ASIC RG 78 — ASIC Regulatory Guide – RG 78 Breach reporting by AFS licensees and credit licensees

Page 1 REGULATORY GUIDE 78 Breach reporting by AFS licensees and credit licensees December 2023 About this guide This guide is for Australian financial services (AFS) licensees and Australian credit licensees (credit licensees). It gives guidance on your obligation to report to ASIC certain breaches of the law under Div 3 of Pt 7.6 of the Corporations Act 2001 (Corporations Act) and Div 5 of Pt 2-2 of the National Consumer Credit Protection Act 2009 (National Credit Act). Note: This guide does not cover certain reporting obligations: see RG 78.12. Page 2 REGULATORY GUIDE 78: Breach reporting by AFS licensees and credit licensees © Australian Securities and Investments Commission December 2023 Page 2 About ASIC regulatory documents In administering legislation ASIC issues the following types of regulatory documents. Consultation papers: seek feedback from stakeholders on matters ASIC is considering, such as proposed relief or proposed regulatory guidance. Regulatory guides: give guidance to regulated entities by:  explaining when and how ASIC will exercise specific powers under legislation (primarily the Corporations Act)  explaining how ASIC interprets the law  describing the principles underlying ASIC’s approach  giving practical guidance (e.g. describing the steps of a process such as applying for a licence or giving practical examples of how regulated entities may decide to meet their obligations). Information sheets: provide concise guidance on a specific process or compliance issue or an overview of detailed guidance. Reports: describe ASIC compliance or relief activity or the results of a research project. Document history This guide was reissued in December 2023 and is based on legislation and regulations as at the date of issue. In May 2024, we updated RG 78.148(b)(viii) to include mention of Ch 7 of the Corporations Act, and updated the link to the ASIC Regulatory Portal in RG 78.155. In August 2025, we made some minor updates to reflect ASIC’s relief that took effect on 24 June 2025, and updated the question numbering in Appendix 2. In February 2026, we made minor changes following the reissue of Regulatory Guide 34 Auditor obligations: Reporting to ASIC (RG 34). On 21 October 2026, we updated references to investigations taking more than ‘30 days’ to ‘60 days’ in Figure 1, RG 78.70, Example 11 and Table 8. Previous versions:  Superseded Regulatory Guide 78, issued September 2008, reissued February 2014, March 2020, September 2021, April 2023, August 2025; and  Superseded Breach reporting by AFS licensees: An ASIC guide, issued October 2004, reissued May 2006, and known in the ASIC Digest as [SGD 190]; rebadged as a regulatory guide 5 July 2007. Disclaimer This guide does not constitute legal advice. We encourage you to seek your own professional advice to find out how the Corporations Act and other applicable laws apply to you, as it is your responsibility to determine your obligations. Examples in this guide are purely for illustration; they are not exhaustive and are not intended to impose or imply particular rules or requirements. Page 3 REGULATORY GUIDE 78: Breach reporting by AFS licensees and credit licensees © Australian Securities and Investments Commission December 2023 Page 3 Contents A Overview ........................................................................................... 4 Who this guide applies to................................................................... 4 What is the breach reporting obligation? ........................................... 4 Our approach to guidance ................................................................. 6 What this guide does not cover ......................................................... 6 How our guidance applies ................................................................. 8 B What you must report to ASIC........................................................ 9 What is a ‘reportable situation’? ......................................................... 9 What is a breach or likely significant breach of your core obligations? ...................................................................................... 12 What is a reportable investigation? ................................................. 24 What are additional reportable situations? ...................................... 30 Reportable situations about other licensees: Financial advisers and mortgage brokers ...................................................................... 31 C When and how to report to ASIC ................................................. 36 When must you report a reportable situation?................................. 36 How do you report a reportable situation? ....................................... 42 When can multiple reportable situations be grouped together in a single report (the ‘grouping test’)? ................................................... 44 What will ASIC do after we receive your report? .............................. 48 What are the consequences of failing to report to ASIC? ............... 49 What information will ASIC publish? ................................................ 50 D Compliance systems and identifying, recording and reporting breaches ........................................................................ 51 What arrangements should you have in place for recording and reporting breaches? ......................................................................... 51 Developing your approach to the breach reporting obligation: Some practical insights ............................................................................... 53 Do you need a breach register? ...................................................... 55 Appendix 1: Summary of core obligations for licensees .................. 56 Appendix 2: Frequently asked questions about how to complete ASIC’s reportable situations form ............................................... 61 Key terms ............................................................................................... 73 Related information ............................................................................... 77 Page 4 REGULATORY GUIDE 78: Breach reporting by AFS licensees and credit licensees © Australian Securities and Investments Commission December 2023 Page 4 A Overview Key points If you are an Australian financial services (AFS) licensee or an Australian credit licensee (credit licensee), you must comply with your obligation to report certain breaches of the law to ASIC. This guide explains: • what you must report to ASIC (see Section B); • when and how you must report to ASIC, including information about how we deal with the reports we receive and the information we will publish about your reports (see Section C); and • our expectations and guidance about your compliance systems (see Section D). Who this guide applies to RG 78.1 This guidance applies to AFS licensees and credit licensees and their representatives. Note: In this guide, we refer collectively to AFS licensees and credit licensees as ‘licensees’. RG 78.2 A breach reporting obligation for credit licensees was introduced into Div 5 of Pt 2-2 of the National Consumer Credit Protection Act 2009 (National Credit Act) by the Financial Sector Reform (Hayne Royal Commission Response) Act 2020 (Financial Sector Reform Act). This obligation mirrors the breach reporting obligation for AFS licensees in Subdiv B, Div 3, Pt 7.6 of Ch 7 of the Corporations Act 2001 (Corporations Act) as reformed by the Financial Sector Reform Act. Specific credit guidance is provided throughout this guide where relevant. What is the breach reporting obligation? RG 78.3 The breach reporting obligation requires licensees to self-report specified matters to ASIC. As stated in the Explanatory Memorandum to the Financial Sector Reform (Hayne Royal Commission Response) Bill 2020 (Explanatory Memorandum): Breach reporting is a cornerstone of Australia’s financial services regulatory structure. Breach reports allow ASIC to detect significant non-compliant behaviours early and take action where appropriate. It also allows ASIC to identify and address emerging trends of non-compliance in the industry. Note: See Explanatory Memorandum, paragraph 11.3. Page 5 REGULATORY GUIDE 78: Breach reporting by AFS licensees and credit licensees © Australian Securities and Investments Commission December 2023 Page 5 RG 78.4 Early detection and reporting of misconduct and breaches of regulatory requirements allows ASIC to: (a) monitor the extent and severity of non-compliance and commence surveillance and investigation when necessary; (b) take law enforcement and regulatory action when warranted, including administrative action to protect consumers of financial products and services; and (c) identify and respond to emerging threats, harms and trends within the financial services industry, detect significant non-compliant behaviours early, and take the appropriate regulatory response. RG 78.5 The regulatory regime acknowledges that, despite an expectation of compliance, breaches will occur and licensees then have an obligation to report these to ASIC. Licensees have a clear role in lifting industry standards as a whole, and part of this is timely identification of their own problems. RG 78.6 We consider that a licensee’s experience with incident and issues management, including breaches, should be a vital source of learning to both reinforce and improve an entity’s compliance framework and overall function. Instances of non-compliance highlight a weakness to be understood, so improvements can be made to prevent the recurrence of the breach in the future. RG 78.7 Breach reporting has been identified as an important aspect of our regulatory regime by: (a) the ASIC Enforcement Review Taskforce, which made several recommendations for strengthening and clarifying the breach reporting requirements in the Corporations Act and recommended that a comparable breach reporting regime for credit licensees be introduced (Recommendation 2); (b) the Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry (Financial Services Royal Commission), which recommended that the Taskforce recommendations should be carried into effect (Recommendation 7.2) and that serious compliance concerns be reported (Recommendations 2.8 and 1.6); and (c) Report 594 Review of selected financial services groups’ compliance with the breach reporting obligation (REP 594), which sets out the findings of ASIC’s review of AFS licensees’ compliance with their breach reporting obligation under s912D of the Corporations Act. Note: See Treasury, ASIC enforcement review: Taskforce report, December 2017; Financial Services Royal Commission, Final report, February 2019. Page 6 REGULATORY GUIDE 78: Breach reporting by AFS licensees and credit licensees © Australian Securities and Investments Commission December 2023 Page 6 Our approach to guidance RG 78.8 This guide gives guidance on your obligation as a licensee to report to ASIC certain breaches of the law. We explain what information must be provided when reporting to ASIC, and what happens after you report, including what information we will publish as required by law. By explaining how we deal with these breach reports, we seek to enhance the transparency of our processes. RG 78.9 To help you understand your obligations and how they might apply in different factual circumstances, this guide contains a number of examples and historical case studies drawn from REP 594. These examples and case studies are for illustrative purposes only, and do not purport to limit the types of reportable situations that must be reported to ASIC or the reasons why a particular breach may or may not be considered significant. RG 78.10 Rather, we provide these examples and case studies to help provide clarity and promote the delivery of consistent and high quality reports. Ultimately, it is your responsibility to decide whether you must report to ASIC under the law, by considering the circumstances of your case. RG 78.11 This guide should be read in conjunction with our regulatory guides on how we administer Ch 7 of the Corporations Act and Ch 2 of the National Credit Act, including Regulatory Guide 104 AFS licensing: Meeting the general obligations (RG 104), Regulatory Guide 105 AFS licensing: Organisational competence (RG 105) and Regulatory Guide 205 Credit licensing: General conduct obligations (RG 205). What this guide does not cover RG 78.12 This guide does not cover the following obligations to report matters to ASIC if you: (a) are a body regulated by the Australian Prudential Regulation Authority (APRA) and you cease to hold that status—for example, if you are a superannuation trustee and you have your approval as a trustee revoked by APRA (see Pro Forma 209 Australian financial services licence conditions (PF 209), condition 11); (b) become aware of a change in control of the licensee (see reg 7.6.04(1)(i) of the Corporations Regulations 2001 (Corporations Regulations) or reg 9(10) of the National Consumer Credit Protection Regulations 2010 (National Credit Regulations)); Note 1: For more information about a change in control of the licensee, see Change in control of AFS licensee on the ASIC website. Page 7 REGULATORY GUIDE 78: Breach reporting by AFS licensees and credit licensees © Australian Securities and Investments Commission December 2023 Page 7 Note 2: In this guide, we use the term ‘regulations’ when referring collectively to the Corporations Regulations and the National Credit Regulations. (c) are an auditor whose reporting obligations are imposed by s311, s324CA–CC, 324CE–CG, 601HG, 990K or 1226H of the Corporations Act or s104 of the National Credit Act (see Regulatory Guide Auditor obligations: Reporting to ASIC (RG 34); or (d) are a credit licensee, the obligation imposed by s53 of the National Credit Act to lodge an annual compliance certificate (see Information Sheet 135 Annual compliance certificates for credit licensees (INFO 135)). RG 78.13 You may also have separate obligations to report in addition to the breach reporting obligation. For example: (a) Market integrity rules: A market participant must notify ASIC of certain suspicious activities (see Rule 5.11.1 of the ASIC Market Integrity Rules (Securities Markets) 2017, Rule 3.6.1 of the ASIC Market Integrity Rules (Futures Markets) 2017, Regulatory Guide 265 Guidance on ASIC market integrity rules for participants of securities markets (RG 265) and Regulatory Guide 266 Guidance on ASIC market integrity rules for participants of future markets (RG 266)). (b) Australian Passport Rules: Australian passport fund operators must notify ASIC of specified changes and certain breaches of these rules, or of the passport rules of an applicable host economy of the fund (see s12 of the Corporations (Passport) Rules 2018 and Regulatory Guide 132 Funds management: Compliance and oversight (RG 132)). (c) Product design and distribution obligations: These obligations require an issuer to notify ASIC of a ‘significant dealing’ (see s994G of the Corporations Act and Regulatory Guide 274 Product design and distribution obligations (RG 274). (d) Internal dispute resolution (IDR) reporting: The IDR data reporting obligation requires some licensees to report to ASIC information about their IDR processes in operation (see s912A(1)(g)(ii) and 1017G(1)(d) of the Corporations Act, s47(1)(ha) of the National Credit Act, s47(1)(c) of the Retirement Savings Account Act 1997 (RSA Act) and s101(1)(c) of the Superannuation Industry (Supervision) Act 1993 (SIS Act). RG 78.14 The IDR data reporting obligation is separate to the IDR requirements set out in Regulatory Guide 271 Internal dispute resolution (RG 271), which licensees must have in place to meet ASIC’s standards and requirements. A significant breach of the enforceable IDR requirements may need to be reported under the breach reporting regime (see RG 78.37(c) and Example 4(e) in Table 4). Page 8 REGULATORY GUIDE 78: Breach reporting by AFS licensees and credit licensees © Australian Securities and Investments Commission December 2023 Page 8 How our guidance applies RG 78.15 For both AFS licensees and credit licensees, the breach reporting obligation under the Financial Sector Reform Act as discussed in this guide applies to ‘reportable situations’ that arose on or after 1 October 2021. RG 78.16 When an investigation must be reported to us as a reportable situation is discussed at RG 78.48–RG 78.62. Investigations into an incident that happened entirely before 1 October 2021 (i.e. the conduct that is the subject of the incident is not continuing) are not reportable to ASIC, even if the licensee commences an investigation into the incident on or after 1 October 2021, and the incident would have been a reportable situation had it occurred on or after 1 October 2021. RG 78.17 An investigation that commenced before 1 October 2021 became a reportable situation if: (a) the investigation was still in progress on or after 1 October 2021 and continued for more than 30 days; and (b) the investigation concerned an incident that started before 1 October 2021 and the conduct that was the subject of the incident was continuing on 1 October 2021. Credit licensees: Reporting breaches that occurred before 1 October 2021 RG 78.18 Credit licensees are not required to report breaches of the National Credit Act that occurred wholly before 1 October 2021, even if the breach is identified on or after 1 October 2021. Page 9 REGULATORY GUIDE 78: Breach reporting by AFS licensees and credit licensees © Australian Securities and Investments Commission December 2023 Page 9 B What you must report to ASIC Key points As a licensee, you must report to ASIC a range of conduct that the law describes as ‘reportable situations’. The types of reportable situations that you must report include: • significant breaches or likely significant breaches of ‘core obligations’; • investigations into whether there is a significant breach or likely breach of a ‘core obligation’ if the investigation continues for more than 60 days; • the outcome of such an investigation if it discloses there is no significant breach or likely breach of a core obligation; • conduct that constitutes gross negligence or serious fraud; and • conduct of financial advisers and mortgage brokers who are representatives of other licensees in certain prescribed circumstances. What is a ‘reportable situation’? RG 78.19 You must report to ASIC all ‘reportable situations’: see s912DAA of the Corporations Act, s50B of the National Credit Act. This term has a specific meaning under the law and includes a range of conduct. RG 78.20 In this guide, we refer to four types of reportable situations (see Table 1): (a) breaches or ‘likely breaches’ of core obligations that are significant; (b) investigations into breaches or likely breaches of core obligations that are significant; (c) additional reportable situations; and (d) reportable situations about other licensees. RG 78.21 When we refer to a ‘likely breach’, we are referring to a situation where a licensee is no longer able to comply with a core obligation and the breach, if it occurs, will be significant: see s912D(1)(b) of the Corporations Act, s50A(1)(b) of the National Credit Act. RG 78.22 For example, one of your licence conditions may require you to have professional indemnity (PI) insurance. You become aware that your PI insurance policy will lapse soon and you have been unable to secure a renewed policy. If you are unable to find a new PI insurance policy before it lapses, you will become uninsured and will no longer be able to comply with your licence conditions. You must report to ASIC. Page 10 REGULATORY GUIDE 78: Breach reporting by AFS licensees and credit licensees © Australian Securities and Investments Commission December 2023 Page 10 Table 1: Types of reportable situations Type of situation Description Guidance and examples Breaches or ‘likely breaches’ of core obligations that are significant These situations include:  any breach of a ‘core obligation’ where the breach is significant; and  any ‘likely breach’ of a ‘core obligation’ where the licensee or a representative of the licensee is no longer able to comply with a core obligation and the breach, if it occurs, will be significant. See RG 78.29–RG 78.47 Note: For guidance on determining whether or not a breach is significant, see RG 78.31–RG 78.47. Investigations into breaches or likely breaches of core obligations that are significant These situations include:  investigations that continue for more than 60 days into whether there is a breach or likely breach of a core obligation that is significant; and  the outcome of such an investigation if it discloses there is no breach or likely breach of a core obligation that is significant. See RG 78.48–RG 78.62 Note: For guidance on determining whether or not a breach is significant, see RG 78.31–RG 78.47. Additional reportable situations These situations include:  conduct constituting gross negligence;  conduct constituting serious fraud; and  other circumstances prescribed by the regulations. See RG 78.63–RG 78.67 Reportable situations about other licensees These situations relate to conduct in certain prescribed circumstances of financial advisers and mortgage brokers of other licensees. See RG 78.68–RG 78.82 RG 78.23 You must lodge a report with ASIC within 30 days after you first know that, or are reckless with respect to whether, there are reasonable grounds to believe a reportable situation has arisen: see s912DAA(3) of the Corporations Act, s50B(4) of the National Credit Act. Note: For guidance on when reasonable grounds might arise, and the required timeframes for reporting, see RG 78.83–RG 78.106. RG 78.24 If a reportable situation arises, failure to report to ASIC in accordance with your obligations is an offence and can lead to criminal or civil penalties: see s912DAA of the Corporations Act, s50B of the National Credit Act. Note: For guidance on the consequences of failing to report, see RG 78.123–RG 78.126. RG 78.25 Reportable situations, ‘core obligations’ and objective determinations of ‘significance’ are important and interrelated concepts underlying the breach reporting obligation: see Figure 1. Page 11 REGULATORY GUIDE 78: Breach reporting by AFS licensees and credit licensees © Australian Securities and Investments Commission December 2023 Page 11 Figure 1: Reportable situations, core obligations and objective determinations of ‘significance’ Note: This figure is described in RG 78.25–RG 78.27 (accessible version). RG 78.26 While we provide guidance on these terms throughout this guide, Figure 1 highlights (with dark shading) three reportable situations that do not require a ‘determination of significance’ before being reported to ASIC. These are: (a) ‘additional reportable situations’ (i.e. gross negligence or serious fraud), which must be reported to ASIC and require no determination of significance; (b) ‘deemed significant breaches’, which are automatically taken to be significant by operation of law; and (c) ‘investigations that continue for more than 60 days’, which require consideration of whether there may be a breach, or likely breach, of a core obligation that is significant, but do not require a determination of significance before being reported to ASIC. RG 78.27 Breaches or likely breaches of core obligations that do not fall into one of these categories (shown with light shading in Figure 1) require an objective determination of significance before being reported to ASIC. Breaches by representatives RG 78.28 A licensee must report breaches committed by the licensee and by its representatives, as this term is defined in the Corporations Act and the National Credit Act: (a) for AFS licensees—representatives include authorised representatives, an employee or director of the licensee or related body corporate, or any other person acting on behalf of the licensee (see s9 of the Corporations Act); and (b) for credit licensees—representatives include an employee or director of the licensee or related body corporate of the licensee, credit representatives of the licensee, or any other person acting on behalf of the licensee (see s5 of the National Credit Act). Note: See RG 78.132–RG 78.146 for guidance on compliance systems, and monitoring and supervision of representatives (including authorised representatives at RG 78.136). Breaches or likely breaches of ‘core obligations’ Additional reportable situations (gross negligence or serious fraud) Other breaches that are significant Investigations that take more than 60 days Deemed significant breaches Reportable situations Page 12 REGULATORY GUIDE 78: Breach reporting by AFS licensees and credit licensees © Australian Securities and Investments Commission December 2023 Page 12 What is a breach or likely significant breach of your core obligations? RG 78.29 You must report to ASIC any significant breach (or likely significant breach) of your ‘core obligations’, as defined in s912D(3) of the Corporations Act for AFS licensees or s50A(3) of the National Credit Act for credit licensees. Appendix 1 to this guide includes a detailed summary of the core obligations for both AFS licensees and credit licensees. Note: In this guide, references to s912D(3) of the Corporations Act and s50A(3) of the National Credit Act are modified by s6 of ASIC Corporations and Credit (Breach Reporting—Reportable Situations) Instrument 2024/620. RG 78.30 You are only required to report breaches (or likely breaches) of core obligations that are ‘significant’: see RG 78.31. What does ‘significant’ breach mean? RG 78.31 You must report any breach or likely breach of a core obligation if the breach is ‘significant’. There are two ways to determine whether a breach is significant: (a) Deemed significant breaches: In certain situations, a breach or likely breach of a core obligation is taken to be significant (see RG 78.34– RG 78.44); and Note: Some breaches are excluded from being deemed significant: see section 6 of ASIC Instrument 2024/620. (b) Other breaches that may be significant: In other situations, a breach or likely breach of a core obligation will need to be considered against the factors in s912D(5) of the Corporations Act or s50A(5) of the National Credit Act to determine whether it is significant (see RG 78.45– RG 78.47). RG 78.32 In determining whether a breach is significant, you should first consider whether a breach is a deemed significant breach. Only if it is not such a breach should you then proceed to determine whether it is significant, having regard to the factors in s912D(5) of the Corporations Act or s50A(5) of the National Credit Act. RG 78.33 Licensees need an adequate incident and issues management system in place to properly deal with each breach. As a critical part of such a system, an accurate and complete breach register can help with the timely identification of breaches and determination of whether or not an individual breach is significant. For example, if you identify a single, isolated breach that is not significant, it should be recorded in your breach register or risk management system. Although a single breach may not be significant, multiple breaches of the same kind may result in a later breach being considered significant: Page 13 REGULATORY GUIDE 78: Breach reporting by AFS licensees and credit licensees © Australian Securities and Investments Commission December 2023 Page 13 see s912D(5)(a) of the Corporations Act or s50A(5)(a) of the National Credit Act (which relate to the number or frequency of similar breaches). Note: For more information on breach registers and how you can demonstrate compliance with your obligations, see Section D. For guidance on breaches of s912D(5) of the Corporations Act or s50A(5) of the National Credit Act, see RG 78.45–RG 78.47. What are ‘deemed significant breaches’? RG 78.34 Under s912D(4) of the Corporations Act or s50A(4) of the National Credit Act, certain breaches of core obligations are taken to be significant (‘deemed significant breaches’). If a breach is a ‘deemed significant breach’, no additional steps are needed to determine whether the breach is ‘significant’ before reporting to ASIC. As stated in the Explanatory Memorandum: The purpose of the deemed significance test is to provide greater certainty for industry and to ensure significant breaches are reported to ASIC in a timely manner. For example, where a breach constitutes a contravention of a relevant civil penalty provision or the commission of a relevant offence, the significance of the breach is immediately taken to be satisfied. Note: See Explanatory Memorandum, paragraph 11.37. RG 78.35 Deemed significant breaches include: (a) breaches that constitute the commission of an offence and the commission of the offence is punishable on conviction by a penalty that may include imprisonment for: (i) three months or more if the offence involves dishonesty; or (ii) 12 months or more in any other case; (b) breaches of a civil penalty provision (other than a civil penalty provision that is excluded under the regulations); Note: Certain contraventions of core obligations, including the civil penalty provisions, are not taken to be significant: see RG 78.38. (c) for credit licensees, breaches that constitute a contravention of a key requirement under s111 of the National Credit Code (Sch 1 to the National Credit Act) (except if the key requirement is exempted under the regulations); (d) breaches that contravene s1041H(1) of the Corporations Act or s12DA(1) of the Australian Securities and Investments Commission Act 2001 (ASIC Act) (the misleading or deceptive conduct provisions); Note: Certain contraventions of core obligations, including the misleading or deceptive conduct provisions, are not taken to be significant: see RG 78.38. (e) breaches that result, or are likely to result, in material loss or damage to: (i) for credit licensees—a credit activity client of the licensee; Page 14 REGULATORY GUIDE 78: Breach reporting by AFS licensees and credit licensees © Australian Securities and Investments Commission December 2023 Page 14 Note: The term ‘credit activity client’ is defined in s50A(6) of the National Credit Act. (ii) for AFS licensees: (A) in all cases—a person or persons to whom the AFS licensee or a representative of the licensee provides a financial product or a financial service as a wholesale or retail client; (B) in the case of a managed investment scheme—a member or members of the scheme; or (C) in the case of a superannuation entity—a member or members of the entity. Breaches of civil penalty provisions, key requirements, the misleading or deceptive conduct provisions and relevant exemptions RG 78.36 Breaches of civil penalty provisions and breaches of key requirements under s111 of the National Credit Act must be reported to us as deemed significant breaches. Breaches of the misleading or deceptive conduct provisions must also be reported to us as deemed significant breaches. RG 78.37 However, a number of civil penalty provisions and key requirements are excluded from the list of core obligations for which a breach is deemed to be significant under s912D(4)(b) of the Corporations Act and s50A(4)(b) of the National Credit Act, as follows: (a) Regulation 7.6.02A(2) of the Corporations Regulations (AFS licensees) and reg 12A of the National Credit Regulations (credit licensees) specify breaches of civil penalty provisions that do not need to be reported solely because the breach is a contravention of a civil penalty provision. (b) Regulation 12B of the National Credit Regulations excludes from deeming a number of key requirements under the National Credit Code. (c) While the enforceable paragraphs of RG 271 are civil penalty provisions, s5 of ASIC Instrument 2024/620 relieves single breaches of these provisions from being deemed significant breaches under s912D(4)(b) of the Corporations Act and s50A(4)(b) of the National Credit Act. RG 78.38 In addition, s6 of ASIC Instrument 2024/620 provides that certain insignificant contraventions of core obligations are not taken to be significant. These include: (a) a breach of the misleading or deceptive conduct provisions or the prohibition in s12DB(1) of the ASIC Act (the false or misleading representation prohibition) if the breach meets the following conditions: Page 15 REGULATORY GUIDE 78: Breach reporting by AFS licensees and credit licensees © Australian Securities and Investments Commission December 2023 Page 15 (i) the underlying circumstances in relation to the breach must have only given rise, and only be likely to give rise, to a single reportable situation; Note: Section 6 of ASIC Instrument 2024/620 provides that there is a single reportable situation even if particular conduct constitutes a single contravention of two or more of s12DA(1) or s12DB(1) of the ASIC Act or s1041H(1) of the Corporations Act: see notional s912D(4B)(a) of the Corporations Act and notional s50A(4B)(a) of the National Credit Act. (ii) the relevant breach must only impact one person or, if the breach relates to a financial product, credit product, consumer lease, mortgage or guarantee that is, or is proposed to be, jointly held by consumers, impact only those consumers; and (b) the relevant breach must not result in, and be unlikely to result in, any financial loss or damage to any person (regardless of whether that loss or damage has been, or will or may be, remediated);a breach of a core obligation that meets the following conditions: (i) the underlying circumstances in relation to the breach must have only given rise to a single reportable situation or single group of reportable situations; Note: A single group of reportable situations means two or more reportable situations that each involve the same or substantially similar conduct other than the identity of the consumer and the date of the conduct, and occur within a period of no more than 60 days. (ii) the underlying circumstances in relation to the breach must not constitute a contravention of sections 828C or 981M; (iii) there are no more than 10 persons impacted by the single reportable situation or single group of reportable situations; (iv) the total financial loss or damage from the single reportable situation or single group of reportable situations results does not exceed $1,000 (regardless of whether than loss or damage has been, or will or may be, remediated); and (v) the breach must have been rectified (including any remediation to clients) within 60 days after the reportable situation first occurred. RG 78.39 If a breach is excluded from deeming under s6 of ASIC Instrument 2024/620, but then the underlying circumstances in relation to the breach give rise to further reportable situations or it becomes evident that the breach has given rise to further financial loss so that it no longer meets the conditions of our relief, you must report it and any further breach(es) to us. RG 78.40 When a breach is excluded from deeming under the regulations or s5 or s6 of ASIC Instrument 2024/620 you must still consider whether it is a deemed significant breach under any of the other criteria in s912D(4) of the Page 16 REGULATORY GUIDE 78: Breach reporting by AFS licensees and credit licensees © Australian Securities and Investments Commission December 2023 Page 16 Corporations Act or s50A(4) of the National Credit Act (see RG 78.35), such as when the breach: (a) is a commission of an offence carrying certain penalties of imprisonment; or (b) results, or is likely to result in, material loss or damage to a client. RG 78.41 If you determine that none of those criteria apply, you must also consider whether it is significant in light of the factors in s912D(5) of the Corporations Act or s50A(5) of the National Credit Act (see RG 78.45– RG 78.47). Breaches that result, or are likely to result, in material loss or damage RG 78.42 The term ‘material loss or damage’ is not defined in the legislation. We provide some examples of material loss or damage: see Example 3(a) in Table 2. RG 78.43 In determining whether there is material loss or damage, licensees should be guided by the Parliamentary intent in the Explanatory Memorandum (as it applies to both the Corporations Act and the National Credit Act provisions): ‘Loss or damage’ in the context of the deemed significance test has its ordinary meaning, which is extensive. The term includes financial and non- financial loss or damage. Whether a breach results or is likely to result in material loss or damage to a person will depend on the person’s circumstances. For example, a relevant circumstance may include the person’s financial situation. If a breach affects several people, it is sufficient for significance to be established if the breach is likely to result in material loss or damage to one person. Additionally, where the breach affects several people, licensees should consider the total loss or damage resulting from the breach. For example, even if the breach does not result in a material loss or damage to individual persons, the total loss or damage to persons resulting from the breach may, when aggregated, amount to material loss or damage to persons, thereby satisfying the significance requirement. Consistent with the common law position, ‘likely to result in material loss or damage’ is intended to mean that there is a real and not remote possibility that loss or damage will occur as a result of the breach. Note: See Explanatory Memorandum, paragraphs 11.30–11.33. Page 17 REGULATORY GUIDE 78: Breach reporting by AFS licensees and credit licensees © Australian Securities and Investments Commission December 2023 Page 17 RG 78.44 You should consider the financial circumstances of clients (retail and wholesale) affected by a breach in considering whether loss or damage suffered is material. This does not mean you should delay reporting a breach while the specific financial circumstance of each affected client is determined. However, the circumstances of clients who suffer loss or damage as a result of a breach are relevant, particularly when there is a small number of clients who have suffered loss and the loss may be substantial to one or more of them. In this situation, we would expect you to consider information about these clients that is within your knowledge to determine if the loss is material to them. Page 18 REGULATORY GUIDE 78: Breach reporting by AFS licensees and credit licensees © Australian Securities and Investments Commission December 2023 Page 18 Table 2: Examples of deemed significant breaches Example 3(a): Material loss or damage to clients Material loss or damage to a debtor If a debtor with a credit contract surrenders goods to a credit provider under s85 of the National Credit Code and the credit provider fails to comply with its obligations to sell those goods as soon as reasonably practicable to a purchaser nominated by the debtor (or, where a purchaser is not nominated by a debtor, for the best price reasonably obtainable), the debtor may suffer loss or damage. The breach may need to be reported to ASIC when the loss or damage to the debtor is material given:  the value of the goods surrendered;  the length of any delay in the sale of the goods to a purchaser nominated by the debtor (or, where a purchaser is not nominated by the debtor, the difference between the amount the goods are sold for and the best price that could have been reasonably obtained); and  the financial situation of the debtor. Material loss or damage to consumer credit insurance clients Over a four-year period, an insurer allowed consumer credit insurance (CCI) to be sold to clients who the insurer knew, or should have known, at the time of the sale were not eligible to claim for unemployment or temporary or permanent disability cover provided by the CCI. While on average the breach meant that the general insurer had collected $153 in unsuitable premiums per client, collectively the breach may amount to material loss, with the insurer refunding over 65,000 clients around $10 million. Separately, consideration of materiality also included the affected clients’ financial situation, as they were mostly low-income students or people who were unemployed. Material loss or damage to members of a superannuation fund A superannuation fund trustee identifies issues with its operation and control systems that led to overcharging of member insurance premiums. The trustee establishes that the individual loss to members is low (and estimated to be less than $80 per member). However, the breach collectively results in a large cohort of affected members (over 70,000) who suffer a significant collective loss (over $5 million). In assessing whether a breach results, or is likely to result, in material loss or damage to a member or members of a superannuation entity, a superannuation fund trustee should take into account the total and aggregated loss or damage to affected members of the entity, even if the individual loss per affected member is small. Example 3(b): Dishonestly obtaining client funds (criminal offence) If a licensee, or a licensee’s representative, breaches a core obligation by engaging in conduct that constitutes a criminal offence, the licensee must report this to ASIC. For example, if the licensee identifies, after complaints have been lodged by clients, that an authorised representative has given advice to clients to dishonestly obtain client funds and use them for personal expenses or other purposes, the licensee must report that breach to ASIC. Page 19 REGULATORY GUIDE 78: Breach reporting by AFS licensees and credit licensees © Australian Securities and Investments Commission December 2023 Page 19 Example 3(c): Governance failures in a responsible entity (civil penalty provision) If the licensee is a responsible entity of a registered scheme and it becomes aware that in exercising its powers and carrying out its duties as responsible entity it has not complied with the compliance plan for the registered scheme, it will be in breach of the obligations under s601FC(1)(h) of the Corporations Act (duties of responsible entity) and must report this to ASIC. Because a breach of s601FC(1)(h) contravenes s601FC(5) and incurs a civil penalty under s1317E, such a breach is deemed to be significant and must be reported to ASIC. Example 3(d): Quality of advice and failure to act in interests of the client (civil penalty provision) An AFS advice licensee identifies that four of its representatives have failed to comply with their best interests duty (in breach of s961B of the Corporations Act) and to provide appropriate advice to multiple clients (in breach of s961G of the Corporations Act). As a result, the advice licensee may be in breach of its obligation to take reasonable steps to ensure that its representatives comply with the best interests duty (s961L)—a civil penalty provision. There may also be breaches of the licensee’s core obligations to comply with the relevant financial services laws (s912A(1)(c)—licensees must ensure compliance) in relation to s961L. There may also be a failure to take reasonable steps to ensure that its representatives comply with those laws: see s912A(1)(ca). The advice licensee must report the breach to ASIC. Example 3(e): Contraventions of the misleading or deceptive conduct provisions or false or misleading representation prohibition If a licensee or representative contravenes the misleading or deceptive conduct provisions or the false or misleading representation prohibition, and the contravention does not meet the conditions for relief in s6 of ASIC Instrument 2024/620, the licensee must report this to ASIC. Credit licensees A licensed mortgage broker conducts an audit of one of its representatives and identifies a loan application containing false information, which indicates that its representative made false representations to a number of potential lenders that are likely to cause financial loss or damage to those lenders. Based on this information, the mortgage broker has reasonable grounds to believe a reportable situation has arisen (misleading or deceptive conduct in contravention of s12DA of the ASIC Act), and it must report this to ASIC. AFS licensees An AFS licensee identifies that a representative has contravened the misleading or deceptive conduct provisions by asking clients to sign blank forms, signing clients’ names on an authority to proceed (part of the SOA), and falsely declaring to have witnessed forms. As the conduct has impacted multiple clients, the licensee has reasonable grounds to believe that a reportable situation has arisen (misleading or deceptive conduct in contravention of s1041H of the Corporations Act) and it must report this to ASIC. Example 3(f): Charging prohibited fees to a debtor (key requirement under the National Credit Code) A contravention of a key requirement, as defined for the purposes of the National Credit Code, must be reported to ASIC, except when excluded by the regulations: see s50A(4)(c) of the National Credit Act. For example, a credit licensee conducts a review of its credit contracts and identifies that it is imposing a fee or charge that is prohibited under s23(1) (prohibited money obligations) of the National Credit Code. The licensee must report this to ASIC, even if the fee or charge is imposed on only one debtor. Page 20 REGULATORY GUIDE 78: Breach reporting by AFS licensees and credit licensees © Australian Securities and Investments Commission December 2023 Page 20 Example 3(g): Efficiently, honestly and fairly (civil penalty provision) Under its general licence obligations, an AFS licensee must do all things necessary to ensure that the financial services covered by its licence are provided efficiently, honestly and fairly: see s912A(1)(a) of the Corporations Act. If it contravenes this obligation, it must report this to ASIC. A licensee is undertaking a large remediation as a result of discovering that customers had been overcharged fees for a particular financial product for over 10 years. The licensee failed to establish and maintain adequate systems, processes and procedures to ensure that the product was delivered as promised, and to identify the failure when it occurred. As a result of this failure, customers have suffered loss and the licensee understands that it is obliged to compensate them for that loss. Due to a significant decrease in the number of new customers over the last two years, the licensee is experiencing a sizeable downturn in revenue. As a result of this, and following discussions with the executive committee, its customer remediation unit has altered its remediation timetable to effectively adopt a ‘go slow’ approach to paying remediation to these customers. The licensee’s conduct in overcharging fees and the resulting decision to go slow on remediation is systemic because it affects many of its customers, it continued over an extended period, and highlights failings in its systems, processes and procedures. We consider this conduct would be in breach of the licensee’s obligation to do all things necessary to ensure financial services covered by its licence are provided efficiently, honestly and fairly, and it therefore has an obligation to report this conduct to ASIC. Other breaches that are significant RG 78.45 Except for deemed significant breaches and additional reportable situations, a breach (or likely breach) of a core obligation needs to be assessed to determine whether it is significant having regard to certain factors in s912D(5) of the Corporations Act or s50A(5) of the National Credit Act. These factors are: (a) the number or frequency of similar breaches; (b) the impact of the breach or likely breach on the licensee’s ability to supply the financial services or engage in credit activities covered by the licence; (c) the extent to which the breach or likely breach indicates that the licensee’s arrangements to ensure compliance with those obligations are inadequate; and (d) any other matters prescribed by the regulations. RG 78.46 Whether a particular breach is significant should be determined objectively: see RG 78.25. Table 3 explains how each of these factors may be applied to determine whether a breach is significant. Table 4 gives examples of Page 21 REGULATORY GUIDE 78: Breach reporting by AFS licensees and credit licensees © Australian Securities and Investments Commission December 2023 Page 21 breaches we consider may be significant, while Table 5 gives examples of breaches we consider may not be significant. Note: As noted earlier, these examples are for illustrative purposes only; a determination of significance for a particular breach, or likely breach, will depend on the licensee’s individual circumstances: see RG 78.9–RG 78.10. RG 78.47 You must have regard to all of the factors in RG 78.45 when determining whether a breach (or likely breach) is significant. A breach may be significant even if only one of the factors applies to your circumstances, or when there is a combination of factors. Table 3: Factors that determine whether a breach (or likely breach) is ‘significant’ under s912D(5) of the Corporations Act or s50A(5) of the National Credit Act Factor How it may be applied to determine whether a breach is significant The number or frequency of similar breaches: see s912D(5)(a) of the Corporations Act, s50A(5)(a) of the National Credit Act The greater the number or frequency of similar breaches, the more likely it will be that the new breach will be significant. The repeat of a breach may also indicate a continuing underlying systemic problem. If minor breaches of a technical or administrative nature repeatedly occur, you may become aware that you can no longer comply with your obligations under the financial services laws or credit legislation (e.g. because you have inadequate compliance arrangements, risk management systems, or technological or human resources). This may be a reportable situation under s912D(1)(b) of the Corporations Act or s50A(1)(b) of the National Credit Act. It would also amount to a deemed significant breach, as the following sections are civil penalty provisions:  s912A(1)(d) of the Corporations Act (obligation to have adequate resources to provide financial services covered by your licence);  s912A(1)(h) of the Corporations Act (obligation to have adequate risk management systems);  s47(1)(k) of the National Credit Act (obligation to have adequate arrangements to ensure compliance with the general obligations under s47); and  s47(1)(l) of the National Credit Act (obligation to have adequate risk management systems and adequate resources to provide credit activities covered by your licence). The impact of the breach or likely breach on your ability to supply the financial services or engage in credit activities covered by your licence: see s912D(5)(b) of the Corporations Act, s50A(5)(b) of the National Credit Act If a breach or likely breach reduces your ability or capacity to supply the financial services or engage in the credit activities covered by your licence, it is likely to be significant. For example, we consider that a breach of the financial requirements of your licence conditions may be significant. If these minimum requirements are not met, you may not have the financial ability or capacity to supply the financial services or credit activities covered by your licence. If the breach or likely breach will not affect your ability or capacity to supply the financial services or credit activities covered by your licence, it may still be significant having regard to one or more of the other factors. Page 22 REGULATORY GUIDE 78: Breach reporting by AFS licensees and credit licensees © Australian Securities and Investments Commission December 2023 Page 22 Factor How it may be applied to determine whether a breach is significant The extent to which the breach or likely breach indicates that the licensee’s arrangements to ensure compliance with those obligations are inadequate: see s912D(5)(c) of the Corporations Act, s50A(5)(c) of the National Credit Act If the breach or likely breach indicates that your arrangements to ensure compliance failed to prevent the breach in an isolated and specific instance, it may not be significant. However, if it indicates broader inadequacies in your compliance arrangements, it is more likely to be significant and, if so, you should report it to ASIC. We recognise that compliance arrangements are unlikely to ensure full compliance with every aspect of the law at all times, and occasional and minor breaches do not of themselves mean that your compliance arrangements are inadequate. However, this factor requires you to consider whether a breach or likely breach indicates that your compliance arrangements are inadequate. We expect that under this factor you would ask yourself questions such as the length of time the incident went undetected, to what extent the compliance arrangements helped in identifying the breach, and the timeframe it took to investigate and assess the incident as a breach. We consider that, when systems are appropriately resourced, used and audited, they should identify instances of non-compliance in a timely manner. Any other matters prescribed by the regulations: see s912D(5)(d) of the Corporations Act, s50A(5)(d) of the National Credit Act You should check to see whether the regulations have prescribed any further factors. Table 4: Examples of breaches that may be significant under s912D(5) of the Corporations Act or s50A(5) of the National Credit Act Example 4(a): Failure to notify ASIC of changes in key persons If a licensee is required as a condition of its licence to report to ASIC when a person ceases to be an officer or perform duties on behalf of the licensee, and it fails to inform ASIC within the required time period and lodge information in relation to the replacement of that key person, there may be a significant breach. If the departure of one or more key persons will impact on the licensee’s ability to provide the financial services or credit activities covered by its licence, that is a breach of s912A(1)(b) of the Corporations Act or s47(1)(c) of the National Credit Act. A failure to inform ASIC and appoint an appropriate replacement person should be reported to ASIC if the breach is significant under s912D(5) of the Corporations Act or s50A(5) of the National Credit Act. Page 23 REGULATORY GUIDE 78: Breach reporting by AFS licensees and credit licensees © Australian Securities and Investments Commission December 2023 Page 23 Example 4(b): Failure to follow disclosed investment mandates If a fund is promoted as following a particular investment mandate or as having particular characteristics, we would expect a failure of the responsible entity to ensure that the scheme complies with the mandate or has the promoted characteristic (which in certain circumstances will be a breach of s601FC(1)(c) of the Corporations Act) to be a significant breach, even when the breach may not have resulted in material loss or damage to members. For example, if a scheme is promoted as having an investment mandate that compels the scheme to invest in certain ethical investments (e.g. ‘green energy’) or investment types and to avoid others (e.g. tobacco, fossil fuels), a failure to comply with this would adversely affect the interests of members and may mean the promotional material issued to investors is misleading. It may not cause material loss and damage if the returns generated by the scheme were the same or higher than would have been achieved under the disclosed mandate. This would nevertheless be morally unacceptable to many of them. Note: If you identify that the promotional material for the scheme is potentially misleading, this will constitute misleading or deceptive conduct and therefore be a deemed significant breach: see Example 3(e) in Table 2. Example 4(c): Breach of ASIC market integrity rules Operators of licensed markets and participants in financial markets must comply with the ASIC market integrity rules made under s798G of the Corporations Act. Failure to comply with these rules (which in certain circumstances may be a breach of s798H of the Corporations Act) is a civil penalty provision excluded from deemed significance. However, such a breach may still need to be reported to us if one of the other circumstances of deemed significance in s912D(4) applies, or if it is otherwise significant under s912D(5) of the Corporations Act. For example, dealing in a financial product by the participant on account of a client when a market participant ought reasonably suspect that the client has placed the order with the intention of creating a false or misleading appearance of the price of a financial product: see Rule 5.7.1 of the ASIC Market Integrity Rules (Securities Markets) 2017. The same dealing may also constitute a breach of Rules 5.6.1 or 5.6.3 if the dealing was conducted through the market participant’s automated order processing system. Example 4(d): Breach of IDR requirements If a licensee breaches the IDR standards outlined in the enforceable paragraphs of RG 271, it will not be a deemed significant breach despite being a breach of a civil penalty provision. This is because s5 of ASIC Instrument 2024/620 excludes such a breach from being deemed significant under s912D(4)(b) of the Corporations Act or s50A(4)(b) of the National Credit Act. However, the breach may still be reportable. For example, a licensee identifies that a pro forma letter sent by the licensee in response to complaints for the past three months as part of the IDR process did not inform the complainants that they can take their complaint to the Australian Financial Complaints Authority (AFCA). This failure to inform is in breach of the enforceable paragraphs of RG 271: see RG 271.53–RG 271.54. This breach would likely be significant due to the number of clients impacted and may also indicate that a licensee’s arrangements to ensure compliance are inadequate and must be reported to us: see s912D(5) of the Corporations Act. Page 24 REGULATORY GUIDE 78: Breach reporting by AFS licensees and credit licensees © Australian Securities and Investments Commission December 2023 Page 24 Table 5: Examples of breaches that may not be significant Example 5(a): Isolated failure to give a disclosure document (Financial Services Guide (FSG) or Credit Guide) A licensee identifies an isolated instance of an authorised representative or credit representative failing to give a client a copy of an FSG or Credit Guide in contravention of s941B of the Corporations Act or s113(1) of the National Credit Act, which are civil penalty provisions excluded from deemed significance by the regulations. The licensee must still consider whether the breach is significant under any of the other deeming categories, or otherwise significant under s912D(5) of the Corporations Act or s50A(5) of the National Credit Act: see RG 78.45. If, for example, the licensee determines that there are no further contraventions or losses arising from the contravention, it is unlikely to be required to report to ASIC. However, if it identifies multiple breaches of the same nature, or issues surrounding the contravention that suggest that there are deficiencies in its compliance systems, it may be required to report the breach to ASIC. Example 5(b): Isolated failure to provide a statement of account If a licensee fails to give a periodic statement of account to an individual client in the time period required by the National Credit Code in an isolated instance, the breach is not li