26-244MR Fortnum Private Wealth penalised $1.35 million for cybersecurity failures

The $1.35 million Supreme Court penalty follows admissions that the firm failed to adequately manage cyber risks across its adviser network, reinforcing ASIC's focus on board accountability, third-party oversight, and operational resilience. Compliance teams should expect heightened scrutiny of how cyber risk is identified, escalated, and controlled at both licensee and adviser levels. Key actions include refreshing cyber risk assessments, validating vendor and adviser network controls, testing incident response and breach notification processes, and documenting board-level oversight.

Firms should also review ASIC's cyber resilience expectations, notifiable data breach obligations, and any applicable APRA standards if part of a group. The case creates both risk and opportunity. Firms with mature cyber governance can differentiate themselves, while laggards face regulatory, reputational, and client-loss exposure.

RegTech providers offering continuous control monitoring, third-party risk management, and incident simulation may see increased demand. Wealth management and advice licensees should prioritise remediation where cyber controls are delegated to practice-level entities. Urgency: Medium.

The penalty is immediate for Fortnum, but broader industry scrutiny is ongoing. Compliance leaders should use this as a trigger for board reporting and remediation planning in the next quarter.