An investigation by the Australian Investments and Securities Commission (ASIC) into the time taken for banks and other financial institutions to correct breaches of the law has found “serious, unacceptable delays”.
In its report Review of Selected Financial Services Groups’ Compliance with the Breach Reporting Obligation, ASIC examined the breach reporting processes of 12 financial services groups, including the big four banks (ANZ, CBA, NAB and Westpac) and AMP.
Chair of ASIC, James Shipton (pictured) said the industry was taking “far too long” to identify and investigate potential breaches.
“Our review found that, on average, it takes over five years from the occurrence of the incident before customers and consumers are remediated,” Mr Shipton said.
He said this was a sad indictment on the financial services industry and “must not stand”.
The ASIC Chair said the process from starting an investigation to lodging a breach report with ASIC also took too long with major banks taking an average of 150 days.
“Once a financial institution has investigated and determined that a breach has occurred and that it is significant, the law requires that the breach be then reported to ASIC within 10 business days,” Mr Shipton said.
“One in seven significant breaches (110 of 715) were reported later than that 10-business day requirement.”
He said many of the delays in breach reporting and compensating consumers were due to the financial institutions’ inadequate systems, procedures and governance processes, as well as a lack of a consumer orientated culture of escalation.
“There is an urgent need for investment by financial services institutions in systems and processes, as well as commitment and oversight from boards and senior executives to address these significant failings,” Mr Shipton said.
ASIC’s 125-page report can be accessed at this PS News link.
