What you need to know
Anyone who receives an ASIC notice should not treat it as routine correspondence; it signals that the regulator believes the recipient holds information relevant to an active surveillance or investigation.
What you need to do
- Understand the notice: carefully assess the scope of the notice and what is required.
- Develop a plan for response: engage legal advisers, identify key stakeholders and document repositories, use generative AI to assist with document review and triage requests for documents and information.
- Engage early with ASIC: clarify the scope of what the regulator actually needs from you and keep them informed on progress of your response.
- Consider privilege and confidentiality: withhold documents that are subject to legal professional privilege and identify confidential documents.
- Review your position: consider your broader regulatory and litigation exposure particularly if the services you offer are the subject of ASIC's enforcement priorities or significant media coverage.
Received an ASIC notice? Five steps to position yourself well
When you receive a notice from the Australian Securities and Investments Commission (ASIC), a well-managed response can make a meaningful difference to the outcome. The way you handle the process – including timing, scope and engagement with ASIC – can influence whether the matter is resolved cooperatively or leads to civil penalty proceedings, significant business disruption and reputational consequences. Importantly, the documents you produce and the information you provide in response to a notice may later be relied on by ASIC in any enforcement action. Getting the fundamentals right from the outset is therefore essential. The five steps below will help you understand what ASIC is asking for, plan and resource your response, manage your engagement with the regulator, protect your privileged and confidential material and assess your broader regulatory and litigation exposure.
1. Understand the notice
ASIC is empowered to issue notices requiring both the production of documents (document notices) and the provision of information by way of written statement (information notices). The notices are in writing and set out a specific time and place for production and response.
The document notices are issued under Part 3 of the Australian Securities and Investments Commission Act 2001 (Cth) (ASIC Act): Investigations and Information-Gathering. The information notices are usually issued under s 912C of the Corporations Act 2001 (Cth), which allows ASIC to direct a financial services licensee to give to ASIC a written statement containing specified information. Both kinds of notices are often issued as part of an investigation into a contravention of law although that is not always the case.
The document notices will generally require the production of categories of "books" relevant to the issues under investigation. The term “books” is defined broadly under the ASIC Act. It includes any record of information – not just physical documents, but electronic data, files, emails, SMS messages, instant messages and voice and video recordings. You should therefore assume that the categories in a notice may capture a wide range of materials held across multiple platforms.
The scope of information notices can be broad provided there is connection to the financial services provided by the licensee, the financial services business or whether the fit and proper person test in s 913BA of the Corporations Act is met. ASIC can be specific about the format of information sought by an information notice, for example, by requiring the recipient to complete an excel spreadsheet with data relevant to the issue under investigation.
You should read any notice carefully and ensure you understand precisely what is required, by when, and in what format.
2. Develop a plan for response
You may have been issued with notices simply because you hold relevant information rather than because ASIC is investigating your potential misconduct. ASIC’s current usual practice is to hold a meeting with the subject of an investigation to let them know an investigation will commence and then issue an investigation plan detailing what it will cover (including whether notices will be issued). So you should know before receiving a notice whether there is an investigation into alleged misconduct by you. In any event, a document notice will usually identify whether an investigation is on foot while an information notice won’t necessarily do so. Even if any notices indicate that no investigation has yet been commenced against you, there is always the risk of the inquiry expanding. Responses to regulatory notices can result in disruption to BAU and present major risks for the commencement of enforcement proceedings against notice recipients. If the regulator commences proceedings, it will rely on notice responses (i.e. the documents and information statements provided by you) in doing so. It is therefore critical to engage experienced legal advisers immediately on receipt of any notices to help with your response.
Responding to notices will involve identification of and discussion with key stakeholders who hold the relevant information and documents. Together with IT staff, they will need to identify the repositories of documents and extract the documents for review before production. Review will ensure that you only produce documents relevant to the notice, that is, those that are required to be produced by its terms.
Productions in response to document notices can involve significant volumes of data, spanning multiple systems, stakeholders and years. You should engage a law firm with inhouse platforms leveraging generative AI to manage, analyse and protect vast volumes of data, like Ashurst Perkins Coie’s Advance offering. These platforms, particularly where part of a firm’s inhouse capability, can reduce the time and costs of responding to ASIC notices.
Managing disruption to the business might also include triaging the different categories of information or documents required by the notices so that they can be provided in tranches at different times to the regulator. This will involve the next critical step: engagement with ASIC.
3. Engage with ASIC
You should consider early engagement with ASIC on the notice irrespective of whether you are the subject of an investigation or not. It can help to open the lines of communication between the regulator and the notice recipient to allow dialogue about what the regulator wants and what the recipient can give.
ASIC may unknowingly seek vast volumes of data or request information that is challenging to provide, which it does not actually require to conduct its investigation. A discussion about these issues can more readily identify what should be given to ASIC so that it can meet its regulatory objectives.
If it becomes necessary to negotiate with ASIC on deadlines for responses, early engagement may make the regulator more amenable to requests of this nature from you. Where such a request becomes necessary, you should provide details about any extension of time required. This might include where the documents are held, how many need to be reviewed and anything causing any particular delays.
4. Consider privilege and confidentiality
Information and documents which are to be produced to ASIC must be carefully reviewed to check whether they are subject to legal professional privilege. This privilege applies to confidential communications brought into existence for the dominant purpose of giving or obtaining legal advice or for use in actual or anticipated legal proceedings. Generally, documents subject to legal professional privilege should not be produced.
ASIC will not require you to produce documents and information that are the subject of a valid legal professional privilege claim. ASIC does not accept a blanket claim, however, and requires notice recipients to complete a schedule identifying each document over which a claim is made and to provide certain detail in respect of each document.
In some cases, you may elect to voluntarily disclose privileged documents or information. If this happens, you and ASIC may agree to ASIC’s standard “Voluntary confidential LPP disclosure agreement”. Under this agreement, you and ASIC would agree that the disclosure of the information to ASIC is not a waiver of the privilege. This means ASIC cannot later assert the provision of the information amounts to a waiver of privilege. There may be risks with taking this approach and privileged material should not be voluntarily disclosed to ASIC without legal advice.
Even highly confidential documents must be produced to ASIC but these should be identified and discussed with ASIC. In the event that ASIC uses this information in subsequent enforcement proceedings, you could seek court orders to a confidentiality regime preventing disclosure.
5. Review your broader position
An ASIC notice should prompt you to look beyond the immediate compliance task and assess your broader regulatory exposure. The next step in an investigation after document and information notices are usually notices issued under s 19 of the ASIC Act. This allows ASIC to issue a notice requiring a person to appear before staff and answer questions under oath. There could, however, be much more to come beyond this. It is important to understand where the risks might be, particularly if your industry or services are under scrutiny by ASIC and fall within ASIC's enforcement priorities (see here for the 2026 priorities).
Receipt of notices should also prompt consideration of your exposure to general litigation risk, including class actions. Misconduct within the purview of ASIC can also often give rise to proceedings by private litigants for causes of action such as misleading and deceptive conduct, breaches of financial services laws and many others.
Authors: JK Muckersie, Partner; Camilla Clemente, Partner; Kenneth Nguyen, Partner; Nicholas Mavrakis, Partner; Michael Sloan, Partner; Con Tzerefos, Partner and Jacqueline Chan, Partner.
