ASIC v Statewide Superannuation Pty Ltd [2021] FCA 1650
1. Executive Summary
In Australian Securities and Investments Commission v Statewide Superannuation Pty Ltd [2021] FCA 1650, Besanko J made declarations that Statewide Superannuation Pty Ltd (Statewide) contravened the Corporations Act 2001 (Cth) and Australian Securities and Investments Commission Act 2001 (Cth) (ASIC Act) through systemic failures in the administration of members’ insurance and a related delay in reporting significant breaches to ASIC.
The case is significant because the misconduct did not involve deliberate overcharging or an intention to profit. It arose principally from failures in data migration, insurance-rule configuration, systems testing, change management, escalation and remediation following Statewide’s migration to the Acurity administration platform.
At least 14,209 members were affected by discrepancies between their actual insurance status under Statewide’s insurance policies and the status recorded in Acurity. Statewide deducted insurance premiums from members whose insurance had already ceased and sent annual statements and warning correspondence containing incorrect representations about insurance cover and premium obligations. During the relevant period it accepted at least $2.7 million in incorrectly charged insurance premiums and at least $320,000 in related administration fees. [17]–[18], [72].
Statewide also failed to lodge a significant breach report with ASIC within the then-applicable statutory timeframe. It became aware of the relevant breaches by no later than 22 July 2019. A report was required by 6 August 2019 but was not lodged until 20 September 2019. [41]–[43], [67].
The Court imposed pecuniary penalties totalling $4 million, comprising $3.5 million for false or misleading representations under the ASIC Act and $500,000 for the breach-reporting contravention. It also ordered adverse publicity, a comprehensive review and remediation program, independent expert oversight and payment of ASIC’s costs.
For AFSL holders and superannuation trustees, the central governance lesson is that technology administration is not separate from regulatory compliance. Data migration, system configuration, testing, change control, exception management and escalation can directly determine whether a licensee satisfies its statutory obligations. Besanko J accepted ASIC’s characterisation that Statewide had suffered from “inadequate management and risk control”. [54].
2. Citation & Context
| Item | Detail |
|---|---|
| Case | Australian Securities and Investments Commission v Statewide Superannuation Pty Ltd [2021] FCA 1650 |
| Court | Federal Court of Australia, General Division |
| Judge | Besanko J |
| Judgment | 22 December 2021 |
| Reasons published | 17 January 2022 |
| Hearing | 17 December 2021 |
| Proceeding | SAD 25 of 2021 |
| Plaintiff | Australian Securities and Investments Commission |
| Defendant | Statewide Superannuation Pty Ltd |
| Principal legislation | Corporations Act 2001 (Cth) ss 912A, 912D, 1041H, 1101B, 1317G; ASIC Act ss 12DA, 12DB, 12GBA, 12GBB, 12GLB |
| Outcome | Declarations, $4 million total pecuniary penalties, adverse publicity, remediation program and $240,000 costs |
| Source | Linked Federal Court judgment |
ASIC sought declarations, penalties, an adverse publicity order, a review and remediation program and costs. The parties filed a detailed statement of agreed facts under s 191 of the Evidence Act 1995 (Cth), together with affidavit evidence and a Court Book. Statewide accepted the substantive declarations and ancillary relief. The principal contested issue was the amount of the pecuniary penalties. [1]–[4], [32]–[37].
3. Material Facts and Governance Failure
Statewide was trustee and RSE licensee of the Statewide Superannuation Trust and held an AFSL. As at 30 June 2020, the Fund had approximately 160,000 member accounts and $9.9 billion in assets under management. [6].
During the relevant period, Statewide maintained group life and income protection insurance policies with MetLife. Insurance could automatically cease under policy rules including the Nil Balance Rule and, for part of the relevant period, the U$4K Rule. [8]–[11].
Statewide migrated its administration functions from the SuperB platform to Acurity in May 2017. Acurity recorded member insurance status and was used to determine member communications and insurance premium deductions. [12]–[16].
The underlying problem was that the migration and processing of insurance data and the coding of insurance rules in Acurity were not completed correctly. The result was a mismatch between the insurance position recorded by the system and the member’s actual insurance position under the relevant policy. [17], [51].
Statewide accepted that it had failed to:
- adequately and properly test migrated member insurance data;
- ensure that policy rules governing lapsing and cancellation were accurately reflected in Acurity;
- undertake structured and successful testing of insurance-status and end-of-month premium processes;
- maintain effective escalation arrangements for administration problems identified by non-management personnel; and
- require appropriate senior management oversight and approval of coding and data changes. [52]–[53].
The failures were therefore not confined to an isolated coding defect. They extended into governance, change management, testing and escalation.
The risk indicators also accumulated over time. Complaints and insurance-status errors had been logged from approximately May 2017. In May 2018, management identified incorrect premium deductions affecting about 1,300 members. By July 2019, a briefing paper warned that it was “highly likely” that members had received inaccurate insurance statements in 2018 and might receive incorrect information again in 2019 unless the issue was remediated. [50], [58]–[64].
Repeated “data fixes” did not resolve the underlying problem. The Court nevertheless accepted that the conduct was not deliberate and that Statewide’s leadership was attempting to investigate and remediate the issue. [55], [65].
4. Contraventions
| Act | Section | Duty / Prohibition | Conduct | Count / Scale | Finding | Pinpoint |
|---|---|---|---|---|---|---|
| Corporations Act 2001 (Cth) | 1041H(1) | No misleading or deceptive conduct in relation to financial products or services | Annual statements and insurance communications incorrectly represented insurance status and premium deductions | Thousands of communications across 2018–2019 plus warning letters | Contravened | Orders 1–3; [19]–[21] |
| ASIC Act | 12DA(1) | No misleading or deceptive conduct in trade or commerce concerning financial services | Same underlying representations | Same conduct | Contravened | Orders 1–3; [19]–[21] |
| ASIC Act | 12DB(1)(g) | No false or misleading representation as to price | Annual statements represented premiums as payable when affected members did not hold cover | At least 6,779 FY2018 and 7,779 FY2019 statements | Contravened | Orders 2, 4; [22], [38] |
| ASIC Act | 12DB(1)(i) | No false or misleading representation concerning rights or obligations | Represented Statewide was entitled to deduct premiums and members were required to pay them | Same affected statements | Contravened | Orders 2, 5; [22], [38] |
| Corporations Act | 912A(1)(c) | Comply with financial services laws | Underlying ASIC Act and Corporations Act contraventions | Each relevant contravening occasion | Contravened | Order 6 |
| Corporations Act | 912A(1)(a) | Do all things necessary to ensure financial services are provided efficiently, honestly and fairly | Systems, testing, administration, escalation, premium deduction and remediation failures | Not quantified as separate counts | Contravened | Order 7; [52]–[54] |
| Corporations Act | 912D(1B), 912D(3) | Report significant breaches within the then-applicable statutory timeframe | Report due 6 August 2019; lodged 20 September 2019 | 45-day delay | Contravened | Order 8; [41]–[44], [67] |
The Court treated the conduct giving rise to the s 12DB(1)(g) and (i) contraventions as one course of conduct, notwithstanding that incorrect annual statements were issued in two separate years. Besanko J regarded the course-of-conduct concept as an analytical tool rather than a rigid rule for calculating penalties. [61]–[66], [91].
5. Key Legal Principles
Systems and administration can engage the “efficiently, honestly and fairly” obligation
The s 912A(1)(a) contravention was not based merely on an incorrect statement to an individual customer. It incorporated failures to test migrated data, correctly implement insurance-policy rules, control system changes, escalate problems and prevent continued incorrect charging.
The decision therefore illustrates how operational systems and technology governance can form part of how a regulated financial service is provided.
Besanko J accepted ASIC’s submission that the circumstances demonstrated:
“inadequate management and risk control.” — [54]
For compliance functions, a technology incident affecting member entitlements should therefore be assessed not only as an operational or IT matter, but also against the licensee’s statutory obligations.
Breach reporting cannot depend on completing remediation
At the relevant time, s 912D(1B) required a significant breach report to be lodged as soon as practicable and, in any event, within 10 business days after the licensee became aware of the relevant breach.
Statewide’s own Incident and Breach Reporting Policy recognised this expressly:
“This timeframe is a regulatory requirement and cannot be extended.” — [68]
The policy also recognised that reporting might be required before investigation, board consideration, legal advice or rectification was complete.
Statewide continued investigating, analysing affected populations and developing remediation during the reporting delay. Those matters mitigated the seriousness of the conduct but did not suspend the statutory obligation. [69]–[71].
Operationally, breach assessment and remediation should therefore operate as parallel workstreams. The absence of complete quantification does not necessarily mean there is insufficient information to make a regulatory reporting decision.
Course of conduct is an analytical tool
ASIC contended that the 2018 and 2019 annual statements involved two courses of conduct. Statewide argued for one.
Besanko J accepted Statewide’s position, having regard particularly to the common underlying systems failure, the substantially standardised communications and the absence of deliberate misconduct. [61]–[66].
The significance is primarily one of penalty methodology. The doctrine should not obscure the actual number of affected customers, duration of the conduct or seriousness of the underlying control failure.
Deterrence is the principal purpose of civil penalties
The Court reiterated the orthodox position that civil penalties serve both specific and general deterrence and should not become an acceptable business expense.
Besanko J stated:
“The pecuniary penalty must be a real deterrent” — [93]
The likely merger of Statewide with Host Plus reduced the weight given to specific deterrence because Statewide was unlikely to continue as a separate entity. Its cooperation, contrition and remediation were also relevant. [94]–[100].
Those factors reduced the penalty that might otherwise have been imposed, but did not remove the need for substantial penalties.
6. Orders, Compensation and Penalty Position
| Order / Remedy | Legal Basis | Amount / Scope | Paragraphs |
|---|---|---|---|
| Pecuniary penalty | ASIC Act ss 12GBA, 12GBB | $3.5 million for s 12DB(1)(g) and (i) contraventions | Orders 9; [38]–[40], [121]–[122] |
| Pecuniary penalty | Corporations Act s 1317G | $500,000 for breach-reporting contravention | Order 10; [41]–[44], [123] |
| Adverse publicity | ASIC Act s 12GLB | Publication for at least 90 days through specified website/member channels | Order 11; [35] |
| Review and remediation | Corporations Act s 1101B | Identification of affected current and former members, reconstruction of insurance status, compensation and lost-return calculations | Order 12; [36], [77] |
| Independent expert | Part of remediation order | Independent assessment of implementation and effectiveness, reported to ASIC | Order 12(b) |
| Costs | Court order | $240,000 | Order 13 |
Statewide had already made some refunds before judgment, including approximately $182,250 to about 1,300 members in June 2018 and $348,242 to 1,124 members by 30 June 2019. [74].
However, the Court-ordered remediation went considerably further. It required Statewide to reconstruct the correct insurance position for past and present members, refund overcharged premiums, compensate members for lost returns and identify consequential insurance entitlements.
The judgment therefore distinguishes between fixing system data and achieving complete customer remediation.
7. Relevance for Licensees, Trustees and Responsible Managers
The decision supports six practical propositions.
- System implementation is a compliance control. A migration affecting customer rights, fees, insurance or entitlements requires legal-rule mapping, controlled testing, reconciliation and accountable sign-off.
- Policy terms must be traceable into system logic. Where contractual insurance rules determine whether premiums can lawfully be deducted, the organisation should be able to demonstrate that those rules are accurately encoded and tested.
- Repeated data fixes are a warning signal. Tactical remediation that repeatedly fails to resolve the same issue should trigger root-cause escalation rather than being treated as ordinary operational maintenance.
- Customer complaints and exceptions are governance information. Complaints and anomalous account outcomes should be aggregated so management can identify systemic patterns rather than resolving each case independently.
- Breach reporting requires its own control clock. Investigation, remediation and board engagement do not themselves extend a statutory reporting deadline.
- Remediation should address the entire affected population. Former members, closed accounts, lost investment earnings and consequential insurance outcomes may need to be included, rather than limiting remediation to current customers or readily identifiable charges.
8. Risk Management & Compliance Recommendations
| Audience | Control Type | Legal Rationale | Risk Indicator | Practical Control |
|---|---|---|---|---|
| Board / Risk Committee | Governance | Oversight of regulated service delivery | Persistent customer-impacting system defects | Material systems incident reporting with affected population, financial exposure and ageing |
| Technology / Operations | Preventative | Accurate administration of customer rights | Major platform migration | Legal-rule mapping, migration reconciliation and pre-production acceptance criteria |
| Technology | Preventative | Reliable implementation of contractual rules | Rule or coding changes | Controlled change approval, segregation of duties and regression testing |
| Risk / Compliance | Detective | Identify systemic rather than isolated failures | Repeated data fixes or customer complaints | Pattern analysis and mandatory root-cause escalation threshold |
| Operations | Detective | Prevent incorrect charging | Status/premium mismatch | Automated exception reporting reconciling eligibility, cover status and deductions |
| Legal / Compliance | Preventative | Timely regulatory reporting | Investigation continuing near reporting deadline | Independent breach-reporting clock and documented significance assessment |
| Remediation team | Corrective | Restore affected customers | Closed or exited accounts | Full-population methodology including former members and lost earnings |
| Internal Audit | Governance | Demonstrable control effectiveness | Reliance on system-generated status | End-to-end testing from source legal requirement to customer outcome |
9. Regulatory and Governance Significance
The strongest compliance message from Statewide is that apparently technical failures can become financial-services-law failures when they affect customer rights, charges and communications.
Statewide did not intentionally design a system to overcharge members. The Court accepted that the conduct was not deliberate and was not motivated by profit. [47], [122].
That did not prevent findings of serious contraventions or the imposition of substantial penalties.
The progression of the incident is particularly instructive: an implementation problem produced incorrect data; incorrect data produced inappropriate premium deductions and communications; attempts at tactical remediation failed to eliminate the root cause; management information accumulated; and the regulatory reporting process did not respond within the statutory timeframe.
This is why the case is better understood as a governance and control failure rather than simply a misleading-statements case.
It also demonstrates the importance of customer outcomes in systems governance. Members were entitled to expect that the trustee accurately understood whether they were insured and whether premiums could lawfully be deducted. As Besanko J observed, members were plainly entitled to accurate information concerning their insurance. [108].
10. Recommended Next Steps
For an AFSL holder or RSE licensee reviewing this decision, priority actions are:
- Map material customer rules into technology. Identify product, policy and legislative requirements that determine fees, insurance, benefits or entitlements and document how each is implemented in production systems.
- Review migration governance. Require reconciliations, negative testing, exception testing and business-owner sign-off before material customer data is migrated.
- Test change-management controls. Confirm customer-impacting coding and data changes cannot occur without documented approval, testing and post-implementation validation.
- Analyse repeated incidents collectively. Configure complaints, incidents and data-remediation registers to identify recurring themes and trigger systemic escalation.
- Separate breach reporting from root-cause completion. Test whether compliance teams can identify the statutory reporting trigger before the final affected population or remediation amount is known.
- Review remediation population methodology. Ensure former customers, closed accounts, consequential loss and lost earnings are addressed where appropriate.
- Require evidence of effective closure. Do not close a material incident because a data fix has been deployed. Require evidence that the underlying cause has been corrected and the affected population has been identified.
11. Referenced Cases
- Australian Competition and Consumer Commission v TPG Internet Pty Ltd [2013] HCA 54; (2013) 250 CLR 640 — deterrence and penalties must not become an acceptable cost of doing business — cited at [93].
- Commonwealth v Director, Fair Work Building Industry Inspectorate [2015] HCA 46; (2015) 258 CLR 482 — general and specific deterrence as central purposes of civil penalties — cited at [93].
- Australian Securities and Investments Commission v Dover Financial Advisers Pty Ltd (No 3) [2021] FCA 170; (2021) 150 ACSR 185 — maximum penalties and circumstances where a theoretical aggregate maximum provides limited assistance — cited at [89].
- Australian Securities and Investments Commission v MLC Nominees Pty Ltd [2020] FCA 1306; (2020) 147 ACSR 266 — totality and the relevance of the trustee-beneficiary relationship to penalty — cited at [108], [112].
- Australian Securities and Investments Commission v Commonwealth Bank of Australia [2021] FCA 423 — comparative treatment of systems-based overcharging, delay and deterrence — considered at [70], [114]–[120].
Source: Australian Securities and Investments Commission v Statewide Superannuation Pty Ltd [2021] FCA 1650.