In addition, the 2025 Relief Instrument:
- Extends the length of investigations that are reportable to ASIC from 30 days to 60 days; and
- Clarifies that a report is taken to be lodged with ASIC, if a licensee has submitted a breach report to APRA that contains all the information APRA has requested.
The ASIC media release outlining the 2025 Relief Instrument can be accessed here.
Background
Prior to the implementation of the 2025 Relief Instrument, under the reportable situations regime Australian financial services and credit licensees were required to submit notifications to ASIC about all breaches of MDC provisions or CPPs (subject to certain limited exceptions). Breaches of these provisions were deemed “significant” breaches of “core obligations” under section 912D(4)(b) and (c) of the Corporations Act 2001 (Cth) ("Corporations Act") and section 50A(4)(b) and (d) of the National Consumer Credit Protection Act 2009 (Cth) ("National Credit Act").
During consultation on the 2025 Relief Instrument, ASIC noted this automatic reporting requirement had led to reports which were of limited value to ASIC, but still involved a cost for licensees. In light of this situation, the 2025 Relief Instrument seeks to strike a balance between reducing the reporting burden on licensees, and upholding the objectives of the reportable situations regime.
In more detail
The 2025 Relief Instrument establishes that breaches are not deemed to be “significant” if all of the following conditions are satisfied:
- The underlying circumstances in relation to the breach would only give rise to a single reportable situation or a “single group of reportable situations” as a result of:
- A breach of the MDC provisions; or
- A contravention of a CPP; and
“Single group of reportable situations”, for the purposes of the 2025 Relief Instrument, refers to two or more single reportable situations which (1) involve the same or substantially similar conduct other than the identity of the consumer at the date of the conduct, and (2) occur within a period of 60 days or less.
- The breach has been rectified within 60 days from when it first occurred (and remediation has been paid if required); and
- The number of impacted consumers is less than 10; and
- The total financial loss or damage to all impacted customers resulting from the breach does not exceed AUD 1000 (including where the loss has been remediated); and
- The breach is not a contravention of clearing and settlement services rules or rules relating to reporting client monies.
The 2025 Relief Instrument represents a broadening of the types of reports that are exempt following ASIC’s public consultation, increasing:
- The time allowed for rectification from 30 days to 60 days;
- The number of impacted consumers from five to 10; and
- The total financial loss or damage to consumers from AUD 500 to AUD 1000.
Further, following consultation ASIC has expanded the scope of the relief provided in the 2025 Relief Instrument. In particular:
- In response to submissions about the time it takes to complete investigations, the 2025 Relief Instrument now provides that only investigations ongoing for more than 60 days, instead of 30 days, are reportable to ASIC. This means that, if an investigation is completed within 60 days and no reportable situation is identified, a report does not have to be submitted; and
- The 2025 Relief Instrument clarifies that a report is taken to be lodged with ASIC if a licensee has submitted a breach report to APRA that contains all the information APRA requests.
Despite the 2025 Relief Instrument, licensees should be aware that relevant breaches could still be reportable under other circumstances in section 912D of the Corporations Act and section 50A of the National Credit Act. For example, these breaches could be “significant” as a result of there having been a number of similar breaches under section 912D(5)(a) of the Corporations Act and section 50A(5)(a) of the National Credit Act.
In addition, ASIC has reminded licensees of the obligation to have systems and processes in place for identification, escalation, investigation, rectification and capture of incidents and breaches as part of their general obligations to maintain adequate risk management systems and to ensure compliance with their licensee obligations.
Next steps
We consider the 2025 Relief Instrument as a step in the right direction by ASIC to assist licensees with their compliance costs in relation to information that is of little value to ASIC. The 2025 Relief Instrument commenced on 27 June 2025, and we suggest this is an opportune time for licensees to review and look to update their breach reporting policies as needed.
