ASIC v HSBC: Is "adequacy" enough to manage cybersecurity risk?

While Optus and Medibank come to mind when we think of cyber incidents, ASIC is increasingly enforcing its regulatory priority of licensee failures to have adequate cyber-security protections. Think RI Advice, Lanterne, and now HSBC. As financial services' use of digital and computer technology – including artificial intelligence – increases, so too must our vigilance against cyber-attack fatigue and our understanding of just how adequate systems must be to manage cybersecurity risk.

In the Courts

In 2022, the Federal Court declared that RI Advice¹ breached its AFSL obligations to have adequate risk management systems and to do all things necessary to ensure its services were provided efficiently, honestly and fairly. RI Advice admitted that it had failed to have adequate documentation, controls and risk management systems to manage cybersecurity risk across its authorised representative network. RI Advice had more than 100 representatives across the country.