Breach Reporting Under RG 78: A Practical Guide for AFSL Holders

Breach reporting is one of the most important—and sometimes most difficult—obligations for AFSL holders. Getting it wrong can lead to regulatory action and reputational damage. This guide explains ASIC's requirements for reporting 'reportable situations' under Regulatory Guide 78, including how to identify, assess, and report them correctly and on time.

What Is RG 78?

ASIC Regulatory Guide 78 (RG 78) sets out ASIC's expectations for how AFSL holders identify, assess, and report 'reportable situations' under the Corporations Act.

The current reportable situations regime came into effect on 1 October 2021. It replaced the previous 'significant breach' reporting obligation with a broader framework designed to ensure ASIC receives timely information about significant non-compliance and emerging risks in financial services.

What Is a Reportable Situation?

You must report a range of conduct that the law defines as 'reportable situations'. The types of reportable situations include:

• Significant breaches or likely significant breaches of 'core obligations'
• Investigations into whether there is a significant breach or likely breach of a core obligation if the investigation continues for more than 30 days
• The outcome of such an investigation if it discloses there is no significant breach or likely breach of a core obligation
• Conduct constituting gross negligence or serious fraud
• Conduct of financial advisers and mortgage brokers who are representatives of other licensees in certain prescribed circumstances

Core obligations include general obligations under s912A of the Corporations Act, such as providing financial services efficiently, honestly and fairly; managing conflicts of interest; maintaining adequate arrangements for client money; and having adequate risk management systems.

The 30-Day Reporting Requirement

You must lodge a report with ASIC within 30 calendar days after you first know that, or are reckless with respect to whether, there are reasonable grounds to believe a reportable situation has arisen.

The 30-day period starts when you first know (or are reckless about whether) reasonable grounds exist to believe a reportable situation has occurred—not when the breach itself occurred. This could be through internal monitoring, a client complaint, a file review, or information from a representative.

Missing the 30-day deadline is itself a breach of your licence obligations and can result in enforcement action. ASIC takes late reporting seriously because it affects the regulator's ability to respond to potential client harm.

Step 1: Identifying Breaches

Effective breach reporting starts with identification. Breaches can arise from many sources, including:

• File reviews and compliance audits: Regular reviews of advice files, transactions, and processes may uncover breaches of advice obligations, disclosure requirements, or licensing conditions
• Client complaints: Complaints can indicate breaches of conduct obligations, disclosure failures, or systemic supervision issues
• Representative misconduct: Issues identified through monitoring, client feedback, or internal reports
• Systems failures: Errors in disclosure documents, fee calculation errors, or technology failures that affect client outcomes
• Licence condition breaches: Operating outside your licence authorisations, failing to meet adequate resource requirements, or breaching specific conditions imposed by ASIC

As a Responsible Manager, you should ensure that staff and representatives understand their obligation to escalate potential breaches promptly. Delays in escalation can lead to late reporting. For more on the Responsible Manager's role in breach identification, see our guide on what a Responsible Manager does.

Step 2: Assessing Whether a Breach Is Reportable

Not every breach is reportable. Once a potential breach is identified, you must assess whether it is a reportable situation. There are two pathways for determining whether a breach of a core obligation is significant:

Deemed Significant Breaches

Certain breaches of core obligations are automatically taken to be significant ('deemed significant breaches'). If a breach is deemed significant, you must report it to ASIC—no additional assessment of significance is required. Deemed significant breaches include:

• Breaches constituting an offence punishable by imprisonment for three months or more (if involving dishonesty) or 12 months or more (in any other case)
• Breaches of civil penalty provisions (subject to certain exclusions for minor contraventions)
• Misleading or deceptive conduct in contravention of s1041H(1) of the Corporations Act or s12DA(1) of the ASIC Act (subject to relief for minor, isolated contraventions)
• Breaches resulting in material loss or damage (or likely to result in material loss or damage) to clients, members of a managed investment scheme, or members of a superannuation entity

The 'material loss or damage' test covers financial and non-financial loss. Whether a breach results in material loss or damage depends on the person's circumstances. If a breach affects several people, it is sufficient if the breach is likely to result in material loss or damage to one person, or if the total loss when aggregated across multiple people amounts to material loss or damage.

Other Breaches That May Be Significant

If a breach is not deemed significant, you must still assess whether it is significant by considering factors including:

• Number or frequency: Is this an isolated breach or part of a pattern?
• Impact on clients: Has the breach caused, or is it likely to cause, harm to clients?
• Extent of the breach: How widespread is the non-compliance?
• Actual or potential financial loss: What is the financial impact on clients?
• Nature and seriousness: Does the breach relate to a core obligation such as best interests duties or conflicts of interest?
• Systemic issues: Does the breach indicate broader problems with your compliance framework?

Reportable Investigations

In addition to significant breaches themselves, you must report investigations into whether there is a significant breach or likely breach of a core obligation if the investigation continues for more than 30 days.

Once an investigation becomes a reportable situation (on day 31), you have 30 days from that point to report it to ASIC. This means the report is typically due around day 60 of the investigation. You must also report the outcome of the investigation within 30 days after it concludes. Importantly, if the investigation discloses that there is no significant breach or likely breach of a core obligation, you must still report that outcome to ASIC.

Additional Reportable Situations

Beyond breaches of core obligations, you must also report:

• Gross negligence: Conduct constituting gross negligence must be reported regardless of whether it breaches a core obligation
• Serious fraud: Conduct constituting serious fraud must be reported regardless of whether it breaches a core obligation
• Other prescribed circumstances: The regulations may prescribe additional reportable situations

Common Examples of Reportable Situations

While every situation is different, the following scenarios often result in significant breaches:

• Failure to act in clients' best interests: Providing advice that prioritises commission or licensee interests over client outcomes
• Inadequate advice: Providing personal advice without conducting a reasonable investigation or failing to have a reasonable basis for the advice
• Disclosure failures: Failing to provide required disclosure documents (FSG, SOA, PDS) or providing inaccurate disclosure
• Conflicts of interest: Failing to identify, disclose, or manage conflicts that could influence advice or product recommendations
• Unauthorised activities: Operating outside your AFSL authorisations, such as dealing in products you are not licensed to offer
• Fee-for-no-service: Charging ongoing fees without providing the agreed services
• Inadequate supervision: Systemic failures in monitoring and supervising representatives, leading to client harm

Step 3: Reporting the Reportable Situation to ASIC

If you assess a situation as reportable, you must lodge a report with ASIC within 30 days using the prescribed form through the ASIC Regulatory Portal. The report should include:

• Description of the reportable situation: What occurred, how it occurred, and which obligations were breached (if applicable)
• When you became aware: The date you first knew, or were reckless with respect to whether, there were reasonable grounds to believe a reportable situation had arisen
• Assessment of significance: For breaches that are not deemed significant, explain why you consider the breach to be significant, including the impact on clients
• Affected clients: The number and nature of clients affected
• Remediation steps: What you have done or plan to do to address the situation and compensate affected clients
• Root cause analysis: Why the breach or other reportable situation occurred and what steps you are taking to prevent recurrence

The quality and completeness of your report can affect ASIC's response. Clear, detailed reports that demonstrate you have taken the issue seriously are viewed more favourably than vague or incomplete submissions.

What Happens After You Report?

Once you lodge a report for a reportable situation, ASIC will review it and may:

• Request additional information or documents
• Conduct further investigation or surveillance
• Take no further action if satisfied with your remediation and prevention steps
• Take regulatory action, such as imposing additional licence conditions, issuing infringement notices, or commencing enforcement proceedings

ASIC's response depends on the seriousness of the reportable situation, the adequacy of your remediation, and whether it indicates broader issues with your organisational competence. For more on organisational competence, see our guide on RG 105 explained.

What If You're Unsure Whether a Situation Is Reportable?

Assessing whether a situation is reportable can be difficult, especially when circumstances are complex or unclear. If you are unsure, consider:

• Erring on the side of caution: If the assessment is borderline, reporting demonstrates that you take compliance seriously
• Seeking legal or compliance advice: An external adviser can help you assess whether a situation is reportable and ensure your report is comprehensive
• Documenting your assessment: Even if you decide not to report, document why you assessed the situation as not reportable—ASIC may review this decision later

Remember, failing to report a reportable situation is itself a breach. Under-reporting is a more serious compliance risk than over-reporting.

Building an Effective Breach Identification and Reporting Framework

To meet your RG 78 obligations, you need more than just a breach reporting policy. You need an embedded framework that ensures reportable situations are identified, assessed, and reported promptly. Key elements include:

1. Clear Escalation Paths

Staff and representatives must know how to escalate potential reportable situations. This includes clear guidance on who to report to, what information to provide, and the urgency of escalation.

2. Regular Monitoring and File Reviews

Proactive monitoring helps identify reportable situations before they become systemic. Regular file reviews, transaction monitoring, and client feedback mechanisms are essential.

3. Breach Register

Maintain a breach register that records all identified breaches, whether or not they are reportable. This register should include the date identified, the assessment of whether it is reportable, remediation steps, and (if reported) the report reference.

4. Training and Awareness

Ensure that Responsible Managers, compliance officers, and representatives understand their breach reporting obligations. Regular training and updates help maintain awareness and competence.

5. Root Cause Analysis and Prevention

Don't just report reportable situations—analyse why they occurred and implement changes to prevent recurrence. ASIC expects to see evidence that you are learning from breaches and improving your compliance framework.

How Training Supports Breach Reporting Compliance

Understanding the reportable situations framework is a critical skill for Responsible Managers and compliance professionals. The Clearwise AFSL Bootcamp includes a dedicated module on breach identification and reporting under RG 78, covering:

• How to identify potential reportable situations in day-to-day operations
• Frameworks for assessing whether a breach is deemed significant or otherwise reportable
• Practical examples and common scenarios
• Steps for reporting to ASIC correctly and on time through the ASIC Regulatory Portal
• Building effective breach identification and remediation systems

The course is self-paced and includes CPD certificates to document completion—useful for evidencing ongoing competence in breach reporting.

Key Takeaways

• You must report 'reportable situations' to ASIC within 30 days after you first know, or are reckless with respect to whether, there are reasonable grounds to believe a reportable situation has arisen
• Reportable situations include significant breaches of core obligations, investigations continuing beyond 30 days, gross negligence, and serious fraud
• Some breaches are 'deemed significant' and automatically reportable—no additional assessment is required
• For other breaches, significance is assessed based on factors including impact on clients, frequency, and systemic issues
• Effective breach identification starts with clear escalation paths, regular monitoring, and a culture of compliance
• Documenting your assessment and reporting promptly protects you from further enforcement action
• Training and ongoing professional development help Responsible Managers and compliance officers meet their RG 78 obligations with confidence

Further Reading

• What Does a Responsible Manager Do?
• RG 105 Explained: Organisational Competence and Responsible Manager Options
• ASIC RG 78: Breach Reporting by AFS Licensees
• ASIC: Breach Reporting for AFS Licensees