{"id":"F2024L01202","name":"ASIC Corporations and Credit (Breach Reporting—Reportable Situations) Instrument 2024/620","slug":"asic-corporations-and-credit-breach-reporting-reportable-situations-instrument-2024-620","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"in_force","isInForce":true,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":105381,"registerId":"commonwealth-F2024L01202-current","compilationNumber":null,"startDate":"2026-04-03","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"1","sectionType":"section","heading":"ASIC Corporations and Credit (Breach Reporting—Reportable Situations) Instrument 2024/620","content":"![Commonwealth Coat of Arms and ASIC logo](image.001.png)\n\nASIC Corporations and Credit (Breach Reporting—Reportable Situations) Instrument 2024/620\n\nmade under subsection 926A(2) of the Corporations Act 2001 and subsection 109(3) of the National Consumer Credit Protection Act 2009\n\nCompilation No. 2\n\nCompilation date: 12/09/2025\n\nIncludes amendments up to: F2025L01084\n\nAbout this compilation\n\nThis compilation\n\nThis is a compilation of the ASIC Corporations and Credit (Breach Reporting—Reportable Situations) Instrument 2024/620 that shows the text of the law as amended and in force on 12/09/2025 (the compilation date).\n\nThe notes at the end of this compilation (the endnotes) include information about amending laws and the amendment history of provisions of the compiled law.\n\nUncommenced amendments\n\nThe effect of uncommenced amendments is not shown in the text of the compiled law. Any uncommenced amendments affecting the law are accessible on the Register (www.legislation.gov.au). The details of amendments made up to, but not commenced at, the compilation date are underlined in the endnotes. For more information on any uncommenced amendments, see the Register for the compiled law.\n\nApplication, saving and transitional provisions for provisions and amendments\n\nIf the operation of a provision or amendment of the compiled law is affected by an application, saving or transitional provision that is not included in this compilation, details are included in the endnotes.\n\nModifications\n\nIf the compiled law is modified by another law, the compiled law operates as modified but the modification does not amend the text of the law. Accordingly, this compilation does not show the text of the compiled law as modified. For more information on any modifications, see the Register for the compiled law.\n\nSelf‑repealing provisions\n\nIf a provision of the compiled law has been repealed in accordance with a provision of the law, details are included in the endnotes.\n\nContents\n\n[Part 1—Preliminary](#_Toc208916537)\n\n[1 Name of legislative instrument](#_Toc208916538)\n\n[3 Authority](#_Toc208916539)\n\n[4 Definitions](#_Toc208916540)\n\n[Part 2—Declaration](#_Toc208916541)\n\n[5 Reportable Situations](#_Toc208916542)\n\n[6 Insignificant contraventions of core obligations](#_Toc208916543)\n\n[6A Ongoing investigations](#_Toc208916544)\n\n[7 Reporting period for additional reportable situations](#_Toc208916545)\n\n[7A Reports submitted to APRA](#_Toc208916546)\n\n[8 Core obligations](#_Toc208916547)\n\n[9 Repeal](#_Toc208916548)\n\n[Endnotes](#_Toc208916549)\n\n[Endnote 1—About the endnotes](#_Toc208916550)\n\n[Endnote 2—Abbreviation key](#_Toc208916551)\n\n[Endnote 3—Legislation history](#_Toc208916552)\n\n[Endnote 4—Amendment history](#_Toc208916553)\n\nPart 1—Preliminary\n\n1 Name of legislative instrument\n\nThis is the ASIC Corporations and Credit (Breach Reporting—Reportable Situations) Instrument 2024/620.\n\n3 Authority\n\nThis instrument is made under subsection 926A(2) of the Corporations Act 2001 and subsection 109(3) of the National Consumer Credit Protection Act 2009.\n\n4 Definitions\n\nIn this instrument:\n\nAustralian credit licence has the same meaning as in section 5 of the Credit Act.\n\nCorporations Act means the Corporations Act 2001.\n\nCredit Act means the National Consumer Credit Protection Act 2009.\n\ncredit licensee means a person who holds an Australian credit licence.\n\nfinancial services licensee has the same meaning as in section 9 of the Corporations Act.\n\nPart 2—Declaration\n\n5 Reportable Situations\n\n(1) Part 7.6 of the Corporations Act (other than Divisions 4 and 8) applies in relation to financial service licensees as if section 912D were modified or varied by omitting paragraph 912D(4)(b) and substituting:\n\n“(b) the breach is constituted by the contravention of a civil penalty provision under any law, other than:\n\n(i) a civil penalty provision prescribed by the regulations for the purposes of this paragraph; or\n\n(ii) subsection 912A(5A) to the extent that the contravention results from a contravention of subparagraph 912A(1)(g)(ia) as notionally inserted by ASIC Corporations, Credit and Superannuation (Internal Dispute Resolution) Instrument 2020/98; or”.\n\n(2) The provisions to which Part 2-6 of the Credit Act applies apply in relation to credit licensees as if subsection 50A were modified or varied by omitting paragraph 50A(4)(b) and substituting:\n\n“(b) the breach is constituted by the contravention of a civil penalty provision under any law, other than:\n\n(i) a civil penalty provision prescribed by the regulations for the purposes of this paragraph; or\n\n(ii) subsection 47(4) to the extent the contravention results from a contravention of subparagraph 47(1)(h)(ii) as notionally substituted by ASIC Corporations, Credit and Superannuation (Internal Dispute Resolution) Instrument 2020/98.”.\n\n6 Insignificant contraventions of core obligations\n\n(1) Part 7.6 of the Corporations Act (other than Divisions 4 and 8) applies in relation to financial service licensees as if section 912D were modified or varied by:\n\n(a) in subsection 912D(4), omitting “For the purposes” and substituting “Subject to subsections (4A) and (4AA), for the purposes”; and\n\n(b) after subsection 912D(4), inserting:\n\n“(4A) A breach of a core obligation constituted by a contravention of subsection 1041H(1) of this Act or subsection 12DA(1) or 12DB(1) of the ASIC Act is not taken to be significant if:\n\n(a) but for this subsection, the underlying circumstances in relation to the breach:\n\n(i) would only give rise, and would only be likely to give rise, to a single reportable situation as a result of the following:\n\n(A) paragraph (4)(b) in so far as it relates to a contravention of subsection 12DB(1) of the ASIC Act;\n\n(B) paragraph (4)(c); and\n\n(ii) would not give rise, and would be unlikely to give rise, to a reportable situation other than as specified in subparagraph (i); and\n\n(b) either:\n\n(i) only one person (client) is, or is likely to be impacted by the contravention; or\n\n(ii) if the contravention relates to a financial product that is, or that is proposed to be, held by more than one person (each a client) jointly, those clients are the only persons who are, or are likely to be, impacted by the contravention; and\n\n(c) the contravention has not resulted in, and is unlikely to result in, any financial loss or damage to any person (for the purposes of this paragraph, financial loss or damage is to be taken into account regardless of whether it is, or will or may be, remediated).\n\n(4AA) A breach of a core obligation is also not taken to be significant if:\n\n(a) but for this subsection, the underlying circumstances in relation to the breach:\n\n(i) would only give rise, and would only be likely to give rise, to a single reportable situation or a single group of reportable situations as a result of paragraphs (4)(b) and (c); and\n\n(ii) would not give rise, and would be unlikely to give rise, to a reportable situation other than as specified in subparagraph (i); and\n\n(b) the underlying circumstances in relation to the breach do not constitute a contravention of section 828C or 981M; and\n\n(c) there are no more than 10 persons (clients) who are, or are likely to be, impacted by the single reportable situation or single group of reportable situations (where a breach relates to a financial product that is, or that is proposed to be, held by more than one person jointly, those persons are to be treated as a single client for the purposes of this paragraph); and\n\n(d) the total financial loss or damage to all persons resulting from, or likely to result from, the single reportable situation or single group of reportable situations does not exceed $1,000 (for the purposes of this paragraph, financial loss or damage is to be taken into account regardless of whether it is, or will or may be, remediated); and\n\n(e) the breach has been rectified (including any necessary remediation to clients) within 60 days after the reportable situation first occurred.\n\n(4B) For the purposes of:\n\n(a) subsection (4A)—the circumstances in which there is a single reportable situation as a result of particular conduct include circumstances in which the conduct constitutes a single contravention of two or more of the following and does not otherwise give rise to a reportable situation:\n\n(i) subsection 1041H(1) of this Act;\n\n(ii) subsection 12DA(1) of the ASIC Act;\n\n(iii) subsection 12DB(1) of the ASIC Act; and\n\n(aa) subsection (4AA)—the circumstances in which there is a single reportable situation as a result of particular conduct include circumstances in which the conduct constitutes a single contravention of two or more provisions referred to in paragraphs (4)(b) and (c) and does not otherwise give rise to a reportable situation; and\n\n(ab) subsection (4AA)—a single group of reportable situations means two or more single reportable situations which:\n\n(i) each involve the same or substantially similar conduct other than the identity of the consumer and the date of the conduct; and\n\n(ii) occur within a period of no more than 60 days; and\n\n(b) subsections (4A) and (4AA)—a person is impacted by a contravention of:\n\n(i) subsection 1041H(1) of this Act or subsection 12DA(1) of the ASIC Act if they are misled or deceived as a result of the contravention; and\n\n(ii) subsection 12DB(1) of the ASIC Act if they are the recipient of the false or misleading representation to which the contravention relates.\n\nNote: Otherwise, impacted has its ordinary meaning.”.\n\n(2) The provisions to which Part 2-6 of the Credit Act applies apply in relation to credit licensees as if subsection 50A were modified or varied by:\n\n(a) in subsection 50A(4), omitting “For the purposes” and substituting “Subject to subsections (4A) and (4AA), for the purposes”; and\n\n(b) after subsection 50A(4), inserting:\n\n“(4A) A breach of a core obligation constituted by a contravention of subsection 12DA(1) or 12DB(1) of the ASIC Act is not taken to be significant if:\n\n(a) but for this subsection, the underlying circumstances in relation to the breach:\n\n(i) would only give rise, and would only be likely to give rise, to a single reportable situation as a result of the following:\n\n(A) paragraph (4)(b) in so far as it relates to a contravention of subsection 12DB(1) of the ASIC Act;\n\n(B) paragraph (4)(d); and\n\n(ii) would not give rise, and would be unlikely to give rise, to a reportable situation other than as specified in subparagraph (i); and\n\n(b) either:\n\n(i) only one person (affected consumer) is, or is likely to be, impacted by the contravention; or\n\n(ii) if the contravention relates to any of the following that is, or that is proposed to be, entered into jointly by more than one credit activity client (each an affected consumer) of the licensee, those affected consumers are the only persons who are, or are likely to be, impacted by the contravention:\n\n(A) a credit contract or proposed credit contract;\n\n(B) a consumer lease or proposed consumer lease;\n\n(C) a mortgage or proposed mortgage;\n\n(D) a guarantee or proposed guarantee; and\n\n(c) the contravention has not resulted in, and is unlikely to result in, any financial loss or damage to any consumer (for the purposes of this paragraph, financial loss or damage is to be taken into account regardless of whether it is, or will or may be, remediated).\n\n(4AA) A breach of a core obligation is also not taken to be significant if:\n\n(a) but for this subsection, the underlying circumstances in relation to the breach:\n\n(i) would only give rise, and would only be likely to give rise, to a single reportable situation or single group of reportable situations as a result of paragraphs (4)(b) and (d); and\n\n(ii) would not give rise, and would be unlikely to give rise, to a reportable situation other than as specified in subparagraph (i); and\n\n(b) there are no more than 10 persons (affected consumers) who are, or are likely to be, impacted by the single reportable situation or single group of reportable situations (where a breach relates to any of the following that is, or that is proposed to be, entered into jointly by more than one credit activity client those credit activity clients are to be treated as a single affected consumer for the purposes of this paragraph):\n\n(i) a credit contract or proposed credit contract;\n\n(ii) a consumer lease or proposed consumer lease;\n\n(iii) a mortgage or proposed mortgage;\n\n(iv) a guarantee or proposed guarantee; and\n\n(c) the total financial loss or damage to all consumers resulting from, or likely to result from, the single reportable situation or single group of reportable situations does not exceed $1,000 (for the purposes of this paragraph, financial loss or damage is to be taken into account regardless of whether it is, or will or may be, remediated); and\n\n(d) the breach has been rectified (including any necessary remediation to affected consumers) within 60 days after reportable situation first occurred.\n\n(4B) For the purposes of:\n\n(a) subsection (4A)—the circumstances in which there is a single reportable situation as a result of particular conduct include circumstances in which the conduct constitutes a single contravention of both of the following and does not otherwise give rise to a reportable situation:\n\n(i) subsection 12DA(1) of the ASIC Act;\n\n(ii) subsection 12DB(1) of the ASIC Act; and\n\n(aa) subsection (4AA)—the circumstances in which there is a single reportable situation as a result of particular conduct include circumstances in which the conduct constitutes a single contravention of two or more provisions referred to in paragraphs (4)(b) and (d) and does not otherwise give rise to a reportable situation; and\n\n(ab) subsection (4AA)— a single group of reportable situations means two or more single reportable situations which:\n\n(i) each involve the same or substantially similar conduct other than the identity of the consumer and the date of the conduct; and\n\n(ii) occur within a period of no more than 60 days; and\n\n(b) subsections (4A) and (4AA)—a person is impacted by a contravention of:\n\n(i) subsection 12DA(1) of the ASIC Act if they are misled or deceived as a result of the contravention; and\n\n(ii) subsection 12DB(1) of the ASIC Act if they are the recipient of the false or misleading representation to which the contravention relates.\n\nNote: Otherwise, impacted has its ordinary meaning.”.\n\n6A Ongoing investigations\n\n(1) Part 7.6 of the Corporations Act (other than Divisions 4 and 8) applies in relation to financial service licensees as if section 912D were modified or varied by, in paragraph 912D(1)(c), omitting “30 days” and substituting “60 days”.\n\n(2) The provisions to which Part 2-6 of the Credit Act applies apply in relation to credit licensees as if section 50A were modified or varied by, in paragraph 50A(1)(c), omitting “30 days” and substituting “60 days”.\n\n7 Reporting period for additional reportable situations\n\n(1) Part 7.6 of the Corporations Act (other than Divisions 4 and 8) applies in relation to financial service licensees as if section 912DAA were modified or varied by omitting subsection 912DAA(3) (other than the heading) and substituting:\n\n“(3) The report must be lodged with ASIC:\n\n(a) within 30 days after the financial services licensee first knows that, or is reckless with respect to whether, there are reasonable grounds to believe the reportable situation has arisen; or\n\n(b) if:\n\n(i) there is a reportable situation (previous reportable situation) with underlying circumstances that are the same as, or substantially similar to, the underlying circumstances of the reportable situation (current reportable situation); and\n\n(ii) the financial services licensee has lodged a report under this section in relation to the previous reportable situation with ASIC;\n\nwithin 90 days after the financial services licensee first knows that, or is reckless with respect to whether, there are reasonable grounds to believe the current reportable situation has arisen.”.\n\n(2) The provisions to which Part 2-6 of the Credit Act applies apply in relation to credit licensees as if subsection 50B were modified or varied by omitting subsection 50B(4) (other than the heading) and substituting:\n\n“(4) The report must be lodged with ASIC:\n\n(a) within 30 days after the licensee first knows that, or is reckless with respect to whether, there are reasonable grounds to believe that the reportable situation has arisen; or\n\n(b) if:\n\n(i) there is a reportable situation (previous reportable situation) with underlying circumstances that are the same as, or substantially similar to, the underlying circumstances relating to the reportable situation (current reportable situation); and\n\n(ii) the licensee has lodged a report under this section in relation to the previous reportable situation with ASIC;\n\nwithin 90 days after the licensee first knows that, or is reckless with respect to whether, there are reasonable grounds to believe the current reportable situation has arisen.”.\n\n7A Reports submitted to APRA\n\n(1) Part 7.6 of the Corporations Act (other than Divisions 4 and 8) applies in relation to financial service licensees as if section 912DAA were modified or varied by omitting paragraph 912DAA(5)(b) and substituting:\n\n“(b) the licensee has given a report to APRA that contains the following information in relation to the licensee and the reportable situation:\n\n(i) the following information in relation to the licensee:\n\n(A) the name of the licensee;\n\n(B) the ACN or ARBN of the licensee;\n\n(C) the licence number of the licensee;\n\n(ii) the date of the first and, if there has been more than one occurrence, the last occurrence of the circumstances giving rise to the reportable situation;\n\nNote: A reportable situation need not involve a breach of a core obligation: see paragraphs 912D(1)(b) to (d) and subsection 912D(2).\n\n(iii) if the reportable situation relates to a core obligation:\n\n(A) if paragraph 912D(3)(a) applies—the applicable obligations under section 912A or 912B; and\n\n(B) if paragraph 912D(3)(b) applies—the provisions of this Act or the ASIC Act that the obligation relates to; and\n\n(C) if paragraph 912D(3)(c) applies—the provisions of Commonwealth legislation that the obligation relates to; and\n\n(D) if paragraph 912D(3)(d) applies—the provisions of Commonwealth, State or Territory legislation or the rule of common law or equity that the obligation relates to; and\n\n(E) if paragraph 912D(3)(e) applies—the provisions of this Act or the ASIC Act that the obligation relates to;\n\n(iv) a description of the reportable situation;\n\n(v) if applicable, when the licensee started and completed an investigation into the reportable situation;\n\n(vi) the root cause of the reportable situation;\n\n(vii) whether any similar reportable situations have occurred;\n\n(viii) the number of complaints received by the licensee in relation to the reportable situation;\n\n(ix) the extent or magnitude of the circumstances giving rise to the reportable situation, including an estimate of the number of impacted persons and the dollar amount involved;\n\n(x) whether, when and how the circumstances giving rise to the reportable situation have been rectified;\n\n(xi) whether, when and how impacted persons have been compensated or redressed;\n\n(xii) any measures taken by the licensee to prevent future similar breaches or circumstances from occurring.”.\n\n(2) The provisions to which Part 2-6 of the Credit Act applies apply in relation to credit licensees as if section 50B were modified or varied by omitting paragraph 50B(6)(b) and substituting:\n\n“(b) the licensee has given a report to APRA that contains the following information in relation to the licensee and the reportable situation:\n\n(i) the following information in relation to the licensee:\n\n(A) the name of the licensee;\n\n(B) the ACN or ARBN of the licensee;\n\n(C) the Australian credit licence number of the licensee;\n\n(ii) the date of the first and, if there has been more than one occurrence, the last occurrence of the circumstances giving rise to the reportable situation;\n\nNote: A reportable situation need not involve a breach of a core obligation: see paragraphs 50A(1)(b) to (d) and subsection 50A(2).\n\n(iii) if the reportable situation relates to a core obligation:\n\n(A) if paragraph 50A(3)(a) applies—the applicable obligations under section 47; and\n\n(B) if paragraph 50A(3)(b) applies—the provisions of this Act, the Transitional Act or Division 2 of Part 2 of the ASIC Act and regulations made for the purpose of that Division that the obligation relates to; and\n\n(C) if paragraph 50A(3)(c) applies—the provisions of Commonwealth legislation that the obligation relates to; and\n\n(D) if paragraph 50A(3)(d) applies—the provisions of this Act, the Transitional Act or Division 2 of Part 2 of the ASIC Act and regulations made for the purpose of that Division that the obligation relates to; and\n\n(iv) a description of the reportable situation;\n\n(v) if applicable, when the licensee started and completed an investigation into the reportable situation;\n\n(vi) the root cause of the reportable situation;\n\n(vii) whether any similar reportable situations have occurred;\n\n(viii) the number of complaints received by the licensee in relation to the reportable situation;\n\n(ix) the extent or magnitude of the circumstances giving rise to the reportable situation, including an estimate of the number of impacted persons and the dollar amount involved;\n\n(x) whether, when and how the circumstances giving rise to the reportable situation have been rectified;\n\n(xi) whether, when and how impacted persons have been compensated or redressed;\n\n(xii) any measures taken by the licensee to prevent future similar breaches or circumstances from occurring.”.\n\n8 Core obligations\n\nThe provisions to which Part 2-6 of the Credit Act applies apply in relation to credit licensees as if subsection 50A were modified or varied by omitting paragraph 50A(3)(c) and substituting:\n\n“(c) the obligation under paragraph 47(1)(d), so far as it relates to Commonwealth legislation that is:\n\n(i) covered by paragraph (d) of the definition of credit legislation; and\n\n(ii) one of the following:\n\n(A) Banking Act 1959;\n\n(B) Corporations Act 2001;\n\n(C) Financial Sector (Collection of Data) Act 2001;\n\n(D) Financial Sector (Shareholdings) Act 1998;\n\n(E) Financial Sector (Transfer and Restructure) Act 1999.”.\n\n \n\nPart 3—Repeal\n\n9 Repeal\n\nThis instrument is repealed at the start of 1 October 2029.\n\nEndnotes\n\nEndnote 1—About the endnotes\n\n> Note: The endnotes provide information about this compilation and the compiled law.\n\n> Note: The following endnotes are included in every compilation:\n\n> Note: Endnote 1—About the endnotes\n\n> Note: Endnote 2—Abbreviation key\n\n> Note: Endnote 3—Legislation history\n\n> Note: Endnote 4—Amendment history\n\n> Note: Abbreviation key—Endnote 2\n\n> Note: The abbreviation key sets out abbreviations that may be used in the endnotes.\n\n> Note: Legislation history and amendment history—Endnotes 3 and 4\n\n> Note: Amending laws are annotated in the legislation history and amendment history.\n\n> Note: The legislation history in endnote 3 provides information about each law that has amended (or will amend) the compiled law. The information includes commencement details for amending laws and details of any application, saving or transitional provisions that are not included in this compilation.\n\n> Note: The amendment history in endnote 4 provides information about amendments at the provision (generally section or equivalent) level. It also includes information about any provision of the compiled law that has been repealed in accordance with a provision of the law.\n\n> Note: Misdescribed amendments\n\n> Note: A misdescribed amendment is an amendment that does not accurately describe how an amendment is to be made. If, despite the misdescription, the amendment can be given effect as intended, then the misdescribed amendment can be incorporated through an editorial change made under section 15V of the Legislation Act 2003.\n\n> Note: If a misdescribed amendment cannot be given effect as intended, the amendment is not incorporated and “(md not incorp)” is added to the amendment history.\n\nEndnote 2—Abbreviation key\n\n| ad = added or inserted | orig = original |\n| ---------------------------------------------- | ----------------------------------- |\n| am = amended | par = paragraph(s)/subparagraph(s) |\n| amdt = amendment | /sub‑subparagraph(s) |\n| c = clause(s) | pres = present |\n| C[x] = Compilation No. x | prev = previous |\n| Ch = Chapter(s) | (prev…) = previously |\n| def = definition(s) | Pt = Part(s) |\n| Dict = Dictionary | r = regulation(s)/rule(s) |\n| disallowed = disallowed by Parliament | reloc = relocated |\n| Div = Division(s) | renum = renumbered |\n| exp = expires/expired or ceases/ceased to have | rep = repealed |\n| Effect | rs = repealed and substituted |\n| F = Federal Register of Legislation | s = section(s)/subsection(s) |\n| gaz = gazette | Sch = Schedule(s) |\n| LA = Legislation Act 2003 | Sdiv = Subdivision(s) |\n| LIA = Legislative Instruments Act 2003 | SLI = Select Legislative Instrument |\n| (md not incorp) = misdescribed amendment | SR = Statutory Rules |\n| cannot be given effect | Sub‑Ch = Sub‑Chapter(s) |\n| mod = modified/modification | SubPt = Subpart(s) |\n| No. = Number(s) | underlining = whole or part not |\n| o = order(s) | commenced or to be commenced |\n| Ord = Ordinance | |\n\nEndnote 3—Legislation history\n\n```html\n

Name

Registration

Commencement

Application, saving and transitional provisions

ASIC Corporations and Credit (Breach Reporting—Reportable Situations) Instrument 2024/620

24 September 2024 (see F2024L01202)

25 September 2024

ASIC Corporations and Credit (Amendment) Instrument 2025/289

26 June 2025 (see F2025L00746)

27 June 2025

ASIC Corporations and Credit (Amendment and Repeal) Instrument 2025/590

11 September 2025 (see F2025L01084)

12 September 2025

\n```\n\nEndnote 4—Amendment history\n\n| Provision affected | How affected |\n| ------------------------------------------------------- | ------------ |\n| Section 2 | rep. s48D LA |\n| Section 6 | am. 2025/289 |\n| Section 6A | ad. 2025/289 |\n| Section 7A | ad. 2025/289 |\n| Subsection 6(2) (notional subparagraph 50A(4B)(ab)(ii)) | am. 2025/590 |","sortOrder":0}],"analysis":{"kimi_summary":{"content_quality":"ok","complexity_score":7,"scope_assessment":{"changed":false,"description":"The instrument remains tightly focused on its original purpose of defining reportable situations and breach reporting thresholds for financial services and credit licensees. While it has been amended twice (in June and September 2025) to refine the insignificant breach exceptions and add APRA reporting alternatives, these changes operate within the original framework rather than expanding into new regulatory areas. The scope has not grown beyond breach reporting administration."},"complexity_factors":["Notional amendments: The instrument doesn't directly state the law but modifies other Acts 'as if' sections were omitted and substituted, requiring readers to mentally reconstruct the modified text","Dual regime structure: Parallel provisions for financial services licensees (Corporations Act) and credit licensees (Credit Act) with subtle differences in wording and scope","Nested conditional logic: Section 6 contains multi-layered exceptions with cumulative conditions (subsections 4A and 4AA) requiring tracking of: number of affected persons, dollar thresholds, time limits, remediation status, and underlying conduct characteristics","Cross-references to other instruments: References to ASIC Corporations, Credit and Superannuation (Internal Dispute Resolution) Instrument 2020/98 and its notional insertions","Defined terms with special meanings: 'Impacted' has specific statutory definitions for different contravention types in subsection 4B, plus a note preserving ordinary meaning otherwise","Complex temporal calculations: 60-day investigation periods, 60-day rectification windows, 30-day initial reporting, 90-day similar breach reporting, and 5-year sunset clause","Group reporting mechanics: Definition of 'single group of reportable situations' involving 'substantially similar conduct' and 60-day occurrence windows","Joint holder treatment rules: Special counting rules where financial products or credit contracts are held jointly – treated as single client for threshold purposes"],"plain_english_summary":"This ASIC rule changes when financial services and credit licensees must report legal breaches, creating clear de minimis exceptions for small, quickly remedied incidents and exempting internal dispute resolution breaches from automatic reporting. It extends investigation time to 60 days, lengthens reporting windows for repeat similar breaches, and lets dual-regulated entities rely on detailed APRA reports instead of duplicative ASIC notices. The aim is to reduce regulatory burden while keeping serious breaches reportable."},"flash_summary":{"complexity_score":7,"scope_assessment":{"changed":true,"description":"This instrument narrows and timeshifts the scope of reportable situations compared with a straightforward application of the existing reporting rules. It introduces de‑minimis exemptions (limiting reports for small‑scale incidents), extends investigation and reporting timeframes, and permits reliance on APRA reports. Those changes reduce the set of events that must be reported and delay some reporting obligations, so the operational and informational scope of the regime is materially altered from a more expansive original reporting approach (see ss5–7, 6A, 7A)."},"complexity_factors":["Multiple cross‑references to the Corporations Act (Part 7.6: sections 912A, 912B, 912D, 912DAA) and the National Consumer Credit Protection Act (Part 2–6: sections 47, 50A, 50B) — extensive cross‑legislative linkage","Nested conditional tests added (new subsections 912D(4A), (4AA), (4B) and equivalents) with multiple conjunctive requirements (number of persons, dollar threshold, rectification time)","Numeric thresholds and time limits to apply across modified sections (10 persons, $1,000 total loss, 60 days for rectification, 30/60/90 day reporting windows)","Dual regimes: parallel modifications for financial services licensees and credit licensees throughout the instrument (mirrored provisions)","Subjective terms retained (\"impacted\", \"substantially similar\", \"financial loss or damage\") requiring interpretation with statutory and factual context","Substitution of APRA reporting with a long list of required fields — creates dependency on another regulator's reporting format and content (detailed list in s7A)","Amendments and a scheduled repeal date (s9) plus subsequent amending instruments in the endnotes increase lifecycle complexity"],"plain_english_summary":"**What this instrument does (mechanically)\n\n- It changes how and when financial services licensees and credit licensees must report \"reportable situations\" to ASIC. The instrument does this by modifying how Parts 7.6 of the Corporations Act and Part 2–6 of the National Credit Act operate in relation to reporting (see s5, s6 and equivalents).\n\n- It narrows which civil‑penalty contraventions automatically trigger a report by excluding most civil penalty contraventions from the definition of a reportable breach, subject to a small list of exceptions (s5).\n\n- It introduces de‑minimis (insignificance) tests so certain small or isolated contraventions of core obligations do not have to be reported as \"significant\" (new subsections added at s6: 912D(4A), (4AA), (4B) and credit Act equivalents). Key numeric thresholds in those tests are:\n - No more than 10 impacted persons (or one client) in some cases;\n - Total financial loss across impacted persons not exceeding $1,000; and\n - Rectification (including any remediation) completed within 60 days.\n\n- It lengthens the reporting deadline for matters under investigation from 30 days to 60 days in certain circumstances (s6A modifies 912D(1)(c) and the credit Act equivalent).\n\n- It allows a longer lodgement window (up to 90 days rather than 30) for a current reportable situation when the underlying circumstances are the same or substantially similar to a previously reported matter for which a report to ASIC has already been lodged (s7 modifies 912DAA/50B timing rules).\n\n- It permits the use of a report already given to APRA (containing specified fields) as meeting the information requirement for ASIC reporting in certain cases, by specifying what the APRA report must contain (s7A modifies 912DAA(5)(b) and the credit Act equivalent).\n\n- It clarifies which Commonwealth laws are treated as \"core obligations\" for credit licensees by listing specific Federal Acts that are covered (s8 modifies scope of paragraph 50A(3)(c)).\n\n- The instrument is time‑limited: it is repealed at the start of 1 October 2029 (s9).\n\nWho this affects\n\n- Financial services licensees regulated under the Corporations Act (references: s5, s6, s6A, s7, s7A).\n- Credit licensees holding Australian credit licences regulated under the National Consumer Credit Protection Act (references: s5(2), s6(2), s6A(2), s7(2), s7A(2), s8).\n- APRA (as a possible alternative reporting recipient) because APRA reports that meet the listed requirements can be used for ASIC reporting (s7A).\n- Consumers and clients of licensees, to the extent the changes alter which incidents are publicly or regulatorily reported and when.\n\nWhy it matters (incentives, costs, trade‑offs)\n\n- Reduces immediate reporting burden for licensees: By excluding many civil penalty contraventions and creating de‑minimis exemptions (small number of persons, small aggregate loss, quick rectification), the instrument reduces the number of incidents that must be treated as \"significant\" reportable situations (see s5 and s6).\n\n- Lowers duplication and administrative friction: Allowing APRA reports that contain specified information to stand in for ASIC reporting reduces duplicate reporting where both regulators are involved (s7A).\n\n- Gives licensees more time to investigate and to treat repeated/similar incidents as related: the investigation period is extended from 30 to 60 days (s6A) and similar incidents can be reported within 90 days when a prior report for the same circumstances exists (s7). That reduces pressure to lodge immediate follow‑up reports.\n\n- Shifts decision power and recordkeeping burden to licensees: licensees decide whether an incident meets the numeric/temporal thresholds and must retain evidence that remediation occurred within 60 days, the number of impacted persons, the dollar amount of loss, and whether incidents are \"substantially similar\" to prior reports (s6, s7). That creates an internal compliance task to document classifications and timing.\n\n- Creates potential incentives to classify incidents as \"insignificant\" or to limit remediation to stay below thresholds: because thresholds are explicit (e.g. $1,000 total loss; ≤10 persons), licensees face an incentive to structure remediation and incident responses to fall within the exemption criteria. The instrument does not remove ASIC's enforcement powers, but it changes when licensees must report (see s6 and note in s7A).\n\n- Transparency trade‑off: fewer reports and later reporting may lower regulatory visibility and public information about problems that affect consumers. That is the direct trade‑off for lower compliance costs.\n\n- Legal and operational ambiguity remains: the instrument uses partly subjective concepts (for example, whether persons are \"impacted\", what counts as \"financial loss or damage\" and whether conduct is \"substantially similar\"), and cross‑references many other statutory provisions. That creates scope for disagreements between ASIC and licensees about whether an incident was reportable (see definitions and subsections added at s6(1)(4A)–(4B)).\n\nImplementation and compliance risks\n\n- Systems and recordkeeping: licensees must track incidents across a 60‑day window, aggregate small losses across multiple clients, record remediation completion, and show whether incidents are essentially the \"same\" as prior reports (s6(4AA), s6B(4B), s7). Those operational tasks can be non‑trivial for firms with many small incidents.\n\n- Subjectivity and enforcement risk: because key determinations (e.g. \"impacted\", \"financial loss or damage\") have partly contextual meanings, firms face the risk of ASIC later concluding a matter was reportable, exposing the firm to enforcement action or reputational harm (see s6(4B) explanatory notes).\n\n- Behavioural response: firms may accelerate remediation to meet the 60‑day deadline or aggregate incidents into \"single reportable situations\" to rely on the exemptions. That can be efficient, but could also produce perverse outcomes if remediation is superficial.\n\nWho pays and who decides\n\n- Who pays: compliance, reporting and recordkeeping costs fall on licensees (see s5–s8). Any costs of remediation and compensation fall on licensees when incidents require remediation.\n\n- Who decides: licensees decide whether an incident meets the de‑minimis tests, whether it is \"substantially similar\" to a prior incident, and whether remediation within 60 days has occurred (see s6 and s7). ASIC retains oversight and can challenge licensees' assessments through enforcement action if it considers a report ought to have been made.\n\nConcentrated benefits and diffuse costs\n\n- Concentrated benefits: the main and immediate beneficiaries are licensees (reduced reporting and duplication costs; clearer thresholds) (s5, s6, s7A).\n\n- Diffuse costs: consumers and the public potentially face reduced or later disclosure of issues across the sector, which is a diffuse effect that is harder to measure but follows directly from fewer and later reports being required.\n\nStatutory time limit\n\n- The instrument expires (is repealed) on 1 October 2029, which makes these changes temporary unless renewed or made permanent in future legislation (s9).\n\nPrimary sections to scan for details: sections 5–8 (modifications/exemptions/timing), and section 9 (repeal)."},"flash_summary_failed":{"failed":true,"reason":"A positive credit balance is required for all requests, including BYOK, so fallback providers remain available. Add credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up to continue.","source":"analysis-cron"}},"importantCases":[],"_links":{"self":"/api/acts/asic-corporations-and-credit-breach-reporting-reportable-situations-instrument-2024-620","history":"/api/acts/asic-corporations-and-credit-breach-reporting-reportable-situations-instrument-2024-620/history","analysis":"/api/acts/asic-corporations-and-credit-breach-reporting-reportable-situations-instrument-2024-620/analysis","conflicts":"/api/acts/asic-corporations-and-credit-breach-reporting-reportable-situations-instrument-2024-620/conflicts","importantCases":"/api/acts/asic-corporations-and-credit-breach-reporting-reportable-situations-instrument-2024-620/important-cases","documents":"/api/acts/asic-corporations-and-credit-breach-reporting-reportable-situations-instrument-2024-620/documents"}}