On 14 October 2026, the Supreme Court of NSW ordered Fortnum Private Wealth to pay a $1.35 million penalty, plus $250,000 towards ASIC's costs, for failing to adequately manage cybersecurity risk across its financial advice network.
It follows the ASIC vs FIIG ruling in February, where FIIG Securities was ordered to pay $2.5 million, and RI Advice in 2022. Three cases in under five years tell financial services boards something important: ASIC has a proven enforcement pathway for cyber governance failures, the courts are endorsing it, and the regulator intends to keep using it.
Fortnum delivered advice through a network of 81 to 94 authorised representative practices, more than 200 advisers and around 55,000 retail clients. Between April 2021 and May 2023, it admitted it did not have:
ASIC commenced proceedings after Fortnum notified it of a cyber attack at one of its authorised representatives. The court accepted the conduct was not deliberate and that Fortnum cooperated with ASIC throughout. The penalty still landed at $1.35 million.
The RI Advice judgment in May 2022 was a public, court-endorsed finding that a licensee operating through authorised representatives must manage cyber risk across its whole network. Fortnum runs the same model, and its admitted failures continued for a full year after that judgment.
The standard was visible and set by the court. It still took an incident and ASIC action to bring Fortnum’s gaps to light. The ASIC vs FIIG ruling then sharpened that standard. FIIG admitted its cyber security was not adequate for its size or the sensitivity of the data it held, and that following its own policies and procedures could have helped it detect its breach earlier. Fortnum confirms the same standard applies across the sector: any licensee carrying the same gaps faces the same exposure to civil penalties, whether its client data sits in one office or across a network of practices. Many licensees in this position assume a policy, an IT provider or controls at head office cover the whole licence. The case looked further, at how cyber risk was managed across every practice and adviser under the licence.
Two civil penalties in eight months, and judicial findings that cybersecurity failures breach the general AFS licensee obligations. Each case makes the next one faster to run.
ASIC's 2025 enforcement priorities included "licensee failures to have adequate cyber-security protections". FIIG and Fortnum are consistent with that focus, and investigations take time.
In May 2026, ASIC wrote to every AFS licensee asking for its letter to be tabled at board level, with a clear message: "the time to act and prepare is right now."
Announcing Fortnum, Chair Sarah Court said ASIC "will continue to work with industry to lift standards and take action where businesses fall short."
When an incident happens, the court assesses how cyber risk was governed in the years before it. FIIG's failures spanned more than four years and Fortnum's more than two. Improvements made after a breach help with remediation. The record of what was in place when it mattered stays fixed.
The governance that counts in a future proceeding is the governance you can evidence from today.
Fortnum has since introduced mandatory cyber controls, annual reviews, enhanced training and specialist cyber expertise. That makes a practical baseline for any licensee:
1. Does our cyber policy cover everyone operating under our licence?
2. What evidence shows they are meeting it?
3. Do we have enough specialist cyber expertise for our size?
4. When did the board last see a cyber risk report it could act on?
5. Who can we get to help us navigate these cyber-governance challenges?
Download the briefing. After FIIG: a practical briefing for financial services IT leaders sets out what the court found and what adequate preparation looks like, control by control. Download the briefing
Watch the webinar recording. Mark Andersen, Managing Director of andersenIT, and Leah Mooney, Partner at Wotton Kearney, unpack the ASIC vs FIIG ruling and where boards are most exposed. Watch the recording
Ready to see where you stand? Request an ASIC Readiness Review