Fortnum Private Wealth penalised over cybersecurity failures in Australia

Traders Union
All News
Regulators
Fortnum penalised over cybersecurity failures

Highlights

Federal Court ordered Fortnum Private Wealth to pay a A$1.35 million penalty for failing to implement adequate cybersecurity policies and oversight.
Fortnum's network of 81–94 advice practices and over 200 advisers exposed sensitive client data, with additional A$250,000 ordered toward ASIC's legal costs.
ASIC highlighted this as its third enforcement action for weak cyber protections, intensifying regulatory scrutiny on financial firms’ cyber risk management.

Penalty details and admitted control gaps

As reported by ASIC, Fortnum admitted it did not implement an adequate cybersecurity policy, lacked sufficient oversight and monitoring of its authorised representatives, and failed to maintain enough specialised cyber expertise and risk management systems.

During the relevant period, Fortnum's network included between 81 and 94 financial advice practices and more than 200 authorised advisers. Those practices collected and held sensitive information including identification documents, tax file numbers and financial account details, increasing the potential harm from cyber-related attacks or cybercrime.

Justice Black said the parties agreed that Fortnum's failures exposed authorised representatives and retail clients to the risk of serious harm and loss. The Court also ordered the company to pay A$250,000 toward ASIC's costs.

Regulatory pressure on cyber resilience

ASIC Chair Sarah Court said the ruling reinforces that Australian financial services licence holders must properly manage and protect against cybersecurity risk. She said the outcome is ASIC's third against a licensee over inadequate cyber protections, following earlier actions involving RI Advice and FIIG Securities.

The judge said the A$1.35 million penalty provides the necessary deterrent given the scale of Fortnum's business, while also reflecting that the conduct was not deliberate and that the company cooperated with ASIC during the investigation and court proceedings. The decision adds to regulatory pressure on financial firms to strengthen basic cyber controls as watchdog scrutiny of operational resilience continues.

We previously reported on U.S. regulators imposing a $1.2 billion penalty on Bank of America over major failures in its anti-money laundering and sanctions controls, including not properly reporting more than $5 billion in suspicious transactions. Our earlier article also noted the bank was placed under orders requiring remediation and third-party support, as authorities pointed to ongoing compliance weaknesses and insufficient expertise within key control functions.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.