AFS licence management: the controls advice practices should review

Practice note — evergreen

AFS licence management is easy to treat as an administrative task. For an advice practice, it is better understood as one element of the control framework around the licensee and the businesses operating under it.

ASIC publishes guidance on applying for and managing an AFS licence, including information about changing licence details through the Regulatory Portal. Those pages should be the starting point for determining what applies to a particular licensee. The practice’s role is to ensure that business changes are identified, assessed and documented rather than dealt with informally.

Start with the licence record

A useful review compares the information recorded for the licence with the licensee’s current structure and operations. Depending on the circumstances, that review may include:

• the legal entity and business structure;
• the financial services and product authorisations recorded for the licence;
• authorised representatives and responsible managers or other nominated personnel;
• business and contact details; and
• arrangements between the licensee and businesses operating under its authorisation.

The purpose is not to assume that every change requires an ASIC notification or licence variation. It is to ensure that each material change has been assessed against the applicable ASIC process, with the conclusion recorded.

ASIC’s guidance on applying for and managing an AFS licence is available here: https://www.asic.gov.au/for-finance-professionals/afs-licensees/applying-for-and-managing-an-afs-licence/

Build the assessment into change control

The assessment should begin when a change is proposed, not after it has been implemented. Examples of changes that may warrant review include a change to an authorised representative, a responsible manager or key person; a change to the licensee’s structure or details; a proposed change to financial services; or a change in how responsibilities are allocated between a licensee and an authorised representative business.

The required regulatory response will depend on the facts and the relevant ASIC requirements. A practice should therefore record:

• what changed or is proposed to change;
• the legal entities and people affected;
• whether the change was assessed as requiring ASIC action;
• the source relied upon for that assessment;
• who approved the assessment; and
• any resulting lodgement, variation, notification or follow‑up task.

These are suggested governance controls, not a statement that ASIC requires a particular register, approval pathway or review timetable.

Use the Regulatory Portal deliberately

Where a change must be made through the Regulatory Portal, the practice should define who may prepare, approve and submit it. It should also retain the relevant submission details, reference number or portal status, together with any ASIC correspondence and follow‑up actions.

A lodgement is not necessarily the same as a completed ASIC process. Internal records should distinguish between a proposed change, a submitted request, an ASIC request for further information, and any outcome or status communicated through the portal or by ASIC.

ASIC’s guidance on changing licence details through the Regulatory Portal is available here: https://www.asic.gov.au/for-finance-professionals/afs-licensees/changing-details-and-lodging-afs-forms/afs-licensees-changing-your-licence-details-through-the-regulatory-portal/

Control scenarios to test

Rather than relying on a generic checklist, senior management and compliance teams can test scenarios relevant to their business. For example:

• an authorised representative changes role or leaves the business;
• a responsible manager or other key person changes;
• the licensee changes its legal structure, trading details or contact information;
• an advice business is acquired, sold or moved within a group; or
• the business proposes to provide a service or deal with a product category not previously considered in its licence framework.

For each scenario, the question is whether the change affects the licence, the information held by ASIC, the arrangements documented between the parties, or the practice’s ability to operate within its existing permissions. The answer should be checked against the applicable ASIC material rather than inferred from the business’s internal records.

A central register can be a useful control where a licensee has several entities, representatives or locations. It is a recommended management tool, not a substitute for checking the underlying ASIC requirements. The register might record the current position, open assessments, owners, lodgement details and evidence of completion.

A proportionate review cycle

A practice does not need to wait for a regulatory change to test its licence‑management controls. A proportionate review could involve:

• obtaining the current licence information and comparing it with the legal entity and operating model;
• reviewing material business and personnel changes since the last assessment;
• checking who has Regulatory Portal access and whether submission records can be retrieved;
• testing a sample of past changes against the documented assessment; and
• assigning owners to resolve discrepancies or obtain further advice.

The timing should reflect the size, structure and change profile of the business. A four‑week review may be suitable for one practice and insufficient for another; it should not be treated as an ASIC deadline or a universal compliance standard.

ASIC’s published guidance provides the relevant starting points. The remaining controls — ownership, escalation, record‑keeping and review — should be designed and documented by the licensee for its own circumstances.¹