Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 22 JUNE 2026

An AFS Licensee First: Receiving An Order To Pay AU$2.5 Million For Cybersecurity Failures

K&L Gates
K&L Gates
Contributor
K&L Gates

K&L Gates

The Firm K&L Gates is an integrated, international law firm. As a single global law firm, truly...

View firm profile
Explore more from K&L Gates

In a key decision against an Australian financial services licence (AFSL) holder, the Federal Court of Australia has ordered the AFSL holder to pay AU$2.5 million in penalties for inadequate cybersecurity measures.

AustraliaTechnology
Cameron Abbott
Cameron Abbott
Daniel Knight
Daniel Knight
Rob Pulham
Rob Pulham
Alex Parker
Alex Parker
Madison Jeffreys
Madison Jeffreys
Emre Cakmakcioglu
Emre Cakmakcioglu
Annaliese Filippis
Annaliese Filippis

In a key decision against an Australian financial services licence (AFSL) holder, the Federal Court of Australia has ordered the AFSL holder to pay AU$2.5 million in penalties for inadequate cybersecurity measures. The Australian Securities and Investments Commission (ASIC) took action following a cyberattack on the AFSL holder’s IT systems, resulting in approximately 385GB of data being downloaded from its servers. 

This is the first time civil penalties have been imposed for cybersecurity failures pursuant to general AFSL obligations. The Court found the AFSL holder failed to comply with the following obligations under the Corporations Act 2001 (Cth):

  • Efficient, honest, and fair financial services (s 912A(1)(a)): the AFSL holder lacked an adequate incident response plan such as monitoring threat alerts or providing mandatory cybersecurity awareness training.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

APRA v Bedingo And Adelaide Bank: A Wake-up Call For Directors And Officers

The Australian Prudential and Regulatory Authority has launched unprecedented civil penalty proceedings against Bendigo and Adelaide Bank following a 2023 cybersecurity breach that exposed critical weaknesses in the bank's risk management systems. This landmark case signals a fundamental shift in regulatory enforcement, extending accountability beyond corporate entities to individual directors and officers who fail to ensure adequate cybersecurity controls are functioning as intended.
AustraliaTechnology
Kennedys
Kennedys
Article

ASIC Demands Urgent Cyber Upgrades To Combat Frontier AI Security Threats

In an open letter published on 8 May 2026, ASIC, who are responsible for regulating Australia's corporate, financial services and insurance sectors, urged Australian financial services licence (AFSL) holders to act promptly against the risks posed by advanced AI systems. ASIC warned that malicious actors are increasingly using cutting-edge AI models to identify and exploit vulnerabilities at an unprecedented scale.
AustraliaTechnology
Kennedys
Kennedys
Article

Text-Message Marketing In Texas, One Year After SB 140

Texas Senate Bill 140 (SB 140) took effect 1 September 2025, and applies to conduct occurring on or after that date. The bill amended Section 302 of the Texas Business and Commerce Code to extend registration and disclosure requirements to text messages by expanding the definition of “Telephone solicitation,” which previously applied only to a “telephone call,” to include certain transmissions of text or graphic messages and images. In addition, SB 140 added a definition of “Telephone call” that incorporates the definition found in Section 304, which includes certain text or graphic messages and images, but excludes certain agreed-to transmissions.
United StatesMedia, Telecoms, IT, Entertainment
K&L Gates
K&L Gates
Article

SEC And CFTC Open Door To Tokenized Markets After Clarity Fails To Advance

The SEC and CFTC have issued coordinated regulatory relief measures that significantly advance crypto-based trading infrastructure in US markets, bypassing Congressional gridlock on the CLARITY Act. These orders establish new frameworks for tokenized securities venues and passive software providers, potentially reshaping how digital assets are traded and accessed in regulated markets.
United StatesFinance and Banking
K&L Gates
K&L Gates
Article

EU AI Act: Final Guidelines On Transparency Obligations Under Article 50

The European Commission has issued guidelines on transparency obligations under Article 50 of the EU AI Act, clarifying how providers and deployers must inform individuals when they interact with AI systems or are exposed to AI-generated content. These non-binding guidelines address a wide range of AI applications, from chatbots to deepfake technologies, and establish four main transparency scenarios with specific disclosure requirements that businesses must now prepare to implement.
European UnionGovernment, Public Sector
K&L Gates
K&L Gates
Article

Venezuela's Reopening: Investment, Infrastructure, And Technology Opportunities In A Rebuilding Latin America

Venezuela's post-Maduro reopening is creating unprecedented opportunities for foreign investors across energy, mining, telecommunications, and infrastructure sectors. With expanding OFAC sanctions relief, landmark legislative reforms, and major US companies nearing multibillion-dollar deals, the country presents investment prospects not seen in a generation—though success requires disciplined navigation of corruption, security, and regulatory risks.
United StatesInternational Law
K&L Gates
K&L Gates
Article

New EU Withdrawal Button Requirement: Practical Implications And Recommendations For US And Global Online Sellers

The European Union's new Consumer Rights Directive amendment introduces a mandatory "withdrawal button" for online merchants, fundamentally changing how consumers exercise their 14-day right of withdrawal from distance contracts. This requirement, effective June 19, 2026, applies to any trader—including US-based companies—actively selling to EU consumers, creating new compliance obligations around button placement, design standards, data collection, and confirmation processes. Understanding whic
European UnionConsumer Protection
K&L Gates
K&L Gates
Article

United States Opens A New Chapter In Civil Nuclear Cooperation With The Kingdom Of Saudi Arabia

The United States and Saudi Arabia have signed a landmark nuclear cooperation agreement under Section 123 of the Atomic Energy Act, establishing the legal framework for decades of civilian nuclear partnership. This agreement resolves years of debate over nonproliferation conditions and positions US companies to participate in Saudi Arabia's ambitious civil nuclear program. The deal carries significant implications for US engagement in the Middle East, international nuclear commerce, and the global competiti
GlobalGovernment, Public Sector
K&L Gates
K&L Gates