ASIC expects an AFS licensee to maintain a compliance infrastructure appropriate to its financial services, representatives, and risk profile. It applies whenever the licensee provides regulated services and should include governance, risk management, supervision, monitoring, breach handling, complaints, training, record keeping and evidence of effective controls.
Expanded Answer
Compliance infrastructure is the operational system an AFS licensee uses to meet and demonstrate its general obligations under the Corporations Act. ASIC expects the system to be proportionate, documented and effective in practice. Policies alone are not enough. The licensee must be able to show that controls operate, issues are escalated, and responsible people receive reliable information.
An AFS licensee should establish clear accountability, compliance policies, a risk register, adviser supervision, file reviews, processes for incidents and reportable situations, internal dispute resolution, competency controls, regulatory change processes, and secure record-keeping. The infrastructure should identify who performs each control, when it occurs, what evidence is retained and how exceptions are addressed.
Key obligations:
- Governance must allocate ownership and oversight.
- Monitoring must test whether controls work.
- Escalation must capture complaints, incidents and potential breaches.
- Records must demonstrate decisions, reviews and remediation.
Higher-risk services, complex advice, rapid growth, weak data or recurring failures require stronger surveillance, more frequent testing and clearer board or management reporting. Read what a defensible compliance framework looks like.
Why it matters
Weak compliance infrastructure increases the risk of client harm, undetected misconduct, late breach reporting and ineffective remediation. ASIC scrutiny increases when an AFS licensee cannot demonstrate active supervision, reliable records, accountable decision-making and timely action on recurring or systemic issues.
Unsure how this applies to you?
Get a clear answer in a 15-minute call with a compliance specialist. Book your call
Practical guidance
- Map each regulatory obligation to an owner, control, evidence source and review frequency.
- Test advice files, complaints, incidents and representative conduct against documented standards.
- Report control failures, trends and remediation actions to responsible management regularly.
Further reading
Who is accountable for AFSL compliance?