This is Information Sheet 259 (INFO 259). It is for:
It outlines the obligations for licensees to investigate certain breaches of the law and to notify and remediate clients and consumers in certain circumstances.
Note: In this information sheet, we refer collectively to AFS licensees and credit licensees as ‘licensees’. We refer to the obligations as the ‘notify, investigate and remediate obligations’.
This information sheet explains:
The notify, investigate and remediate obligations are set out for:
The obligations require licensees to:
Licensees must also maintain records to show compliance with these obligations.
In this information sheet, an ‘affected client’ refers to a client of a financial adviser consistent with the meaning in section 912EA of the Corporations Act or a consumer who receives credit assistance from a mortgage broker in relation to a mortgage over a residential property consistent with the meaning in section 51A of the National Credit Act.
In considering how the notify, investigate and remediate obligations apply, licensees should also take into account our general guidance in:
The notify, investigate and remediate obligations apply to licensees whose conduct, or that of their representatives, triggers the obligations.
The notify, investigate and remediate obligations will be triggered if all four of the following circumstances exist:
To determine if there are ‘reasonable grounds to suspect’, a licensee should consider whether there are facts that would induce a reasonable person to suspect the truth or existence of the circumstances. This threshold relies on the common law meaning of the term ‘reasonable grounds to suspect’ and is not defined by the legislation: see Explanatory Memorandum to the Financial Sector Reform (Hayne Royal Commission Response) Bill 2020 (Explanatory Memorandum), paragraphs 12.28 and 12.29.
The concept of a ‘reportable situation’ relies on the meaning given in section 912D of the Corporations Act and section 50A of the National Credit Act, which deal with licensees’ general breach reporting obligations. What constitutes a reportable situation is explained in more detail in RG 78.
Only a subset of reportable situations will trigger the notify, investigate and remediate obligations. These are:
‘Core obligations’ are the general obligations under sections 912A and 912B of the Corporations Act and section 47 of the National Credit Act. For a summary of the core obligations, see the appendix to RG 78.
To fall within the scope of the notify, investigate and remediate obligations, the reportable situation must have arisen on or after 1 October 2021.
The term ‘loss or damage’ is not defined in the legislation. In determining whether there is loss or damage to an affected client for the purposes of the notify, investigate and remediate obligations, it is not relevant to consider whether that loss or damage is material.
To trigger the obligations, the loss or damage to an affected client must be a result of the reportable situation, and does not need to be as a result of the personal advice or credit assistance provided: see the Explanatory Memorandum, paragraphs 12.31, 12.109 and 12.110.
An affected client may have a legally enforceable right to recover loss or damage. This right may exist if there is a potential claim that, if pursued by the affected client, may be enforced as a judgment by the court against the licensee: see the Explanatory Memorandum, paragraph 12.32.
There are many circumstances in which an affected client will have a legally enforceable right to recover loss or damage arising from a reportable situation. Examples include a licensee’s or representative’s negligence, dishonest conduct, breach of contract or breach of fiduciary duty, or where a compensation order is available (e.g. under section 1317HA of the Corporations Act).
Importantly, if an affected client does not have a legally enforceable right (e.g. because a negligence claim is barred by expiry of the statutory limitation period), you still need to consider the requirements under the existing remediation framework in deciding whether it is efficient, honest and fair to remediate: see Action 4: Remediate affected clients for the breach in Part B of this information sheet.
The notify, investigate and remediate obligations will apply only if they have been triggered, as set out in Part A: see When are the obligations triggered? This part gives guidance on how to comply with the obligations, including:
Table 1 summarises the actions a licensee must take if the obligations have been triggered.
What you must do
When you must act
Action 1: Notify affected clients of the reportable situation
Take reasonable steps to notify affected clients in writing of the reportable situation
Action 2: Investigate the reportable situation
Start an investigation into the nature and full extent of the reportable situation
Action 3: Notify affected clients of the outcome of the investigation
Take reasonable steps to notify affected clients in writing of the outcome of the investigation
Within 10 days of the investigation concluding
Action 4: Remediate affected clients for the breach
If there is loss or damage and an enforceable right to recover, take reasonable steps to pay affected clients remediation of an amount equal to the loss or damage
Within 30 days of the investigation concluding
These actions may overlap and are not necessarily sequential. For example, you may choose to:
The law allows ASIC to approve a form that licensees must use to notify clients (Actions 1 and 3). While we have not approved a form at this time, we may do so if we become aware of deficiencies in the approach taken by licensees in communicating with affected clients.
You must take reasonable steps to notify the affected client within 30 days after you first know that, or are reckless with respect to whether, the circumstances exist to trigger your obligations: see When are the obligations triggered? in Part A.
The notice to affected clients must be in writing. It should explain:
The types of information we consider are relevant to include in this notice are:
You must start your investigation within 30 days after you first know that, or are reckless with respect to whether, the four circumstances exist to trigger your obligations: see When are the obligations triggered? in Part A.
As part of the investigation, you must identify the conduct that gave rise to the reportable situation.
You must also quantify the loss or damage that you have reasonable grounds to suspect affected clients have:
We expect that your investigation will be thorough, complete and robust, and that you will make whatever inquiries are reasonably necessary to determine the nature and full extent of the breach of the law.
During the investigation you may find reasonable grounds to believe that additional reportable situations have arisen or you may identify additional affected clients. This may trigger obligations to report the additional breach to ASIC, and to notify clients of the reportable situation (Action 1), and to investigate and remediate as required within the relevant timeframes.
Your investigation must be completed as soon as reasonably practicable after it starts. What is a reasonable amount of time for an investigation will depend on the circumstances of the case, including the size of your business, the extent and period of the misconduct, and the nature of the loss or damage caused by the licensee: see the Explanatory Memorandum, paragraph 12.58.
When appropriate, it is prudent for you to keep affected clients informed of the progress of the investigation – for example, with interim updates on the investigation: see the Explanatory Memorandum, paragraph 12.68.
You must also provide notice, in writing, to affected clients of the outcome of the investigation. You must take reasonable steps to provide this notice within 10 days of the investigation concluding.
This notice should:
Your investigation may find that an affected client you notified at Action 1 has not suffered or will not suffer loss or damage that they have a legally enforceable right to recover. If this is the case, you must still notify them of the outcome of the investigation as described above.
In satisfying this obligation, a licensee has qualified privilege and is protected from a defamation action in relation to the information contained in the licensee’s notice about the outcome of the investigation. The licensee is also not liable for any action based on breach of confidence.
You must take reasonable steps to pay affected clients an amount equal to their loss or damage, within 30 days after the investigation is completed.
The remediation applies to all affected clients who, after the investigation, you have reasonable grounds to believe have:
For clients who fall outside the scope of the obligation to remediate, you must continue to consider the requirements of the existing remediation framework in deciding whether it is efficient, honest and fair to remediate.
As stated in paragraph 12.33 of the Explanatory Memorandum: ‘… affected clients may still have rights that they are able to pursue through internal dispute resolution and through [the Australian Financial Complaints Authority]. Licensees should take this into account in determining whether they should extend the breadth of their remediation.’
For affected clients that you remediate, you may consider providing non-monetary remedies alongside the compensation provided. For example:
You must keep sufficient records to demonstrate your compliance with the notify, investigate and remediate obligations.
See RG 256 for further information about record keeping in the context of remediation.
ASIC can take enforcement action against you if you fail to comply with the notify, investigate and remediate obligations. Examples of compliance failures are:
A civil penalty applies for non-compliance with the notify, investigate and remediate obligations. Failure to keep adequate records is a criminal offence. We may also take administrative action if you do not comply with the obligations. These actions could include suspending or cancelling your licence, or imposing additional licence conditions.
Note: For an explanation of how we approach our enforcement role, see Information Sheet 151 ASIC’s approach to enforcement (INFO 151). For information about penalties, including the value of a penalty unit, see Fines and penalties.
For more information on complying with your obligations, see the following guidance:
You can also call ASIC on 1300 300 630 or refer to our Top call centre questions.
Please note that this information sheet is a summary giving you basic information about a particular topic. It does not cover the whole of the relevant law regarding that topic, and it is not a substitute for professional advice. We encourage you to seek your own professional advice to find out how the applicable laws apply to you, as it is your responsibility to determine your obligations.
You should also note that because this information sheet avoids legal language wherever possible, it might include some generalisations about the application of the law. Some provisions of the law referred to have exceptions or important qualifications. In most cases, your particular circumstances must be taken into account when determining how the law applies to you.
Information sheets provide concise guidance on a specific process or compliance issue or an overview of detailed guidance.
This information sheet was updated in December 2023.
What you need to know
