Surfacing amid a flurry of regulatory action from ASIC, the Review further demonstrates ASIC's intention to enforce accountability and drive proactive action by responsible entities in complying with their regulatory obligations. It serves as a reminder to responsible entities of registered schemes that they must swiftly address inadequacies in their compliance plans, and continue to review and update them at regular intervals and as new regulatory changes arise.
Key takeaways
The Review identified that thorough coverage of all obligations (including design and distribution obligations, internal dispute resolution and reportable situations) is crucial to a functional and effective compliance plan. A transparent controls framework is necessary for all responsible entities in complying with their obligations, including setting out a clear structure and accountability for each obligation.
This Review emphasises that to comply with their obligations and avoid regulatory action, responsible entities must stay up to date on legal and regulatory developments and review and update their compliance plans both at relevant trigger points and regular intervals.
In more detail
In reviewing the adequacy of registered schemes' compliance plans, ASIC focused on the treatment of regulatory obligations and methodologies for ensuring effective compliance. Specifically, ASIC limited their review to three core sets of regulatory obligations, all of which have been introduced or enhanced over the last few years:
- Reportable situations reporting – see Regulatory Guide 78 Breach Reporting by AFS licensees and credit licensees
- The product design and distribution obligations (DDO) regime – see Regulatory Guide 274 Product design and distribution obligations, and
- Internal dispute resolution processes and reporting (IDR) – see Regulatory Guide 271 Internal dispute resolution.
ASIC identified widespread poor practice in the compliance plans reviewed, stating that most plans failed to adequately address the most important requirements across all three sets of obligations considered. In particular, the treatment of responsible entities' DDO requirements, which has been a specific focus of ASIC in recent years (see our recent client alert here), was identified as the poorest of the three obligation sets, with 40% of plans not addressing DDO requirements at all.
ASIC set out eight questions for responsible entities to consider when developing, reviewing and modifying fund compliance plans:
- Does your plan identify all the obligations in operating the fund or funds?
- Does your plan identify the functions and the officers responsible for performing and monitoring each control?
- Does your plan specify how the performance of each control measure will be monitored?
- Does your plan identify an adequate frequency for performing each control and for the monitoring of that performance?
- Does your plan provide for the flow of useful information about control performance to the board or a compliance committee?
- Does your plan require adequate record keeping?
- Does your plan contain sufficient detail?
- Is your plan up to date?
In their review ASIC set out examples of 'poor' and 'better practice' in relation to each question, and praised compliance plans that included features such as customised structure level documentation relevant to each scheme. While responsible entities are permitted to use a 'master compliance plan' across multiple schemes, ASIC identified deficiencies in master plans where they did not adequately address compliance measures in relation to the structure of a responsible entity's operations. Similarly, the Review identified compliance plans that set out clear compliance controls and responsibility for each control, including the person responsible for implementing controls, the methods of implementing them, and a different person responsible for monitoring performance of controls, as best practice.
Compliance plans should also provide for regular reporting to a board or compliance committee on the operations of compliance controls, specifying the metrics to be included in such reports and what analysis of the effectiveness of controls will be included.
ASIC's Review underscores that compliance plans must function as dynamic tools that underpin scheme governance and a responsible entity's obligations. Responsible entities should treat the development and review of compliance plans as an ongoing strategic imperative which are embedded in governance frameworks and responsive to evolving regulatory landscapes. To adhere to their regulatory responsibilities and protect investors, this requires responsible entities at a minimum to:
- Identify all of their compliance obligations
- Document the adequate control measures developed to address each obligation, and
- Diligently implement and monitor the implementation of those controls.
A failure to have in place an adequate compliance plan can result in the risk of civil penalties, administrative action, and reputational damage, particularly in light of increased regulatory scrutiny. By not addressing deficiencies, responsible entities may increase the likelihood of harm to themselves and their investors.
What should I do?
Given ASIC's active engagement with reviewing compliance plans right now, it is crucial that responsible entities review their compliance plans and update them as necessary to ensure that they are comprehensive, up to date and fit for purpose. As ASIC Commissioner Alan Kirland said: "Failing to plan is planning to fail". In addition this is a timely reminder for responsible entities to ensure they are practically complying with their compliance plan procedures and record evidence of such compliance.
If you require any assistance in reviewing your compliance plan in light of ASIC's updated guidance, or part of a general review, our team is happy to help.
