3 min read

ASIC vs Fortnum Private Health ruling

Picture of ait-admin ait-admin : October 26, 2026

ASIC vs Fortnum Private Health ruling

 

Why ASIC’s third cyber enforcement means more are coming

On 14 October 2026, the Supreme Court of NSW ordered Fortnum Private Wealth to pay a $1.35 million penalty, plus $250,000 towards ASIC's costs, for failing to adequately manage cybersecurity risk across its financial advice network.

It follows the ASIC vs FIIG ruling in February, where FIIG Securities was ordered to pay $2.5 million, and RI Advice in 2022. Three cases in under five years tell financial services boards something important: ASIC has a proven enforcement pathway for cyber governance failures, the courts are endorsing it, and the regulator intends to keep using it.

 

The ruling

Fortnum delivered advice through a network of 81 to 94 authorised representative practices, more than 200 advisers and around 55,000 retail clients. Between April 2021 and May 2023, it admitted it did not have:

  • an adequate cybersecurity policy across its business and authorised representative network
  • adequate processes to oversee and monitor its authorised representatives' cyber resilience
  • sufficient staff with specialised cybersecurity expertise
  • adequate cybersecurity risk management systems

ASIC commenced proceedings after Fortnum notified it of a cyber attack at one of its authorised representatives. The court accepted the conduct was not deliberate and that Fortnum cooperated with ASIC throughout. The penalty still landed at $1.35 million.

 

Our insight

The RI Advice judgment in May 2022 was a public, court-endorsed finding that a licensee operating through authorised representatives must manage cyber risk across its whole network. Fortnum runs the same model, and its admitted failures continued for a full year after that judgment.

The standard was visible and set by the court. It still took an incident and ASIC action to bring Fortnum’s gaps to light. The ASIC vs FIIG ruling then sharpened that standard. FIIG admitted its cyber security was not adequate for its size or the sensitivity of the data it held, and that following its own policies and procedures could have helped it detect its breach earlier. Fortnum confirms the same standard applies across the sector: any licensee carrying the same gaps faces the same exposure to civil penalties, whether its client data sits in one office or across a network of practices. Many licensees in this position assume a policy, an IT provider or controls at head office cover the whole licence. The case looked further, at how cyber risk was managed across every practice and adviser under the licence.

 

More rulings are coming

 

The pathway is proven

Two civil penalties in eight months, and judicial findings that cybersecurity failures breach the general AFS licensee obligations. Each case makes the next one faster to run.

The pipeline was built in 2025

ASIC's 2025 enforcement priorities included "licensee failures to have adequate cyber-security protections". FIIG and Fortnum are consistent with that focus, and investigations take time.

Boards are on notice

In May 2026, ASIC wrote to every AFS licensee asking for its letter to be tabled at board level, with a clear message: "the time to act and prepare is right now."

ASIC has said so

Announcing Fortnum, Chair Sarah Court said ASIC "will continue to work with industry to lift standards and take action where businesses fall short."

 

Why govern now

When an incident happens, the court assesses how cyber risk was governed in the years before it. FIIG's failures spanned more than four years and Fortnum's more than two. Improvements made after a breach help with remediation. The record of what was in place when it mattered stays fixed.

The governance that counts in a future proceeding is the governance you can evidence from today.

 

What adequate looks like

Fortnum has since introduced mandatory cyber controls, annual reviews, enhanced training and specialist cyber expertise. That makes a practical baseline for any licensee:

  • One standard across the licence, applied to every practice, adviser and third party
  • Oversight you can evidence, with a record of what was checked and fixed
  • The right expertise, proportionate to your size and the data you hold
  • Risk reporting the board can act on, with remediation tracked to closure

Five questions for your next board meeting

1. Does our cyber policy cover everyone operating under our licence?

2. What evidence shows they are meeting it?

3. Do we have enough specialist cyber expertise for our size?

4. When did the board last see a cyber risk report it could act on?

5. Who can we get to help us navigate these cyber-governance challenges?

 

Go deeper

Download the briefing. After FIIG: a practical briefing for financial services IT leaders sets out what the court found and what adequate preparation looks like, control by control. Download the briefing

Watch the webinar recording. Mark Andersen, Managing Director of andersenIT, and Leah Mooney, Partner at Wotton Kearney, unpack the ASIC vs FIIG ruling and where boards are most exposed. Watch the recording

Ready to see where you stand? Request an ASIC Readiness Review

 

References