At least 32 CFD issuers changed four or more control areas, ASIC’s figures show

At least 32 of the 52 contracts-for-difference issuers in ASIC’s 2024–25 review made changes across four or more of five control areas, a reconstruction of the regulator’s published counts establishes. At least 11 must have changed all five. The minimum figures show that the Australian sector’s remediation extended across several stages of the customer relationship within many individual firms; it could not have consisted mainly of separate groups fixing one isolated issue each.[1]

ASIC did not publish those overlap counts or identify the issuers in each group. They follow mathematically from its stated review population and five separate totals: target-market definitions, website content, onboarding, ongoing client monitoring and derivative transaction reporting. The result is a conservative minimum, rather than an estimate of the most likely distribution. It describes changes made during a review, not five proven legal violations at every firm or a finding that the same weaknesses remain today.[1]

That distinction matters as Australia revisits its retail CFD protections. ASIC’s current consultation proposes extending and amending its product intervention order, including rules about margin on opposing positions. The regulator has corrected its proposed end date to 1 April 2031 and extended the response deadline to 16 November 2026. The older review provides evidence about implementation of existing protections; the new proposals address their future scope. They are different exercises, but both turn on whether safeguards work together in practice.[3]

The counts that force an overlap

REP 828 says the review ran from October 2024 to December 2025 and covered 52 CFD issuers. Adding its five change counts gives 219 issuer-area occurrences. Each occurrence means one issuer made changes in one of the five named areas. It does not count the number of amendments within an area: rewriting one page and rewriting hundreds of pages each contribute one issuer to the website total.[1]

If every issuer had changed no more than three areas, the largest possible total would be 52 multiplied by three, or 156. ASIC’s reported total is 63 above that ceiling. An issuer moving from three areas to the maximum five can contribute at most two of those additional occurrences. At least 32 issuers are therefore needed to supply the excess: 31 could supply only 62. That establishes a minimum of 61.5% of the review cohort making changes in four or five areas.[1]

A second calculation isolates the minimum changing all five. If every issuer had changed at most four areas, the maximum would be 208 occurrences. The published total is 11 higher. Only an issuer appearing in all five categories can add one occurrence above that four-area ceiling, so at least 11 issuers, or 21.2% of the review population, must be present in every category. The actual overlaps can be larger.[1]

These bounds do not rely on assuming that changes were independent, randomly distributed or equally serious. We checked that arrangements of 52 anonymous issuers can reproduce all five published totals while attaining each minimum. This confirms that the wording “at least” is necessary: the public totals support the floors but do not reveal the actual distribution. A firm-level cross-tabulation would answer the next question, namely how many issuers changed exactly one, two, three, four or five areas.[1]

The calculation uses the review’s 52 issuers, rather than a different population elsewhere in the report. ASIC separately collected financial-year 2023–24 client and trading data, and its appendix lists firms that participated in the review and/or supplied those data. It also says onboarding processes were demonstrated or tested at 48 issuers. Those populations cannot silently replace the 52-firm review denominator. The reconstructed minimum concerns the five reported change categories within that review.[1]

Why several control areas matter together

A target-market determination describes the customers for whom a product is intended. A website influences who is attracted to it. An onboarding assessment checks whether a prospective customer fits those criteria. Ongoing monitoring examines whether that assessment remains plausible once actual trading begins. Transaction reporting gives the regulator information about the activity. The five stages serve different purposes, but a weak hand-off between them can undermine an otherwise credible rule at one stage.[1]

ASIC’s examples show how that can happen. Some issuers defined a target market but did not test all its criteria during onboarding. Some relied on declarations or questions with obvious answers. Others collected financial information for anti-money-laundering purposes but failed to use it to assess whether the customer’s circumstances matched the target market. Improving the wording of a target-market document alone would not correct those gaps in the admission process.[1]

The review prompted 44 issuers to improve onboarding. Changes included questions tied to specific target-market criteria, responses that excluded unsuitable applicants immediately, limits on repeat attempts and removal of prompts that steered customers towards acceptable answers. ASIC said changes were substantial in most cases. Those details help interpret the count: a change could alter whether an account was opened, rather than merely make the questionnaire easier to read.[1]

Monitoring after admission was another recurring weakness. ASIC said most issuers did little or no ongoing monitoring of client trading outcomes and behaviour, with existing checks often focused on anti-money-laundering concerns such as large deposits. Improvements at 42 issuers included alerts for losses, funding and withdrawals, margin close-outs and negative-balance protection. Some connected trading behaviour with income and savings information obtained at onboarding.[1]

The mechanism is important for a customer whose position changes after joining. Passing an assessment on the first day cannot establish that later losses, repeated deposits or signs of vulnerability are consistent with the original target-market assumptions. ASIC’s examples describe review procedures, responsibility for alerts and the action required when a client is flagged. They do not prescribe that every trading loss requires account closure, and they do not establish that every flagged client received an effective intervention.[1]

Reporting changes were widespread, but not all alike

The largest category was derivative transaction reporting: 48 issuers made changes. ASIC reviewed compliance with reporting rules that took effect in October 2024. Some failures related to new requirements, including reporting payments made when a derivative terminates and correctly describing conversion from transaction-level to position-level reporting. The regulator said most issuers worked constructively with it and their reporting delegates to rectify those deficiencies and back-report missing data.[1]

That offers an important qualification. A high change count can reflect adaptation to a new regime as well as longstanding control weakness. It cannot establish an identical underlying cause at every issuer. The report nevertheless identified problems beyond transition errors, including incorrect or missing collateral information, inaccurate prices and timestamps, omissions involving hedging counterparties, and inadequate oversight of third parties submitting data.[1]

ASIC found more than 70 million erroneous reports during the review. That number is not 70 million customers, losses or separately adjudicated breaches. High-volume transaction reporting can generate many erroneous records from one process failure. The report says only one issuer consistently supplied high-quality data without identifiable errors or omissions, and describes its reconciliations, oversight and engagement with guidance. That positive example shows why better reporting is measurable without equating every error with financial harm.[1]

The money returned is a separate measure

ASIC reported securing more than A$39 million for retail clients. The largest component concerned margin discounting: 28 issuers refunded more than A$36 million for costs on affected positions, including interest. The regulator had challenged practices that calculated margin on the net value of opposing long and short positions or only on the larger leg. Its report explains that those arrangements could permit excessive leverage, increase financing costs and create abrupt margin demands when one leg closed.[1]

Other remediation included more than A$1.3 million for 250 retail clients of an exotic CFD product and more than A$1.3 million following leverage-limit contraventions by two issuers. These are distinct reported categories, not a licence to divide the total refunds among the 32 or 11 issuers in our reconstruction. ASIC does not disclose the cross-tabulation needed to determine which refund populations coincide with the five control-change groups.[1]

The report also records 133,674 retail clients making net losses of A$458.01 million in financial year 2023–24, including A$73.29 million in fees. Those are the outcomes of the loss-making group; profitable clients are reported separately. The figures cannot be described as losses caused by the reviewed shortcomings or as an amount universally owed back to clients. Leveraged trading can lose money despite lawful distribution, accurate reporting and effective controls.[1]

A later action illustrates the distinction between a sector-wide improvement count and a firm-specific regulatory finding. ASIC suspended GFA Capital Markets’ licence from 23 July to 18 December 2026 after identifying client-money, reporting and control deficiencies. The notice includes the possibility of review by the Administrative Review Tribunal and permits only limited activities during suspension. That action has its own evidence and status. It does not identify GFA as one of the reconstructed 11 issuers or establish the position of any other firm.[4]

What would show that the changes worked

The review measured changes made during regulatory engagement. It does not provide a matched, post-remediation outcome series for the minimum 32 issuers. A claim that the programme reduced their clients’ losses, prevented unsuitable onboarding or eliminated reporting errors would require later observations with consistent definitions. Firms can implement a control on paper before it performs reliably in live operations; conversely, a correction may be effective without producing an immediate fall in market-driven trading losses.[1]

The next useful evidence would combine the breadth of changes with tests of operation: applications excluded for the relevant reasons, repeat attempts handled consistently, alerts investigated within documented times, remediation completed, and reports reconciled without recurring errors. Such measures would also distinguish a modest website correction from a redesign of a firm’s admission or monitoring system. They would help regulators and readers judge outcomes rather than simply count amended processes.[1]

ASIC’s current CFD consultation keeps these questions relevant. It proposes explicitly confirming that initial margin applies separately to each CFD and cannot be reduced by netting opposing positions, alongside other changes. The proposed extension to 2031 is subject to ministerial approval, and the existing order is due to expire on 23 May 2027. Those dates describe a proposal and an existing expiry, not an enacted extension.[3]

The public record already supports a narrower, firm conclusion: the cleanup necessarily reached multiple control areas within a substantial majority of the reviewed issuers. At least 32 changed four or five areas, and at least 11 changed all five. Whether those linked changes now produce better customer outcomes is the next evidential test; neither the overlap arithmetic nor a regulator’s count of amended processes can answer it alone.[1]

Report an error or submit an update