ASIC's recent action against Lanterne highlights ASIC's increasing focus on the adequacy of risk management systems

AFS licensees must have adequate risk management systems

Compliance expectations

AFS licensees should have risk management systems that are supplemented by risk management tools to assist with identifying and evaluating risks faced by its business, including the risks of non-compliance with financial services laws and the risks relating to its CARs and ARs. Such risk management systems should include a documented risk management framework (which includes risk management tools such as a risk matrix, incident management process and compliance management system), which describes how the AFS licensee manages and mitigates identified risks, and how regularly the risk management system should be reviewed (internally and externally) and updated.

Allegations

ASIC has alleged that Lanterne contravened its obligation to have adequate risk management systems in place based on its failure to engage internal or external personnel with risk management expertise, its failure to have an adequate compliance management system which had regard to the nature, scale and complexity of its business and its failure to implement an adequate risk management system with basic risk management tools that:

• identified and assessed the risks faced by its business and its CARs and ARs;
• documented and identified or assessed risks;
• managed or mitigated risks, including the failure to have incident management processes in place; and
• provided independent oversight or monitoring of its risk management systems.

Instead, Lanterne relied on:

• an outdated Compliance Manual that omitted regulatory and compliance obligations of its CARs, ARs and itself as an AFS licensee; and
• its initial due diligence of the directors of potential CARs and monthly compliance self-assessments by the CARs to monitor and identify risks associated with the CARs and ARs.

TEXT

Maintain competence to provide financial services

Compliance expectations

To maintain competence to provide financial services, AFS licensees should have sufficient responsible managers that are appropriately qualified in the financial services offered by its CARs and ARs across the industries and business in which they operate. An AFS licensee should have documented and implemented processes for assessing its responsible managers to ensure they are appropriately qualified and have sufficient time to effectively conduct their roles.

Allegations

In its Concise Statement, ASIC notes that Lanterne failed to have:

• any processes to ensure it had appropriate qualified responsible managers;
• responsible managers with sufficient time to effectively conduct their roles; and
• a sufficient number of appropriately experienced responsible managers for the businesses operated by Lanterne and its CARs.

Adequate training

Compliance expectations

AFS licensees have a duty to ensure its representatives are adequately trained and competent to provide the financial services. To do so, AFS licensees should have available internal or external training and competency programs, which clearly document the skills and competencies required by its ARs to provide the authorised financial services. Each AR should be assessed against relevant skills and competencies matrixes to ensure those skills and competencies are maintained and up-to-date.

AFS licensees should also maintain training records to assess the effectiveness of the training on an annual basis.

Allegations

ASIC claims that Lanterne relied solely on the unaudited monthly self-assessment compliance reports provided by its ARs to satisfy itself that its ARs had undertaken training. As such, Lanterne failed to assess the skills and competency requirements of representatives of its CARs or ARs.

Lanterne also failed to provide any training, professional development or other instructional programs for its CARs and ARs.

Reasonable steps to ensure representatives comply with financial services laws

Compliance expectations

ASIC expects AFS licensees to have effective and documented processes to:

• conduct background checks and due diligence investigations of representatives of its prospective CARs and ARs;
• provide clear guidance and instructions to its CARs and ARs about their compliance with financial services laws;
• ensure effective supervisory systems are in place to conduct regular reviews of its appointed ARs to ensure they remain appropriate; and
• monitor and supervise CARs and ARs through a program of reviews and audits following a prescribed methodology (with the frequency of such audits depending upon the risk assessment of each CAR and AR, with higher risk CARs and ARs being reviewed and audited more frequently);
• ensure negative audit findings, events and breaches are reported and addressed accordingly.

ASIC also expects the board of directors or an independent party to monitor and supervise management and responsible managers of AFS licensees.

Allegations

ASIC has alleged that Lanterne failed to implement reasonable steps to ensure its representatives comply with financial services law. Specifically, ASIC has noted that Lanterne failed to implement:

• documented and robust due diligence processes for prospective CARs and ARs;
• monitoring and audit processes on its CARs, ARs, employees and responsible managers; and
• failed to ensure ARs remained appropriate.

Resources

Compliance expectations

ASIC expects AFS licensees to have adequate resources and documented processes in place covering its basic functions of:

• risk and compliance – to supervise and monitor its representatives;
• IT – to ensure appropriate assessments and plans are designed, implemented and regularly updated (e.g. cyber security assessment, disaster recovery plans, acquisition and installation of appropriate hardware and software);
• financial management – to implement appropriate processes to ensure solvency and positive net assets test, cash needs requirements and audit requirements are met; and
• human resources – to implement documented performance management systems, staff training and development programs and plans to deal with the loss of key personnel.

Allegations

Lanterne has allegedly failed to have available and maintain adequate resources and documented processes, including a failure to have:

• any adequately trained and skilled compliance and risk management personnel;
• any human resources capability;
• adequate IT capability including a failure to implement any IT-related plans (eg. cyber security and disaster recovery);
• adequate financial management capability having regard to the nature and scale of its business; or

considered and assessed the financial resources it required to provide the financial services covered by its AFSL and carry out supervisory arrangements.

Provide financial services efficiently, honestly and fairly

Compliance expectations

In ASIC RG 104: AFS licensing: Meeting the general obligations, ASIC broadly notes that an AFS licensee is required to do all things necessary to ensure that financial services are provided so as to meet all of the elements of "efficiently, honestly and fairly".

The obligation to provide financial services efficiently, honestly and fairly is also a standalone obligation that operates separately from the other general obligations outlined in section 912A of the Corporations Act.

ASIC relevantly provides that a breach may still amount to a failure to provide financial services efficiently, honestly and fairly even where contravention of the other general obligations under section 912A of the Corporations Act does not arise.

Allegations

ASIC has formed the view that Lanterne has failed to provide financial services efficiently, honestly and fairly by virtue of its failures to comply with the general obligations outlined above.