Category: Uncategorized

Every August, the Australian Securities and Investments Commission publishes a corporate plan. On the surface it is a compliance document, required under the Public Governance, Performance and Accountability Act 2013. In practice it is one of the clearest signals a regulated business gets about where the regulator’s attention, and its enforcement resources, are heading over the next four years.
With ASIC’s latest plan hot off the press this month, we thought it was the perfect opportunity to step back and take the long view: to line the newest edition up against those that came before it and see just how much the regulator’s priorities, language and posture have shifted over a decade.
So we pulled three of them off the shelf (2016, 2021 and 2026) and read them side by side. Ten years apart at the bookends, five years between each. What emerges is a changing idea of what ASIC is for, written each time in the language of whichever crisis or inquiry had most recently reshaped the environment. Each plan is very much a product of its moment.

The three moments
It helps to remember what each plan was written into.
The 2016 plan (covering 2016–17 to 2019–20) was Greg Medcraft’s, and it landed less than a decade after the 2008 global financial crisis. The GFC is never far from the surface. The plan opens on the language of trust, confidence and “gatekeepers,” and it reads as a document still processing the lesson that markets can break and that the public’s faith in the financial system is fragile and hard-won.
The 2021 plan (2021–22 to 2024–25) was Joseph Longo’s first as Chair, written roughly eighteen months into COVID-19 and, more importantly for its character, two years after the Hayne Banking Royal Commission handed down its final report in February 2019. The Commission’s findings run right through the document: in its emphasis on misconduct, on the Financial Accountability Regime, on design and distribution obligations, and on ASIC’s re-cast identity as “a strong and targeted law enforcement agency” and “an active litigator.”
The 2026 plan (2026–27 to 2029–30) is Sarah Court’s first, and it reflects a regulator operating in a genuinely new risk landscape (artificial intelligence, cyber and operational resilience, private markets and private credit, digital assets) and one that, after years of rebuilding its enforcement capability, is visibly more confident. Court came to the chair as ASIC’s deputy and a career litigator, having overseen what the government described as some of the agency’s strongest enforcement results on record. That self-assurance shows.

The language: from “trust and confidence” to “harder to avoid”
The most striking shift over ten years is tone.
The 2016 plan is earnest and almost academic. Its central vocabulary is trust, confidence, culture, gatekeepers and behaviour. Medcraft’s message dwells on “human behaviour drivers” such as financial literacy, behavioural biases, incentives and deterrence, and frames ASIC’s role as understanding why people and firms act as they do. There is a diagnostic, social-science quality to it. The recurring promise is to “detect, understand and respond.”
By 2021, the register has hardened. Longo’s message is built around the language of misconduct, disruption, deterrence and enforcement. ASIC “will remain an active litigator against misconduct” and will “use our full suite of tools and powers to address wrongdoing.” Where 2016 wanted to understand behaviour, 2021 wants to identify, disrupt and deter it. This is the vocabulary of a post-Royal-Commission regulator that had been publicly criticised for being too soft.
By 2026, the language shifts again, this time toward balance and confidence. Court’s framing is that ASIC will be “easier to deal with for those trying to comply with the law, while being harder to avoid for those causing harm.” The plan repeatedly insists it does not have to “choose between strong regulation and growth”; it can and must have both. Words like productivity, growth, innovation and resilience now sit alongside enforcement. This is the language of a regulator that no longer feels it has to prove it can bite, and can therefore afford to talk about being a partner to well-behaved business.

Areas of focus: what each plan actually points at
The headline priorities tell their own story.
2016 organised itself around five “long-term challenges”: aligning conduct with trust and confidence; digital disruption and cyber resilience; structural change (led by the growth of superannuation); complexity driven by financial innovation; and globalisation. Notably, cyber is present but framed abstractly, as “digital disruption and cyber resilience,” an emerging theme rather than a live threat.
2021 reorganised around a cleaner set of external strategic priorities: promoting economic recovery (a COVID artefact); reducing consumer harm from poor product governance and scams “in a low-yield environment”; enhancing cyber resilience; and driving industry readiness for the wave of law reform flowing from the Royal Commission, including the Financial Accountability Regime, breach reporting, and design and distribution obligations. The through-line is implementing the Commission’s agenda.
2026 presents five strategic priorities: improving consumer and small business outcomes; strengthening professional conduct and access to reliable information; supporting better retirement and superannuation outcomes; supporting effective, resilient and innovative operations; and driving integrity, transparency and confidence across markets. Underneath sit focus areas that simply did not exist in comparable form a decade earlier: the impact of AI use, digital asset platforms, private credit practices including valuations and liquidity, mandatory climate reporting, and scam prevention and disruption as a first-order concern rather than a footnote.
Two structural moves are worth flagging. The first is that private markets and private credit have arrived as a headline preoccupation. The 2026 plan explicitly targets “changing risks, interconnectedness and supervision across private markets” and the distribution of private credit funds to retail clients. This reflects the migration of risk out of the well-lit public markets and into less transparent alternative investments, and it is arguably the single biggest new area of focus. The second is that AI appears on both sides of the ledger: as a risk ASIC must police (AI-driven market manipulation, deepfakes, unreliable financial information) and as a capability ASIC intends to use itself to regulate more effectively.

The risks identified
Read the risk framing closely and you can date each plan almost to the year.
In 2016 the shadow is the GFC. The plan states plainly that ASIC’s system “is not designed to eliminate market risk, prevent all wrongdoing, or ensure compensation for all investors who lose money,” a sober, almost defensive acknowledgement of the limits of regulation that reads as a direct lesson of 2008. Its economic environment section frets about household debt at record highs (186.9% of disposable income), property oversupply, soft commodity prices and global volatility. The animating concern is systemic fragility and the risk of another confidence-destroying shock.
In 2021 the shadow is the Royal Commission. The identified risks are overwhelmingly about conduct and consumer harm: poor product governance and design, scams, and the risk that firms fail to lift their standards to meet incoming reforms. The plan commits explicitly to working with government “to implement the law reforms responding to the Royal Commission.” Cyber has by now graduated to a standalone strategic priority. The animating concern is that the misconduct the Commission exposed might be allowed to persist.
In 2026 the concern is complexity, technology and interconnection. Its operating-environment analysis is the most sophisticated of the three. It warns that “operational risks are becoming increasingly system wide,” that reliance on shared service providers and platforms allows “disruptions to transmit rapidly across entities and sectors,” and that “uncertainty has become a structural feature” of a fragmented geopolitical and economic order. It names AI as transforming the environment, superannuation assets exceeding $4.5 trillion and consolidating into a handful of giant funds, climate-driven extreme weather pressuring insurance, and private credit as an opaque and growing risk. The animating concern is speed and contagion: in a digitised, interconnected system, harm now spreads faster than the regulator can see it.

How the plan is approached: from framework to focus
The three documents also differ in how they are built.
The 2016 plan is the most conceptual. It is heavy on the strategic architecture, the “detect, understand and respond” model, the “what good looks like” narrative for each sector, and the behavioural theory that underpins it all. It reads as a regulator explaining its philosophy.
The 2021 plan is more of a delivery plan. It splits neatly into external and internal priorities, ties itself tightly to the government’s Statement of Expectations and ASIC’s Statement of Intent, and organises its actions around discrete reform programs. It reads as a regulator executing an agenda largely set for it by others, namely the Commission and the Parliament.
The 2026 plan is the most operational and granular of the three. Under each of five priorities sit specific, named surveillance and enforcement activities: reviews of debt collectors, “disaster chasers,” buy-now-pay-later providers, separately managed accounts, private equity valuation practices, and wholesale broker preparedness for market shocks. It reads less like a philosophy and more like a work program from a regulator that knows exactly which doors it intends to knock on. There is also a new confidence in structure, including a “corporate plan on a page,” explicit budget forward estimates, and a clearer separation of the Chair’s executive authority from the Commission’s strategic role.

The signal from the Chair
If you read only the Chair’s foreword, you would still catch the drift of each decade.
Greg Medcraft (2016) signals a regulator focused on capability-building and understanding. His message is preoccupied with data: a new chief data officer, a data governance council, a behavioural insights team, and the additional government funding that would let ASIC run “more proactive surveillances.” The tone is that of an institution investing in its own intelligence, still finding its feet as a law-enforcement body.
Joseph Longo (2021) signals resolve and rehabilitation. His message is unambiguous that ASIC “will continue to be a strong and targeted law enforcement agency” and “an active litigator.” It is the voice of a Chair repositioning a regulator that had been found wanting, determined to demonstrate teeth while managing a heavy reform-implementation load.
Sarah Court (2026) signals confidence and balance. Her message leads not with enforcement but with productivity, growth and responsible innovation, and with the observation that “how we regulate is as important as what we regulate.” The enforcement posture is now taken as read; it is the settled foundation from which she can talk about being easier to deal with for the compliant. Given her own background as a litigator who spent five years rebuilding ASIC’s enforcement capability, this is a Chair speaking from strength rather than reaching for it, a regulator emboldened by a run of success in the courts and comfortable enough to lead with the carrot because everyone now knows about the stick.
A few other comparisons worth noting
Superannuation has moved from the wings to centre stage. In 2016 it was cited mainly as a driver of “structural change.” By 2026 it commands an entire strategic priority of its own, with $4.5 trillion in assets, an ageing population and 2.5 million Australians heading into retirement over the coming decade, plus a sharp new focus on high-risk lead generation and superannuation-switching misconduct.
Cyber’s promotion captures the decade in miniature. It appears in 2016 as one half of an abstract “digital disruption and cyber resilience” challenge, becomes a standalone strategic priority in 2021, and by 2026 is embedded across the plan. ASIC even commits to its own “multi-year cyber resilience program,” acknowledging that the regulator itself is a target.
The framing of business has also shifted. The 2016 and 2021 plans largely treat industry as a population to be surveilled and, where necessary, disciplined. The 2026 plan, without abandoning that stance, adds an explicit productivity-and-growth mandate handed down in a new Statement of Expectations, reflecting a broader political shift toward reducing regulatory burden. That tension, between protecting consumers and unlocking investment, is now stated openly as the central balance ASIC must strike.
And the regulator is simply bigger. ASIC’s total budgeted resources for 2026–27 sit near $688 million, up 7% year on year, with most costs recovered from industry under the industry funding model, a mechanism that barely featured in the 2016 framing. It is better funded and more explicitly resourced against named priorities than it was a decade ago.
What it means for regulated businesses
Read together, the three plans trace an arc. A regulator that in 2016 was still building the capability to understand, that by 2021 had been pushed to enforce, and that by 2026 is enforcing with confidence while being asked to enable growth.
For anyone operating in financial services, markets or consumer credit, the practical takeaways from the 2026 plan are clear. ASIC’s gaze has moved decisively toward private markets, private credit and alternative investments, toward the safe adoption of AI, toward operational and cyber resilience as systemic issues, and toward the protection of superannuation and retirement savings. It arrives at those targets as a regulator that no longer needs to prove it will litigate, because it already has.
The corporate plan has always been a signalling document. Ten years on, the signal is being sent by a more confident, better-resourced and more sharply targeted regulator than the one that wrote the 2016 edition in the aftermath of the financial crisis. Businesses that treat the plan as advance notice, rather than an annual formality, will be the ones best placed for the four years ahead.

PX Partners helps organisations interpret and respond to the regulatory environment. This article is general commentary based on ASIC’s published corporate plans and is not legal or compliance advice.

Almost five years on from the commencement of the Design and Distribution Obligations (DDO) in October 2021, the expectations around how Fund Issuers oversee their distributors have moved on considerably. ASIC’s work – including Report 795 on compliance with the reasonable steps obligation – has made clear that oversight of distribution is not a box-ticking exercise completed once and filed away. It is an ongoing, holistic discipline.

And yet, in trying to get it perfect, some Issuers risk doing very little. The reasonable steps obligation in s994E of the Corporations Act does not demand a flawless, exhaustive audit of every distributor. It demands reasonable steps – proportionate to the product, the target market and the degree of harm that could result if distribution goes wrong. The trap is treating due diligence as an all-or-nothing project. Waiting until you can build the perfect programme too often means the real, practical steps that would actually improve outcomes never get taken.
So what does “good” look like today? Across the Issuers who are aligning well to regulatory expectations, four themes stand out.

1. Connecting the dots across your distribution data
Distribution oversight has too often been run in silos: complaints sit with one team, significant dealing reports with another, and distributor due diligence somewhere else again. Issuers who are getting this right are joining those data points together. A cluster of complaints about a particular distributor, an unexpected significant dealing notification, and a due diligence response that glosses over sales practices are far more meaningful read together than in isolation. Reasonable steps are best understood as a holistic assessment of an entity’s full framework of controls – not a series of disconnected activities – and that same logic applies to the data an Issuer already holds.

2. A dynamic and responsive approach – not just the annual cycle
An annual due diligence questionnaire remains a sensible backbone, but it should not be the whole story. ASIC’s observations point squarely at the limitations of a static, once-a-year snapshot: circumstances change, regulatory action and corporate activity create an additional layer. Leading Issuers supplement the annual cycle with responsive, event-driven review – asking follow-up questions when a response is generic or incomplete, revisiting a distributor when complaints or dealing data suggest something has shifted, and refreshing their view when a product or its TMD is updated. This is precisely the kind of iterative, follow-up behaviour ASIC highlighted as better practice in Report 795.

3. A risk-based approach, viewed through a customer lens
Reasonable steps are, by definition, proportionate. That means devoting the most effort to the areas of highest risk – higher-risk products, narrower target markets, less mature channels – rather than spreading a thin, uniform layer of scrutiny across everyone. The most effective Issuers calibrate their attention to where the potential for consumer harm is greatest, and they frame the question through a customer lens: how does the distributor align practices with expectation of the Fund Issuer in seeking to limit distribution to the target market.

4. Leveraging systems and data for efficiency – for both sides
Finally, the Issuers making real progress are using technology to make oversight efficient for everyone involved. Chasing responses by email, version-controlling Word documents and hunting through drives and inboxes for missing answers is not just painful – it actively works against good oversight, because effort is consumed by administration rather than analysis. A well-designed system reduces the burden on distributors (who answer once) and on Issuers (who review in one place), freeing both to focus on what actually matters: understanding the distribution and evidencing the reasonable steps taken.

Where Know Your Distributor (KYD) fits
This is exactly the problem Know Your Distributor (KYD) was built to solve. KYD is a complete solution that takes the pain out of distributor due diligence for Australian Fund Issuers and Distributors. It gives product issuers a secure, efficient and meaningful way to monitor the distributors of their fund products – and, critically, to evidence the reasonable steps expected under their Design and Distribution Obligations.
KYD is owned and supported by PX Partners, whose practitioners bring real-world experience of the DDO. The solution is powered by Carne Group technology – a platform that exists and is in use today, deployed in over 75 countries, used to monitor more than 2,000 distributors globally, and relied upon by clients who collectively manage over $1 trillion in assets. It is ISO 27001 certified, hosted on AWS with leading cyber-security. The KYD DDQ is the Australian questionnaire is designed by Australian practitioners with input from a range of Australian Fund Issuers and Distributors.

A questionnaire built for deeper review – beyond the FSC baseline
The KYD due diligence questionnaire is aligned to the Financial Services Council (FSC) standard DDQ, so it covers the industry baseline Issuers already recognise. On top of that, it includes additional KYD-developed sections that allow for a broader and deeper review, with consistent, closed-form questions that make answering easier while capturing more detail for meaningful analysis. Coverage spans:
• company information and ownership
• regulatory status
• product governance arrangements
• distribution and sales practices
• governance, risk, compliance and assurance
• training
• business continuity, and
• a dedicated financial crime section – which has taken on heightened importance following the significant changes to Australia’s AML/CTF regime that commenced on 31 March 2026, moving compliance toward a more risk-based, outcome-focused model.
In other words, KYD gives Issuers a richer, more structured evidence base than the industry-standard DDQ alone – the kind of information that lets you connect the dots described above, rather than simply file another completed form.

How it works
KYD centres on a dynamic, industry-aligned questionnaire built specifically for the Australian market, and runs the whole process end to end through one system. The KYD team arranges for your distributors to complete the in-system questionnaire; distributors answer once and control which product Issuers can view their responses. Issuers then review those responses in a single central record – seeking clarification, uploading supporting information, recording assessments and tracking completion in one place. KYD performs the follow-up of questionnaire responses, leaving you free to focus on the commercial relationship and your own assessment.
The efficiency dividend is substantial: based on analysis undertaken by clients of the underlying Carne technology, the KYD solution could save over 80% in person-days compared to running the same activity manually.

Independent review service by PX Partners
For Issuers seeking greater assurance, KYD offers an optional independent review delivered by the risk and compliance specialists at PX Partners, who have extensive experience with the DDO and broader regulatory compliance. The review pre-vets distributor responses before they reach you, enabling your teams to focus on the highest-risk areas. As part of that service, PX Partners:
• verifies corporate and licensing information against ASIC records, AFSL authorisations and appointed auditors;
• reviews complaints handling by assessing website information and confirming AFCA membership;
• performs financial crime screening, including PEP, sanctions and adverse media checks on the distributor and its directors; and
• benchmarks each distributor against peers to provide comparative insights.
The output is a board-ready report containing DDQ assessment results, RAG-rated findings, executive summaries, key exceptions and practical commentary – exactly what governance forums need to make informed oversight decisions, and to evidence that reasonable steps were taken.

The bottom line
The reasonable steps obligation was never about achieving a theoretical ideal. It was about putting adequate systems, policies and practices in place to address the risks of distribution going astray – and being able to show it. Issuers who connect their data, stay responsive between annual cycles, focus effort where consumer risk is greatest, and lean on systems to do the heavy lifting are meeting that expectation today.
Don’t let perfection be the enemy of reasonable steps. Take the practical ones – and let KYD make them efficient.
To find out how KYD can support your distributor oversight, visit knowyourdistributor.com.au or contact the team at PX Partners.

Artificial Intelligence (AI) has rapidly evolved from experimental use cases such as document summarisation and basic automation to being embedded across critical processes within Australian financial services via agents and automation of key activities and tasks. On the cybersecurity front, frontier AI models have accelerated the risk of external threat vectors with actors now better equipped to target organisations. In April 2026, APRA issued an open letter to regulated entities following targeted engagement with banks, insurers, and superannuation trustees. The findings across entities were consistent and illustrated that AI adoption was progressing at pace while change management controls, information security and governance frameworks were struggling to keep up.

At a Board level, APRA observed strong interest in AI’s strategic and commercial potential, particularly in driving productivity, efficiency, and customer experience. However, Boards were not consistently able to demonstrate the technical literacy required to effectively challenge and oversee AI-related risks. APRA specifically noted an overreliance on vendor presentations and high-level summaries, without sufficient independent scrutiny of underlying risks of AI adoption and the specific impacts to customers and organisations.

In May 2026, ASIC reinforced this message through its own open letter to Australian Financial Services (AFS) licensees, calling for urgent uplift in cyber resilience. ASIC highlighted that frontier AI models are significantly accelerating the capability and accessibility of sophisticated cyber-attacks, allowing vulnerabilities to be identified and exploited at unprecedented speed and scale. ASIC’s message to industry was unambiguous: entities should not wait for further sophisticated AI developments before addressing their cyber resilience fundamentals and should act now with urgency, focus and accountability. Though an external lens to consider, it highlights that AI adoption is here now and the rapid pace of change and adoption represents significant risks to not only organisations but ultimately the end customers.

Both APRA and ASIC have shifted scrutiny towards Boards and senior executives, reinforcing that AI governance is not solely a technology responsibility, but a broader governance and risk management issue. This regulatory posture puts risk management back at the heart of AI adoption – CROs now need to consider what risk this change poses and how to manage it.

AI Adoption and Acceleration of Threat Vectors

This regulatory focus is underpinned by two related dynamics: the risk organisations and their service providers take on through adoption of AI and the acceleration of threat vectors that AI now enables.

One area of challenge facing organisations is that AI adoption risk is no longer confined to formally approved AI transformation programs or initiatives. Increasingly, AI capabilities are being embedded into everyday business tools, SaaS platforms and third-party solutions, often without the explicit label of “AI”. Each point of adoption can shift an organisations risk tolerances and resilience settings. The question for entities is whether this drift is being appropriately captured in governance and risk processes and factored into resilience assessments, rather than only becoming visible once something goes wrong.

At the same time, frontier AI is lowering the skill and cost required to identify and exploit vulnerabilities and is also creating new avenues for attack that traditional security controls were not designed to detect. A growing area of concern is the emergence of indirect prompt injection attacks, often referred to as “poison pill” or “thread needle” attacks where malicious instructions are hidden inside content that an AI agent later processes. An AI agent with legitimate access to enterprise systems can be manipulated through publicly accessible content that it is instructed to analyse, summarise or act upon. No traditional intrusion may occur, yet the outcome can still compromise data integrity, confidentiality or operational controls. As organisations increasingly deploy AI agents across business functions, the threat environment evolves and the scope of cyber security must expand with it. Understanding where AI agents are operating, what systems they can access and how they can be influenced by external content is rapidly becoming a core component of cyber resilience.

These impacts are compounded by service providers and third-party vendors, many of whom are embedding AI capabilities into their products and service. AI-related risks can be inherited through the supply chain with limited visibility over how these capabilities operate and are governed. Importantly AI-related risks rarely sit within a single risk category. Vulnerabilities can quickly cascade into broader risks such as privacy, conduct and operational resilience and reinforces AI as across-cutting risk theme as opposed to a standalone item on a risk register.

Integrating AI Into Existing Frameworks

Australia’s principles-based regulatory approach means that existing frameworks remain relevant and the focus for entities is on integrating AI into their existing governance structures and risk management frameworks. At the same time, organisations can also draw on global reference frameworks, such as the EU AI Act, ISO 42001, and the NIST AI Risk Management Framework to inform areas such as risk classification, monitoring, and assurance. This combined approach anchors governance in domestic regulatory requirements while leveraging international standards to fill capability and maturity gaps.

CPS230 Implications

For APRA-regulated entities and service providers across the value chain, CPS 230 (Operational Risk Management) provides a clear pathway for embedding AI governance. Although not explicitly AI-focused, it applies to all critical business processes and by extension, captures AI to the extent it is embedded into these processes.

• Operational Risk Management: – Entities must identify and assess AI-specific risks prior to deployment, including model error, data bias, and disruption states that may not be immediately visible.
• Critical Operations – AI systems supporting critical operations require enhanced governance, including defined disruption tolerances, recovery objectives, and tested fallback arrangements. Additionally, considerations on how AI impacts resiliency and service continuity
• Material Service Providers – Most AI vendors will meet the materiality threshold under CPS 230, requiring formal agreements, ongoing monitoring, and clearly defined exit strategies.
• Business Continuity – AI failure scenarios must be incorporated into business continuity plans and tested regularly.

Regulatory Expectations for Uplift

APRA’s open letter to industry clearly articulates regulator expectations and next steps for entities. ASIC’s subsequent communication reinforces and cross-references APRA’s position, signalling that these expectations apply broadly across regulated financial services organisations.

Taken together, the following represent the minimum expectations communicated by regulators:

• Establish an AI governance framework – AI governance should be embedded into the enterprise-wide Risk Management Framework with policies, standards and accountability structures established, including clear ownership across the AI lifecycle. This includes maintaining a live inventory of AI tools and use cases with defined ownership across the full lifecycle.
• Upgrade third-party and supplier risk management – Map the full AI supply chain including fourth-party dependencies and review AI vendor contracts to include appropriate controls such as audit rights, notification of model updates, incident reporting and exit provisions where necessary.
• Concentration risk – SNOW and MSPs are increasingly reliant on a small pool of frontier AI models, warranting explicit third-party risk assessments in the same way concentration in cloud infrastructure providers is managed.
• Update cyber resilience controls – Review and validate core security controls against AI-accelerated threat scenarios. This includes strengthening identity and access management for non-human actors, patching cadences, penetration testing and incident response plans. Cyber resilience controls must be demonstrably working and not just documented.
• Implement integrated & continuous assurance – Entities should establish effective assurance mechanisms across cyber security, data governance, model performance risk, operational resilience, privacy, and conduct risks. Second line and internal audit functions must have sufficient capability and tooling to independently assess AI systems, with risk and security assessments conducted pre-deployment and on a continuous basis.
• Ensure board-level oversight is substantive – Boards should receive clear, evidence-based reporting on AI and cyber risk, including control effectiveness, testing outcomes, and incidents, supported by defined escalation triggers. Oversight should enable informed challenge rather than high-level summaries of AI tools in use.
• Uplift Board and Executive AI capabilities – Implement targeted training programs on AI risk, controls and regulatory expectations, ensuring Boards have sufficient AI literacy to effectively challenge and direct the business.

The Path Forward

Looking ahead, regulatory scrutiny is expected to increase. APRA has indicated further supervisory focus on AI-enhanced risk, while broader regulatory developments such as the Privacy Act reforms coming into effect December 2026 will introduce additional requirements relating to automated decision-making transparency.

Organisations that proactively embed AI within their governance, risk, and resilience frameworks will be better positioned to meet these expectations and demonstrate effective oversight in an increasingly complex risk environment.

APRA has sharpened its expectations on investment governance and, over the past year, begun backing them with enforcement. The standards apply with equal force whether a Trustee outsources investment management, runs it in-house, or operates a hybrid. Our concern, drawn from years leading risk functions inside investment managers, is a quieter one that the enforcement headlines have yet to reach: as more funds have brought investment management in-house, has the risk and compliance capability meant to support it kept pace?

Over the past decade a growing number of superannuation funds have internalised investment management. The stock pickers, deal teams and portfolio management capability now sit inside the Trustee, and that investment capability is usually well built out. The second and third lines have often had less time and investment to scale alongside it. Independent oversight and challenge of the investment function is demanding work, and the risk and compliance capability to match a maturing in- house investment team takes time to build.

There is a good reason attention has sat elsewhere. In superannuation, the functions closest to the member naturally command the most focus. Complaints, death and disability claims, member disclosures, and the core business of accepting contributions and paying benefits are visible, time- critical and emotionally significant. It is understandable that risk and compliance effort has concentrated there. Investment governance, by contrast, can feel remote from the member, until a valuation dispute, a unit pricing error or a poorly monitored option makes it very close indeed.

This article sets out why the same rigour Trustees expect of their outsourced managers should be turned inward, and what recent regulatory activity tells us about the cost of leaving that gap open.

The standards converging on investment governance

Investment governance in superannuation rests first on SPS 530 Investment Governance, which has applied in its strengthened form since 1 January 2023. Under SPS 530 a Trustee must prudently select, manage and monitor investments, and maintain an investment governance framework appropriate to the size, business mix and complexity of its operations, with the board ultimately responsible. The strengthened standard sharpened expectations on valuation governance, liquidity management and stress testing, the same areas APRA and ASIC have found wanting in its review of unlisted asset valuations.

SPS 530 does not operate alone. SPS 515 Strategic Planning and Member Outcomes ties investment decisions back to the outcomes members receive. From 1 July 2025, CPS 230 Operational Risk Management added a resilience layer. It treats investment management as a critical operation or material service whether the function is outsourced, internalised, or a combination of both, and it raises the bar on how Trustees identify and oversee the service providers they depend on, including the fourth parties sitting behind their direct providers. Since early 2025, the Financial Accountability Regime has placed named, personal accountability on Trustees, their directors and senior executives. Accountability, in APRA’s words, cannot be outsourced.

Taken together, these requirements ask Trustees to govern the substance of investment decisions, connect them to member outcomes, make the function operationally resilient, and stand behind it personally. The distinction APRA is now testing is not whether a function was competently procured, but whether it is competently governed on an ongoing basis. That answer must hold wherever the function sits, and for many Trustees it is easier to give for what they outsourced than for what they built themselves.

The gap that has opened up in-house

A common assumption is that internalisation reduces governance risk, because the Trustee now controls the function directly. We are curious at to whether that consistently holds true. An outsourced relationship sits inside a contracted framework: there are service levels, defined reporting, due diligence rights, and a counterparty that is itself regulated. When a fund brings investment management in-house, that external scaffolding falls away, and it is not always replaced with an equivalent internal control environment.

Internal investment teams typically grow out of a small initial footprint and scale quickly alongside funds under management. The second and third lines often do not grow at the same rate. Risk and compliance coverage of the investment function often lags the front office in both capability and resourcing. Many Trustees lack a dedicated second line with the technical depth to challenge portfolio managers on execution quality, counterparty selection, mandate adherence and the conflicts specific to managing money in-house. Valuation governance for unlisted assets is particularly sensitive, since the investment team whose performance is judged on those assets often has the deepest knowledge of them and, without clear separation, can end up influencing how they are valued.

It is worth asking whether the internalisation of investment management was matched by a corresponding uplift in the risk and control functions that oversee it, and whether the same standard of due diligence, monitoring, control assurance and conflicts management a Trustee expects of an external manager would hold if applied to the internal team. For many funds, that is still developing. The opportunity is to bring the internal control environment up to the standard already expected of outsourced investment management.

Having led risk and compliance functions inside investment managers, the PX Partners team has seen this from the inside. We know how quickly an internal capability can outgrow the controls around it, and how easily independent oversight becomes an afterthought when the investment team is delivering.
The point is not that in-house management is wrong. It is that it carries obligations Trustees cannot meet by governing the internal team more lightly than they would an external one.

One lens, wherever the function sits

CPS 230 and SPS 530 apply the same test regardless of the operating model. CPS 230 asks the operational questions: can you identify the critical operation, understand its dependencies and the
providers behind it, set tolerances for disruption, monitor against them, and respond when something fails? SPS 530 asks the substantive ones: can you evidence that investments were prudently selected and are being properly monitored and valued? Neither standard cares whether the function is run by a third party or by a team down the corridor. The Trustee owes the same answer either way.

Where Trustees run more than one model, there is an additional layer to manage. Hybrid arrangements, with some asset classes managed internally and others left with external managers, create a coordination point between the two that benefits from clear ownership. It is worth checking that the standard applied to external managers also informs the internal approach, and that member facing impacts have a clear owner rather than sitting between functions.

Where the gaps typically appear

• For outsourced functions, the recurring weakness is what happens after onboarding. Initial due diligence tends to be thorough. Ongoing oversight then narrows to performance reporting, an annual due diligence questionnaire and the occasional site visit. Operational risk indicators, control attestations, visibility into sub-custodians and sub-advisers, business continuity testing and exit planning are often underdone. CPS 230 has raised the bar here, extending the
  expected depth of oversight beyond the direct provider to the fourth parties they in turn rely on.
• For internalised functions, the gaps are structural. A common gap is second-line depth: the specialist skills needed to challenge the front office on investment risk take time and investment to build. Compliance coverage of trade execution, mandate adherence and conflicts of interest is often still maturing. Valuation governance for unlisted assets warrants particular attention.
• For hybrid models, the risks of both combine.

What APRA has signalled

APRA has put its focus on investment governance beyond doubt. On 7 October 2025 it wrote to platform Trustees, following a thematic review covering Trustees responsible for around 95 per cent of platform assets, calling for stronger action on investment governance (the accompanying letter is available here). Two of its findings travel well beyond platforms. First, a Trustee’s core duties are the same irrespective of its business model. Second, accountability for deciding what belongs on the menu, and for the outcomes members experience, stays with the Trustee no matter how many parties sit in between.

APRA has since acted on those findings. On 17 December 2025 it accepted a court-enforceable undertaking from Netwealth Superannuation Services over the depth of due diligence and monitoring applied to onboarded options and the management of related-party conflicts, and imposed additional licence conditions on Equity Trustees Superannuation the following day. It has since taken action against further platform Trustees, including HTFS Nominees, the Trustee of the HUB24 Super Fund, in May 2026. The detail cuts against a comfortable assumption, that outsourcing investment management reduces the governance burden. It does not. The same logic runs in the other direction: bringing the function in-house does not reduce it either. APRA&’s Deputy Chair has said the platform segment will remain a supervisory priority throughout 2026, and the events sitting behind these actions, including the First Guardian and Shield collapses, have produced member losses and compensation running into the hundreds of millions. The stakes of weak investment governance are no longer hypothetical.

What separates mature Trustees

Across our engagements with Trustees running internalised, outsourced and hybrid models, three themes consistently separate mature investment governance from the rest.

1. Govern the function, not the form. Internal investment teams should be held to the same standard as external managers: documented mandates through investment policies, performance and risk monitoring, control assurance, conflicts management and contingency planning. The test is simple. If you would expect an external manager to produce it, your internal team should produce it too.
2. Build the second and third line to match the first. Investment risk and compliance need real technical depth. Investment risk management keeps strategies running true to label, but the area that most often needs attention is the expertise to review and challenge front office controls, such as execution quality and counterparty selection, and to understand the conflicts unique to managing money in-house. For Trustees with internalised capability, this is often where the greatest investment is required.
3. Anchor everything in member impact. Investment governance is not a back-office discipline. Unit pricing errors, delayed switches, valuation disputes and performance issues flow downstream from investment management to the very member-facing activities that already command a Trustee’s attention. Tolerances under CPS 230, and objectives under SPS 530, should be set against member outcomes, not internal service levels alone.

Why Trustees should act now

APRA’s focus has shifted from documentation to demonstration, and the events of late 2025 show what that shift looks like in practice. The question is no longer whether the material service provider register is current. It is whether the tolerances, controls and oversight hold when tested, and whether the Trustee can show it, for the functions it runs as much as the ones it buys.

This cannot be retrofitted on a supervisory timetable. Building second and third line technical depth takes time. Setting tolerances and objectives that connect to member outcomes, and testing them under stress, takes longer still. Trustees who start now will have something defensible by the time it is tested. Those who wait will be assessed against what their peers have already done.

In our experience, the Trustees getting ahead of this are interrogating their in-house investment governance against SPS 530 and CPS 230, testing whether they can evidence the same rigour internally as they expect of their external managers. Having sat on both sides of that question, inside investment managers and now advising Trustees, we think it is the right one to be asking.

Consistent with practices overseas, the trend of regulators leveraging the industry’s interconnectedness to enable more effective surveillance and oversight has come to Australia. While in some ways this is a positive development for consumers as it could lead to an uplift in standards of conduct across the board, it means a higher compliance burden on issuers and distributors of financial products. 

Background

The financial system plays a key role in supporting broader economic activity in Australia, so it is a system which is of huge value to the community at large. Given this cornerstone role in our society, it is critical that the system operates in a way that meets community expectations. If you deposit your cash into a bank, you should have a high degree of confidence that your cash will be available to you to withdraw in the future. If you invest in a pension scheme, you should have confidence that your funds will not be dissipated by virtue of fraud or theft. Although the latter will be exposed to the normal risks of investing.

The historical approach taken by governments and Regulators to ensure the soundness of the financial system has been threefold:

1. Impose obligations on firms to do certain things or abide by principles set down by legislation or regulation;
2. Subject firms to regular oversight by independent auditors and impose reporting obligations on these auditors; and
3. Hold Boards (and therefore Directors) accountable. And more recently, senior management, under the new accountability regimes.

For the most part, this system of obligations, checks and accountability has been successful in its objective. However, our system is framed to be ‘light touch’. Regulations are mostly principle based, Boards cannot be across all the details of all the firm’s operations, and auditors apply sample testing and various materiality thresholds when reviewing financial statements for accuracy. 

In the last few years, we have observed a new regulatory trend which looks to supplement the traditional approach – the increasing role that clients and counterparties are being asked to play in monitoring conduct and compliance of industry players. In this article, we look at what this means in practice and the important role that RegTech plays in supporting these new obligations. 

Investment Management oversight

Probably the most established and long-standing model is one of institutional clients (pension funds, insurers, etc) performing due diligence on those who manage their funds. The robustness of this framework is reflective of the level of risk posed and some high profile collapses through the years. 

During the 1980’s and 1990’s a focus on performance returns drove a large majority of investors. This attitude changed following the global financial crisis and due diligence increasingly came to the fore as proactive risk management.

In Australia, APRA’s set out its expectations of pension providers in relation to oversight of investment management companies in 2014. And in response, the two industry bodies—the Australian Institute of Superannuation Trustees (AIST), which represents Responsible Superannuation Entities (RSEs), and the Financial Services Council (FSC), which represents fund managers and RSEs in retail superannuation — formalised the approach for operational due diligence which governs oversight arrangements today. 

The model is very well established in Australia and a number of providers supply due diligence services to institutional clients in addition to larger asset owners conducting their own reviews. This has led to a lifting of the bar across the investment management industry with Investment Managers having to meet a number of minimum standards in order to be able to access these institutional mandates.

Breach reporting – dobbing in

The new breach reporting regime introduced in October 2022, introduces an obligation on a licensee to report to ASIC if there are reasonable grounds to believe a ‘reportable situation’ has arisen in relation to a mortgage broker, or individuals who provide personal advice to retail clients in relation to certain financial products.

ASIC has clarified that it does not expect licensees to take proactive steps to investigate potential reportable situations involving other licensees that it deals with in the course of its business. Rather, they are now to be obliged not to turn a blind eye to any facts that come before them through their usual practices or processes that would give them reasonable grounds to conclude that a reportable situation has arisen for another licensee.

This new obligation creates an informal oversight arrangement between issuers and distributors of certain financial products within the chain of financial services.

DDO distributor oversight

With the introduction of the new Design and Distribution (DDO) obligations in October 2021, ASIC has been clear that appropriate arrangements (governance, systems, controls) must be in place to ensure product design and distribution leads to sound consumer outcomes. ASIC has also been clear that the selection and monitoring of distributors forms part of a product issuers reasonable steps obligations. In RG274 ASIC provides that:

“[w]e will consider the steps that an issuer has taken in conducting due diligence in the selection of distribution channels, methods and distributors. Reasonable steps will generally include making an assessment of the capacity of the distributor to comply with the distribution conditions imposed and meet its own obligations as a distributor. We consider that relevant factors would include an assessment of the distributor’s resources, internal controls, past conduct, experience with the target market and competence to distribute the financial product to the target market.”

A useful starting point for product issuers is to consider what processes, systems and controls it would have in place if it were to distribute its products directly to retail clients to ensure the products are sold as intended and in line with the Target Market Determination. This could include controls and processes in relation to product, sales and compliance training, scripts / conversation guides, setting of key performance indicators and appropriate use of incentives. Global firms can also learn from their overseas counterparts who may have implemented KYD and distributor oversight programs for the rollout of MiFID II in Europe or the SFC’s product governance requirements in Hong Kong.

In some segments of the industry, this will be a paradigm shift especially where the product issuer / distributor relationship is one where distributors are seen less as business partners and more as valued clients. In these segments there may be a tension as product issuers look to achieve their reasonable steps obligations without ‘troubling’ distributors. PX Partners is supporting issuers and distributors with the KYD solution for distributor monitoring to take the pain out of the process and reduce costs for all. 

Customer due diligence reliance

Changes introduced by AUSTRAC in June 2021 have created new obligations on Reporting Entities where reliance is placed on customer due diligence (CDD) conducted by a third party. These arrangements can often reduce compliance costs and provide a better customer experience so that CDD is not duplicated or repeated by multiple businesses. 

However, Reporting Entities must manage the risks and regularly assess the arrangement. Entering a CDD arrangement can allow Reporting Entities to take advantage of customer identification and verification performed by a reliable third party on an ongoing basis. These arrangements also provide ‘safe harbour’ from liability for isolated breaches of the customer identification procedures – provided that due diligence has been completed and that the third party’s processes and procedures to be adequate. Reliance can be placed without a CDD arrangement on a case-by-case basis. In these circumstances, the Reporting Entity is liable for any breaches of customer identification procedures when a designated service is provided to a customer. 

The Reporting Entity must ensure the third party has appropriate measures in place to comply with their obligations:

• It must be a reliable third party (as defined).
• CDD arrangements must be recorded in writing with approval from a senior managing official or governing board. 
• The CDD arrangement must include an outline of the responsibilities of each of the parties to the arrangement and provisions to enable the relying reporting entity to obtain all required KYC information relating to the identity and verification details on request.
• Assess CDD arrangements regularly, at least every two years.

When managing risk under a CDD arrangement, it is important to remember that the ML/TF risk assessment of the third party may be different to your own so that the procedures applied by the third party must reflect the risk assessment of the Reporting Entity who is placing reliance. 

Source: AUSTRAC

So what does this mean for me?

• Like it or it not, there is a regulatory trend toward devolved oversight obligations being formally imposed on participants within the chain of financial services. This means that firms will have to establish oversight processes and controls to discharge these new obligations.
• Get ready for more difficult conversations with your Distribution network as the relationship is shifting away from the traditional issuer–distributor sales & relationship focus to one with an oversight and feedback loop.
• Firms should leverage and adapt existing oversight structures and resources which already exist to manage additional compliance without a substantial increase in costs.
• Regulatory technology (RegTech) solutions should be deployed by firms which can assist with efficiency and effectiveness in addition to reducing the associated resourcing costs.

jon@staging.px.partners is passionate about supporting clients with designing fit for purpose oversight arrangements that work. Reach out to learn more about how PX Partners can help. 

On the 6 month anniversary of the introduction of RG274, Design and Distribution Obligations, Jon O’Keeffe hosted a panel of industry experts as they explored:

• What went well in the implementation journey and lessons learned
• Progress on Day 2 deliverables
• The European perspective: 4 years of MiFID II
• The role of RegTech and automation in supporting compliance

Australian Anti-Money Laundering Rules require an Independent Review of the reporting entity’s AML/CTF Part A Program on a regular basis, which in practice is every one to three years depending on the risk profile of the business. Whether you’re new to AML Independent Reviews or it’s been a while since the last one, this article looks to provide you with insights on some of the key components of a Part A Program Independent Review so that you can anticipate and prepare for what is hopefully a quick and painless review.   

Like all reviews / audits / investigations, AML Independent Reviews (Reviews) require key business resources to dedicate precious time to the Review by providing information and responding to sometimes multiple rounds of queries. And while we get excited combing through the details and finding ways to help clients improve their Programs, we recognise that a fast, insightful and efficient Review is much appreciated by compliance officers, Board and senior management.

Below are a few of the key areas the reviewer will assess, and how you can prepare.

1. Risk Assessment

The most important artefact other than the Program itself, is the reporting entity’s ML/TF risk assessment. The reviewer will look at the Program to understand how the entity assesses its ML/TF risk as this will drive their assessment of whether the Program has been designed appropriately given the ML/TF risk exposure of the reporting entity.

The Rules are relatively prescriptive on which factors the entity needs to consider when assessing risk – this includes customer types, types of designated services, foreign jurisdictions, etc. And most-often, these factors are considered and rated individually to inform the overall risk position. AUSTRAC expects that the reporting entity includes all available data in the assessing risk (e.g. trends in usage of a product or channel, transaction monitoring results, suspicious matter raised, relevant AUSTRAC industry assessments).

The reviewer will be verifying that all the factors have been considered and assess the appropriateness of the rating methodology and outcomes.

The reviewer will also consider how the assessment is documented and how often it is updated. Given that the risk assessment is intended to be a living document, the expectation is that it is contained in an easily updatable format (i.e. not solely in the Program documentation) and that it is revisited frequently or when there is significant change in the business. AUSTRAC has provided guidance on its expectations of ML/TF risk assessments.

2. Board Approval of Program

The reviewer will want to see the current version of the Part A Program, as well as any version of the Part A Program that was in place during the review period which is normally 12 months. Therefore, it can be useful to agree a review period where only one version of a Part A Program has been in effect. The reviewer will also ask to see your AML/CTF Policy.

The reviewer will be looking for evidence that the Program was approved by senior management or the Board, usually in the form of Board meeting minutes noting that the Program was approved. They’ll also want to see other supporting policies (e.g. HR policies covering employee screening and on-boarding, risk-rating methodologies) and any standalone process documents or desktop procedures which provide detailed descriptions of processes like transaction monitoring and suspicious matter reporting.

3. Training Content and Delivery

The reviewer will be considering training from a few different angles. Firstly, has the reporting entity considered what levels of training should be provided to which staff (based on their roles and the ML/TF risk arising)? Have all employees completed the AML/CTF training required for their role? Is completion monitored? A training register spreadsheet, or system report showing training completed should be sufficient to demonstrate completion.

The content of the training will also be reviewed. The Rules are prescriptive on what needs to be included (obligations under the Act, consequences of non-compliance, entity-specific risks and consequence and AML related processes and procedures) so the reviewer will want a copy of the training materials provided to verify that the content meets the requirements. In our experience, reporting entities tend to receive findings related to the lack of entity-specific training content.

While there is a plethora of general and generic AML/CTF training available, AUSTRAC expects that employees be trained on how ML/TF risks might present themselves specifically in the organisation they work for, and roles they work in. Risks faced by a fund manager may be greatly different than those face by frontline staff at a large bank. And while some general content is fine, the expectation is that training is tailored to the organisation and to specific roles.

Finally, the frequency of training and training refreshers will be considered. Standard practice is that AML/CTF training should be included in induction training for all employees, and potentially increased or more in-depth training for higher risk-rated roles. An annual re-fresher training for higher risk-rated roles is better practice with all employees having a refresher training at a regular frequency (e.g. every 2 years). Programs should specify the frequency of training so that the reporting entity can clearly demonstrate compliance. Avoid using words like “regular” as this is open to interpretation.

4. Suspicious Matter Reporting

The Act is relatively clear on what matters to report and the timeframes to do so. The reviewer will look to see that these details are outlined in the Program. The reviewer will assess the design of the process which should clearly detail the steps for raising, investigating, and reporting suspicious matters, including forms, systems, roles and responsibilities and timeframes. If any suspicious matters were raised or reported in the period, the reviewer may want to walk through a couple of examples and see the documentation trail to ensure that any matters raised were investigated and reported in line with the Program.

5. Transaction Monitoring Program

While the Program will outline the transaction monitoring process and controls, this area may also have additional process documentation to ensure that those responsible can consistently execute the process. The reviewer will consider how transactions are monitored (i.e. manual vs automated), who is performing the review and its frequency, the logic used to determine which transactions are flagged including how often it is reviewed, and how transactions are investigated and the integration into suspicious matter reporting.

If reports are used, the reviewer will look at how the entity ensures that the reports are complete particularly if no transactions have been identified for further investigation. Likewise, with automated monitoring the reviewer should, at minimum, obtain an understanding as to how the entity ensures that the system is operating as intended and who can setup and change monitoring logic.

6. Ongoing Customer Due Diligence

In addition to performing due diligence on customers at the onboarding stage, the Rules require that some level of review and update of customer identification data is performed throughout the relationship with the customer, particularly in relation to high risk rated customers. We commonly see that this requirement is overlooked, perhaps due to the amount of effort required to update customer data at any frequency.

The reviewer will be considering the risk-based approach to OCDD the reporting entity has applied (which should be documented in the Program or a supporting standard or procedure) and whether the processes and controls are in place to ensure the OCDD program is consistently executed.

We often see high level statements in Programs in relation to keeping customer information up to date. These high-level policy statements cause issues for reporting entities come Review time. By being too vague and open ended, reporting entities can find themselves in a position where they are unable to demonstrate compliance with this aspect of their Program.

7. Employee Due Diligence

The reviewer will want to see written details (whether in the Program itself, or a separate cross-referenced policy) of the reporting entities practices in relation to considering which roles are higher risk from a ML/TF perspective, and what additional due diligence applies to these higher risk roles.

Weaknesses we observe include reporting entities that state the job titles of higher risk roles, without providing any basis for the assessment (e.g. level of influence / seniority, involvement in operating key fraud or ML/TF controls, involvement in relationship management). Another common weakness is Programs that deal with EDD at the onboarding stage but do not have regard to movements of staff from lower risk to higher risk roles.

A quick win here is to ensure alignment between policies and procedures – we sometimes note inconsistencies between the actual onboarding practices of the HR function relative to what is stated in the Program drafted by the Compliance function.

8. Outsourcing and using suppliers

If you use third parties to execute any aspect of your AML/CTF Program, the reviewer will want to see evidence of the usual third party risk management controls being in place e.g. written contracts, risk assessment, due diligence, ongoing monitoring. Screening tools should be vetted to ensure they are fit-for-purpose and that the reporting entity understands the limitations. We have seen examples of the Program relying on certain tools only to later discover that a certain module was never switched on. AUSTRAC has provided useful guidance in relation to reliance on third parties for ongoing CDD arrangements.

If you’re looking to uplift your AML Program, for additional guidance to prepare for your next AML Independent Review, or are interested in speaking to use about performing your next Independent Review, reach out to tanushree@staging.px.partners.

It’s back to school this week signalling that the holiday period is well and truly over. Back to the grind with the addition of rapid antigen testing this year! Over the break, we have been reflecting on the year that was in 2021 and what is to come in 2022.

Without doubt, the past year was almost unprecedented in the amount of regulatory change. This year offers some much-needed reprieve with few changes announced for the year thus far. Government and Regulatory bodies are actively consulting with industry and other stakeholders to shape the next round of changes. And industry is using this time to take a breath, review and iterate what has been done in 2021. Given the confluence of change in October last year, we see a number of deliverables which were deferred to ‘day 2’ rightfully getting attention now. To help out with your planning, we’ve compiled a short list of things consider for the year ahead.

1. File your AML/CTF Compliance report with AUSTRAC

The filing period opened in January so no doubt this is already near the top of your list. We note with interest some of the new sections / questions in the report:

• New questions about outsourcing the development of your AML Program and ensuring it is tailored to the business. This highlights the importance of an entity-specific Program and a sign that AUSTRAC sees this as a current weakness in AML Programs that have been reviewed.
• The mandated independent review is subject to further interrogation this year – whether or not the timeframe for independent reviews is specified in the AML Program (e.g. every two years). If it is not, an explanation as to why is required. This may be data gathering in preparation for a regulatory update mandating specified review timeframes.
• The Regulator is also now seeking details of transaction monitoring in place, querying the level of automation in the process, potentially signaling future guidance over requirements for the testing of automated components as a part of the independent review.

Lastly, you may want to refresh yourself with the changes to the AML/CTF Act that came in to effect in June 2021, particularly around reliance on third party customer identification and verification. Current practices in Europe and Asia see product issuers conducting due diligence on distributors as part of broader distribution governance arrangements (e.g. DDO).

Complete your compliance report before 31 March: AUSTRAC compliance reports | AUSTRAC

2. Review your Whistleblower policy & Modern Slavery Statement

In October 2021, ASIC sent a letter to CEOs detailing findings of its Whistleblower policy review and reminding them of their whistleblower requirements per 2019’s RG 270 Whistleblower Policies. The results of the review of some 100 policies found that the majority of policies provided unclear, incomplete or inaccurate information about how whistleblowers could raise a matter, and what protections they are afforded under the Corporations Act. Additionally, ASIC noted that some policies still referenced obsolete requirements and that others omitted or inaccurately described whistleblower protections.

Fortunately for recipients, ASIC have included detailed observations and commentary as to better practices at the individual requirement level which gives reasonable insights into their expectations of a well-written policy. See the full media release here.

At the end of last year, Monash University released their analysis of the Modern Slavery (MS) Statements of the 100 largest listed companies on the ASX. The results were widely reported in the media and contain some good learnings particularly around the importance of due diligence and remediation. While the importance of a well written policy and robust framework may seem of less importance for unlisted companies, we expect this area to come in for more scrutiny by institutional clients (e.g. superannuation funds) and other gatekeepers in line with the increasing focus on ESG matters. If you have a MS Statement, consider the Monash report and whether enhancements are required.

3. Re-visit the proposed systemic issue analysis and day 2 activities for your Internal Disputes Resolution (i.e. complaints)

RG271 brought about significant changes to the complaint management processes (capturing, responding to, analysing and reporting). Some firms did not treat enhancements to their complaint management processes as day 1 activities so it is worth re-visiting the final decisions on responsibility, frequency, and any details of how these will be performed. Another area that has been left in the day 2 bucket at many firms is settling on how the effectiveness of the IDR process will be monitored, by whom, and at what frequency. Similarly, linking and leveraging analysis performed across both incidents and complaints to ensure systemic issues are identified is key, and an area that may not have been given adequate attention in the scramble leading up to go live in October 2021. We can see these matters becoming issues if left unaddressed for too long, particularly at board reporting time.

4. Perform distributor due diligence and review distributor governance agreements (Regulatory Guide RG 274 Product design and distribution obligations)

We saw a real focus on TMDs as the perceived day 1 critical activity for DDO. But DDO is much more than just TMDs and focus should already have shifted to implementation of governance arrangements including the review and monitoring of distributors. While Programs should already outline how distributors will be monitored (e.g. understanding processes and controls in place via questionnaires, reviews, etc.), they may not consider some of the more practical aspects like what to do with incomplete and inconsistent information from distributors (and exactly who will be making these determinations). In addition, given that some target market determinations will need to be reviewed by October 5, it’s a good time to start formalising the finer details of the review process.

Read more about our views on distributor monitoring here and find out more about our RegTech solution that takes the pain out of due diligence here: Know Your Distributor (KYD)

5. Revisit your controls

The quantity and quality of documented controls varies across firms but it is always a good exercise to give them another look. Time bound review periods can help identify duplicated, obsolete or outdated controls and is an opportunity to document any known, but yet to be documented, controls. If you are looking to enhance your risk and control regime, it is good practice to follow a specific taxonomy ensuring controls are documented in a consistent format and structure helps ensure that controls are applied against the correct risks allowing for a more accurate residual risk assessment. When controls follow a consistent taxonomy and documentation standard, the population of controls can be analyzed to highlight over-reliance on certain types of controls (e.g. manual detective controls) or under-use (e.g. lack of monitoring controls).

6. Get ready for CPS 511

If you want to be on the front foot of one of the next significant regulatory changes, CPS 511 comes into effect from 1 January 2023 for ADI SFIs, with a further staged implementation until 1 January 2024, when it comes into effect for all other APRA regulated entities. Presumably this is being done in conjunction with FAR requirements (where applicable) but this will be new requirements for some. Given that it deals with the often contentious issue of remuneration, we’d suggest allowing additional time for consensus and approval of requirements such as variable vesting, payout schedules and downward adjustment processes.

See the final draft here: Final Prudential Standard CPS 511 Remuneration

7. Get involved with some consultation

We know that it is difficult to find the time to participate in the consultation process but we know that Government and Regulators find these insights invaluable when shaping rules and regulation. It is often more efficient to participate through submissions coordinated by industry bodies (e.g. FSC, FPA) or through services providers which have industry wide reach (e.g. Accounting or Legal firms, custodians) Some to watch for this year:

• regulatory relief for Foreign Financial Service Providers (closed 12 January 2022)
• Implementing Corporate Collective Investment Vehicles (closed 21 January 2022)
• Draft terms of reference of the quality of advice review (due 4 February 2022)
• Financial adviser education standards (due 1 February 2022)
• Employee Share Schemes (due 4 February 2022)
• Consumer remediation draft guidance (due 11 February 2022).

Without the hard deadlines imposed by regulatory change, the to-do list this year has a bit more flexibility but certainly no shortage of action.

Talk to candace@staging.px.partners about how PX Partners is supporting clients with implementation and iteration in 2022.