The Supreme Court of New South Wales has ordered financial services licensee Fortnum Private Wealth Ltd (Fortnum) to pay a $1.35 million penalty flowing from failures in the management of cybersecurity risk. The decision in Australian Securities and Investments Commission v Fortnum Private Wealth Ltd [2026] NSWSC 1252 is a timely reminder that cyber resilience is not achieved by simply having a cybersecurity policy on the books. Instead, businesses must ensure that their cybersecurity controls and protocols are adequate, properly enforced, monitored and supported by appropriate expertise.

In this case, the key facts (agreed between ASIC and Fortnum and accepted by the Court) were as follows: 

• Fortnum, as an Australian Financial Services Licence (AFSL) holder, operates a financial services business through a network of financial advice practices and individual advisers acting as Authorised Representatives (ARs);
  
  
• Between 20 April 2021 and 11 May 2023 (Relevant Period), Fortnum's AR network comprised between 81 and 94 financial advice practices and between 202 and 214 individual advisers. Fortnum's ARs network serviced approximately 55,000 retail clients (within the meaning of s761G of the Corporations Act 2001 (Cth) (Corporations Act));
  
  
• During the Relevant Period, Fortnum's board comprised five directors, being its Chief Executive Officer and four non-executive directors. The board had several committees, including a Risk & Compliance Committee (Risk Committee), which met monthly. Mr Younger was the Head of the Risk Committee and other members of the Risk Committee were Fortnum's Head of Advice and its Head of Operations;
  
  
• In providing financial services, Fortnum's ARs electronically received, stored and accessed significant amounts of confidential and sensitive client information and personal information. Such information included: personal details; contact information; copies of identification documents; tax file numbers; and financial information, including bank account and credit card details;
  
  
• In the context of the personal information collected, Fortnum was aware that its ARs were potential targets for cyber-related attacks and cybercrime and that such an incident could cause serious harm to Fortnum, its representatives and their clients; 
  
  
• On 20 April 2021, Fortnum introduced its first policy specifically directed at cybersecurity (April 2021 Policy). The April 2021 Policy included a strategy requiring network practices to undertake a Fortnum-created "Self-Assessment and Attestation process", together with an optional Advanced Strategy aligned with the ACSC's Essential Eight framework. Fortnum later issued an updated May 2023 Policy on 11 May 2023 to improve its policy framework; and
  
  
• Fortnum was aware of the Australian Signals Directorate's (ASD) Essential Eight security framework, ASIC's report  555,  “Cyber resilience of firms in Australia’s financial markets”, the Federal Court’s decision in ASIC v RI Advice Group Pty Ltd [2022] FCA 496 (RI Advice) and several cyber incidents affecting Fortnum’s network practices and ARs before and during the Relevant Period. Most significantly, between 5 and 20 September 2022, one network practice, Wealthwise, suffered a data breach involving the exfiltration and subsequent publication of more than 200GB of data relating to up to 9,828 clients. 

After Fortnum reported the Wealthwise incident to ASIC on 30 March 2023 and subsequently cooperating with ASIC's investigation, ASIC commenced proceedings in the Supreme Court of New South Wales on 21 July 2026. 

ASIC sought declaratory relief and the imposition of a civil penalty on Fortnum on the basis that, during the Relevant Period, it contravened its obligations as an AFSL holder under the Corporations Act by failing to:

• implement an adequate cybersecurity policy to manage and mitigate cybersecurity risks facing Fortnum and its ARs (section 912A(1)(a)); 
  
  
• implement adequate processes, systems or frameworks to oversee and monitor the cyber resilience of its ARs (section 912A(1)(a));
  
  
• have available adequate human resources with specialised cybersecurity experience or expertise (section 912A(1)(d)); and
  
  
• maintain adequate risk management systems in respect of cybersecurity and cyber resilience (section 912A(1)(h)).

Fortnum admitted the contraventions.

Justice Black therefore accepted ASIC had a proper interest in seeking the proposed declaratory relief, was satisfied each contravention had been established and ultimately ordered a $1.35 million penalty and for Fortnum to pay $250,000 towards ASIC's costs.

The relevant provisions, agreed facts and admitted contraventions bear similarities to those considered in RI Advice, so the outcome is somewhat unsurprising.

In light of the above, the Court outlined the following reasons as to why Fortnum's arrangements for managing cyber risk failed to comply with its obligations and breached the relevant contraventions. 

Under the April 2021 Policy, each of Fortnum's downstream network practices were required to complete a cybersecurity self-assessment and an attestation by 1 September 2021. More comprehensive cybersecurity measures, which were aligned with the ACSC's Essential Eight guidelines, were included in an "Advanced Strategy" but its implementation was not made mandatory. 

The difficulty was not simply that Fortnum's April 2021 Policy contained gaps, it was that it was not being implemented. 

By 1 September 2021, only approximately 44% of practices had completed the required self-assessment, while only approximately 12% had completed the required attestation. Those completion rates did not substantially improve, with another year passing by with only approximately 54% of practices had completed  the self-assessment and approximately 27% completing the attestations. 

Why does this matter? The self-assessment and attestation process was Fortnum's primary means of monitoring whether it had implemented and complied with the policy.

Compounding the issue was the fact that Fortnum also had no formal process to resolve the serious security gaps identified through "no" or "unsure" responses submitted by the ARs. 

These inherent deficiencies in the April 2021 Policy and its incomplete or failed implementation resulted in the Court finding that the April 2021 Policy:

1. Did not require Principal Practices that answered "no" or "unsure" in their self-assessment to consult Fortnum;
   
   
2. Did not require those practices to rectify the deficiencies identified;
   
   
3. Allowed practices to consult an IT consultant without Fortnum having processes to ensure that the consultant had appropriate experience or expertise;
   
   
4. Treated mitigation strategies such as the Essential Eight as optional; and
   
   
5. Did not require network practices to take steps that were adequate to manage and mitigate the cyber risks they faced.

The Court also accepted that Fortnum lacked adequate processes, systems or frameworks to monitor matters including compliance with its cyber policy, cyber controls adopted by individual ARs, their use of external cybersecurity providers and their individual cyber risk profiles.

It is clear that if a business in Fortnum's position does not improve or penalise its business units, ASIC and the courts will.

One of the more significant aspects of the decision concerns who is responsible for developing and overseeing an organisation's cyber framework.

Fortnum employed between 22 and 32 employees during the Relevant Period. None had specialised qualifications, experience or expertise in cybersecurity. Its Head of Technology had experience in technology roles but no formal cybersecurity training. Fortnum also did not formally engage an external specialist with cybersecurity expertise to develop, implement, oversee or monitor the April 2021 Policy, although it had consulted with some IT consultants.

The Court accepted that "adequacy" under section 912A(1)(d) has both a quantitative and qualitative dimension: it is not simply whether the organisation has enough people, but whether those people have the necessary skills, experience and knowledge.

In Fortnum's circumstances, access to specialist cybersecurity expertise, whether internally or through a formally engaged third party, was necessary.

In 2022, in RI Advice the Federal Court confirmed that an AFSL holder's obligation to maintain adequate risk management systems extends squarely to cybersecurity and cyber resilience. RI Advice also provided that deficient cybersecurity arrangements can amount to a failure to ensure financial services are provided efficiently, honestly and fairly under section 912A(1)(a), even though the deficient policies or systems do not themselves constitute the direct provision of financial advice.

In following RI Advice, the Court noted that although Fortnum maintained a risk register, risk appetite statement, incident register and breach reporting processes, the systems and controls comprising its broader risk framework did not adequately:

1. Identify and evaluate cyber risks affecting Fortnum and its ARs;
   
   
2. Establish, implement and maintain controls addressing those risks;
   
   
3. Document responsibility between Fortnum and its ARs for managing cyber risk; or
   
   
4. Enable cybersecurity issues to be appropriately identified, reported and escalated from ARs to Fortnum. 

The above shortcomings reinforce the position that an AFSL holder's cyber risk management obligations extend beyond merely having policies to ensuring that risk management on paper is put into practice and done so effectively.

It is an established principal that the nature and quantum of a penalty will turn on the facts and circumstances of each case. 

The Court considered the $1.35 million financial penalty appropriate, acknowledging that the contraventions were serious, numerous and sustained for almost two years.

Similar to what occurred in ASIC v FIIG Securities Ltd [2026] FCA 92, the sustained nature of the deficiencies reinforces that persistent failures to adequately manage known cyber risks can attract significant penalties.

There were in this case, however, the following important mitigating factors. Firstly, the contraventions were not deliberate. Secondly, ASIC did not identify any specific loss caused by Fortnum's contraventions. Thirdly, Fortnum did not obtain a profit or benefit from the contraventions. The Court also took into account Fortnum's cooperation with ASIC, its early resolution of the proceedings and the significant remediation undertaken since the relevant period. This included updated cyber policies, annual reviews of Principal Practices involving a third-party cybersecurity specialist, regular cyber training, additional cyber resources and the appointment by Fortnum's new parent company, Entireti Ltd, of a Head of Cyber whose remit includes Fortnum.

By imposing a penalty of $1.35 million and the court also emphasised the need to impose a sting or burden on Fortnum’s business having regard to its size and in order to achieve specific and general deterrence. 

The message from ASIC v Fortnum is clear: cybersecurity governance must be practically maintained (and enforced) and cannot simply exist on paper. 

For AFSL holders in particular, the decision shows that the compliance requirement to adequately manage cyber risk is embedded within statutory obligations imposed by section 912A of the Corporations Act and shows that ASIC and the courts will enforce these provisions.

This decision also provides a timely reminder for all organisations managing personal information or operating through networks, subsidiaries, franchisees or authorised representatives that: 

1. Cyber policies must match the risks actually faced by the organisation. A generic policy or checklist is unlikely to be enough if it does not translate identified risks into mandatory controls and protocols.
   
   
2. Identified gaps must be remediated. Self-assessments and attestations alone do not manage cyber risk. Organisations should put in place mechanisms for deficiencies to be identified, escalated, addressed and monitored.
   
   
3. Compliance is being tested. Organisations should be capable of demonstrating that required cybersecurity controls have actually been implemented, rather than assuming that issuing a policy means it is being followed.
   
   
4. Third parties and ARs remain within the cyber governance framework of the AFSL holder. Where services are delivered through an AR network, outsourcing or decentralising those services does not necessarily relieve the AFSL of its responsibility for oversight. 
   
   
5. Appropriate cyber expertise is available. General technology experience will not necessarily satisfy an obligation requiring specialist cybersecurity competence. Where that expertise does not exist internally, businesses should consider formally engaging suitably qualified external specialists.
   
   
6. Cyber risk forms part of enterprise risk management. Cybersecurity should be reflected in governance, risk registers, escalation mechanisms, responsibility matrices and board reporting, rather than operating as a standalone IT issue.
   
   
7. Cyber frameworks evolve with the threat environment. Identifying that a cyber framework requires improvement is only the first step. There is a real regulatory risk created where known deficiencies persist while a replacement framework is being developed.

Perhaps the most important takeaway is that loss resulting from a cyber incident is not a prerequisite for regulatory exposure. ASIC will enforce and penalise ahead of an incident occurring. In Fortnum, ASIC did not identify any cyber breach event or specific loss caused by the contraventions. The inadequacy of the arrangements and the unacceptable risk created by them, was itself sufficient to attract substantial regulatory consequences.

The key question for organisations is not "do we have a cyber policy?", but rather "can we demonstrate that risks are identified, adequate, implemented, monitored and working?"

If your organisation is reviewing its cyber governance, regulatory obligations or resilience framework, our Technology & Data team can assist with assessing existing policies and governance arrangements, identifying regulatory gaps and strengthening cyber risk management and incident preparedness.