Fortnum pays $1.35m to settle ASIC lawsuit

Fortnum Private Wealth will pay a penalty of $1.35 million and ASIC's costs to resolve legal proceedings against the firm over a cyber governance matter which occurred between April 2021 and May 2023.

Fortnum self-reported the matter to ASIC and cooperated with them to resolve the matter, avoiding a lengthy trial.

The NSW Supreme Court made orders reflecting the agreement, Fortnum said.

Fortnum noted ASIC "did not identify any client or adviser loss caused by the contraventions" and the advice firm's core systems were not compromised.

"However, we apologise for the concern that this may have caused some of our clients. Our priority has always been and remains the safety of client assets and data and supporting advisers in maintaining robust safety standards," Fortnum Private Wealth chief executive Matt Brown said.

"The cyber frameworks and policies reviewed by ASIC three years ago, no longer reflect the cyber security management framework, governance arrangements, controls and support that are in place today in our business."

He said Fortnum and the broader Entireti Group have made "significant" investments in cyber governance, oversight, specialist expertise, and training for advisers and risk management systems to strengthen cyber resilience across the business and adviser network.

"Cyber security is an ongoing challenge for all industries and organisations world-wide. Effective cyber resilience requires continuous improvement and shared responsibility across licensees, advisers, employees and technology providers," he added.

ASIC alleged the advice firm did not meet its AFSL obligations for failing to have adequate policies, frameworks, systems and controls in place to deal with cybersecurity risks when commencing the proceedings in July last year.

It was alleged that, between April 2021 and May 2023, Fortnum failed to manage and comply with its cybersecurity obligations that exposed the information of its advisers and clients.

At the time, Brown refuted ASIC's allegations "that FPW failed to meet its obligations with regard to appropriate cyber controls over the period 2021-2022 and will vigorously defend our position."

Meanwhile, ASIC chair Sarah Court said the outcome reinforced that AFSL holders must properly manage and protect against cybersecurity risk.

"Today's outcome is the third obtained by ASIC against a licensee over failures to adequately protect against cybersecurity risk, following previous enforcement actions against RI Advice and FIIG Securities," she said.

"In this case, Fortnum was aware of the cybersecurity risks facing its business and authorised representatives but failed to implement an adequate cybersecurity policy and have adequate oversight and monitoring arrangements.

"These failures exposed authorised representatives and their clients to the risk of cyber-related attacks and cybercrime and fell below the standard the public is entitled to expect from an AFSL holder.

"This outcome reinforces ASIC's continued focus on licensees getting the fundamentals right. Strong cyber resilience is critical to maintaining trust and confidence in our financial system. We will continue to work with industry to lift standards and take action where businesses fall short."