Fortnum’s A$1.35 million cyber penalty exposes gaps in adviser-network oversight

Fortnum Private Wealth Ltd was ordered on 12 October 2026 to pay an A$1.35 million civil penalty and A$250,000 towards ASIC’s legal costs after admitting cybersecurity failures across its advice network. ASIC announced the outcome on 14 October. The case puts the implementation and supervision of controls alongside policy design as an obligation of the financial-services licensee.[1][2]

The admitted period ran from 20 April 2021 to 11 May 2023. Fortnum’s network then comprised 81–94 advice practices, more than 200 authorised advisers and approximately 55,000 retail clients. Their work involved sensitive records including identity documents, tax file numbers and financial-account details.[2]

The missing step was evidence that controls operated

The economic issue for a distributed business is the difference between issuing a standard and obtaining assurance that each location follows it. A head office can purchase good software and still lack visibility over local access, devices, vendors or exceptions. Completion statistics are a starting signal: a signed attestation is evidence of a response, not proof that a control works.

ASIC’s published good-practice guidance describes assurance across complete business processes and periodic assessments of suppliers and partners. It also supports board measures such as detection time, response speed and recovery performance. These measures connect spending with operational capability: whether a compromise is discovered, contained and recovered from across the service chain.[4]

A penalty for inadequate risk control

The Court accepted admitted breaches covering efficient, honest and fair service, adequate human resources and adequate risk-management systems. ASIC identified no particular loss caused by these contraventions, and the parties agreed that Fortnum obtained no profit or benefit from them. That is a causation distinction, not a finding that the network had experienced no cyber incidents.[1]

Fortnum’s conduct was not deliberate. Its cooperation and subsequent improvements were recognised in the outcome. ASIC says the firm introduced mandatory controls, annual reviews, enhanced training and specialist expertise. Those developments matter when assessing its current position: the judgment addresses historical deficiencies rather than declaring that the old arrangements remain in place.[2]

The same enforcement programme has already reached a trading and custody business. In February 2026, FIIG Securities was penalised A$2.5 million, ordered to contribute A$500,000 in costs and required to engage an independent expert for a compliance programme. FIIG admitted that adequate controls could have improved detection and that compliance with its own procedures could have prevented some or all of the client-data download. That causal finding was more specific than the one made in Fortnum.[3]

What the decision changes for network economics

For a licensee, the relevant budget is broader than central IT expenditure. It includes the people needed to evaluate local practices, verify exceptions and follow remediation through to completion. An inexpensive policy roll-out can become costly if management cannot establish whether it has reached the firms actually holding customer information.

A useful implementation record would connect a required control with the practice responsible, the evidence examined, any exception, the person approving that exception and the date for retesting. This is an operational inference from the case and ASIC’s assurance guidance, not a new prescribed form or a guarantee of compliance. It allows directors to distinguish a completed document exercise from a reduction in exposure.[1][4]

The immediate court orders require the penalty and fixed legal costs within 28 days after entry of the orders. Their combined A$1.6 million is a sanction and costs figure, not a customer-loss estimate.[1]

Report an error or submit an update