1. Executive summary
In Australian Securities and Investments Commission v Firstmac Limited (Penalty Hearing) [2025] FCA 12, Downes J imposed an $8 million pecuniary penalty on Firstmac Limited for contraventions of the design and distribution obligations in Part 7.8A of the Corporations Act 2001 (Cth).
Firstmac distributed information and product disclosure documents concerning the High Livez investment product to existing term-deposit customers without taking reasonable steps that would have resulted in distribution being consistent with the product’s target market determination. The conduct comprised:
- 115 emails sent to retail customers between 5 October 2021 and about April 2022; and
- 716 letters sent to retail term-deposit customers on or about 29 August 2022.
The Court had previously found that each communication constituted a contravention of s 994E(3), producing 831 contraventions across two courses of conduct.
Firstmac knew there was a realistic possibility that some recipients sought capital-guaranteed investments or had short investment timeframes and therefore fell outside the target market for High Livez. Its response was nevertheless inadequate. It did not establish an effective written distribution framework, train relevant staff, implement appropriate screening or adequately understand the processes used by the employee dealing directly with prospective investors. The Court found that Firstmac’s steps were “wholly inadequate” and that it objectively courted the risk of contravention.
The decision is significant because it was one of the first contested penalty decisions under the design and distribution obligations. It confirms that:
- a target market determination is not merely a disclosure document;
- distributors must implement operational controls that make inconsistent distribution unlikely;
- reliance on a PDS, published target market determination or customer access to staff will not necessarily constitute reasonable steps;
- cross-selling to existing customers remains distribution conduct requiring a product-specific assessment;
- inadequate training, undocumented procedures and poor internal communication can support findings of serious contravention;
- potential consumer harm is sufficient even where few consumers acquire the product and quantifiable financial loss is minimal; and
- remediation after judgment can materially reduce penalty exposure but does not remove the need for substantial deterrence.
2. Citation and context
Case: Australian Securities and Investments Commission v Firstmac Limited (Penalty Hearing)
Neutral citation: [2025] FCA 12
Court: Federal Court of Australia
Judge: Downes J
Judgment and orders: 24 January 2025
Hearing: 18–19 December 2024
Proceeding: QUD 467 of 2022
Registry: Queensland
Nature of decision: Contested civil penalty hearing following the liability judgment in ASIC v Firstmac Limited [2024] FCA 737.
ASIC sought a penalty of $25 million. Firstmac submitted that the appropriate range was $3 million to $6 million and proposed $4 million to $4.5 million. The Court determined that $8 million was sufficient to achieve specific and general deterrence without being oppressive.
3. The High Livez product and target market
High Livez was an investment product distributed by Firstmac. Its target market determination identified the class of retail consumers for whom the product was likely to be appropriate.
Relevant characteristics included investment objectives and expected investment timeframe. Consumers seeking:
- capital protection or a capital guarantee; or
- a short investment timeframe,
could fall outside the target market.
Firstmac sought to cross-sell High Livez to existing customers holding term deposits. Senior personnel considered whether those customers were likely to fall within the target market and recognised that some might not. Firstmac nevertheless proceeded on the basis that existing disclosures and access to a staff member would sufficiently protect consumers outside the target market.
4. Distribution conduct
The contraventions arose from two communication campaigns:
| Course of conduct | Period | Retail recipients | Conduct |
|---|---|---|---|
| High Livez Documents | 5 October 2021–about April 2022 | 115 | Emails attaching the High Livez PDS |
| High Livez Information | On or about 29 August 2022 | 716 | Letters to term-deposit holders attaching the High Livez PDS |
| Total | 831 | Separate contraventions of s 994E(3) |
The communications exposed recipients to the High Livez product without adequate steps being taken to identify or screen out customers whose objectives were inconsistent with the target market.
Only one term-deposit holder ultimately invested in High Livez following the relevant distribution conduct. Firstmac received a management fee of about $150 from that investment. The modest financial benefit did not remove the seriousness of the contraventions because the design and distribution regime is directed to reducing the risk that unsuitable financial products are distributed to consumers.
5. Contraventions and findings
| Act | Provision | Obligation | Conduct | Finding |
|---|---|---|---|---|
| Corporations Act 2001 (Cth) | s 994E(3) | A regulated person must take reasonable steps that will, or are reasonably likely to, result in retail product distribution conduct being consistent with the applicable target market determination | Firstmac distributed High Livez material to retail term-deposit customers without adequate product-specific screening, procedures, training or controls | 831 contraventions established |
| Corporations Act 2001 (Cth) | s 1317G | Court may impose a pecuniary penalty for a serious financial services civil penalty contravention | Contraventions increased the risk that High Livez would be distributed to consumers outside its target market | $8 million penalty imposed |
The 831 contraventions were treated as two interrelated courses of conduct for penalty purposes. The theoretical maximum exceeded $9.22 billion, but the Court considered that figure disproportionately large and of little practical assistance as a penalty yardstick.
6. Why Firstmac’s controls were inadequate
The deficiencies were operational rather than merely documentary.
No adequate written framework
Firstmac’s senior personnel knew a written policy or framework was needed to explain the reasonable steps required when distributing High Livez. No effective product-specific framework was created.
A generic policy prepared by the Audit and Compliance Manager was:
- deficient;
- not finalised; and
- not distributed to relevant staff.
The Court found that Firstmac lacked adequate systems, policies, practices and procedures addressing the risk of distribution inconsistent with the target market determination.
No DDO or target market training
The employee primarily responsible for dealing with term-deposit customers and High Livez investors received no training on:
- the design and distribution obligations;
- the High Livez target market determination; or
- the need to obtain information relevant to whether a customer was within the target market.
The Audit and Compliance Manager was responsible for regulatory training but provided no DDO or High Livez target market training before the distribution campaigns.
Inadequate screening
Firstmac knew some customers might seek a capital guarantee or short-term investment. It could have taken straightforward steps to eliminate or materially reduce inconsistent distribution, including product-specific questions or distribution filters.
Instead, customers could receive the High Livez PDS irrespective of whether they had shown interest in the product or expressed objectives inconsistent with its target market.
Breakdown in communication
Senior management was not aware of the actual processes followed by the employee dealing with customers. That breakdown was particularly significant because only a small number of personnel were involved with High Livez.
Firstmac’s review of its cross-selling strategy did not reveal how distribution was occurring in practice and did not identify the reasonable steps required for compliance.
7. Objective recklessness and “courting the risk”
The Court accepted that Firstmac did not deliberately set out to contravene the law. It nevertheless found that the second distribution campaign involved objective recklessness.
By August 2022:
- Firstmac knew some customers might be outside the target market;
- the original control deficiencies remained;
- ASIC had issued statutory notices seeking information about DDO compliance;
- Firstmac’s in-house lawyer had identified risk in marketing High Livez to term-deposit customers; and
- effective screening and control measures remained available but had not been implemented.
The Court concluded that Firstmac failed to appreciate an obvious risk of consumer harm and thereby “courted the risk” of contravention.
This finding is important for risk governance. A business need not consciously intend illegality before its conduct attracts significant penalties. Continuing a distribution strategy despite known uncertainties, weak controls and readily available safeguards may amount to objective recklessness.
8. Key legal and compliance principles
The DDO regime is customer-centric
The Court identified the purpose of the design and distribution obligations as consumer protection through a customer-centric approach to product design and distribution.
Product issuers and distributors must increase the likelihood that financial products reach consumers for whom they are likely to be suitable. The regime is not satisfied merely because the product itself is lawful or the PDS is accurate.
A TMD must be operationalised
A target market determination must inform:
- distribution-channel design;
- scripts and customer questions;
- eligibility or exclusion criteria;
- digital and manual controls;
- staff training;
- monitoring;
- record keeping; and
- review triggers.
Publishing a TMD on a website does not make distribution consistent with it.
Existing customers are not automatically suitable
Firstmac’s customers already held term deposits. That existing relationship did not establish that they fell within the target market for High Livez.
Cross-selling requires a fresh assessment of:
- the target market for the new product;
- relevant customer objectives and likely needs;
- the distribution method;
- available customer information; and
- the risk that the existing customer population includes consumers outside the target market.
Disclosure is not a substitute for distribution controls
Firstmac relied partly on the High Livez PDS, the availability of the TMD and customers’ ability to speak with staff.
Those measures did not constitute adequate reasonable steps. The DDO regime is intended to influence which consumers receive product information and offers, not merely ensure that consumers receive disclosure after the distribution decision has effectively been made.
Potential harm supports substantial penalties
The Court found no significant quantifiable customer loss. Nevertheless, the conduct increased the risk that unsuitable product material would be distributed to consumers outside the target market.
The DDO regime is preventive. Penalty exposure does not depend on ASIC proving that a large number of consumers acquired the product or suffered realised financial loss.
9. Senior management and compliance culture
Firstmac accepted that senior management was involved in the conduct.
Its executive team gave ultimate approval for the distribution, sale and marketing of High Livez. Senior personnel:
- helped prepare or knew the contents of the TMD;
- considered whether term-deposit holders fell within the target market;
- recognised a realistic possibility that some did not;
- considered compliance steps without understanding the actual frontline process;
- knew a written framework was required but failed to establish one; and
- failed to ensure staff were trained.
The Court found that Firstmac did not have a culture conducive to compliance during the relevant period. That conclusion arose from the absence of effective policy, training and review arrangements—not simply from the existence of the contraventions themselves.
10. Remediation and mitigation
Following the liability hearing, Firstmac implemented substantial reforms, including:
- separating audit from compliance;
- appointing an executive-level Head of Risk and Compliance reporting directly to the chief executive officer and Risk Committee;
- engaging external consultants to train the board, executives and managers;
- updating its DDO policy;
- establishing a control-monitoring schedule;
- requiring DDO training and assessment for all staff and board members;
- providing targeted face-to-face training;
- revising customer scripts; and
- introducing “knock-out” questions before consumers could access High Livez information online.
High Livez was wound up in December 2024, resulting in lost revenue for Firstmac. The Court regarded the reforms as significant evidence of contrition and a genuine intention to comply. Those measures strongly supported a penalty materially below the $25 million sought by ASIC.
The Court did not treat Firstmac’s decision to contest liability as an aggravating factor. Section 994E(3) had not previously received judicial interpretation, and Firstmac’s arguments were not unreasonably maintained.
11. Penalty assessment
Aggravating considerations
The Court considered:
- 831 contraventions;
- two distribution campaigns;
- involvement of senior management;
- wholly inadequate reasonable steps;
- objective recklessness in the second campaign;
- inadequate policies and procedures;
- no relevant staff training;
- poor internal communication;
- the risk of distribution outside the target market;
- Firstmac’s scale and financial capacity; and
- the need to establish a meaningful benchmark for the relatively new DDO regime.
Firstmac was one of Australia’s largest non-bank lenders, with substantial operating income, profits, net assets and internal legal and compliance resources. A modest penalty risked being treated as a cost of doing business.
Mitigating considerations
The Court also considered:
- minimal direct financial benefit from the contraventions;
- no established quantifiable consumer loss;
- no previous comparable contravention finding;
- Firstmac’s genuine post-judgment reforms;
- its decision to wind up High Livez;
- the novelty of the statutory provisions;
- the reasonableness of its decision to test liability; and
- the need to avoid an oppressive penalty.
ASIC’s proposed $25 million penalty was excessive. Firstmac’s proposed range was insufficient to reflect the seriousness of its conduct. The Court concluded that $8 million appropriately balanced deterrence and oppressive severity.
12. Orders and remedies
| Order or remedy | Legal basis | Amount or scope |
|---|---|---|
| Pecuniary penalty | s 1317G, Corporations Act | $8 million, payable within 60 days |
| Costs | Court order | Firstmac to pay ASIC’s costs as agreed or taxed |
| Declaration | Previously made on 22 July 2024 | Contraventions of s 994E(3) |
No compensation, injunction or adverse publicity order was made in this penalty judgment.
13. Broader significance for product issuers and distributors
The decision establishes a substantial DDO penalty benchmark. It signals that courts may impose multi-million-dollar penalties where distribution controls are systemically inadequate, even if:
- only a small number of customers acquire the product;
- direct financial loss is not proved;
- the benefit to the distributor is small;
- the organisation took some compliance steps; and
- the provisions are relatively new.
The judgment also moves DDO compliance beyond formal product governance. A compliant framework requires evidence that the TMD has changed actual distribution behaviour.
Relevant evidence includes:
- customer screening;
- scripts and questions;
- channel restrictions;
- staff instructions;
- data controls;
- monitoring results;
- distribution exceptions;
- review records; and
- escalation of inconsistent distribution.
14. Relevance for AFS licensees and responsible managers
Licensees should review cross-selling arrangements where products are marketed to existing customers based primarily on the existing relationship.
High-risk indicators include:
- treating a broad customer book as presumptively within a new product’s target market;
- relying on PDS disclosure rather than screening;
- allowing product information to be sent before relevant customer information is collected;
- no product-specific distribution procedure;
- no training on the TMD;
- senior management approving campaigns without verifying frontline practice;
- unresolved uncertainty about customer objectives; and
- continuing distribution after regulatory enquiries or internal legal warnings.
Responsible managers should require evidence that distribution controls work in practice rather than relying on management assurances or the existence of a TMD.
15. Recommended controls
| Audience | Control type | Legal rationale | Risk indicator | Practical control |
|---|---|---|---|---|
| Board and product governance committee | Governance | Part 7.8A consumer-protection purpose | Material cross-selling campaign | Approve a product-specific distribution plan |
| Product issuer | Preventative | TMD must guide distribution | Broad or heterogeneous target market | Define measurable inclusion and exclusion criteria |
| Distributor | Preventative | s 994E(3) reasonable-steps duty | Existing customer list used for marketing | Screen customer cohorts before distribution |
| Frontline operations | Preventative | Staff must identify likely target-market inconsistency | Customers express capital-guarantee or short-term objectives | Use mandatory knock-out questions |
| Compliance | Detective | Distribution must remain consistent with TMD | PDS sent without recorded screening | Conduct campaign-level and file-level monitoring |
| Training | Preventative | Staff must understand product boundaries | No TMD-specific training | Require training before staff participate in distribution |
| Data governance | Preventative | Available customer data should inform controls | Existing objectives or preferences not used | Build automated suppression rules |
| Senior management | Governance | Approval requires understanding of actual process | Disconnect between executives and frontline staff | Verify process through walkthroughs and testing |
| Legal and regulatory affairs | Corrective | Regulatory enquiries heighten known risk | ASIC notice or legal concern | Suspend or reassess distribution pending control review |
| Internal audit | Detective | Policy existence does not establish operation | Generic DDO policy | Test product-specific implementation and evidence |
16. Recommended next steps
Product issuers and distributors should:
- identify every product distributed to existing customer cohorts;
- compare each cohort with the applicable TMD;
- document the reasonable steps adopted for each distribution channel;
- introduce enforceable screening and exclusion criteria;
- ensure relevant staff receive product-specific TMD training;
- confirm that senior management understands actual frontline practices;
- test whether disclosure is being used as a substitute for eligibility controls;
- monitor distribution outcomes and identify consumers likely to be outside the target market;
- reassess campaigns following regulatory enquiries or internal legal concerns; and
- preserve evidence showing how controls reduce inconsistent distribution.
17. Broader impact
The judgment establishes an important enforcement benchmark for Australia’s design and distribution obligations. It confirms that a target market determination must shape how a product is actually marketed and distributed, rather than operate as a standalone compliance document. Product issuers and distributors must implement product-specific screening, training, procedures and monitoring that make distribution outside the target market unlikely.
The decision also shows that substantial penalties may be imposed even where few consumers acquire the product, direct financial loss is not proved, and the commercial benefit is small. The DDO regime is preventive: regulatory exposure arises from the creation of an unacceptable risk that unsuitable products will reach consumers. Cross-selling to existing customers, therefore, requires a fresh assessment of the new product’s target market and cannot rely solely on the pre-existing customer relationship or on disclosure through a PDS.
More broadly, the case increases governance expectations for boards, responsible managers and senior executives approving distribution campaigns. They must understand how frontline processes operate in practice and ensure that available customer information is used to exclude unsuitable recipients. Continuing a campaign despite known uncertainties, weak controls or regulatory concerns may be treated as objectively reckless and materially increase penalty exposure.
This analysis is suitable for internal legal, governance and compliance review, but final positions should be confirmed against the liability judgment, current legislation and any subsequent appellate developments.