---
title: "Financial Services Regulation (AFSL/ASIC/credit)"
url: "https://ailawframework.com/practice/financial-services-regulation"
type: "practice_area"
site: "AI Law Framework"
id: "A28"
task_count: 33
last_reviewed: "2026-10-10"
---

# Financial Services Regulation (AFSL/ASIC/credit)

> Identify the regulated entity, activity and licence conditions before assessing compliance. Check current obligations, factual evidence and reporting requirements, with clear responsibility for decisions and escalation.

Canonical page: https://ailawframework.com/practice/financial-services-regulation  
Last reviewed: 2026-10-10

Site index for agents: https://ailawframework.com/llms.txt

Also covers: Financial services law, AFSL compliance, credit regulation, financial advice law, regulatory compliance (financial services), fintech regulation, ASIC enforcement, APRA prudential regulation, consumer credit law, NCCP Act practice, DDO compliance, breach reporting regime

## Key facts

- Tasks: 33
- Green: 8, Yellow: 20, Red: 5
- Levels: Green is AI drafts and the lawyer checks; Yellow is lawyer and AI draft together; Red is the lawyer writes and AI may only check, clarify or collect data.

## Principles

- **Define the matter**: Confirm the client’s instructions, jurisdiction, intended output and the information available before dividing the work.
- **Verify the authorities**: Open each relied-on authority independently. Confirm its existence, current status, proposition and any quotation or pinpoint reference.
- **Reconcile the figures**: Trace every relied-on figure to its source, confirm dates and assumptions, and independently recalculate totals or derived amounts.

## Checklist

- Open each relied-on authority independently. Confirm its existence, current status, proposition and any quotation or pinpoint reference.
- Trace every relied-on figure to its source, confirm dates and assumptions, and independently recalculate totals or derived amounts.
- Calculate operative dates independently from the current rule and actual triggering event. Check exceptions and record the verified deadline.
- Confirm that the actual tool, feature and processing terms permit use of this information, including access, retention, training and disclosure conditions.
- Obtain and inspect the relevant current official register or search result. Confirm identities, interests and the date and scope of the search.
- Review the original source set for relevant material absent from the output, including contrary evidence, qualifications and unresolved gaps.
- Verify the applicable jurisdiction and the version of each relevant law, rule or instrument in force at the material time.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.

## Restrictions

- Confirm firm, client and applicable court or professional restrictions before using any AI feature.

## Jurisdiction note

Apply this guidance to the actual matter and jurisdiction. Confirm current requirements before relying on an example.

## Basis

Practice guidance supports planning; the responsible lawyer confirms the scope, evidence and review requirements for the matter.

Also covers: Financial services law, AFSL compliance, credit regulation, financial advice law, regulatory compliance (financial services), fintech regulation, ASIC enforcement, APRA prudential regulation, consumer credit law, NCCP Act practice, DDO compliance, breach reporting regime

Australian financial services regulation is a dense, penalty-rich statutory regime where lawyers advise AFSL holders, ACL holders and their responsible managers on licensing, conduct obligations, disclosure, enforcement and remediation. The core AI risk is compounded: the underlying law is highly technical and frequently amended (Corporations Act 2001 (Cth), ASIC Act 2001 (Cth), National Consumer Credit Protection Act 2009 (Cth)); ASIC's and APRA's regulatory expectations are evolving rapidly (ASIC REP 798, October 2024; ASIC open letter 26-092MR, May 2026; APRA AI governance letter, April 2026); and hallucinated statutory citations, outdated regulatory positions, or incorrect breach notification content handed to a client can constitute a reportable situation and give ASIC or APRA fresh enforcement grounds.

## Limits on AI assistance

Red lines — never in this area

## Limits on AI assistance

AI must never draft or finalise any representation to ASIC or APRA in enforcement, s19 examination, notice-to-produce or breach notification contexts without a lawyer personally drafting and approving every sentence before it is sent. AI must never be used as the sole or primary tool for legal professional privilege review over documents subject to an ASIC compulsory notice or court order — the consequences of inadvertent waiver are irreversible and may constitute a criminal offence. AI must never generate a creditworthiness 'not unsuitable' assessment or financial product recommendation that is embedded in a regulated document (SOA, credit assessment) or delivered to a client without a qualified human adviser independently reviewing and signing off the substance. AI must never generate fee, cost or return figures for inclusion in a PDS, FSG or SOA without those figures being independently verified against the actual product terms and the current ASIC prescribed calculation methodology — an incorrect fee disclosure in a PDS or SOA is a criminal offence under s1022B Corporations Act. AI must never characterise a specific ASIC instrument, class order or legislative instrument as 'in force' or state its commencement date without the lawyer independently verifying the register entry on the Federal Register of Legislation. AI must never assess whether a firm's cybersecurity posture is 'adequate' for AFSL purposes — that assessment requires a qualified technical expert and cannot rest on a language model's output; this is reinforced by ASIC v FIIG Securities (February 2026) and ASIC's May 2026 open letter to all AFS licensees. AI must never opine on whether a specific AI use case by a client falls outside the definition of 'financial service' or is exempt from AFSL licensing requirements — that is an interpretive legal opinion with direct consequences for the client's licensing position and potential criminal liability. AI must never be used as the sole tool for a privilege review, relevance assessment, or redaction decision in any regulatory production — a lawyer must independently review every document before production. AI must never perform a circular review — that is, review for best interests duty compliance content that was itself generated by AI without an independent substantive lawyer review intervening between AI-generation and AI-review steps. AI must never produce an individual accountability statement for FAR purposes without a lawyer verifying that the responsibilities described accurately reflect the accountable person's actual role — inaccurate FAR statements lodged with APRA or ASIC are a regulatory exposure in their own right.

- AI must never draft or finalise any representation to ASIC or APRA in enforcement, s19 examination, notice-to-produce or breach notification contexts without a lawyer personally drafting and approving every sentence before it is sent.
- AI must never be used as the sole or primary tool for legal professional privilege review over documents subject to an ASIC compulsory notice or court order — the consequences of inadvertent waiver are irreversible and may constitute a criminal offence.
- AI must never generate a creditworthiness 'not unsuitable' assessment or financial product recommendation that is embedded in a regulated document (SOA, credit assessment) or delivered to a client without a qualified human adviser independently reviewing and signing off the substance.
- AI must never generate fee, cost or return figures for inclusion in a PDS, FSG or SOA without those figures being independently verified against the actual product terms and the current ASIC prescribed calculation methodology — an incorrect fee disclosure in a PDS or SOA is a criminal offence under s1022B Corporations Act.
- AI must never characterise a specific ASIC instrument, class order or legislative instrument as 'in force' or state its commencement date without the lawyer independently verifying the register entry on the Federal Register of Legislation.
- AI must never assess whether a firm's cybersecurity posture is 'adequate' for AFSL purposes — that assessment requires a qualified technical expert and cannot rest on a language model's output; this is reinforced by ASIC v FIIG Securities (February 2026) and ASIC's May 2026 open letter to all AFS licensees.
- AI must never opine on whether a specific AI use case by a client falls outside the definition of 'financial service' or is exempt from AFSL licensing requirements — that is an interpretive legal opinion with direct consequences for the client's licensing position and potential criminal liability.
- AI must never be used as the sole tool for a privilege review, relevance assessment, or redaction decision in any regulatory production — a lawyer must independently review every document before production.
- AI must never perform a circular review — that is, review for best interests duty compliance content that was itself generated by AI without an independent substantive lawyer review intervening between AI-generation and AI-review steps.
- AI must never produce an individual accountability statement for FAR purposes without a lawyer verifying that the responsibilities described accurately reflect the accountable person's actual role — inaccurate FAR statements lodged with APRA or ASIC are a regulatory exposure in their own right.

## Jurisdiction-specific considerations

Australian traps

## Jurisdiction-specific considerations

ASIC REP 798 (October 2024, 'Beware the gap') is the primary reference for AI governance expectations; ASIC has stated it will measure licensee conduct against it. AI trained before October 2024 will not know this document exists. ASIC open letter 26-092MR (8 May 2026, Commissioner Simone Constant): sent to every AFS licensee and market participant; declares frontier AI has materially changed the cyber threat environment; contains a 12-point action list and four board-level expectations, with a direction that the letter itself be tabled and discussed at board and risk governance committees. AI trained before May 2026 will not know this document exists. This is now part of the baseline for what ASIC expects of an AFSL holder. APRA April 2026 AI governance letter (30 April 2026): directed to all APRA-regulated entities following a targeted supervisory review; identifies four governance failure areas (cyber and information security, governance, supplier risk, change management and assurance); notes that many boards lack technical AI literacy and over-rely on vendor presentations. Signals an active supervisory program and possible further policy action. AI trained before May 2026 will not know this document. ASIC Regulatory Portal and RG 1 (revised 16 June 2025): the legacy eLicensing system and MOVEit were decommissioned in June 2025; all AFSL and ACL applications now via the ASIC Regulatory Portal. RG 2 and RG 3 were withdrawn on 16 June 2025. The new process requires structured in-portal answers (not uploaded Core/Non-Core proofs) and People Proofs only for responsible managers. AI almost certainly describes the superseded process. ASIC v FIIG Securities Limited (Federal Court, orders by consent 9 February 2026): first civil penalty for AFSL cybersecurity failures under s912A Corporations Act; $2.5m penalty plus $500k costs; breach period March 2019 to June 2023; approximately 385GB of client data compromised across approximately 18,000 clients. Sets the 'proportionate to risks faced' standard for s912A adequacy. ASIC brought proceedings in March 2025; AI trained before early 2026 may not reliably summarise the outcome. Financial Accountability Regime (FAR): extended to insurance and superannuation industries from 15 March 2025 (banking from 15 March 2024). Creates personal liability for accountable persons (directors, senior executives) for governance failures including AI risk management failures. CPS 230 (APRA Prudential Standard, Operational Risk Management): effective 1 July 2025; pre-existing material service provider contracts required to be updated by 1 July 2026 (or earlier renewal). Targeted amendments for non-traditional service providers (NTSPs) came into effect 1 July 2026. AI trained before these dates will state incorrect compliance timelines. s912D breach reporting and investigation clock: ASIC Corporations and Credit (Amendment) Instrument 2025/289 (effective 27 June 2025) extended the investigation trigger threshold from 30 days to 60 days, and the rectification window from 30 days to 60 days. AI trained before 27 June 2025 will state incorrect thresholds. The 30-day reporting period from when the licensee first knows/is reckless of a reportable situation is unchanged. Treasury Laws Amendment (Delivering Better Financial Outcomes and Other Measures) Act 2024 (Royal Assent 9 July 2024): this is the correct Act name for the Quality of Advice Review reforms — AI and secondary commentary frequently uses incorrect or inconsistent short-form names. The Act has staggered commencement dates: some provisions from 10 July 2024; life insurance commission consent from 10 July 2025. Confirm which provisions have commenced before any SOA or best interests duty analysis. Privacy Act automated decision-making transparency obligation (new APP 1.7): enacted via Privacy and Other Legislation Amendment Act 2024 but does NOT commence until 10 December 2026. OAIC guidance due September 2026. AI may conflate this not-yet-commenced obligation with obligations already in force, or may miss the enacted changes (statutory tort for serious invasions of privacy, strengthened NDB scheme) that are already operative. DDO and RG 274: updated 10 September 2024. Significant dealing reports can now be lodged through the ASIC Regulatory Portal. Confirm the version number in any AI-generated compliance reference. AFCA Rules: monetary limits updated 1 January 2024 ($1.263m claim cap; $6.317m credit facility cap for small businesses and primary producers; $6,300 compensation cap per claim for indirect/non-financial loss). Rules amended 1 July 2024 (Rule D.4 per-claim clarification). AI citations to AFCA thresholds and rules are unreliable without current verification. Responsible lending regime distinctions: the standard NCCP Act 'not unsuitable' framework does not apply uniformly to SACCs, consumer leases and BNPL products; applicable regime must be confirmed before any file review or remediation advice. State and territory consumer protection overlaps: jurisdiction-specific instruments (including under Fair Trading Acts and consumer lease registration requirements) are frequently missed by AI focused on the Commonwealth framework.

- ASIC REP 798 (October 2024, 'Beware the gap') is the primary reference for AI governance expectations; ASIC has stated it will measure licensee conduct against it. AI trained before October 2024 will not know this document exists.
- ASIC open letter 26-092MR (8 May 2026, Commissioner Simone Constant): sent to every AFS licensee and market participant; declares frontier AI has materially changed the cyber threat environment; contains a 12-point action list and four board-level expectations, with a direction that the letter itself be tabled and discussed at board and risk governance committees. AI trained before May 2026 will not know this document exists. This is now part of the baseline for what ASIC expects of an AFSL holder.
- APRA April 2026 AI governance letter (30 April 2026): directed to all APRA-regulated entities following a targeted supervisory review; identifies four governance failure areas (cyber and information security, governance, supplier risk, change management and assurance); notes that many boards lack technical AI literacy and over-rely on vendor presentations. Signals an active supervisory program and possible further policy action. AI trained before May 2026 will not know this document.
- ASIC Regulatory Portal and RG 1 (revised 16 June 2025): the legacy eLicensing system and MOVEit were decommissioned in June 2025; all AFSL and ACL applications now via the ASIC Regulatory Portal. RG 2 and RG 3 were withdrawn on 16 June 2025. The new process requires structured in-portal answers (not uploaded Core/Non-Core proofs) and People Proofs only for responsible managers. AI almost certainly describes the superseded process.
- ASIC v FIIG Securities Limited (Federal Court, orders by consent 9 February 2026): first civil penalty for AFSL cybersecurity failures under s912A Corporations Act; $2.5m penalty plus $500k costs; breach period March 2019 to June 2023; approximately 385GB of client data compromised across approximately 18,000 clients. Sets the 'proportionate to risks faced' standard for s912A adequacy. ASIC brought proceedings in March 2025; AI trained before early 2026 may not reliably summarise the outcome.
- Financial Accountability Regime (FAR): extended to insurance and superannuation industries from 15 March 2025 (banking from 15 March 2024). Creates personal liability for accountable persons (directors, senior executives) for governance failures including AI risk management failures.
- CPS 230 (APRA Prudential Standard, Operational Risk Management): effective 1 July 2025; pre-existing material service provider contracts required to be updated by 1 July 2026 (or earlier renewal). Targeted amendments for non-traditional service providers (NTSPs) came into effect 1 July 2026. AI trained before these dates will state incorrect compliance timelines.
- s912D breach reporting and investigation clock: ASIC Corporations and Credit (Amendment) Instrument 2025/289 (effective 27 June 2025) extended the investigation trigger threshold from 30 days to 60 days, and the rectification window from 30 days to 60 days. AI trained before 27 June 2025 will state incorrect thresholds. The 30-day reporting period from when the licensee first knows/is reckless of a reportable situation is unchanged.
- Treasury Laws Amendment (Delivering Better Financial Outcomes and Other Measures) Act 2024 (Royal Assent 9 July 2024): this is the correct Act name for the Quality of Advice Review reforms — AI and secondary commentary frequently uses incorrect or inconsistent short-form names. The Act has staggered commencement dates: some provisions from 10 July 2024; life insurance commission consent from 10 July 2025. Confirm which provisions have commenced before any SOA or best interests duty analysis.
- Privacy Act automated decision-making transparency obligation (new APP 1.7): enacted via Privacy and Other Legislation Amendment Act 2024 but does NOT commence until 10 December 2026. OAIC guidance due September 2026. AI may conflate this not-yet-commenced obligation with obligations already in force, or may miss the enacted changes (statutory tort for serious invasions of privacy, strengthened NDB scheme) that are already operative.
- DDO and RG 274: updated 10 September 2024. Significant dealing reports can now be lodged through the ASIC Regulatory Portal. Confirm the version number in any AI-generated compliance reference.
- AFCA Rules: monetary limits updated 1 January 2024 ($1.263m claim cap; $6.317m credit facility cap for small businesses and primary producers; $6,300 compensation cap per claim for indirect/non-financial loss). Rules amended 1 July 2024 (Rule D.4 per-claim clarification). AI citations to AFCA thresholds and rules are unreliable without current verification.
- Responsible lending regime distinctions: the standard NCCP Act 'not unsuitable' framework does not apply uniformly to SACCs, consumer leases and BNPL products; applicable regime must be confirmed before any file review or remediation advice.
- State and territory consumer protection overlaps: jurisdiction-specific instruments (including under Fair Trading Acts and consumer lease registration requirements) are frequently missed by AI focused on the Commonwealth framework.

## Risks to address

How it goes wrong

## Risks to address

Hallucinated ASIC instrument numbers: AI invents plausible-sounding ASIC class orders or legislative instrument numbers (e.g., 'ASIC Class Order [CO 24/xxx]') that do not exist; inserted into a client memo or PDS, this is undetectable without an independent registry check and can constitute misleading advice. Superseded AFSL application process: AI describes the legacy eLicensing process and the Core/Non-Core proof structure decommissioned in June 2025, causing applications to be prepared in the wrong format for the ASIC Regulatory Portal and to fail under RG 1 (June 2025) requirements. AI may also cite withdrawn RG 2 and RG 3 as authoritative. Missing ASIC open letter 26-092MR (May 2026) and APRA April 2026 AI governance letter: any AI governance advice or REP 798 gap analysis produced by AI trained before May 2026 will not reflect ASIC's 12-point action list, the board-level tabling expectation, or APRA's four targeted governance expectations — the resulting gap analysis will be materially incomplete. s912D investigation clock error: AI states that the investigation trigger is 30 days when it has been extended to 60 days by ASIC Corporations and Credit (Amendment) Instrument 2025/289 (effective 27 June 2025); a client advised on the old threshold may over-report, or may fail to understand the relief available. Incorrect Act name for DBFO reforms: AI frequently refers to the 'Financial Services Amendment (Enhancing Financial Advice) Act 2024' or similar non-existent short-form names; the correct Act is the Treasury Laws Amendment (Delivering Better Financial Outcomes and Other Measures) Act 2024; using the wrong Act name undermines the reliability of any commencement analysis or SOA review. Pre-DBFO best interests duty analysis: AI applies the pre-2024 best interests duty documentation framework to SOA reviews, missing the staggered changes under the DBFO Act including life insurance commission consent obligations commencing 10 July 2025.

- Hallucinated ASIC instrument numbers: AI invents plausible-sounding ASIC class orders or legislative instrument numbers (e.g., 'ASIC Class Order [CO 24/xxx]') that do not exist; inserted into a client memo or PDS, this is undetectable without an independent registry check and can constitute misleading advice.
- Superseded AFSL application process: AI describes the legacy eLicensing process and the Core/Non-Core proof structure decommissioned in June 2025, causing applications to be prepared in the wrong format for the ASIC Regulatory Portal and to fail under RG 1 (June 2025) requirements. AI may also cite withdrawn RG 2 and RG 3 as authoritative.
- Missing ASIC open letter 26-092MR (May 2026) and APRA April 2026 AI governance letter: any AI governance advice or REP 798 gap analysis produced by AI trained before May 2026 will not reflect ASIC's 12-point action list, the board-level tabling expectation, or APRA's four targeted governance expectations — the resulting gap analysis will be materially incomplete.
- s912D investigation clock error: AI states that the investigation trigger is 30 days when it has been extended to 60 days by ASIC Corporations and Credit (Amendment) Instrument 2025/289 (effective 27 June 2025); a client advised on the old threshold may over-report, or may fail to understand the relief available.
- Incorrect Act name for DBFO reforms: AI frequently refers to the 'Financial Services Amendment (Enhancing Financial Advice) Act 2024' or similar non-existent short-form names; the correct Act is the Treasury Laws Amendment (Delivering Better Financial Outcomes and Other Measures) Act 2024; using the wrong Act name undermines the reliability of any commencement analysis or SOA review.
- Pre-DBFO best interests duty analysis: AI applies the pre-2024 best interests duty documentation framework to SOA reviews, missing the staggered changes under the DBFO Act including life insurance commission consent obligations commencing 10 July 2025.

## Review checklist

The lawyer's review checklist

## Review checklist

Every ASIC regulatory guide, class order or legislative instrument number cited by AI is verified on the Federal Register of Legislation and ASIC's register — check number, title, current status and commencement date; hallucinated instrument numbers are a documented failure mode in this practice area. Every Corporations Act or NCCP Act section number is verified against the current consolidated Act on the Federal Register — AI frequently transposes or misquotes section numbers in highly-numbered statutes. All statutory deadlines and reporting clocks are independently verified: the s912D 30-day reporting period (from knowledge/recklessness of a reportable situation) and the 60-day investigation trigger (as amended by 2025/289 instrument, effective 27 June 2025); the Privacy Act 30-day NDB notification period; CPS 230 compliance dates. A wrong deadline in a client memo is an immediate liability. Confirm that ASIC REP 798 (October 2024), ASIC open letter 26-092MR (May 2026) and APRA's April 2026 AI governance letter are accurately reflected — if AI output predates these documents, any AI governance gap analysis may be missing ASIC's and APRA's current expectations entirely. Confirm the correct Act name and commencement status for DBFO reforms: the Treasury Laws Amendment (Delivering Better Financial Outcomes and Other Measures) Act 2024 (not 'Financial Services Amendment (Enhancing Financial Advice) Act 2024') with staggered commencement dates; confirm which provisions are in force before any SOA or best interests duty compliance assessment. Where AI has assessed a client's AI use case as a particular risk tier, verify the use case description matches the actual deployed system — AI risk assessments based on a misdescribed use case are worthless and potentially misleading. Any output characterising a product, service or arrangement as not a 'financial product' or 'financial service' for licensing purposes must be treated as Red until a lawyer has independently worked through the ss763A–766B definitions and confirmed no AI hallucination has occurred. Check whether output relies on any case law — verify every citation exists, was decided as stated, and has not been overturned or distinguished. ASIC v FIIG Securities (Federal Court, orders 9 February 2026) is the most significant recent decision and must be verified for accuracy before it is relied on in advice. Confirm that any client-facing draft (PDS, FSG, SOA, TMD, s912D notification, FAR accountability statement) has been read in full by the supervising lawyer before it leaves the firm — no such document may be issued on AI output alone.

- Every ASIC regulatory guide, class order or legislative instrument number cited by AI is verified on the Federal Register of Legislation and ASIC's register — check number, title, current status and commencement date; hallucinated instrument numbers are a documented failure mode in this practice area.
- Every Corporations Act or NCCP Act section number is verified against the current consolidated Act on the Federal Register — AI frequently transposes or misquotes section numbers in highly-numbered statutes.
- All statutory deadlines and reporting clocks are independently verified: the s912D 30-day reporting period (from knowledge/recklessness of a reportable situation) and the 60-day investigation trigger (as amended by 2025/289 instrument, effective 27 June 2025); the Privacy Act 30-day NDB notification period; CPS 230 compliance dates. A wrong deadline in a client memo is an immediate liability.
- Confirm that ASIC REP 798 (October 2024), ASIC open letter 26-092MR (May 2026) and APRA's April 2026 AI governance letter are accurately reflected — if AI output predates these documents, any AI governance gap analysis may be missing ASIC's and APRA's current expectations entirely.
- Confirm the correct Act name and commencement status for DBFO reforms: the Treasury Laws Amendment (Delivering Better Financial Outcomes and Other Measures) Act 2024 (not 'Financial Services Amendment (Enhancing Financial Advice) Act 2024') with staggered commencement dates; confirm which provisions are in force before any SOA or best interests duty compliance assessment.
- Where AI has assessed a client's AI use case as a particular risk tier, verify the use case description matches the actual deployed system — AI risk assessments based on a misdescribed use case are worthless and potentially misleading.
- Any output characterising a product, service or arrangement as not a 'financial product' or 'financial service' for licensing purposes must be treated as Red until a lawyer has independently worked through the ss763A–766B definitions and confirmed no AI hallucination has occurred.
- Check whether output relies on any case law — verify every citation exists, was decided as stated, and has not been overturned or distinguished. ASIC v FIIG Securities (Federal Court, orders 9 February 2026) is the most significant recent decision and must be verified for accuracy before it is relied on in advice.
- Confirm that any client-facing draft (PDS, FSG, SOA, TMD, s912D notification, FAR accountability statement) has been read in full by the supervising lawyer before it leaves the firm — no such document may be issued on AI output alone.

## Tasks (33)

| Task | Level | How AI is used | What the lawyer must review |
| --- | --- | --- | --- |
| [Draft a financial-services or credit-licence application narrative](https://ailawframework.com/practice/financial-services-regulation/draft-a-financial-services-or-credit-licence-application-narrative.md) | Yellow | Produce a first-draft competency narrative and responsible-manager table from the CVs and organisational chart, mapped to the criteria the lawyer has listed. | Check every competency claim against the actual CV and the current regulator guide Do not lodge a generated proof |
| [Build an AI-use gap table against the licence's general obligations](https://ailawframework.com/practice/financial-services-regulation/build-an-ai-use-gap-table-against-the-licence-s-general-obligations.md) | Yellow | Map the client's AI uses to the governance headings the lawyer listed (accountability, risk, consumer harm, transparency, human review, vendors) and mark gaps. | Apply the current licence obligations and regulator letters Do not treat a vendor blog as the standard |
| [Draft a reportable-breach assessment and notification](https://ailawframework.com/practice/financial-services-regulation/draft-a-reportable-breach-assessment-and-notification.md) | Red | The tool writes no part of the notification: the lawyer drafts every answer lodged in ASIC's prescribed form.… | The lawyer decides whether the incident is a reportable situation and fixes the date the licensee first had reasonable grounds to believe it, because that… |
| [Review a sample of advice files against the best-interests steps](https://ailawframework.com/practice/financial-services-regulation/review-a-sample-of-advice-files-against-the-best-interests-steps.md) | Yellow | Check a sample of statements of advice against the best-interests steps the lawyer has listed and produce a gap report with file references. | Confirm the sample is representative Check for oral advice that was never recorded; the tool cannot see it |
| [Review credit files against the responsible-lending or suitability assessment](https://ailawframework.com/practice/financial-services-regulation/review-credit-files-against-the-responsible-lending-or-suitability-asses.md) | Yellow | From the loan files, list income and expense evidence, the suitability assessment and gaps against the checklist the lawyer has named. | Confirm which lending regime applies before the review starts Do not let a generated 'not unsuitable' label stand |
| [Draft or review a product-disclosure document or financial-services guide](https://ailawframework.com/practice/financial-services-regulation/draft-or-review-a-product-disclosure-document-or-financial-services-guid.md) | Yellow | Draft a product-disclosure document or financial-services guide from the product terms, or compare an existing one to the lawyer's heading checklist. | Check fee tables and risk statements against the current prescribed calculations Do not treat a generated cost figure as a disclosure |
| [Draft or review a target-market determination for a financial product](https://ailawframework.com/practice/financial-services-regulation/draft-or-review-a-target-market-determination-for-a-financial-product.md) | Yellow | Draft a target-market determination from the product terms and distribution channels, or compare an existing one to the product-governance rules named. | Reject an 'everyone' target market Confirm the product and the distribution data actually match the determination |
| [Map individual accountability for AI and operational risk](https://ailawframework.com/practice/financial-services-regulation/map-individual-accountability-for-ai-and-operational-risk.md) | Yellow | From the org chart and the accountability rules the lawyer names, draft a statement mapping AI and operational-risk functions to named accountable persons. | Confirm the regime applies to this entity Do not lodge a generated accountability statement |
| [Build a production log for a regulator examination or notice to produce](https://ailawframework.com/practice/financial-services-regulation/build-a-production-log-for-a-regulator-examination-or-notice-to-produce.md) | Red | From the notice and the document set, list potentially responsive items, privilege candidates and a chronology for examination prep. | Decide privilege and relevance yourself Do not treat a generated 'responsive' tag as a production decision |
| Build a breach-register row from the incident facts | Yellow | Turn the incident description into a draft register row: date identified, description, significance assessment, notifications and remediation, with gaps marked. | Treat the register as a regulated record Decide dates and significance yourself |
| Extract product terms, fees and distribution channels into a product-governance table | Green | Pull key features, fees, risks and channels from the product documents into a table that can be checked against the target-market determination. | Open each source document Do not treat a generated fee as a product term |
| Build an authorised-representative or appointed-rep register issues list | Yellow | Compare the representative register, appointments and training records and list missing agreements, overdue training and unauthorised product lines. | Confirm appointments against the signed documents Do not treat a register extract as the appointment |
| Map the client's activities to the authorisations on its licence | Green | Extract each authorisation from the licence as issued and each activity from the lawyer's activity list, and draft a coverage matrix keyed to the exact… | The lawyer characterises each activity as a financial service, financial product or credit activity, confirms the authorisation wording against the licence as… |
| Build the responsible-manager coverage and proof index | Green | Draft the coverage matrix and proof index from the responsible managers' CVs, qualification records and the authorisations sought, flagging each authorisation… | The lawyer confirms which of the five options is actually available to each responsible manager, tests the experience claims against verifiable sources,… |
| Draft the internal dispute resolution response to a complaint | Yellow | Assemble the complaint chronology and the findings from the complaint file and, under the lawyer's direction, help draft the response so that it answers each… | The lawyer decides the outcome and any remedy, checks every finding against the file, confirms each issue raised is answered including issues the complainant… |
| Build the IDR timeframe and content exception report | Green | Extract the receipt date, complaint type, response date and response content from the complaint records into the exception table against the timeframes and… | The lawyer confirms the complaint type and so the applicable timeframe for each record, opens the underlying file for every flagged record, decides whether a… |
| Respond to a hardship notice under the National Credit Code | Yellow | Assemble the hardship notice, the account history and the information the debtor supplied into an assessment sheet, and, under the lawyer's direction, help… | The lawyer checks the date the notice was received and the resulting statutory due date, confirms whether and when further information was requested, tests… |
| Prepare the accountability statement and accountability map for an accountable person | Yellow | Draw the responsibilities out of the position description, delegations and organisational chart into the regulator's statement template and, under the… | The lawyer confirms who is an accountable person, tests that the statement captures that person's actual responsibilities without gaps or overlaps, confirms… |
| Set the distributor's reporting schedule and significant-dealing triggers | Yellow | Extract the determination's reporting requirements and distribution conditions and, under the lawyer's direction, help draft the reporting schedule and the… | The lawyer checks the schedule against the determination as made and against the statutory reporting obligations, confirms who is a distributor for each… |
| Screen and record wholesale or sophisticated client status | Green | Extract the test relied on, the figures, the certificate date and the certifier's details from each client file into the classification record, and flag… | The lawyer decides which test applies to this client and this product, confirms the certificate is from a qualified accountant and certifies what the… |
| Review a collections or outsourcing arrangement against the licensee's obligations | Green | Extract the conduct, contact, complaint-escalation and record-keeping terms from the collection agreement and the collector's own procedures into an issues… | The lawyer decides whether the collector needs a licence in each state it operates in, tests the contractual controls against the licensee's supervision and… |
| Take a staff account of the events for a complaint or dispute file | Red | Index the records the account refers to, cross-reference each of them to the lawyer's topic list, and list the assertions in the account the lawyer has… | The lawyer takes the account from the person, records it in that person's own words, and confirms before it is signed that every assertion is the person's own… |
| [Gap-check an AFSL holder's AI governance against ASIC REP 798](https://ailawframework.com/practice/financial-services-regulation/gap-check-an-afsl-holder-s-ai-governance-against-asic-rep-798.md) | Yellow | Map the client's AI inventory and policies to REP 798 findings and list gaps. | Decide significance under general obligations and advise. |
| [Prepare a NCCP default notice and hardship-variation checklist](https://ailawframework.com/practice/financial-services-regulation/prepare-a-nccp-default-notice-and-hardship-variation-checklist.md) | Yellow | Extract contract terms, arrears and notices into a dated checklist for the credit provider. | Confirm each statutory period and notice content against the National Credit Code text. |
| [Review a credit-reporting correction request against Privacy Act Part IIIA](https://ailawframework.com/practice/financial-services-regulation/review-a-credit-reporting-correction-request-against-privacy-act-part-ii.md) | Yellow | Organise the request, evidence and credit-file entries into a correction-decision table. | Lawyer checks each element against Part IIIA and the CR Code. |
| [Review a licensee's AI-drafted Statement of Advice process](https://ailawframework.com/practice/financial-services-regulation/review-a-licensee-s-ai-drafted-statement-of-advice-process.md) | Red | Map the AI drafting step against best-interests duty safe-harbour steps. | Licensed adviser signs off; s 961B steps cannot be delegated to AI. |
| [Draft a licensee AI governance framework gap table against REP 798](https://ailawframework.com/practice/financial-services-regulation/draft-a-licensee-ai-governance-framework-gap-table-against-rep-798.md) | Yellow | Compare the client's AI governance against ASIC's REP 798 questions. | Lawyer settles gaps; check later ASIC updates. |
| [Prepare explainability documentation for an AI fraud or credit model](https://ailawframework.com/practice/financial-services-regulation/prepare-explainability-documentation-for-an-ai-fraud-or-credit-model.md) | Yellow | Record model logic, thresholds and escalation for regulator queries. | Lawyer confirms ADM disclosure from 10 Dec 2026. |
| [Update a licensee's privacy notice for AI and automated decisions](https://ailawframework.com/practice/financial-services-regulation/update-a-licensee-s-privacy-notice-for-ai-and-automated-decisions.md) | Yellow | Draft ADM disclosure text for the privacy policy. | Check against APP 1 and OAIC guidance. |
| [Build a human-in-the-loop sign-off register for AI-generated advice](https://ailawframework.com/practice/financial-services-regulation/build-a-human-in-the-loop-sign-off-register-for-ai-generated-advice.md) | Green | Design a log capturing reviewer, changes and approval. | Compliance confirms record-keeping obligations. |
| Review an AFSL holder's AI governance against ASIC REP 798 | Yellow | Gap-analyse the licensee's AI governance against ASIC findings. | Lawyer gives the advice. |
| Review AI-generated financial-advice content for licensing compliance | Red | Flag personal-advice and best-interests issues. | Lawyer and compliance review. |
| Draft an AI risk register for a fund manager | Green | List AI uses, risks and controls. | Compliance approves. |

## Jurisdiction notes

### Australia

#### Scope

Licensing, conduct, disclosure, enforcement and remediation advice to AFSL and ACL holders and their responsible managers.

#### Legal sources

Corporations Act 2001 (Cth), ASIC Act 2001 (Cth) and National Consumer Credit Protection Act 2009 (Cth), all frequently amended.

#### Regulator letters

ASIC REP 798 (October 2024), ASIC open letter 26-092MR (May 2026) and APRA's AI governance letter (April 2026).

#### Where it goes wrong

An invented citation, outdated position or wrong breach notice given to a client can itself be a reportable situation and give ASIC or APRA new enforcement grounds.

### New Zealand

Local name: Financial services regulation (FMCA / FMA)

#### Licensing and conduct

Financial Markets Conduct Act 2013 and the Financial Markets Authority. No AFSL, no RG 209 and no FAR.

#### Consumer credit

Take any credit rules from the New Zealand credit legislation you have opened, not the NCCP Act.

#### Climate reporting

Climate-reporting entities are a Part 7A FMCA overlay, not an ASIC climate guide.

Sources:

- [Financial Markets Conduct Act 2013](https://www.legislation.govt.nz/act/public/2013/69/en/latest/) (checked 2026-09-23)
- [FMA: climate reporting entities](https://www.fma.govt.nz/business/services/climate-reporting-entities/) (checked 2026-09-23)
- [Companies Office: legislation for our registers](https://www.companiesoffice.govt.nz/about-us/what-we-do/our-legislation/) (checked 2026-09-23)

### United States

Local name: Financial services regulation

#### Regulators

SEC, CFTC and FINRA replace AFSL/ASIC as the licensing frame.

#### AI claims

SEC press release 2024-36 is the enforcement marker for false AI claims by advisers. Marketing Rule and Form ADV statements about AI must be accurate.

Sources:

- [SEC press release 2024-36, charges against two investment advisers for AI-related misstatements](https://www.sec.gov/newsroom/press-releases/2024-36) (checked 2026-09-23)
- [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-09-23)

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*