Cyber governance is now a board-level responsibility.
The court made it clear: outsourcing IT does not outsource accountability.
ASIC secured its first civil penalty under general financial services licence obligations for cyber security failures. If you hold an AFSL, manage client assets, or operate in a regulated framework, this ruling changes everything.
DOWNLOAD THE FREE BRIEFINGIn February 2026, the Federal Court ruled that FIIG Securities had failed to meet its cybersecurity obligations under the Corporations Act for more than four consecutive years. The failures weren't technical. They were failures of governance, investment and accountability at the organisational level. The court identified five specific areas where FIIG fell short, and the penalty was more than double what compliance would have cost.
A three-page executive briefing that breaks down the FIIG ruling clearly, maps the five failures to practical controls, and shows you exactly what your organisation needs to demonstrate. Written for boards, CIOs, CFOs, IT leaders and technical teams.
Excludes reputational damage, client claims, business interruption, and ongoing compliance costs.
The court was clear: ASIC is not asking for perfect security. It is asking whether you can demonstrate adequate preparation in people, budget, controls and governance. If you operate in a regulated financial services framework, you are in scope.
The court ordered a compliance programme requiring FIIG's CEO to personally attest they have read and understood the independent expert's reports. This accountability mechanism is now standard in ASIC cyber enforcement. Boards and executives cannot outsource this responsibility.
"This is the first time the Federal Court has imposed civil penalties for cyber security failures under the general AFS licensee obligations, setting a clear licence-to-operate expectation for robust cyber resilience."
Fill in your details and we'll send the three-page executive briefing straight to your inbox. It takes 5 minutes to read and could save your organisation from a conversation you don't want to have with a regulator.
Takes 30 seconds. Sent straight to your inbox.
