Background
ASIC brought civil-penalty proceedings against Fortnum Private Wealth Ltd, an Australian financial services licensee whose authorised representatives provided financial advice to retail clients. Between 20 April 2021 and 11 May 2023, those representatives handled substantial volumes of sensitive client information, including identification, tax file, banking and credit-card details.
Fortnum introduced a cybersecurity policy in April 2021, but its mandatory measures largely relied on practices completing a self-assessment and attestation. The policy did not require practices to remedy identified gaps, made more comprehensive measures optional, and was poorly implemented and monitored. Completion rates were low, and Fortnum did not conduct the annual reviews contemplated by the policy. Fortnum also lacked personnel, or formally engaged external specialists, with cybersecurity expertise.
The Court’s Holding
Black J accepted Fortnum’s admissions and made declarations that it contravened ss 912A(1)(a), 912A(1)(d) and 912A(1)(h) of the Corporations Act 2001 (Cth), and therefore s 912A(5A). Fortnum had failed to ensure its licensed financial services were provided efficiently, honestly and fairly; failed to have adequate human resources; and failed to maintain adequate cybersecurity and cyber-resilience risk-management systems.
The Court held that Fortnum’s deficiencies exposed its authorised representatives and their clients to an unacceptable risk of cyber-related attacks and resulting harm, even though ASIC did not allege that the contraventions caused a particular loss or that Fortnum obtained a benefit. The Court approved the parties’ agreed $1.35 million penalty, finding it provided appropriate specific and general deterrence, and ordered Fortnum to pay ASIC’s fixed costs of $250,000.
Key Takeaways
- An AFSL holder’s cybersecurity obligations extend to effective oversight of authorised representatives handling client data.
- A policy is insufficient if it does not require and verify remediation of identified cyber-security deficiencies.
- Adequate resources may require internal or formally engaged external cybersecurity expertise.
Why It Matters
The decision reinforces that cybersecurity governance is part of a financial services licensee’s core statutory obligations, not a peripheral IT issue. Licensees must adopt, implement and monitor controls proportionate to their business and representative network.
The $1.35 million agreed penalty also signals that inadequate cyber-risk frameworks can attract substantial sanctions without proof of a specific customer loss, particularly where a licensee has delayed responding to known gaps and industry cyber risks.