Mackay Chapman November 2026 ASIC Update
In this month's ASIC update:
- ASIC reports $830 million in penalties and more than $580 million in consumer repayments and refunds but the headline figures don’t tell the whole story;
- Fortnum Private Wealth penalised $1.35 million for cybersecurity failures in a significant matter for AFS Licensees;
- ASIC identifies shortcomings in mortgage brokers' best interests duty practices;
- Visy and Pratt companies pay more than $4.1 million over late financial reporting;
- Former Rex director Lim Kim Hai disqualified for four years and ordered to pay an $800,000 penalty;
- Concrete contractor charged over alleged dishonesty and dealing with proceeds of crime;
- Former financial adviser charged with breaching ASIC banning orders; and
- ASIC consults on new digital asset laws commencing in 2027.
ASIC's $830 million enforcement year: the figures behind the headlines
ASIC has reported a record $830 million in court-ordered civil penalties for 2025–26, alongside more than $580 million in repayments and refunds secured for consumers and investors.
But the headline figures only tell part of the story.
According to ASIC's 2025–26 Annual Report, the regulator commenced 260 formal investigations, initiated 32 civil proceedings and completed 1,012 surveillances during the year, and achieved the penalty and repayment/refunds detailed above.
However, as reported by the Australian Financial Review, ASIC's annual report also reveals an operating deficit of $89.9 million, compared with an $18 million surplus the previous year. Increased enforcement expenditure contributed to the result.
Questions have also emerged about the recoverability of some of ASIC's largest penalties.
At 30 June 2026, ASIC recorded $419.5 million in outstanding non-taxation fines and penalties, with an impairment allowance of $391.5 million reflecting doubts about recovery.
Among the year's largest outcomes was a $300.2 million penalty imposed against Union Standard International Group and two former authorised representatives for serious misconduct involving contracts for difference. Union Standard has been in liquidation since 2020.
The results highlight an important distinction between penalties ordered by courts and money ultimately recovered, with anecdotal evidence of significant penalties being obtained against companies in liquidation or financial distress, unable to defend matters and also ultimately unable to pay penalties.
While substantial penalties are agued to serve a general deterrence purpose, questions remain about the practical value of enforcement outcomes involving insolvent or distressed companies and the costs of pursuing them.
Fortnum Private Wealth penalised $1.35 million for cybersecurity failures
Cybersecurity has been firmly established as an ASIC enforcement priority. Its latest action against Fortnum Private Wealth marks the regulator's third enforcement outcome against a licensee over cybersecurity failures, a suite of actions taken to establish precedents and drive change around cybersecurity in financial services.
Fortnum has been ordered to pay a $1.35 million penalty after admitting failures in its cybersecurity arrangements and oversight of authorised representatives.
ASIC commenced proceedings against Fortnum in July 2025 after the firm notified it of a cyberattack affecting one of its authorised representatives.
Fortnum admitted that between April 2021 and May 2023 it failed to implement adequate cybersecurity policies and risk management systems. It also lacked sufficient specialist expertise and effective oversight of cybersecurity arrangements across its representative network.
At the time, Fortnum's network included more than 200 advisers and approximately 55,000 retail clients. Its representatives held sensitive information including identification documents, tax file numbers and financial account details.
The Court also ordered Fortnum to contribute $250,000 towards ASIC's legal costs.
The decision follows earlier ASIC cybersecurity enforcement proceedings involving RI Advice and FIIG Securities.
The decision reinforces the importance of effective licensee oversight and systems to manage cyber risk. Cybersecurity is not simply an IT issue, but forms part of a licensee's broader risk management and regulatory obligations.
ASIC and AUSTRAC increase scrutiny of mortgage lending practices
A mortgage broker recommending a more expensive loan does not necessarily breach the best interests duty. But the broker needs evidence to justify why that recommendation is in the customer's interests.
That is one of the key findings in ASIC's Report 840, which examined how mortgage broker groups supervise compliance with the best interests duty and manage consumer complaints.
The review covered 13 credit licensees across eight large mortgage broker groups. Together, they were responsible for approximately two-thirds of Australia's mortgage broker representatives.
Seven of the eight aggregator groups reported that brokers did not recommend the cheapest available loan in more than 20% of cases.
ASIC found instances where brokers lacked sufficient evidence to explain why higher-cost recommendations were in their customers' interests.
It also identified weaknesses in complaints handling. Some complaints were missed, withdrawn without adequate investigation or took too long to resolve.
The findings come alongside separate scrutiny of mortgage fraud risks by AUSTRAC.
In September, AUSTRAC's Fintel Alliance released the findings of Operation Claw. An analysis involving ten major Australian banks identified potentially hundreds of millions of dollars in suspected fraudulent mortgage loans.
The suspected conduct included inflated incomes, false employment information, misleading documentation and repeated involvement of particular brokers and other professional intermediaries.
AUSTRAC did not identify evidence of widespread money laundering through the operation. However, it identified significant fraud risks and weaknesses in lending controls.
The ASIC and AUSTRAC reviews address different issues. Together, they highlight regulatory concerns about mortgage origination, broker conduct, supervision and the integrity of lending practices.
Since early this year we have been engaged by a significant number of brokers in relation to a wide range of issues - potential criminal conduct, regulatory scrutiny and investigation, professional conduct investigations and proceedings, accreditation issues, and financial and contractual disputes with aggregators. All this follows or falls from the CBA exposure of potentially $1 billion in mortgage fraud across its book in late 2025 (and NAB’s subsequent issues and Operation Claw) and flow on effects across the industry.
For brokers and aggregators, documenting recommendations, retaining evidence considered, and maintaining effective supervision and complaints handling remain critical as ‘protective tools’ in an environment of heightened regulatory scrutiny of the mortgage broking industry.
Visy and Pratt companies pay more than $4.1 million over alleged financial reporting failures
ASIC is continuing its enforcement campaign against companies that fail to meet their financial reporting obligations.
The latest action has resulted in 21 companies within the Visy and Pratt group paying infringement notices totalling $4.158 million.
Each company paid $198,000 following alleged failures to lodge financial reports for the year ended 30 June 2025 by the required deadline of 31 October 2025.
Payment of an infringement notice is not an admission of liability or guilt.
Since commencing its surveillance programme targeting late or missing financial reports in August 2025, ASIC has issued 48 infringement notices totalling more than $9.3 million.
Other groups subject to enforcement activity include companies operating under the Canva, Mecca, Zara, H&M and Sephora brands.
For 2026 ASIC made timely financial reporting an enforcement priority and has followed through on this priority. The size and number of these infringement notices demonstrate that the regulator is prepared to take significant action against established corporate groups for reporting failures.
Failures to report or flaws in group reporting and compliance can be dealt with proactively if the company is properly advised, and can involve proactive engagement with ASIC and utilising key remedial provisions under the Corporations Act 2001 (Cth) which allow for courts to fix procedural irregularities, validate inadvertent mistakes, and/or relieve officers or companies from liability. Expert advice and action is key.
ASIC seeks leave to appeal Rex decision as former director receives $800,000 penalty
ASIC's proceedings against former Rex directors have produced different outcomes for executive and non-executive directors. Those differences are now the subject of a proposed appeal.
On 20 October, the Supreme Court of NSW disqualified former Rex chief executive and executive chair Lim Kim Hai from managing corporations for four years. He was also ordered to pay an $800,000 penalty.
Mr Lim admitted breaches of his directors' duties and involvement in Rex's continuous disclosure contraventions.
The proceedings arose from a February 2023 profit forecast and Rex's subsequent failure to keep the market properly informed about its financial performance.
The Court previously found that Rex breached its continuous disclosure obligations from 14 April 2023.
However, ASIC was unsuccessful in its claims against former non-executive directors John Sharp, Siddharth Khotkar and Lincoln Pan. The Court did not find that they had breached their directors' duties in relation to the forecast.
ASIC has since sought leave to appeal those findings. It argues that the primary judge made errors concerning the non-executive directors. ASIC is not seeking to overturn the Court's findings in relation to Rex.
The application for leave remains to be determined.
The proceedings raise important questions about non-executive directors' responsibilities for financial oversight and continuous disclosure, and should be closely monitored by non-execs and their advisors.
Concrete contractor charged over alleged dishonesty and proceeds of crime
Company directors can face serious criminal exposure if they dishonestly deal with company assets after losing authority to do so.
NSW concrete contractor Ali Youssef has been charged with dishonestly using his position as a director and dealing with proceeds of crime.
Mr Youssef was a director of Allscope Concrete & Pumping Pty Ltd.
ASIC alleges that on 4 December 2023 he transferred $69,000 from the company's bank account into his personal account after being informed that the company was to be wound up.
ASIC alleges he was no longer authorised to deal with the company's assets.
It is further alleged that he subsequently transferred the funds, together with other money, into two additional accounts. One belonged to him and the other to his wife.
Mr Youssef faces three charges involving dishonest use of his position and dealing with proceeds of crime.
The matter is being prosecuted by the Commonwealth Director of Public Prosecutions following an ASIC investigation and referral.
The allegations have not yet been determined by a court.
Former financial adviser charged with breaching ASIC banning orders
ASIC banning orders are not simply administrative sanctions and breaching them can result in serious trouble including criminal prosecution.
While it happens rarely, the case of Former NSW financial adviser Ezzat-Daniel Nesseim demonstrates the ultimate risk. Mr Nesseim has been charged with seven offences relating to alleged breaches of permanent ASIC banning orders.
ASIC alleges that between June 2022 and December 2024 Mr Nesseim continued to perform functions involved in operating financial services businesses.
It also alleges he provided personal financial product advice to four consumers despite being prohibited from doing so.
ASIC permanently banned Mr Nesseim from providing financial services in February 2018 and from engaging in credit activities in July 2019.
A further banning order was imposed in July 2022. It prohibited him from controlling or performing functions involved in a financial services business.
The charges follow an ASIC investigation and referral to the Commonwealth Director of Public Prosecutions.
Criminal proceedings for alleged breaches of banning orders are less commonly reported than the banning decisions themselves. This case demonstrates the potential consequences where ASIC alleges prohibited conduct has continued in breach of a banning order.
The allegations have not yet been determined by a court.
ASIC consults on new digital asset laws commencing in 2027
Australia's new digital asset regulatory framework is scheduled to commence on 8 April 2027. Businesses operating digital asset and tokenised custody platforms will need to consider the new licensing and compliance requirements.
ASIC has commenced consultation on proposed guidance and standards for the framework.
Consultation Paper 392 sets out ASIC's proposed approach to regulating digital asset platforms and tokenised custody platforms.
The framework will bring relevant platform operators into the financial services regulatory system.
Depending on their activities, businesses may need to obtain or vary an Australian Financial Services Licence.
ASIC is also consulting on proposed requirements covering asset holding, trading and settlement, customer disclosure and financial resources.
The changes will affect new digital asset businesses and existing financial services licensees offering relevant services.
ASIC has proposed measures to streamline licensing for certain existing licensees.
Consultation closes at 5pm AEDT on 27 November 2026.
With commencement approaching, affected businesses will need to assess their licensing arrangements and prepare for the new regulatory requirements.
The contents of this update do not constitute legal advice, are not intended to be a substitute for legal advice, and should not be relied upon as such. They are designed and intended as general information in summary form, current at publication, for general informational purposes only. You should seek legal or other professional advice concerning any particular legal matters you or your organisation may have.
