Skip to content

IT and cybersecurity for financial services firms that have to prove it.

An annexure from your licensee, a questionnaire from your insurer, a third-party review from your platform. Advisers, authorised representatives, retirement planners and financial brokers all get the same asks. So do self-managed super fund (SMSF) administrators, wealth managers, boutique investment firms, accounting firms with financial services work, and mid-tier dealer groups. If you hold client money, financial records or tax data, you get the same list. Big banks, major super funds and general insurers need a different delivery model, and we will say so upfront.

What compliance asks of you See if we're a fit

What's actually different

Financial services IT in 2026 is mostly evidence and oversight.

You almost certainly have the controls already. Multi-factor authentication (MFA), endpoint detection and response (EDR), backups, allowlisting, logging, offboarding. None of that is exotic. The hard part is evidence. Your licensee, your broker and your platform all want proof that a control was on and stayed on. So does the Australian Securities and Investments Commission (ASIC). Most firms we assess have the controls in name but can't produce the evidence when someone digs in.

Then there is everyone else who touches your data. Platforms, advice software, practice management, client records, SMSF administration, tax and modelling tools. Every one of them adds another login and another set of people to trust. CPS 234, ASIC guidance, your licensee's annexure and the broker's questionnaire all want that oversight documented now. Someone has to read the vendor's assurance report, track their breach history and keep the access register current. When a vendor's security slips, someone has to notice. That is a real job, and it does not fit in the gaps of someone else's week.

If you are an authorised representative, your dealer group has already reacted to the Fortnum proceedings. ASIC's position is that licensees must set and enforce minimum cyber controls on their representatives. Failing to do so, it says, breaches the licence obligations. Annexures got tighter, attestations appeared, and audits became more frequent. That is not hostile. Their licence depends on your controls. Sorting the annexure before the audit costs less than sorting it during one.

You get one team for the day-to-day IT, the cybersecurity layer and the vendor oversight. We own the tenants, the devices, the identities and the vendor register. Nowhere for a problem to fall between providers, and a straight answer on the day your licensee, your broker, your auditor or ASIC asks.

Live right now

The 2026 pressure points we're actively working on with clients.

The specific asks, deadlines and enforcement actions shaping 2026 conversations in your sector.

ASIC v Fortnum Private Wealth (July 2025)

ASIC has filed civil penalty proceedings against Fortnum. It alleges Fortnum failed to set minimum cyber training and security controls for its authorised representatives (ARs) after the 2022 Wealthwise breach. The directions hearing is listed for July 2026. Every licensee group holding an Australian Financial Services Licence (AFSL) is now pushing MFA, EDR, baseline controls and staff training onto its ARs in writing. If you are an AR, expect your next licensee audit to ask for evidence. If you are the licensee, what you owe your ARs is now spelled out.

Licensee cyber annexures arriving through 2025/26

Fortnum, Count, Centrepoint, Oreana, Infocus, WT Financial, Lifespan, Clearview and Insignia have all tightened their cybersecurity policy for ARs in the past 12 months. Most ask for the same list: phish-resistant MFA, EDR on every device, documented patching, awareness training, a managed password vault. Then onboarding and offboarding run by HR, a written incident response plan, and evidence that all of it is operating. They are not suggestions. They are the basis of your next AR audit.

Cyber insurance renewal 2025/26 is an audit

Underwriters have stopped quoting financial services firms without the full set: MFA on every account, EDR on every device, tested backups. Then DMARC email authentication, phishing training for staff, and a written incident response plan. "We'll fix it after renewal" is why firms are being declined outright. The Fortnum proceedings are speeding this up.

ASIC 2026 enforcement priorities

Operational resilience, third-party risk and data governance are all named in ASIC's enforcement priorities this year. They apply to licensees the Australian Prudential Regulation Authority (APRA) does not regulate. ASIC will look at your controls before it looks at your advice.

Frameworks and regulators

Industry frameworks, regulations and audit standards for financial services in Australia.

AFSL obligations (Corps Act s912A / s912D)
What an Australian Financial Services Licence requires of your IT: client-data protection, record retention of about seven years, reasonable steps against cyber incidents. Section 912D adds reportable-situations notification to ASIC. It applies to licensees directly, and reaches ARs through the licensee annexure.
ASIC regulatory guides RG 104 and RG 271
ASIC's guides on licence adequacy, cyber risk, operational resilience and complaints handling. RG 104 sets out what ASIC expects of the IT systems behind your licence. The Fortnum proceedings are ASIC making RG 104 enforceable in practice.
Licensee cyber annexure
The document most likely to arrive in your inbox first if you are an AR. Each dealer group writes its own, and they are broadly similar, because each one reflects what the licensee has to defend to ASIC. We read it with you, compare it against what you already have, and close the gaps or write a plan your licensee will accept.
APRA CPS 234
For entities APRA regulates: smaller super funds, life insurers, health funds. Security capability sized to how vulnerable your information assets are, plus the controls to match. A material incident goes to APRA within 72 hours, and third parties need documented oversight. The enterprise end of it (the big banks, the major super funds) is not who we are built for. CPS 234 still reaches the smaller APRA-regulated clients we support.
Privacy Act 1988 and the Australian Privacy Principles
Client personal information, tax file numbers and financial records all count as sensitive. The 2024 Tranche 1 reforms created a statutory tort for serious invasions of privacy. Tranche 2 is expected to remove the small-business exemption from mid-2026. That would cover roughly 100,000 businesses, including most accounting firms and adviser practices under the $3M turnover threshold.
Mandatory ransomware payment reporting
If your turnover is above $3M and you pay a ransom, you report it to the Australian Signals Directorate (ASD) within 72 hours. That started on 30 May 2025 under the Cyber Security Act 2024, and every incident response plan now assumes it.
ACSC Essential Eight
Not mandated for financial services yet. It is still the benchmark your insurer scores at renewal, your licensee writes into AR agreements, and your platform references in its questionnaires. The Australian Cyber Security Centre (ACSC) publishes it. See Essential Eight maturity levels, and how we move clients up them.

Where firms usually start

Compliance and IT starting points for financial services in Australia.

Common questions

The things financial services clients ask us first.

Our licensee just sent us a new cybersecurity annexure to sign. What do we actually need to action?
Read it line by line with someone who knows the controls. Most annexures ask for the same eight or so things. Phish-resistant MFA on every account, EDR on endpoints, managed patching, fortnightly awareness training. Then a zero-knowledge password manager with single sign-on (SSO), written onboarding and offboarding, a documented incident response plan, and tested backups. We compare the annexure against what you already have, close the specific gaps, and document the result. Your licensee audit then becomes a conversation about facts rather than intent. Do it early. Licensees tend to ask again 12 months later.
Our platform (Netwealth / HUB24 / Praemium / Macquarie Wrap) just sent us a third-party risk questionnaire. How do we answer it?
With specifics. Platforms run these questionnaires to document third-party oversight for their own regulators and insurers, and they read the answers. The usual questions: which controls are in place, who operates them, what happens during an incident, how access is governed, how ex-staff are offboarded. We have completed enough of these to know which answers need to be specific. MFA counts when it is on every system, not just email. Some answers need evidence attached. We fill them in with you, not for you.
We're a 4-person advisory firm. Is this level of IT really necessary?
For most practices yes, because the obligations don't scale with headcount. A 4-person firm handles the same category of client data as a 40-person firm. The licensee's annexure asks the same questions. The insurer's renewal questionnaire asks the same questions. The platform's third-party review asks the same questions. What scales is the cost of getting it wrong: at 4 people an incident can end the practice, at 40 it's survivable.
Our cyber insurance renewal questionnaire keeps getting longer. Can you help?
Yes. Broker questionnaires now run 20 to 40 pages for mid-sized financial services firms, and they affect your premium, your excess and your cover. We have completed enough of them to know which answers the broker actually scores. Some trigger follow-up, and sometimes a declined quote. Others are where a "yes" becomes the lie that bites at claim time. We fill them in with you, and every answer is one you can back up.
Can our staff use Microsoft 365 Copilot, ChatGPT Enterprise or Claude for Work on client financial data?
Yes, if you are on an enterprise tier with the right data-handling terms and you have governed how it gets used. The risk is not the model. It is what data goes into it, and whether the tool trains on what you type. We help you pick the enterprise tier that fits the rest of your stack, then write an acceptable-use policy aligned to AFSL and ASIC guidance. The consumer tiers (free ChatGPT, free Claude, free Gemini) get blocked on your network, so "just don't use AI" is not the whole answer. Blanket bans don't hold. Governance does.
What should we do if we think an adviser or admin staff member clicked a phishing link?
Right now: don't click anything else, don't delete the email, ring us. The first hour of containment is where most of the damage is prevented. We isolate the account, check whether credentials or session cookies were taken, and look for forwarding rules or app permissions a reset would miss. Then we write up the timeline. If it was nothing, you get a written record to show your licensee. If it was real, the 72-hour ransomware reporting clock starts straight away for firms above $3M turnover.
We use XPLAN / AdviserLogic / Iress / Practifi / MyProsperity / Class / BGL. Does that change the IT conversation?
Not fundamentally. Those are your practice and administration applications. We manage the environment they run inside: the Microsoft 365 tenant, device configuration, identity, backup, network and offboarding. Workflow support inside the application stays with the software vendor, and the boundary is ours. We also track each vendor's own security record in your vendor register: breaches, certifications, data residency. Your licensee, your broker and your platform all expect that oversight now.
We're a small AFSL with outsourced everything. Is that safer or riskier?
Both, depending on how it's managed. Outsourcing reduces what you have to secure yourself and increases what a third party secures on your behalf. CPS 234 and ASIC guidance both require oversight of third parties: regular review of their security, their access and their breach history. We do that review and keep the paperwork behind it.

The qualifier

Let's see if we're a fit.

Seven questions, one moment of your time. We'd rather tell you now than three months in.

Step 1 of 7

How big is your team?

Counting everyone: staff, contractors, anyone with an account.
See if we're a fit