ASIC breach reporting requires Australian credit licensees to assess possible misconduct, identify reportable situations and lodge them with the Australian Securities and Investments Commission (ASIC). A credit representative escalates the facts to their licensee. The licensee owns the assessment and ASIC report.
The usual submission period is 30 calendar days after the relevant knowledge or recklessness threshold is met. An investigation continuing for more than 60 days can itself become reportable. These periods answer different questions, so record both clocks from the start.
Separate an Incident From a Reportable Situation
An incident is a fact or concern requiring assessment. A reportable situation is a statutory category under the National Consumer Credit Protection Act 2009 (NCCP Act). A complaint, missing document or commission discrepancy can reveal an incident without deciding its legal classification.
ASIC’s reportable situations guidance identifies significant breaches and likely significant breaches of core obligations. It also covers certain investigations, their outcomes and conduct involving gross negligence or serious fraud.
For each matter, identify the Australian credit licence (ACL) under which the conduct occurred. If you are an appointed credit representative, send the incident and evidence through that licensee’s escalation process promptly. Keep the acknowledgment and named assessment contact. Sending a matter to an aggregator only reaches the responsible licensee when that aggregator holds the relevant licence or receives it through an agreed escalation arrangement.
A brokerage that holds its own ACL must arrange its own reportability decision. Assign a compliance assessor and obtain legal advice where the obligation or evidence is disputed. Internal approval arrangements must leave enough time for the reporting deadline.
Preserve Facts and Assign Assessment
Open an incident record as soon as the concern is identified, with a named assessor and next review time. Preserve original file versions and restrict access to client information. Add corrections as new entries so the record shows what was known at each stage.
Use this incident-log structure as a working credit licence breach reporting template. Its status field records the assessment stage, not an automatic legal conclusion.
| Record Field | What to Capture |
|---|---|
| Incident reference and status | A unique reference and a status such as assessment open, investigation open or decision recorded |
| Discovery event | Who first identified the concern, when they identified it and what triggered it |
| Conduct and affected files | The action or omission, its known period, broker, licence and loan-file references |
| Evidence | Original documents, correspondence, system records and the location of each item |
| Impact | Confirmed affected consumers, possible additional consumers, known loss and unresolved estimates |
| Assessment ownership | Assessor, legal adviser where appointed, reporting approver and escalation contact |
| Timing record | Investigation commencement, reporting-trigger assessment, calculated due dates and review reminders |
| Decision and follow-up | Applicable provisions, reasons, reports, remediation tasks and evidence needed for closure |
For example, a hypothetical file review finds two versions of an applicant’s income document. Record the versions and who received each one. Record the reason for concern as possible inaccurate information, with authenticity and responsibility still under assessment. An entry stating proven fraud would go beyond those facts.
Give the assessor access to the originals and a short account of the unresolved questions. The brokerage policy and procedures guide helps assign the recurring roles behind this process.
Apply the Credit-Licence Tests
Assess the conduct against the credit provisions, then record the reasoning for every reporting category that applies. Section 50A of the NCCP Act defines the core obligations and reportable situations for credit licensees.
- Identify the obligation. Record the actual provision and whose conduct engages it, including a representative’s conduct. A breach of an internal policy needs assessment against the legal obligation it protects.
- Test deemed significance. Criminal deeming covers offences punishable by at least three months’ maximum imprisonment for dishonesty, or at least 12 months otherwise. Civil penalty contraventions and National Credit Code key requirements also trigger deeming, subject to applicable exclusions. Misleading or deceptive conduct and material client loss can also trigger deeming.
- Apply the remaining significance factors. Consider the number or frequency of similar breaches, the effect on the licensee’s ability to conduct credit activities and what the incident shows about compliance arrangements. Record any other prescribed factor.
- Assess investigations and additional categories separately. Gross negligence and serious fraud have their own reporting category. A likely significant breach means the licensee or representative is no longer able to comply with a core obligation.
Apply Relief to the Exact Credit Provision
The credit-specific modifications in ASIC Instrument 2024/620, section 6 include a limited relief route with all these conditions:
- The circumstances only give rise, or are likely to give rise, to a single situation or qualifying group through civil penalty or misleading-conduct deeming, with no other reporting ground.
- No more than 10 affected consumers are impacted or likely to be impacted. Joint parties count as one for the specified joint credit contract, consumer lease, mortgage or guarantee, including proposed arrangements.
- Total actual or likely financial loss across consumers is at most $1,000, counting loss even if remediated.
- Rectification, including necessary remediation, finishes within 60 days after the situation first occurs.
A qualifying group involves the same or substantially similar conduct, apart from consumer identity and conduct date, within no more than 60 days. For misleading conduct, impact means being misled or deceived. For false representations, it means receiving the representation.
Record evidence for every condition before relying on relief. The credit test does not import the separate financial-services exclusions for client money or clearing and settlement rules. Reopen the decision if further consumers or loss make a condition fail.
Establish the Reporting Clock
Record the event that starts each period and retain the evidence supporting that event. The RG 78 breach reporting guide explains the knowledge and recklessness tests, investigation commencement and reporting periods.
The ordinary submission clock starts when the licensee first knows, or is reckless about whether, reasonable grounds exist to believe a reportable situation has arisen. Final proof and committee approval are unnecessary to reach that threshold.
The investigation period starts from the factual commencement of the inquiry. Calling it a preliminary review does not decide the start. Track an inquiry into a possible significant core-obligation breach against the more-than-60-day threshold. Once it becomes a reportable investigation, record its submission deadline separately. Report a significant breach identified earlier within its own reporting period.
An investigation ending with no significant breach can still require an outcome report if the investigation itself became reportable. Record both the completion event and the outcome assessment.
Limited timing relief exists for further situations with the same or substantially similar underlying circumstances as an earlier reported situation. Record the prior report and the exact relief conditions before using an extended period. ASIC can direct a shorter period.
A useful timing register therefore has separate fields for discovery, inquiry commencement, reasonable-grounds assessment, investigation threshold and submission due date. If a due date appears missed, escalate immediately and document the delay and corrective action.
Prepare and Submit the Report
Prepare a reviewed factual account and submit through the prescribed ASIC Regulatory Portal transaction. Use ASIC’s published submission instructions for the licence’s own reportable situation and subsequent updates.
Build the submission file around the information requested in the prescribed form and RG 78 Appendix 2:
- Licence and contact details, incident reference and reporting category.
- A description of the conduct, relevant obligations and affected products or credit activities.
- Conduct timing, discovery trigger, investigation timing and the reporting assessment.
- Root causes, affected consumer and instance counts, financial impact and non-financial impact.
- Rectification, remediation progress, outstanding work and expected completion information where requested.
- Supporting documents required by the form, with an index identifying the evidence for each statement.
Separate confirmed figures from estimates and explain the basis of an estimate. Reconcile affected files with consumer counts, including the counting method used for joint borrowers. Avoid marking remediation complete while payments or client communications remain outstanding.
Arrange review by the licensee’s authorised approver. Confirm that the portal user has access to the correct licensee and restrict sensitive event access where appropriate. Create the event transaction group, lodge the report and retain the submitted version and acknowledgment.
Add later information through the event’s update process so it stays with the original report. Reconcile corrections against the earlier version and explain what changed. If access or a portal error prevents submission, preserve the error evidence and escalate to ASIC promptly through its support arrangements.
Complete Client and Control Follow-Up
Assess client notification and remediation separately from lodging the ASIC report. ASIC INFO 259 requires a separate trigger assessment for residential mortgage credit assistance.
The relevant reportable situation must involve a significant core-obligation breach, gross negligence or serious fraud. There must also be reasonable grounds to suspect resulting client loss and a legally enforceable right to recover it from the licensee. Apply the statutory commencement conditions for historical conduct.
When triggered, take reasonable steps to notify affected clients in writing within 30 days of the relevant knowledge or recklessness threshold. Start the required investigation within that period and complete it as soon as reasonably practicable. Notify clients of the outcome within 10 days after completion. Take reasonable steps to pay required remediation within 30 days after completion.
Keep complaint handling active through its own process. The broker complaint and AFCA guide covers that parallel route. If client information is exposed, assess the separate privacy response using the mortgage broker data-security guide.
Attach affected loan references, complaint references and any commission corrections to the incident. Distinguish a correction to brokerage income from remediation owed to a consumer. Record who approves each calculation and what evidence confirms payment or another remedy.
Close the incident only after the assessor confirms the report and updates are complete, required client actions are evidenced and control repairs have been checked. Set a follow-up sample review with an owner and due date. The closure record must show whether the repaired process prevents the same failure on later files.
