ASIC happy that breach reports have tripled

Mike Taylor

Managing Editor and Publisher

10 August 2023

The Australian Securities and Investments Commission (ASIC) has admitted that the changes to the financial services breach reporting regime resulted in a more than tripling of the reports it received.

And the regulator has told Parliamentarians that the increase is welcome because it provides ASIC with better intelligence and data information.

Answering questions on notice resulting from Senate Estimates ASIC confirmed that the number of breach reports it received had risen to 14,034 in 2021-22 up from around 4,000 during the previous full year.

It also noted that the number of breach reports it received increased significantly from 2015 not least because of the Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry from 2017 to 2019 and after ASIC published its Report 594 dealing with compliance with b reach reporting obligations.

“We welcome increased breach reporting as each report adds to our intelligence and data information, and informs our future compliance and enforcement activity. In addition to increased reports flowing from publicity around the Royal Commission, there was an enhanced focus and understanding of the reporting obligations after the publication of Report 594. On 1 October 2021, the new reportable situations regime started. The new legislation lowered the bar for reporting a breach to ASIC. The law reform has led to a significant increase in notifications to ASIC (14,038 in 2021-22, up from approximately 4,000 the previous full year).”

“Over the period, the number of auditor notifications received also increased. These notifications usually duplicate the information reported to ASIC in a breach report.”

“The increase in the NFA rate for reportable situations (previously breach reports), including auditor notifications, is naturally correlated with the increase in reports received. This is because ASIC must direct its resources to taking regulatory actions where we can achieve the most impact on the issues which pose the greatest risk of harm to consumers and markets, and there is a finite number of actions which we can progress with our resources. We do not seek to act on a fixed proportion of reports that we receive,” ASIC said.

ASIC also said that while the number of formal investigations it had commenced had declined since July, 2015, the number of civil and criminal actions it had commenced had actually increased.

“This reflects an increasing proportion of ASIC’s enforcement resources being dedicated to resource-intensive court-based action during this period. In 2021-22, $229 million in civil penalties were imposed by the courts in relation to cases run by ASIC, convictions were secured against 34 persons and companies and over $2 million in criminal penalties was imposed.”

“These enforcement outcomes are materially higher than similar outcomes achieved in 2015,” it said.