So, ASIC wants your books and records? That includes those held offshore and in the cloud

It's a common occurrence. ASIC has issued you with a notice requiring you to produce books and records. What does it mean, and how can you comply quickly and with the least disruption caused to you or your company's business?

Contrary to what you might think, ASIC's decision to issue you with a notice requiring you to produce documents is not always an indication of wrongdoing. Responding to notices requesting books and records is part and parcel of the existence of companies (and those involved with companies) in Australia. It pays to know what to do when issued with one to help you comply as efficiently as possible.

Drawing on our recent experience acting for ASIC in the Federal Court to successfully enforce compliance with a notice, we set out a step-by-step guide to responding to a statutory notice (ASIC v Maxi EFX Global AU Pty Ltd [2020] FCA 1263; Maxi EFX Global AU Pty Ltd v Australian Securities and Investments Commission [2021] FCAFC 59).

Step one: Why is ASIC interested in me?

Your first port of call should be to work out why ASIC is (or is not) interested in you. ASIC has the power to seek documents under Part 3, Division 3 of Australian Securities and Investments Commission Act 2001 (Cth) in different circumstances, including for the purposes of an investigation, or in respect of "an alleged or suspected contravention". The notice itself will refer to the circumstances enlivening ASIC's statutory powers, which may include an investigation already on foot and any legislative provisions which are suspected or alleged to have been contravened.

ASIC has the power to seek books and records under various sections of the ASIC Act, including under:

• Section 30, which requires a body corporate or "a person in relation to the body corporate" to produce "specified books relating to the affairs of the body corporate". Production is limited to documents which relate to, and are held by, the recipient body corporate; and
• Section 33, which is broader and requires a person or company to produce "specified books" in the person or company's possession relating to the affairs of a body corporate, or other specified matters. Production is not limited to documents relating to the person or company in receipt of the notice itself. A section 33 notice can be issued to anyone who is able to compel production of the documents sought.

Step two: Is the notice valid?

The expression "specified books" means the documents to be produced must be identified in the notice with sufficient clarity and precision to enable the recipient to know what documents come within the notice’s terms and to form a view about what must be produced to comply.

• For example, a request for all books and records required to be maintained under the Corporations Law is unlikely to be sufficiently specific.

You should verify that there is a proper connection between ASIC's investigation and the documents sought. A notice which is “couched in such wide and general terms that a proper exercise of the investigatory power could not support the requirement in question” will be invalid. Consider the relevant sections specified on the notice to verify that the notice is related to those sections.

• For example, an investigation into a suspected system of unconscionable conduct under section 12CB(4)(b) of the ASIC Act will support a notice requesting a broad range or large number of documents.

In ASIC v Maxi EFX, ASIC successfully sought at first instance and on appeal an order that Maxi EFX comply with a notice issued to it under section 33. Maxi EFX unsuccessfully challenged the validity of the notice due to its breadth.

At first instance, Justice Wigney held that the mere fact a notice requires production of documents that may ultimately be irrelevant to the investigation does not mean that the notice is impermissibly broad, so long as there is a proper relationship between ASIC's investigation and the documents requested. His Honour confirmed that the use of words such as "relating to", "referring to" or "recording" in a notice, which are commonly used by ASIC, are sufficiently certain. As a result, you should keep in mind that ASIC has power to issue notices requiring the production of a very broad range of documents.

Step three: If issued with a section 33 notice, are the documents in your possession, custody or control?

Here, you need to consider documents held by third parties. The Full Court held that the word "possession" used in section 33 has an extended meaning which means possession, custody or control. This will capture documents which are in the physical possession of companies located overseas: for example, those held by offshore cloud providers. The Full Court confirmed that ASIC is able to seek documents both where you have a proprietary or legal interest in them, but also where you have the practical ability to produce the documents.

Upon receipt of a notice, you should promptly identify any relevant documents held by third parties and request that they provide them to you to ensure that they do not cause you any delay in complying with the notice.

Step four: Do you have a reasonable excuse for non-compliance?

ASIC will only enforce compliance with a notice where it satisfied that a person who failed to comply did not have a reasonable excuse for failing to do so.

It can be expensive, time consuming, and inconvenient to comply with an ASIC notice. Before producing documents, you’ll need to review them to ensure that they respond to the notice, and importantly, to check for legal professional privilege. You should also know exactly what you are handing over to the regulator. In short, responding to a notice is a time suck and demanding on a company's resources. Nonetheless, Justice Wigney confirmed that the expense and inconvenience in complying with a notice will not ordinarily provide a reasonable excuse for non-compliance. His Honour also noted that compliance would not have been particularly burdensome or expensive had Maxi EFX not chosen to outsource virtually all of its operations to entities domiciled in such "far-flung" or "exotic" places as Cyprus, Belize and Israel. While the Full Court did not adopt these descriptors it nevertheless agreed with His Honour as a matter of substance.

If you need more time to comply, it is usually in your interests to communicate this early and clearly to the regulator. For example, if the notice requests a large number of documents, all of which need to be reviewed, or if you are making enquiries with third parties who hold relevant documents, consider saying so. Providing as much detail as possible may be in your interests: such as the number of documents which need to be reviewed and your plan to review them. If you can produce some documents now but need more time to produce others, consider offering to do so.

If ASIC seeks to enforce compliance with the notice, keep in mind that you will require detailed evidence substantiating your reasonable excuse. This evidence may go beyond documentary evidence and may also include oral evidence from those directly involved in the process. For example, the Full Court said that where Maxi EFX's documentary evidence was insufficient, Maxi EFX's director could have given evidence which shed light on issues regarding the steps taken by Maxi EFX to seek to comply with the notice, but he chose not to do so.

Step five: What if the documents are privileged?

You don't need to produce documents subject to a claim of legal professional privilege, but you should be able to substantiate any such claim. ASIC also requires you to provide information substantiating your privilege claim at the time of responding to the notice. The required details are ordinarily set out in the cover letter to an ASIC notice. If ASIC challenges your claim, you should be ready to provide direct evidence about the dominant purpose for which the privileged documents were created. Again, this is likely to require evidence from those directly involved (Australian Securities and Investments Commission v RI Advice Group Pty Ltd [2020] FCA 1277).

In ASIC v RI Advice, Justice O'Callaghan also held that it was insufficient for a notice recipient to merely note in a cover email to ASIC that the recipient sought to provide a relevant document to ASIC “in a manner which [was] consistent with the maintenance of legal professional privilege”. This was insufficient to avoid waiver of privilege. If you want to voluntarily provide a privileged document to ASIC, you should refer to ASIC's Voluntary Confidential LPP Disclosure Agreement.

Step six: What if the documents are confidential?

Even if your documents are highly confidential, unless they are privileged, you must produce them. ASIC is obliged under the ASIC Act to take all reasonable measures to protect from unauthorised use books and records produced pursuant to statutory notice.

Helpful ASIC links:

• Document production guidelines
• Information Sheet 165: Claims of Legal Professional Privilege