ASIC enforcement news and insights for busy people

Your quarterly round-up of the key enforcement developments and updates that ASIC-regulated entities and individuals need to know about, packaged up in a five-minute read and brought to you by our Disputes and Investigations team. 

Key themes of the quarter – August to October 2024

There has been loads going on at ASIC this quarter. The recently released Annual Report revealed a fairly full slate of enforcement outcomes in 2023–2024: civil actions resulted in over $90 million in court ordered penalties, investigations led to 18 criminal convictions and a total of $936,000 in fines were ordered by the courts. 

In the same period, ASIC commenced around 170 formal investigations (an increase of about 25% on the previous year) and filed 32 new civil proceedings in the Federal Court – so buckle up; we can expect loads more to come. 

ASIC’s Enforcement and Regulatory update for the period January to June 2024 published in August 2024 indicated that focus areas for enforcement would include superannuation and greenwashing – both clear themes we have identified this quarter, with notably 11 financial services enforcement litigation matters in progress with respect to superannuation misconduct. 

ASIC also gives us a bit more insight over what might lay in store with the release of ASIC’s 2024-25 Corporate Plan, identifying its top five strategic priorities for 2024–2028. This expanded the regulator’s strategic priorities to include Australia’s public and private markets and emerging financial products. Strategic priorities retained from previous Corporate Plans include improving consumer outcomes and progressing digital and data resilience and safety measures. Climate change risk is a top priority as well as a significant area of ongoing focus, and remains one of the key three themes we have identified for this quarter, as summarised below.

• Climate-related financial disclosure is here and greenwashing remains (even more of) a concern: the scene has been set for Australia’s framework for climate-related financial disclosures to take effect from January 2025 and ASIC secured its biggest pecuniary penalty of $12.9 million against Vanguard for greenwashing. 
• Superannuation: has been held out as a key focus area for ASIC with the sector being put on notice to do more to protect members from practices which put consumers at risk. 
• New Banking Code: ASIC approved an updated ABA Banking Code of Practice, which will commence in February 2025 – meaning participating banks need to start designing and implementing the changes necessary to ensure they can meet the enhanced obligations. 
• What else did I miss? Continuous disclosure obligations remained in the spotlight with a $5 million penalty being imposed on Noumi and the dismissal of ANZ’s appeal against a judgment that it had breached continuous disclosure laws; the focus on combatting cybercrime continued; and the Australian Institute of Company Directors issued a landmark legal opinion and practice statement on directors’ duties, which is highly topical given ASIC’s current focus on this area.

1.    Climate-related financial disclosure is here and greenwashing remains (even more of) a concern

Australia’s first framework for climate-related financial disclosures has been introduced by the Treasury Laws Amendment (Financial Market Infrastructure and Other Measures) Bill 2024 (Cth) (quite the mouthful!) which was passed by Parliament on 9 September 2024 and received royal assent on 17 September 2024. 

From 1 January 2025, entities that are required to prepare annual financial reports under Chapter 2M of the Corporations Act 2001 (and meet certain thresholds) will be required to prepare sustainability reports. Implementation will occur in phases, with the largest entities being required to submit sustainability reports for their financial years commencing from 1 January 2025. A comprehensive overview of the key elements of the Bill is here. ASIC is urging businesses to proactively engage with these mandatory climate reporting requirements and has established a dedicated sustainability reporting page to provide information about the new regime and how ASIC will administer it.

Although, as we know, ASIC does not need to wait for new legislation to take action against ESG-related misconduct. On 25 September 2024, the Federal Court ordered Vanguard to pay a (record) $12.9 million penalty, after Vanguard admitted it had made false or misleading representations and engaged in conduct that was liable to mislead the public in relation to an ‘ethically conscious’ fund. See here for a detailed consideration of the reasons for the penalty. 

The liability judgment handed down in April was ASIC’s first greenwashing court outcome (see further here), although since then, ASIC has secured two other successful verdicts in the Federal Court, including a pecuniary penalty of over $11 million against Mercer Super. We anticipate similar enforcement, supervision and surveillance over the incoming climate-related financial disclosure. 

So if you are a large Australian company (and even if you are not!) preparations should already be well underway to develop (and action) a compliance road map with a view to complying with mandatory (and expected) requirements with respect to climate disclosures.  

2.    Superannuation

ASIC is zeroing in on misconduct in the superannuation sector, which following the release of the ASIC January to June 2024 Enforcement and regulatory update (Update) on 9 September 2024, has been put on notice to do more to protect members from practices which put consumers at risk. Examples of such practices include failure to seek choice (as opposed to underperforming) superannuation investment options and employing high-pressure tactics to encourage inappropriate superannuation switching. Keep your eyes peeled, as ASIC is gearing up to unveil the results of its surveillance into how superannuation funds are handling death benefits claims in the coming months. 

Hot on the heels of the Update (and underlining that the superannuation sector is indeed being placed under the microscope), on 1 October 2024, ASIC announced that it had (during the first half of 2024) taken action against 13 self-managed superannuation fund auditors in relation to a range of topics, including breaches of auditing and assurance standards, independence requirements, continuing professional development obligations, and fit and proper person criteria for remaining an approved SMSF auditor. See here for the ASIC media release.

And it will not have gone unnoticed that two of ASIC’s three (successful) civil penalty actions for greenwashing have been against entities in the superannuation sector.

Although it’s not all home runs for ASIC – it announced on 18 September 2024 that the Federal Court had dismissed ASIC’s case (started in March 2021) against superannuation trustee, Retail Employees Superannuation Pty Ltd for allegedly making misleading representations about limitations on members’ rights to transfer superannuation funds out a trust over a three year period, finding that "REST accurately conveyed to members what its rules and practices were. Its factual statements about that to members were accurate”.

ASIC was ordered to pay 80% of the defendants cost and stated that it brought the action to “clarify the law around [superannuation portability and choice of superannuation fund] and to emphasise the critical responsibility of trustees to provide accurate information to their members”.

3.    New Banking Code

Australian Banking Association’s Banking Code of Practice 2025

The new version of the Australian Banking Association’s Banking Code of Practice (Code) was approved by ASIC in June. It’s not mandatory for industry codes to be submitted to ASIC for approval; however, ASIC’s approval indicates that it considers consumers and industry participants can have confidence that the new Code is robust and appropriate.

The updated version includes enhancements to key protections for consumers and small businesses and will commence on 28 February 2025. Some of the key changes are:

• A broader definition of ‘small business’, which will include a business with $5 million in aggregate borrowings compared with the current $3 million threshold, meaning more small businesses will benefit from the Code’s protections.
• Additional protections for small business loan guarantors: there will be additional steps required to ensure guarantors of small business loans are sufficiently informed to properly understand the risks involved.
• An expanded list of circumstances which increase the risk of a customer being ‘vulnerable’, as well as recognition that a customer may be (or become) vulnerable at any moment. The expanded list includes disability, financial difficulty, domestic violence, literacy or language barriers, Aboriginal or Torres Strait Islander customers, and incarcerated (or recently incarcerated) persons. Obligations in respect of vulnerable customers include making it as simple as possible for such persons to appoint a third-party representative to deal with the bank on their behalf.
• An expanded definition of ‘financial difficulty’, so it includes customers who are likely, or expecting, to be unable to meet future repayments. Examples are given of circumstances which may result in financial difficulty, including loss of employment, a pandemic, or natural disasters. 

This represents the first major amendment to the Code since October 2021, and participating banks will need to begin uplifting their processes and systems and rolling out training well in advance of the February 2025 commencement date. 

What else did I miss?

Here’s our pick of other key ASIC enforcement highlights we think you should know about:

• Continuous disclosure obligations remain in the spotlight:
  • On 5 August 2024, the Federal Court imposed a $5 million penalty on food manufacturer Noumi for breaches of its continuous disclosure obligations under the Corporations Act by overstating the value of inventory (breaches which Noumi admitted to). Two months later, its former CFO and Company Secretary was found to have been knowingly concerned in the breaches and had given false or misleading information to Noumi’s directors and auditors Noumi admitted to these contraventions. See ASIC’s media releases here and here. 
  • On 2 October, the Full Federal Court dismissed ANZ’s appeal against ASIC’s landmark win against ANZ back in October 2023 in which the court found that it had breached continuous disclosure laws. The Court upheld the original decision, which imposed a penalty of $900,000 on ANZ for failing to notify the ASX that between approximately $754 and $791 million of the shares offered in a 2015 institutional share placement were to be acquired by its underwriters rather than placed with investors. See ASIC’s media release (as well as ASIC's media release on the primary judgment). 
• The focus on combatting cybercrime continues, with ASIC announcing on 20 August the takedown of more than 7,300 phishing and investment scam websites as well as publishing Report 790 (Report), in which ASIC found that the scam-prevention measures in place at 15 of Australia’s authorised deposit-taking institutions were less mature than expected. The Report encourages all banks and financial services businesses to take steps to advance their scam prevention, detection and response activities. This was followed closely by the launch of Treasury’s consultation into a proposed new scams prevention framework on 13 September. See our detailed briefing on the proposed framework here.
• The Australian Institute of Company Directors issued a landmark legal opinion and practice statement on directors’ duties on 8 October, which is highly topical given ASIC’s current focus on this area (as highlighted in our Quarterly Update July 2024). These focus on the duty of care and diligence under the Corporations Act 2001 (Cth), with the opinion concluding (among other things) that although a failure to address the risk of non-compliance with regulatory obligations may give rise to a breach of the duty of care and diligence, directors are not required to ‘guarantee’ compliance or eliminate all risks. The opinion also notes that although the board has collective responsibility for company management, the duty of care and diligence falls on each director individually. The practice statement (informed by the legal opinion) is critical reading for all directors – one for the bedside table! 
• The Markets Disciplinary Panel fined Macquarie Bank a record $4.995 million in September for failing to prevent suspicious orders being placed on the electricity futures market (being the highest penalty ever imposed by the MDP). The matter fell within one of ASIC’s 2023 enforcement priorities – market misconduct in energy and commodities derivatives markets – and the fine followed an ASIC investigation during which ASIC put Macquarie on notice about the suspicious orders. Macquarie has stated that it has implemented remediation actions to ensure that issues with monitoring suspicious orders are dealt with appropriately; the matter serves as a useful reminder to listed entities to ensure their own monitoring and reporting systems and processes are up to standard. See the ASIC press release here.

What next? 

Look out for developments in the following areas over the coming months:

• As highlighted in a speech by ASIC Chair Joe Longo on 17 September at the Australian Compliance Institute Annual Conference, compliance will continue to be a focus point for ASIC, with directors being responsible for 'setting the tone' and 'leading a culture of compliance'. In that regard, see the AICD legal opinion and practice statement referred to above.
• Mr Longo expressly called out AI as a focus area within compliance, in particular in relation to the use of AI in financial services and markets, and noted the publication in September by the Department of Industry, Science and Resources of a proposals paper for introducing mandatory guardrails for AI in high-risk settings. While any new legislation or regulatory powers are likely to be some time away, it will be interesting to see how and whether ASIC uses existing regulatory frameworks to manage AI-related risks over the coming months.
• In September, ASIC received new powers under financial market infrastructure reforms (see ASIC’s media release) which expand ASIC’s regulatory powers in respect of financial market infrastructures (FMIs) such as clearing facilities and financial market operators. Keep an eye out for further information and guidance from ASIC on how it will utilise these new powers, which it has said it will be developing in conjunction with the RBA and industry.

Look out for our next issue of Regulatory Rumblings at the end of January 2025. Otherwise, please do get in touch if you have any questions or need advice.

In the meantime, for an in-depth, weekly overview of regulatory matters more broadly, see our Financial Services team’s excellent publication here.