TLDR: ASIC’s 2026 enforcement priorities put specific conduct problems in its sights, but the more important message for AFSL and credit licensees sits underneath them. ASIC continues to identify systemic compliance failures, emerging conduct risks and governance failures as enduring enforcement priorities. Its growing use of data, its focus on AI and operational resilience, and recent cases such as ASIC v Choosi Pty Ltd all point in the same direction: policies remain necessary, but regulators increasingly expect businesses to demonstrate that they identify, control, monitor, and act on foreseeable risks.
Key Insight
I’ve often wondered whether we only become adults when we realise that the simple truths of childhood can’t endure in an environment defined by ambiguity, equivocation and contradiction. Apropos of nothing, ASIC wants to be easier to deal with for businesses trying to comply, while at the same time investing time and resources to become much harder to avoid.
Over the past few months, we’ve been tracking a regulatory direction that’s becoming increasingly difficult for licensees to ignore.
Our July Regulatory and Compliance Update confirmed the regulatory movement towards more continuous, data-driven supervision. Platforms and licensees increasingly have information that can identify product concentrations, unusual advice-fee patterns, replacement activity, recurring documentation failures, and advisers generating disproportionate complaints. Since 2012, we’ve written about this shift to data-driven supervision and the regulators’ increasing expectations of gatekeepers. This early recognition underpinned our development of [complye] as a licensee’s compliance platform. For licensees already collecting this information, the governance question is whether it is aggregated, interrogated and acted on when it reveals changing or recurring risk.
Our August 2026 Regulatory and Compliance Update progressed this idea by highlighting that Regulators were increasingly testing whether frameworks operated effectively in practice. For example, ASIC’s complex-product surveillance identified weaknesses in onboarding, monitoring and disclosure. ASIC and APRA warned that awareness of emerging AI risks needed to translate into action. The broader lesson is simple: compliance infrastructure (frameworks, arrangements and oversight) needs to produce evidence of action.
Then, in Easier To Deal With. Harder To Avoid, we considered the strategic explanation. We highlighted that ASIC’s 2026–27 Corporate Plan promises less unnecessary regulatory friction and more regulatory activity underpinned by better data, analytics, intelligence and faster enforcement. ASIC intends to become both a better friend and a worse enemy.
Thankfully, ASIC’s 2026 enforcement priorities show where that strategy is likely to bite, and there’s a broader message you shouldn’t miss.
What is ASIC actually targeting in 2026?
ASIC’s specific 2026 enforcement priorities include misleading pricing practices, poor private credit practices, financial reporting misconduct, insurance claims and complaints failures, and ongoing action related to the Shield and First Guardian collapses.
Continuing priorities include insider trading, misconduct exploiting consumers facing financial difficulty, unlawful practices affecting small-business creditors, superannuation member-service failures and auditor misconduct.
That’s a diverse list, and it’d be easy for a financial advice licensee, mortgage broker or smaller AFSL holder to scan it and conclude that much of it has little relevance to their business. That would be a mistake.
ASIC also maintains enduring enforcement priorities. These include misconduct involving a high risk of significant consumer harm, systemic compliance failures, new or emerging conduct risks within the financial system, and governance and directors’ duties failures.
Those enduring priorities are arguably more useful for understanding ASIC’s direction.
The annual priorities tell you where ASIC currently sees particular issues, but the enduring priorities are arguably more useful for understanding ASIC’s direction and how ASIC thinks about problems.
The common denominator is governance.
If you look past the subject matter of ASIC’s individual priorities, a consistent control problem emerges.
Poor private credit practices aren’t simply a private credit problem. They raise questions about due diligence, conflicts, valuation, disclosure, product governance, monitoring and board oversight.
Insurance complaints failures aren’t simply complaints problems. They raise questions about whether systems identify complaints, allocate them correctly, monitor timeframes, recognise vulnerable customers and escalate recurring failures.
Shield and First Guardian aren’t relevant only to superannuation trustees or managed investment schemes. They raise broader questions about product due diligence, distribution, adviser supervision, referral arrangements, warning signs and what happens when risk changes.
Financial reporting failures raise questions about management information, accountability and governance.
The subject matter changes but the governance failures don’t.
That doesn’t mean every enforcement priority creates the same legal obligation for every licensee. The useful exercise is to distinguish the specific conduct ASIC is targeting from the recurring governance questions beneath it: who owns the risk, what control addresses it, what evidence shows the control worked, and what happens when the evidence suggests it did not.
The Federal Court’s September decision in ASIC v Choosi Pty Ltd [2026] FCA 1196 provides a timely illustration from another direction.
Choosi argued, among other things, that disclosures, PDS material and subsequent customer interactions qualified representations about the breadth of its insurance comparison service. The Court assessed the representations in their context and the impression conveyed to ordinary and reasonable consumers.
The relevant question wasn’t simply whether individual words could be technically defended. It was what an ordinary and reasonable consumer would understand from the service and its marketing as a whole.
That critical lesson is that subsequent disclosures don’t necessarily repair an earlier misleading impression.
We’ve consistently argued that the substance of your compliance arrangements is far more important than their form. Controls can’t only be defensible when examined in isolation; they need to work in the context in which the risk actually arises.
That’s as relevant to advice processes, complaints, AI and privacy as it is to marketing.
Where does AI fit into ASIC’s enforcement priorities?
Artificial intelligence isn’t separately listed among ASIC’s specific 2026 enforcement priorities, but that doesn’t make it a peripheral concern.
AI risk sits within ASIC’s broader focus on effective, resilient and innovative operations across financial services and markets, while ASIC and APRA have separately urged entities to strengthen their preparedness for frontier-AI-related cyber, technology and operational risks. More fundamentally, as our August Update highlighted, AI is a clear example of ASIC’s enduring concern with new or emerging conduct risks within the financial system.
ASIC and APRA warned financial market entities on 27 August 2026 that awareness of frontier AI risk needed to translate into action. More than 600 participants across nine industry roundtables had identified rapidly evolving cyber, technology and operational risks associated with frontier AI.
The message isn’t to stop using AI. But to simply understand what you’re introducing (and govern it properly).
ASIC had already reached a similar conclusion in Report 798, Beware the gap: Governance arrangements in the face of AI innovation. Its review of 624 AI use cases across 23 financial services and credit licensees identified rapid adoption and a movement towards increasingly complex and opaque technologies.
ASIC’s concern was that governance arrangements weren’t necessarily keeping pace.
The “governance gap”, and how new technology is accommodated within your compliance arrangements, is the real AI compliance problem. AI doesn’t invalidate existing financial services, credit, privacy, consumer-protection and directors’ obligations; they continue to apply.
Consider something relatively mundane such as introducing an AI tool to summarise client meetings. Suppose the summary omits material information, incorrectly records client preferences, adjusts advice documentation without verification or summarises (without recognising or escalating) a client complaint.
None of these risks is solved by writing an “AI Policy”, because the control questions are more practical:
- Who can use the system?
- What information can be entered?
- What testing occurred before deployment?
- When must outputs be independently verified?
- What records are retained?
- How are incidents identified?
- How is third-party provider risk managed?
- Who owns the control?
- What information does the board or Responsible Manager receive?
- And what happens when the risk changes?
These are governance issues that extend far beyond workflow management and model selection.
What does the AMEX privacy determination add?
A client recently asked us about what the AMEX privacy determination means in terms of ASIC’s priorities.
First, it wasn’t an ASIC enforcement action. It’s a determination by the Australian Privacy Commissioner under the Privacy Act 1988, but it’s still important because it reinforces the same governance principles that ASIC do.
The lesson from AMEX isn’t that organisations need more policies. The OAIC expressly observed that effective management of insider risk “requires more than organisational policies or staff training”. The question is whether the controls actually constrain, detect and evidence inappropriate access.
The Privacy Commissioner found that American Express Australia failed to take reasonable steps to protect a customer’s personal information from unauthorised employee access, contrary to Australian Privacy Principle 11.1.
Importantly, the risk came from inside the organisation. The employee had legitimate access to AMEX systems. The problem was whether the organisation didn’t have adequate controls to prevent or detect use of that access for purposes unrelated to legitimate business activities.
There’s a deceptively important lesson here that Compliance people know, but managers often overlook. It’s this. Telling employees not to misuse information isn’t necessarily an adequate control against misuse.
A confidentiality clause isn’t an access control. A privacy policy isn’t monitoring. Training isn’t necessarily prevention. A procedure isn’t evidence that prohibited conduct can be detected.
For financial services businesses holding identity documents, bank details, financial information, advice records and sometimes highly sensitive personal information, insider risk should therefore be treated as an operational risk rather than merely an employment or privacy issue. Incidentally, the determination required additional technical controls, including the capacity to restrict employee access to particular customer information and account-level access and action logging.
What connects enforcement, AI, privacy and Choosi?
The answer is control effectiveness.
We’ve said it before, but having an advice monitoring policy doesn’t mean the monitoring identifies problems or recurring issues. Maintaining a conflicts register doesn’t prove that conflicts are adequately identified, assessed, controlled or managed.
Congratulations, you’ve got an outsourcing policy, but has anybody tested or assessed the provider’s performance? Let’s look at your AI policy. Has anybody validated the AI outputs or employees’ use of AI?
The same applies to your privacy policy, marketing approval process, and complaints procedure.
A series of small advice-review failures may appear unremarkable individually, but the substance of your compliance arrangement becomes even more important as ASIC improves its ability to connect regulatory information.
ASIC is investing in its ability to see that picture, and you need to do the same.
You may have this problem if: complaints are closed without trend analysis; advice reviews are reported mainly as pass/fail results; incidents, breaches and monitoring findings sit in separate registers; or management cannot readily explain whether the same control failure is recurring across advisers, products or teams.
Why does pattern detection matter?
This is where ASIC’s enforcement priorities connect directly to the regulatory developments we identified in July.
Our July Regulatory and Compliance Update concluded that data-driven supervision was beginning to replace reliance on purely periodic compliance review. ASIC’s DDO interventions, platform governance developments, AFCA complaints information, and advice-review commentary all pointed in the same direction: firms should aggregate information to identify emerging risk before it causes widespread harm.
Licensees increasingly hold information capable of revealing:
- abnormal product concentrations;
- recurring advice-fee patterns;
- unusually high replacement activity;
- repeated documentation and evidence deficiencies;
- disproportionate complaints;
- recurring failed controls; and
- clusters of problems associated with particular advisers, products, branches, lead sources or referral partners.
Not using that information available to you is increasingly becoming its own governance risk. In fact, ASIC’s enduring focus on systemic compliance failures makes that capability even more critical.
You can’t reliably identify a systemic failure by only looking at individual incidents. You need aggregation. That means advice monitoring shouldn’t merely record whether File 47 passed or failed; you need more perspective and context.
Complaints shouldn’t merely be closed. Incidents shouldn’t disappear once remediated. Breaches shouldn’t sit in a register disconnected from monitoring findings. Controls shouldn’t simply be marked “completed”.
The information needs to tell management something.
- Are particular advisers failing for the same reason?
- Is one product producing disproportionate complaints?
- Are the same disclosure problems recurring?
- Are issues concentrated in one branch or team?
- Do repeated incidents point to a badly designed control rather than individual error?
- Are exceptions increasing?
- Is remediation actually changing the outcome?
- In July, we described the direction as continuous, evidence-based supervision, and in August we emphasised that regulators now expect your frameworks to produce evidence of action.
That means management information needs to demonstrate a chain like this:
risk identified → responsibility allocated → remediation completed → effectiveness tested → closure evidenced
Anything less creates the possibility that a licensee can repeatedly identify risks without actually controlling or preventing them.
Compliance needs to become observable.
This is one reason we’ve consistently argued that compliance data should be treated as management information, rather than a collection of separate regulatory registers.
Advice reviews, complaints, incidents, breaches, exceptions, adviser risk ratings, product information and control testing shouldn’t operate as separate compliance universes.
Together, they tell the board and Responsible Managers where the organisation’s risk is changing.
ASIC is doing something similar at regulatory scale.
As we explained in Easier To Deal With. Harder To Avoid, ASIC’s Corporate Plan commits to modernising how it receives and triages reports of misconduct and combining that information with other sources, including reportable situations and dispute-resolution data.
ASIC also intends to expand its use of data analytics, machine learning and generative AI to identify risks earlier and support intelligence-led regulatory action.
That changes the regulatory dynamic.
ASIC doesn’t necessarily need more information from every licensee if it becomes better at identifying which licensees warrant closer attention. It doesn’t need to review every advice file if available information tells it where anomalies are concentrated. And it doesn’t need every failure to be individually serious if the aggregate evidence reveals something systemic.
This is also why solutions such as [complye] should do more than digitise compliance administration.
The opportunity lies in connecting obligations, risks, controls, monitoring, incidents and evidence so that patterns become visible before the regulator identifies them for you.
What should boards and Responsible Managers do now?
Start with ASIC’s enforcement priorities, consider them in toto, and ask yourself: “What do these priorities tell us about the risks ASIC expects regulated businesses to identify and control?”
For every material risk, you should ordinarily be able to identify:
- the risk — what might reasonably go wrong;
- the control — what prevents or detects it;
- the owner — who is responsible;
- the evidence — what demonstrates the control operated;
- the monitoring — how effectiveness is tested;
- the trigger — what suggests risk is increasing or the control is failing; and
- the response — what happens next.
Then make the exercise uncomfortable by exploring the limits of your oversight and activity.
- What happens if an adviser fails three reviews?
- What happens if the same deficiency occurs across five advisers?
- What happens if AI-generated material is wrong?
- What happens if an employee repeatedly views unrelated client records?
- What happens when complaints involving one product increase?
- What happens when a provider misses service standards?
- What happens if your disclosure is technically correct but the overall consumer impression is wrong?
There’s a more challenging, existential question to ponder: “What happens when the control identifies the problem but nobody acts?
Those questions reveal much more about your compliance framework than asking whether a policy has been reviewed and approved.
Easier to deal with doesn’t mean easier to satisfy
ASIC’s Corporate Plan, its enforcement priorities and its recent regulatory activity need to be read together. The Corporate Plan describes the regulatory machinery ASIC is trying to build while the enforcement priorities tell industry where ASIC intends to point it.
Our July and August Updates show the transition is already underway, and cases such as ASIC v Choosi Pty Ltd [2026] FCA 1196 remind us that courts will examine what regulated conduct actually communicates and produces, not merely whether individual documents or statements appear compliant when isolated from their context.
ASIC wants faster licensing, less unnecessary administrative burden and easier engagement with businesses genuinely trying to comply. At the same time, it is sharpening enforcement, integrating data and building better analytical capability.
When announcing its 2026 enforcement priorities, ASIC said that over the preceding 12 months it had doubled the number of new investigations and nearly doubled the number of new matters filed in court. So the bargain identified in Easier To Deal With. Harder To Avoid. remains the right way to understand the regulator’s direction.
Regulatory engagement may become simpler, but “flying under ASIC’s radar” may become much more difficult.
Well-managed licensees might welcome this change, but those businesses relying on policies they don’t follow, controls they don’t test, exceptions they don’t aggregate and management information they don’t interrogate should feel considerably less comfortable.
The most effective compliance infrastructure isn’t the compliance framework with the most policies, but the one that can show what its risks are, how they are controlled, whether those controls work, what the evidence says and what happened when they didn’t.
That’s increasingly what being “harder to avoid” requires.
Further reading
Frequently Asked Questions
A defensible framework should produce evidence that material risks are being identified, controlled, monitored and acted on—not merely evidence that policies, registers and reviews exist.
That distinction matters because individual compliance activities can be completed while the underlying risk continues. An advice review may be performed, a complaint closed or an incident remediated without anyone identifying that the same weakness is recurring across advisers, products or processes. ASIC’s current strategy emphasises earlier risk detection, better use of intelligence, and identifying patterns before harm becomes widespread.
A useful test is to take each material risk and trace the chain from risk → control → owner → evidence → monitoring → trigger → response. Then test whether management information shows what happens when controls fail. If repeated exceptions produce no escalation, root-cause analysis or change in control design, the framework may demonstrate activity without demonstrating effectiveness.
Yes. The headline priorities identify areas where ASIC intends to concentrate enforcement resources, but licensees should also consider the control and governance weaknesses those priorities expose.
ASIC’s 2026 priorities include misleading pricing, poor private credit practices, financial reporting misconduct, insurer claims and complaints failures, and continuing action concerning Shield and First Guardian. Continuing priorities include insider trading, misconduct affecting consumers in financial difficulty, unlawful conduct affecting small-business creditors, superannuation member-service failures and auditor misconduct. ASIC also retains enduring priorities addressing matters including systemic failures and significant consumer harm.
For a smaller AFSL, the practical exercise is therefore not to ask only, “Are we in private credit or insurance?” It is to ask whether comparable weaknesses exist in its own environment: inadequate due diligence, ineffective supervision, poor escalation, misleading communications, disconnected complaints data or controls that operate on paper but cannot be evidenced.
No. An AI policy may be part of governance arrangements, but it does not show that AI-related risks are controlled in practice.
ASIC’s REP 798 examined 624 AI use cases across 23 financial services and credit licensees and warned of a potential governance gap as AI adoption develops faster than governance arrangements. ASIC specifically highlighted matters including consumer impact and third-party supplier risk. In August 2026, ASIC and APRA went further on frontier AI, urging entities to move from awareness to action and emphasising tested preparedness, access controls, recovery arrangements and third-party risk management.
For a licensee, that makes implementation evidence important. It should identify approved uses, prohibited information, verification requirements, accountable owners, incidents, third-party dependencies and escalation triggers. If AI is used to produce meeting summaries or advice documentation, for example, the key control is not merely permission to use the tool but how material errors are detected before they affect records, advice or client outcomes.
Management should aggregate information that can reveal recurrence, concentration or deterioration across the business rather than treating each compliance event as an isolated transaction.
Depending on the business, useful sources may include advice-review findings, complaints, incidents, reportable situations, control-testing results, adviser risk assessments, product concentrations, replacement activity, exceptions and remediation outcomes. The purpose is not simply to create more dashboards. It is to answer questions that individual files cannot answer: Are failures concentrated around one adviser? Is one product generating disproportionate complaints? Is the same documentation deficiency appearing across multiple teams? Is remediation reducing recurrence?
ASIC itself is investing in earlier detection and better use of information to identify patterns and emerging issues. A licensee should therefore test whether its own management information distinguishes isolated errors from evidence of a potentially systemic control weakness.
Because the legal assessment can extend beyond isolated wording to the overall impression conveyed to consumers in context.
In ASIC v Choosi Pty Ltd (liability) [2026] FCA 1196, the Federal Court found Choosi falsely gave consumers the impression that its comparison service compared policies from a broader range of insurers than it actually did. ASIC says the products compared were overwhelmingly sourced from one insurer and distributed by an associated entity.
The governance implication reaches beyond comparison websites. Approval processes for websites, advertisements, advice communications and digital journeys should test the impression produced by the communication as a whole—not merely whether individual statements can be defended separately. A useful review question is: what would an ordinary and reasonable consumer understand us to be promising? That can expose risks that a clause-by-clause compliance review misses.
