“You have to report a breach, regardless of materiality, regardless of impact, regardless of who is affected.”
— Chief Risk & Governance Officer, “State of Financial Services Breach Reporting in Australia”, Gadens/Coredata 2022
This article is Part 3 of our Breach Reporting series clarifying the operation of the breach reporting regime by exploring:
- How to identify a ‘significant breach of a core obligation’ and being ‘unable to comply with a core obligation’ (Part 1),
- The obligation to report ‘reportable investigations’, ‘gross negligence and serious fraud’ and reporting other licensees (Part 2).
- The obligation to commence investigations, notify affected clients and conduct remediation (Part 3).
- Reporting to ASIC and connected publication (Part 4).
Reportable situations
We covered reportable situations in Part 1 and 2 of the series and in this article we’ll cover:
- The obligation to notify certain affected clients,
- The obligation to commence an investigation, and
- The obligation to remediate
Importantly, in this article we will also cover the concepts of: “knowledge” and “recklessness”.
The obligation to notify affected clients
Section 912EA of the Corporations Act states a financial services licensee must take reasonable steps to notify an affected client of a reportable situation if:
- The licensee or a representative of the license have provided personal advice to the affected client as a retail client in relation to a relevant financial product, and
- There are reasonable grounds to believe that the reportable situation constituted by a significant breach of a core obligation or gross negligence or serious fraud,
- There are reasonable grounds to suspect that:
- The affected client has suffered, or will suffer loss or damage as a result, and
- The affected client has a legally enforceable right to recover the loss or damage from the licensee.
A notice given under this requirement is to be given in writing within 30 days after the financial services licensee first knows of, or is reckless with respect to, the circumstances listed above.
The legislation ‘leaves the door open’ for ASIC to prescribe a form in which the notice must be given and the material which must accompany the notice.
ASIC Information Sheet 259 (INFO 259) provides that the notice should:
- Explain the nature of the breach identified and any related breaches,
- Describe how the breach affected the client’s interests, and
- Assess the loss or damage you reasonably believe the affected client is entitled to seek or recover.
The obligation to investigate
Section 912EB of the Corporations Act 2001 (Cth) (Corporations Act) states that a financial services licensee must conduct an investigation into a reportable situation if:
- The licensee or a representative of the license have provided personal advice to the affected client as a retail client in relation to a relevant financial product, and
- There are reasonable grounds to believe that the reportable situation is constituted by a significant breach of a core obligation or gross negligence or serious fraud, and
- There are reasonable grounds to suspect that:
- The affected client has suffered, or will suffer loss or damage as a result, and
- The affected client has a legally enforceable right to recover the loss or damage from the licensee.
Licensees must commence the investigation within 30 days after the licensee first knows of, or is reckless with respect to, the circumstances listed above.
Pause here.
Let’s consider the interplay between the ‘obligation to notify affected clients’ and the ‘obligation to investigate’.
As we can see, both these obligations are triggered by the same conditions. Therefore, if there is an obligation to investigate, we may also need to notify affected clients within 30 days unless we determine there is no reportable situation in that 30-day period.
To assist in our analysis, we will turn to the scenario below.
Managing problems like Magic
Magic Financial (Magic) audited ten (10) client files of a servicing advisor that acts as their authorised representative.
They identified contraventions of the ‘Best Interests Duty’ (BID) in two (2) out of the ten (10) audited client files (BID Files).
- Two contraventions are constituted by advice to switch from an industry superannuation fund to a self-managed superannuation fund (SMSF) and purchase property within the SMSF using a limited recourse borrowing arrangement (LRBA).
- A property purchased by the first client under an LRBA was re-zoned favourably and has performed exceptionally well. This means no loss or damage was incurred because of the non-compliant advice.
- A property purchased by the second client underperformed relative to their industry fund and in fact lost value, meaning the non-compliant advice caused loss or damage to the affected client.
The adviser dismissed the identified BID failures as “historical contraventions” and emphasised that they were “just following client instructions”.
As detailed in Part 1 of our series, the contraventions under this scenario constitute significant breaches of a core obligation and therefore are deemed to be a reportable situation.
Does the scenario require that Magic notify affected clients and investigate further?
The BID Files were audited, and as a result of the findings we need to ask:
- Is Magic required to notify the affected clients? and
- Is Magic required to commence an investigation into more of the servicing adviser’s client files as a result of the circumstances of the scenario and, in particular, the BID Files?
Is Magic required to notify the affected client?
Was personal advice provided to a retail client?
Yes. The scenario involves an authorised representative of Magic providing personal advice to retail clients, satisfying the first threshold question under section 912EA.
Does Magic know of, or is Magic reckless with respect to, reasonable grounds to believe there is a reportable situation? Is that reportable situation a significant breach of a core obligation or gross negligence or serious fraud?
Yes. Magic knows of the BID failures.
As previously stated, a BID contravention constitutes a significant breach of a core obligation and therefore the BID Files satisfy the second threshold question under section 912EA.
In our view, Magic will not be reckless with respect to the risk that the servicing adviser has contravened the BID on further occasions for the purposes of section 912EA if Magic commences an investigation under section 912EB. This is because:
- Magic is not “taking the risk” by commencing an investigation into the risk in accordance with the parameters set by section 912B, or, in the alternative,
- Magic is justified in taking the risk because it is investigating that risk in accordance with the parameters set by section 912B.
We’ll unpack the concepts of knowledge and recklessness in detail below.
Does Magic know of, or is Magic reckless with respect to, reasonable grounds to suspect that the affected client has or will suffer loss or damage?
Based upon the information we have, the first client did not suffer loss or damage. Furthermore, because the property was re-zoned favourably it is reasonable to expect that the first client will not suffer loss or damage in the future.
This means that Magic is not legally obliged to notify the first client of the BID File in our scenario.
It is important to note that the word “suspect” imposes a lower threshold than the word “believe”. This means that if we think there is a distinct possibility that the affected client has suffered loss, or will suffer a loss in the future, then this test is satisfied, and we would be required to notify the affected client.
The second client in the scenario has suffered a loss and must therefore be notified by Magic.
Is Magic required to commence an investigation?
Magic does not need to investigate the BID Files themselves, as these files were already audited, and a finding was made.
Was personal advice provided to retail clients?
Yes. We know that the servicing adviser provides personal advice to retail clients.
Does Magic know of, or is Magic reckless with respect to, reasonable grounds to believe there is a reportable situation? Is that reportable situation a significant breach of a core obligation or gross negligence or serious fraud?
This is where it can get tricky.
‘Knowledge’
Under the new breach reporting regime, ‘knowledge’ and ‘recklessness’ take their meaning prescribed by the Criminal Code Act 1995 (Cth) (Criminal Code). Therefore, Magic will ‘know’ when Magic:
‘…has knowledge of a circumstance or a result if he or she is aware that it exists or will exist in the ordinary course of events’
‘Reasonable grounds’
The threshold of ‘reasonable grounds to believe’ creates an objective test. If there are facts or evidence that would lead a reasonable person to a belief that there is a reportable situation, then this test is satisfied.
Applying the test for ‘knowledge’
The BID Files themselves do not constitute facts or evidence that will lead Magic to believe there is another BID failure in relation to another client. In other words, Magic cannot be said to know of facts or evidence of another BID failure based upon the BID Files alone.
So, we must ask whether Magic is reckless with respect to there being another BID failure in relation to another client.
‘Recklessness’
“Recklessness” under section 912EB of the Corporations Act takes its meaning under section 5.4 of the Criminal Code. Therefore, Magic will be ‘reckless’ with respect to circumstance if Magic:
‘…is aware of a substantial risk that circumstance exists or will exist; and having regard to the circumstances known to him or her, it is unjustifiable to take the risk (the question of whether taking the risk is unjustifiable is one of fact)’
Applying the test for ‘recklessness’
In view of the above we must ask; is Magic aware of a substantial risk that facts or evidence of a BID failure in relation to another affected client?
A risk is substantial if a reasonable observer would have taken it to be substantial at the time the risk was taken.
Unfortunately, the Criminal Code requirement of ‘substantial risk’ appears to have been chosen for its indeterminacy of meaning. That is to say, there is no clear cut, ‘one-size-fits-all’ when defining substantial risk.
The case law regarding ‘substantial risk’ oscillates between the requirement that the anticipated result must have been ‘likely’ or ‘probable’ and the lesser requirement that it be merely ‘possible’.
In the case of Hann v Commonwealth of Australia [2014] SASC 86 (Hann), Gray J held:
“The phrase “substantial risk” raises the same issues of indeterminacy as the terms “likely” and “probable” in the common law. Academic and judicial commentary on the meaning of these terms is diverse…Many agree that “substantial risk” can include “possible risk” in offences other than murder”
Further
“The term “substantial risk” does not appear to be defined in Australian legal dictionaries. However, Carswell’s Words and Phrases, an American legal dictionary, describes the phrase as meaning “real and apparent on the evidence presented … not a risk that is without substance or which is fanciful or speculative”. The word “substantial” has been described in Australian legal dictionaries as “real or of substance as distinct from ephemeral or nominal”. “Risk” has been described as “a possibility, chance or likelihood”.[10]
Neither the relevant Explanatory Memorandum nor ASIC Regulatory Guide 78 (RG 78) provide express guidance on this distinction.
In our view, a “substantial risk” for the purpose of establishing recklessness under section 912EB(2) of the Corporations Act means a substantial possibility of an anticipated result eventuating. Not a mere or remote possibility, but a possibility that is supported by a substantial degree of likelihood.
There is very little case law which explores the justification for risk. However, justification is assessed in reference to the social utility of the risk.
It is highly unlikely that a licensee that chooses not to investigate whether a client has suffered material harm will be able to adequately justify this risk as being for the greater good.
What does ASIC say?
ASIC Regulatory Guide 78 (RG 78) provides an example of recklessness (Example 9) which involves a licensee that is aware of a software issue which leads to the significant overcharging of some clients. It’s unclear if it has affected more clients than those initially identified by the Licensee.
In this scenario, the licensee’s failure to investigate is seen to constitute reckless conduct because the licensee is aware of a systemic failure which affected multiple clients (and chooses not to investigate the scale and impact of that failure).
Systems of conduct or patterns of behaviour
The presence of a system of conduct or a pattern of behaviour resulting in compliance failure will likely ‘substantiate’ the possibility of further compliance failure. The Full Court of the Federal Court of Australia addressed and defined these concepts in the case of Unique International College Pty Ltd v Australian Competition and Consumer Commission [2018] FCAFC 155, as follows:
“A ‘system’ connotes an internal method of working, a ‘pattern’ connotes the external observation of events”
Beach J provides further guidance on a ‘system of conduct’ and ‘patterns of behaviour’ in the case of Australian Securities and Investments Commission v AGM Markets Pty Ltd (in liq) (No 3) [2020] FCA 208, stating:
“System’ connotes something designed or intended in its structure; contrastingly a pattern may be manifested without any design or intentional input”
Turning to our scenario, the misconduct of Magic’s authorised representative cannot be said to be a ‘system of conduct’ because it is not constituted by an internal design or structure. Furthermore, the BID issue is not (necessarily) a result of a failure of Magic’s compliance systems, which include systems which supported the servicing adviser, because Magic identified the BID failures.
With respect to patterns of behaviour, Beach J further stated:
“The reference to behaviour is looking at the external manifestation of behaviour and whether it can be characterised as a pattern. …
The meaning of pattern is most usefully expressed as ‘a regular and intelligible form or sequence discernible in certain actions or situations’ (Oxford English Dictionary, meaning 11(b)). So, there must be both repetition and external discernibility. How is a pattern of behaviour to be proved?
Clearly, two or more instances of identical or similar behaviour may be sufficient to infer and discern a pattern. … How many instances will support the induction of a pattern depends upon the context.”
So, are the compliance failures identified by Magic identical, similar and/or predictably repetitive?
Answering this question requires an evaluation of all the material circumstances, including
- timing,
- the adviser’s compliance history,
- the adviser’s understanding of BID, and
- specific externalities which may have impacted the adviser’s conduct and process.
If the question is answered in the affirmative, the conduct of the servicing adviser may constitute a pattern of behaviour ‘substantiating’ the possibility of further compliance failures and obliging Magic to investigate further.
In our scenario, Magic must also consider the fact that the adviser does not understand their Best Interests Duty but this would generally manifest as a pattern of behaviour and an increased incidence of additional compliance issues.
Are there reasonable grounds to suspect that the affected client has or will suffer loss or damage?
If another BID failure exists, the nature of this contravention will mean there are reasonable grounds to suspect that the affected client has or will suffer loss or damage.
Matters to be considered in the investigation
Section 912EB(3) of the Corporations Act provides that in conducting an investigation, licensees must:
- Identify the conduct that gave rise to the reportable situation,
- Quantify the loss the client can reasonably be believed to have suffered or will suffer as a result of the reportable situation, that the affected client has a legally enforceable right to recover from the licensee, and
- Do anything else prescribed by the regulations (at the time of writing no regulations apply)
Notifying an affected client
Licensees must take reasonable steps to give the affected client, subject to the investigation, notice of the outcome in writing within 10 days after the completion of the investigation.
Current legislation ‘leaves the door open’ for ASIC to prescribe the content of notification to an affected client under this provision, however, at the time of writing ASIC has not done so.
Of further note, licensees have qualified privilege when notifying affected clients under these provisions, meaning that – in the absence of malice – the licensee cannot be held liable for defamation in connection to the contents of the notification.
Is Magic required to conduct remediation?
Compensating an affected client
What happens if the investigation finds reasonable grounds to believe that the affected client has suffered, or will suffer a loss and is entitled to recover that loss from us as the licensee?
In this case, section 912EB(8) prescribes that we must take reasonable steps to remediate the affected client within 30 days of the completion of the investigation.
This means Magic is required to remediate the second client by an amount equal to their loss or damage.
For clients that fall outside the scope of the obligation to remediate, such as the first client in our scenario, INFO 259 provides that licensees must consider the existing remediation framework in deciding whether it is efficient, honest and fair to remediate.
As always, the licensee must keep sufficient records to demonstrate their compliance with the obligation to notify, investigate and remediate.
Managing breaches can be surprisingly complex, if you need expert assistance, don’t hesitate to reach out to us.
