2025 Unwrapped
2025 marked a clear shift from framework-based compliance to outcome-based enforcement across ASIC, APRA, AUSTRAC and AFCA.
Regulators consistently focused on whether controls worked in practice, not whether they existed. Enforcement activity targeted specific, provable failures , including poor advice documentation, unregistered adviser activity, ineffective DDO frameworks, cyber governance gaps, and AML/CTF control weaknesses.
AFCA outcomes reinforced that documentation remains the primary failure point, with decisions frequently turning on insufficient evidence rather than inherently inappropriate advice.
At the same time, APRA’s CPS 230 and ASIC’s cyber actions expanded compliance expectations to include operational resilience, outsourcing, and systems governance, while AUSTRAC advanced AML/CTF reforms toward effectiveness and implementation.
Industry pressure also intensified, with CSLR costs, adviser education deadlines, and ongoing regulatory burden impacting licensee sustainability.
Overall, 2025 confirmed that compliance is now judged on consistent, demonstrable outcomes supported by auditable evidence and operational data, not on policy design. Regulators expect proactive monitoring, early issue identification, and defensible evidence across all areas of operation.
Top 12 Regulatory Developments (2025)
1. ASIC Regulatory Priorities Set an Enforcement-Led Tone
ASIC’s Key Issues Outlook 2025 set the tone for the year by explicitly identifying governance, cyber resilience, and consumer harm as priority risk areas, signalling where surveillance and enforcement would be concentrated. Throughout 2025, ASIC reinforced these priorities through communications, advice updates and enforcement outcomes. These signals translated directly into regulatory action.
ASIC treated priorities as operational expectations. Surveillance and enforcement repeatedly identified weak governance oversight, ineffective monitoring and failures to identify and address consumer harm. Licensees must convert priorities into measurable controls, reporting and escalation.
Common failure examples include a lack of alignment between board reporting and ASIC priority areas, limited use of data to identify emerging risks, failure to escalate known issues, and governance frameworks that exist in form but not in practice.
Post 1 January 2026, ASIC is expected to test alignment to these priorities through targeted surveillance and thematic reviews. Firms that cannot evidence proactive monitoring and remediation in identified priority areas are more likely to be subject to enforcement or remediation programs.
Why it matters:
Priority misalignment creates immediate regulatory exposure. ASIC tests whether priorities are embedded through governance reporting, risk metrics and escalation. If these are not aligned, gaps are quickly identifiable through surveillance and often escalate into formal regulatory action.
2. Enforcement on Adviser Registration and Licence Controls
ASIC enforcement activity in 2025 highlighted weaknesses in basic licence controls, particularly in relation to adviser registration and key-person dependencies. This included outcomes such as ASIC 25-053MR and ASIC 25-293MR, where ASIC suspended the AFS licence of Focused Financial Advice Pty Ltd following governance failures. These actions reinforced that foundational licence obligations remain a core enforcement focus and are often used as an entry point for broader regulatory scrutiny.
ASIC treated failures in adviser authorisation, FAR accuracy and responsible manager coverage as governance failures, not administrative issues. Licensees must maintain real-time visibility over adviser status and activity.
Common failures include delayed FAR updates, weak onboarding and offboarding, reliance on key individuals without backup, and limited oversight of authorised representatives.
From 1 January 2026, ASIC will continue targeting licence condition breaches with low tolerance for basic control failures.
Why it matters:
Adviser authorisation and FAR accuracy are “binary” controls. Failures are easily evidenced and often lead directly to licence breaches. Weak onboarding, register maintenance, or key person coverage exposes the licensee to immediate enforcement action and questions about supervision adequacy.
3. “Cookie-Cutter” Advice Enforcement
The $11 million penalty against FIIG Securities Limited in ASIC 25-063MR for templated advice and conflicted remuneration structures reinforced ASIC’s focus on advice quality as an evidence-based obligation. This action is consistent with a broader pattern of ASIC enforcement and case law emphasising the need for genuinely client-specific advice, including earlier Federal Court outcomes such as ASIC v RI Advice Group Pty Ltd and ASIC v Westpac Securities Administration Ltd.
ASIC’s surveillance and public commentary throughout 2025 reinforced that advice models relying on standardisation or scale must still meet full best interests duty obligations. The regulator has repeatedly emphasised that efficiency and scalability do not justify reduced quality or generic outputs, particularly where recommendations cannot be clearly linked to client objectives and circumstances.
Common failure examples include generic risk profiles applied without justification, recommendations not linked to client objectives, boilerplate language replacing tailored reasoning, and incentives influencing product selection without a clear client benefit. These issues often indicate systemic weaknesses in advice frameworks rather than isolated adviser errors.
From 1 January 2026, ASIC is expected to intensify surveillance of advice files and licensee monitoring frameworks, with a focus on identifying systemic issues in advice quality and pursuing enforcement when patterns of templated or non-compliant advice are detected.
Why it matters:
Advice defensibility is determined at the file level. Where client-specific reasoning and benefit cannot be clearly evidenced, breaches are readily established and often indicate systemic control failures, increasing the likelihood of licence-wide remediation and enforcement.
4. DDO Enforcement Became Tangible
The Firstmac Limited penalty in ASIC 25-003MR marked a turning point for Design and Distribution Obligations, demonstrating that the regime has moved from guidance to enforcement. This action sat alongside broader ASIC activity in 2025, including increased use of stop orders, surveillance of target market determinations and ongoing scrutiny of distribution practices.
ASIC enforced DDO breaches and increased use of stop orders, confirming the regime operates as a monitoring and data-driven framework.
Licensees must oversee distribution, detect when sales fall outside the target market and act quickly. Static TMDs are insufficient without ongoing validation.
Common failure examples include selling outside target markets, failing to monitor distribution channels, inadequate TMD review triggers, failing to escalate issues when identified, and insufficient data to evidence product suitability and outcomes.
From 1 January 2026, ASIC will continue using DDO powers to test product governance in practice.
Why it matters:
DDO relies on data. If distribution data does not show alignment, firms face stop orders and penalties. Monitoring and remediation must operate continuously.
5. DBFO Fee Consent Changes Took Effect
The implementation of DBFO reforms in January 2025 changed ongoing fee arrangements, removing FDS and updating consent requirements.
.ASIC provided ongoing clarification throughout 2025, including updates to its fee consent guidance and FAQs and a limited no-action position in respect of certain written consent requirements.
ASIC focused on whether firms obtained valid consent, delivered services and kept clear records. The regulator linked fee compliance to actual service delivery.
This aligns with ASIC’s broader enforcement history regarding fees for no service, including ASIC v Westpac Securities Administration Ltd, which continues to inform expectations around fee integrity and client outcomes.
Common failure examples include obtaining consent outside required timeframes, relying on incomplete or inconsistent consent forms, failing to align the services delivered with the fees charged, and inadequate record-keeping to evidence client authorisation.
From 1 January 2026, ASIC will scrutinise whether firms can prove valid consent and delivered services.
Why it matters:
Fee compliance failures scale quickly. Invalid consent or misaligned service delivery creates systemic remediation exposure, with regulators focusing on whether firms can evidence timing, authorisation and actual service provision across entire client cohorts.
6. Adviser Education Deadline Pressure Intensified
The 31 December deadline forced firms to track adviser education status and manage transitions.
This was further complicated by the Treasury’s proposed reforms to education pathways, which introduced additional flexibility but did not remove the immediate compliance requirement for existing advisers. This created a period of uncertainty in which licensees had to manage both regulatory expectations and evolving policy settings.
The deadline created sustained pressure across the advice industry, with ASIC repeatedly reminding licensees of their obligation to ensure advisers met the education and training standards before the deadline. ASIC communications, including updates to the Financial Advisers Register and guidance on education standards, reinforced that, from 1 January 2026, advisers who failed to meet the standard would no longer be authorised to provide personal advice.
Common failures include inaccurate register data, late identification of non-compliant advisers, weak transition planning and poor client communication.
From 1 January 2026, any advice by non-compliant advisers will trigger clear breaches.
Why it matters:
Education status directly affects licence capacity. Licensees must track status in real time and manage transitions to avoid unauthorised advice.
7. Cybersecurity Became an Enforcement Issue
ASIC’s action in ASIC 25-143MR against Fortnum Private Wealth Ltd demonstrated that cybersecurity failures are now treated as core licence obligations rather than technical issues. The case reinforced that inadequate cyber risk management can constitute a breach of governance and risk management duties. It signalled that cyber resilience is no longer being viewed as an operational side issue. It sits squarely within the obligations of boards, responsible managers and licensees to maintain adequate systems, controls and oversight.
Licensees must identify risks, assess vulnerabilities, oversee third parties and respond quickly to incidents.
Common failures include weak frameworks, poor incident response, limited vendor due diligence, weak access controls and failure to escalate incidents.
From 1 January 2026, ASIC will escalate enforcement where incidents expose governance failures.
Why it matters:
Cyber is now a governance obligation. Regulators assess preparedness, controls and response. Weak frameworks turn incidents into licence breaches.
8. CPS 230 Implementation Drove Operational Uplift
The commencement of CPS 230 in July 2025 required APRA-regulated entities to formalise their operational risk approach, including identifying critical operations, setting impact tolerances, strengthening oversight of service providers, and ensuring credible business continuity arrangements.
This marked a structural shift in expectations around resilience and operational accountability and reinforced that disruption management is now a prudential and governance issue, not just an operations issue.
APRA’s implementation materials and related updates throughout 2025 made clear that CPS 230 is designed to test whether firms can continue delivering critical services during disruption rather than merely document risk frameworks. The emphasis moved from policy design to operational evidence, with firms expected to show how they map dependencies, monitor service providers and respond when critical operations are impaired.
For AFSLs providing services to APRA-regulated entities, this has translated into increased scrutiny of operational resilience, including requests for evidence of business continuity testing, incident response capability, service provider management and system dependencies. This reflects a broader shift where operational risk expectations extend beyond regulated entities to their broader service ecosystem.
Common failures include incomplete mapping of critical operations, unclear tolerances, weak provider oversight and untested continuity plans.
From 1 January 2026, APRA will test resilience through supervision and scenario analysis. APRA will expect explicit testing of impact tolerances under plausible disruption scenarios, evidence of board-level reporting on critical operations and demonstrable oversight of material service providers
Why it matters:
Operational resilience is now a testable obligation. Regulators assess whether critical services can be maintained under disruption, with failures in mapping, tolerances or provider oversight translating directly into prudential and governance breaches.
9. AUSTRAC AML/CTF Reform Progressed to Implementation
The introduction of AML/CTF Rules 2025 and supporting AUSTRAC guidance signalled a shift from framework design to implementation and effectiveness.
The core regulatory question is no longer whether a program exists, but whether it can, in practice, identify, escalate, and respond to suspicious activity.
This reflects a broader move toward outcomes-based supervision, with AUSTRAC increasingly focused on transaction monitoring quality, customer due diligence, governance oversight and suspicious matter reporting. The expectation is that firms understand their money laundering and terrorism financing risks at a granular level, calibrate controls accordingly and actively review whether those controls are working.
Common failures include weak monitoring rules, failure to escalate, outdated risk assessments and limited governance oversight.
From 1 January 2026, AUSTRAC will expect evidence that systems detect and respond to real risks.
Why it matters:
AML programs are judged on outcomes. If monitoring does not detect and escalate real risks, the program fails. Governance must ensure calibration, oversight, and evidence of effectiveness, not just policy completeness.
10. AFCA Complaint Volumes Remained Elevated
Complaint volumes remained high throughout 2025, with advice-related disputes continuing to feature prominently, as reflected in AFCA’s annual review data, which showed sustained levels of complaints across financial advice and investment-related matters.
This sustained level of complaints indicates ongoing issues in advice delivery and highlights the importance of consistency and defensibility in client outcomes.
Firms with repeated complaint themes signal weak monitoring and supervision and ASIC uses complaint data, including AFCA trends, to identify systemic issues and target enforcement action.
In addition, ASIC has highlighted that high complaint volumes may indicate broader failures in licensee monitoring, supervision, and remediation processes, particularly where similar issues arise across multiple advisers or client cohorts. This creates a direct link between AFCA outcomes and potential ASIC intervention, including thematic reviews or enforcement where systemic weaknesses are identified.
From 1 January 2026, persistent complaint trends will trigger increased scrutiny and potential remediation.
Why it matters:
Complaints reveal control failures. Licensees must aggregate and act on trends, not treat complaints as isolated.
11. Documentation Failures Continued to Drive Outcomes
AFCA decisions showed that poor records, not always poor advice, drive losses, as reflected in published decisions and guidance available via AFCA’s determinations database and its approach to advice complaints.
Failure to clearly evidence client circumstances, reasoning, and recommendations continued to drive adverse outcomes, with AFCA frequently finding that, even where advice may have been reasonable, the absence of clear records meant it could not be defended.
This aligns with ASIC’s long-standing position, reinforced through surveillance activity, financial advice updates and enforcement messaging, that advice must be supported by contemporaneous records demonstrating how the best interests duty and related obligations have been met. ASIC has repeatedly highlighted that inadequate file notes, unclear Statements of Advice, poor records of client discussions and weak evidence of strategy selection undermine a licensee’s ability to demonstrate compliance and materially increase the likelihood of both AFCA losses and regulatory intervention.
Common failures include incomplete fact-finds, missing records, weak explanation of alternatives and limited evidence of client benefit.
From 1 January 2026, regulators will continue to test compliance at the file level.
Why it matters:
Documentation is the primary defence. If it is not recorded, it did not happen. Weak records lead directly to losses, remediation and enforcement.
12. CSLR and Industry Sustainability Pressures Increased
Industry bodies, including FAAA and FSC, raised concerns about sustainability pressures linked to CSLR and regulatory costs. This included ongoing commentary on the impact of legacy failures, such as the Dixon Advisory collapse, which has driven significant CSLR levy exposure across the industry and heightened sensitivity to remediation funding models. Industry publications such as IFA reinforced concerns that rising costs, combined with compliance complexity, were reducing adviser numbers and limiting access to advice.
ASIC has acknowledged these pressures in its broader public messaging, including its Key Issues Outlook 2025, in which it noted the tension between consumer protection and the accessibility of advice. While ASIC has maintained its enforcement focus, it has also signalled the importance of sustainable business models that can deliver compliant advice at scale.
Licensees must balance compliance with commercial sustainability.
From 1 January 2026, firms that do not adapt operating models may face financial strain and reduced capacity.
Why it matters:
Economic pressure is now a compliance risk. Licensees must redesign operations to sustain control effectiveness and profitability.
Detailed Insights by Regulator
ASIC
2025 enforcement activity confirmed that ASIC’s primary concerns remain advice quality and licensee control effectiveness. Across the year, regulatory action consistently targeted unregistered adviser activity, templated advice, DDO failures and cyber governance gaps. These were not treated as isolated incidents but as evidence of systemic weaknesses in supervision, monitoring and governance frameworks.
What this means now:
Licensees need to treat file quality, adviser oversight and control testing as core risk indicators and ensure issues are identified and addressed before they become regulator-driven findings.
APRA
CPS 230 pushed operational risk into the centre of compliance expectations. The requirement to identify critical operations, define impact tolerances and oversee third-party providers reflects a broader shift toward resilience and accountability. Operational disruption is no longer viewed solely as a business issue but as a regulatory failure due to insufficient controls.
What this means now:
Licensees must actively map dependencies, test disruption scenarios and demonstrate how critical services will be maintained under stress conditions.
AUSTRAC
AUSTRAC’s direction in 2025 marked a transition from AML framework design to effectiveness. The introduction of updated rules and guidance reinforced the need for risk-based programs to actively detect, escalate, and respond to suspicious activity. Programs that exist only on paper are no longer sufficient.
What this means now:
AML systems and processes need to be regularly tested, calibrated, and overseen to ensure they produce meaningful outcomes rather than meet minimum requirements.
AFCA
AFCA outcomes throughout 2025 continued to highlight failures in evidencing the advice process. Disputes frequently turned on incomplete fact-finds, weak linkage between client circumstances and recommendations, and insufficient documentation of reasoning. In many cases, the issue was not inappropriate advice but the inability to prove appropriateness.
What this means now:
Advice documentation must clearly demonstrate the client’s circumstances, reasoning, and outcomes in a way that withstands external scrutiny.
ATO
ATO data-matching programs’ activities increased around data-matching and the identification of adviser-linked compliance risks. This creates indirect exposure for AFSLs where advice intersects with tax outcomes, particularly if patterns of incorrect or aggressive positions emerge.
What this means now:
Licensees need clear boundaries, documentation and oversight where advice interacts with tax outcomes to manage cross-regulator risk.
Industry Bodies (FAAA / FSC)
Industry advocacy throughout 2025 focused on sustainability pressures, including CSLR levies, education deadlines, and the ongoing regulatory burden. While these concerns were consistently raised, immediate relief was limited, leaving firms to operate under sustained commercial and compliance pressure.
What this means now:
Licensees must actively manage costs, efficiency, and adviser capacity while maintaining compliance standards, as external relief cannot be relied on in the short term.
Cross-Agency Themes
Across all regulators, several consistent themes emerged during 2025. The first is the shift from intent to evidence, in which regulators expect firms to demonstrate outcomes rather than describe processes. The second is the focus on control effectiveness, with policies assumed to exist but tested based on whether they work in practice. There is also a clear expectation of upstream accountability, with firms required to identify and remediate issues early rather than respond after escalation. Compliance and operational risk have converged, particularly in areas such as cyber and outsourcing, meaning failures in systems and processes now carry regulatory consequences. Finally, regulators are increasingly using data to identify trends and risks, requiring firms to develop similar internal capabilities.
A critical implication of these themes is that operational risk, compliance, and advice quality can no longer be treated as separate disciplines.
Failures in systems, outsourcing, data integrity or cyber resilience now directly translate into advice risk, client harm and regulatory exposure. Regulators are increasingly assessing these areas as a single, integrated control environment, meaning weaknesses in one domain will quickly surface in another. Licensees must therefore align governance, monitoring and reporting across these functions to ensure risks are identified and managed holistically rather than in silos.
Strategic Recommendations for AFSL Compliance Teams
Compliance functions should be repositioned as systems that generate evidence of outcomes rather than maintain documentation. File review processes need to move beyond sampling toward identifying patterns and systemic issues. Governance structures should clearly define accountability and ensure that key controls, such as adviser authorisation and supervision, are actively maintained. Operational risk must be integrated into compliance frameworks, particularly in relation to systems, outsourcing and business continuity. AML programs should be tested regularly to ensure they produce meaningful results. Firms should also prepare for regulatory scrutiny by conducting internal reviews aligned to known enforcement themes. Finally, there should be a focus on improving efficiency to manage increasing regulatory costs without compromising control effectiveness.
2026 Outlook Snapshot
Looking into 2026, the trajectory from 2025 is expected to accelerate rather than reset. Regulators are likely to deepen supervision in areas where expectations have already been clearly signalled, with a focus on testing real-world outcomes rather than introducing materially new obligations.
Across ASIC, there is likely to be continued emphasis on advice quality, file defensibility, fee consent validity and cyber resilience, with increased use of surveillance and targeted enforcement where systemic weaknesses are identified. APRA is expected to move into active supervision of CPS 230, including scenario testing and review of operational resilience in practice. AUSTRAC will likely focus on the effectiveness of AML/CTF programs as reforms are embedded, particularly transaction monitoring outputs and reporting quality. AFCA complaint trends are expected to continue informing regulatory priorities and serve as an early indicator of systemic issues.
For AFSLs, the key shift into 2026 is that expectations are now clearly established. The risk is no longer uncertainty, but failure to execute consistently. Firms that cannot demonstrate effective monitoring, strong documentation, and integrated risk management across operations will be more exposed to enforcement, remediation, and reputational damage.
The immediate priority for firms is to ensure that controls implemented in response to 2025 developments are fully embedded, tested, and capable of producing consistent, auditable outcomes at scale.
Closing Observations
2025 did not introduce fundamentally new obligations. It exposed where existing obligations were not being met in practice. Firms that performed well were those that produced consistent, provable and repeatable outcomes across their operations.
Staying ahead of regulatory expectations now requires systems that produce consistent, auditable outcomes across advice, operations and governance. Assured Support works with Licensees (AFSL and Credit Licensees) to design and embed these control environments, ensuring risks are identified early, evidence is defensible, and regulatory expectations are met in practice. If your current framework cannot clearly demonstrate control effectiveness under scrutiny, now is the time to strengthen it.