the Corporations Regulations—which are that AFS licensees must obtain professional indemnity (PI) insurance cover that is adequate, considering the nature of the licensee’s business and its potential liability for compensation claims (reg 7.6.02AAA); or (b) be approved by ASIC as alternative arrangements. Page 23 REGULATORY GUIDE 255: Providing digital financial product advice to retail clients © Australian Securities and Investments Commission August 2016 Page 23 RG 255.82 The Corporations Regulations provide exemptions from the requirements for certain AFS licensees that are regulated by APRA or are related to an entity regulated by APRA: reg 7.06.02AAA(3). RG 255.83 Regulatory Guide 126 Compensation and insurance arrangements for AFS licensees (RG 126) sets out what ASIC considers to be the minimum requirements for adequate PI insurance. RG 126 also provides information about when we will approve alternative arrangements. RG 255.84 Unless an exemption applies, we expect that all AFS licensees, including those who provide digital advice, will assess the adequacy of their compensation arrangements by considering RG 126 and applying the policy considerations to their individual circumstances. Note: Minimum requirements may also apply to certain AFS licensees such as those that apply to MDA operators under Class Order [CO 04/194] Managed discretionary accounts. RG 255.85 To assist you in assessing the adequacy of your compensation arrangements, we have set out some issues to consider and some practical tips. Issues and practical tips digital advice licensees should consider when assessing the adequacy of compensation arrangements When considering whether your compensation arrangements are adequate, you should consider: • the likely growth in client numbers—you can do this by looking at growth figures on a monthly basis; • the potential for widespread loss if an algorithm is flawed (e.g. the underlying assumptions are incorrect or the algorithm is not updated to reflect changes in legislation); • the effect of any aggregation of claims clauses in the PI insurance policy, which may mean that losses arising for different clients as a result of one flawed algorithm may be treated as a single claim by an insurer; • the effect of any lower sub-limits on the amount that can be claimed as a result of an external dispute resolution (EDR) scheme award; and • where appropriate, whether your PI insurance arrangements for providing digital advice exclude MDA services. You should also: • regularly review the nature of your business, and the potential for loss, to assess the adequacy of your PI insurance arrangements; • notify your PI insurers of any material changes to your business; • at least annually, review the features of your PI insurance policy and identify any gaps in your cover; and • either renegotiate the PI insurance policy to address any gaps, or ensure that you have adequate financial resources to cover the gaps. Page 24 REGULATORY GUIDE 255: Providing digital financial product advice to retail clients © Australian Securities and Investments Commission August 2016 Page 24 D Providing scaled advice in the best interests of the client Key points The obligations that apply to the provision of traditional financial product advice and digital advice are the same. The law makes it clear that all personal advice can be ‘scaled up’ or ‘scaled down’. Most advisers offering traditional financial product advice limit the scope of their advice, and communicate the limited nature of this advice through conversations with their clients. In a digital advice context, however, such conversations are not possible because no human adviser is directly involved in providing the advice. We have set out our minimum expectations for digital advice providers to assist them in providing scaled advice that is in the best interests of their clients. Our minimum expectations are consistent with, and build on, our existing guidance in RG 175 and RG 244. Scaled advice and the best interests duty RG 255.86 The Corporations Act is technology neutral. The obligations that apply to the provision of traditional financial product advice and digital advice are the same. Best interests duty and related obligations RG 255.87 When providing personal advice to a retail client, advice providers must act in the best interests of the client in relation to that advice: s961B(1). We refer to this obligation as the ‘best interests duty’. RG 255.88 Section 961B(2) sets out a ‘safe harbour’ for complying with the best interests duty in s961B(1). The elements of the safe harbour are discussed at RG 175.277–RG 175.371. Showing that all of the elements in s961B(2) have been met is one way for an advice provider to satisfy the duty in s961B(1). RG 255.89 Section 961(6) of the Corporations Act makes it clear that personal advice can be offered through a computer program. If there is no individual that provides the advice, which is the case for digital advice, the obligations in Div 2 of Pt 7.7A apply to the person who offers personal advice through a computer program (e.g. a corporate licensee or authorised representative): s961(6). In this guide, we refer to this person as the ‘digital advice provider’. Page 25 REGULATORY GUIDE 255: Providing digital financial product advice to retail clients © Australian Securities and Investments Commission August 2016 Page 25 RG 255.90 A digital advice provider giving personal advice to a client also has related obligations in Div 2 of Pt 7.7A of the Corporations Act to provide appropriate advice, to warn the client if advice is based on incomplete or inaccurate information, and to prioritise the client’s interests over its own interests or that of the advice provider’s associates. RG 255.91 The best interests duty and related obligations apply to all personal advice, but not to general advice. For a discussion of the difference between personal advice and general advice, see Section B of RG 175, and RG 244. ASIC’s guidance RG 255.92 We have already published extensive guidance in RG 175 and RG 244 on how to meet the obligations in Pt 7.7 and in Div 2 of Pt 7.7A of the Corporations Act, including how to meet the best interests duty and related obligations when giving ‘scaled advice’ (i.e. personal advice that is limited in scope). RG 255.93 In RG 244, in particular, we seek to: (a) provide guidance about how to give scaled advice that complies with the personal advice obligations in Div 2 of Pt 7.7A, including the best interests duty and related obligations (see Section D of RG 244); (b) explain the importance of communicating to a client the service that is being provided to them (see Section E of RG 244); and (c) explain that the Corporations Act is generally neutral about how advice is delivered—that is, the law is generally the same regardless of whether advice is provided face-to-face, by telephone, email, internet or video conferencing, or using any combination of these or other ways (see Section F of RG 244). Our minimum expectations when providing scaled advice RG 255.94 All personal advice is scaled, or limited in scope, to some extent. Clients who seek scaled advice expect that the advice will leave them in a better position. RG 255.95 Most advisers offering traditional financial product advice limit the scope of their advice, and communicate the limited nature of this advice, through conversations with their clients. In a digital advice context, however, such conversations are not possible because there is no natural person directly involved in providing the advice. RG 255.96 If you are a digital advice provider offering scaled advice, you should think very carefully about the way you communicate with clients. Your communications should be user focused, clear and timely. This means you should put the client’s needs first when designing your communications and disclosure, and ensure that key information relevant to the client is provided at the right time in the decision-making process. Page 26 REGULATORY GUIDE 255: Providing digital financial product advice to retail clients © Australian Securities and Investments Commission August 2016 Page 26 RG 255.97 We suggest that you consider how information is likely to be interpreted by clients on the different electronic devices they may use to access the advice. You should monitor digital communications on an ongoing basis so that information is presented in a way that facilitates client engagement and understanding. RG 255.98 We have set out our minimum expectations to assist you when providing scaled advice that is in the best interests of your clients. Our minimum expectations for digital advice providers offering scaled advice As a minimum, you should: • explain to the client from the outset what advice is being offered and what is not being offered (i.e. the scope of the advice); • require the client to actively demonstrate that the advice they are seeking