FAE · ASIC Financial Adviser Exam
Lesson 2 of 3 in AML/CTF, privacy and tax (financial) advice
Who the Privacy Act binds and why the small business exemption rarely helps an AFS licensee, the APPs an adviser uses every week with their time limits, notifiable data breaches, and the penalty tiers and statutory tort added by the 2024 amendments.
Financial advice regulatory and legal obligations10 min read9 sections
Checked against: Privacy Act 1988 (Cth), compilation No. 104 (4 Jun 2026; confirmed as the latest compilation on legislation.gov.au, 25 Oct 2026): ss6 (personal information, sensitive information, consent), 6D, 6E(1A), 6EA, 13(4A), 13B, 13G, 13H, 13K, 16C, 26WE-26WL, 80J, 80K, 80N, 80P, 80UB, Sch 1 APPs 1, 3, 5, 6, 7, 8, 10, 11, 12, 13, Sch 2 cl 7-8, endnote 3 (Privacy and Other Legislation Amendment Act 2024, No. 128 of 2024: commenced 11 Dec 2024; Sch 2 on 10 Jun 2025; Sch 1 items 87-89 on 10 Dec 2026); OAIC, APP Guidelines Chapter B (v1.4, 21 Dec 2022) paras B.38, B.57 and Chapter 12 (v1.1, 22 Jul 2019) paras 12.15-12.17, 12.67; ASIC, Financial adviser exam: Exam preparation guidance v6.0 (Sept 2026), reading list item 6.. Independent prep, not endorsed by ASIC.
ASIC's curriculum asks candidates to 'evaluate scenarios in terms of the legal requirements and how to apply the Privacy Act' (Exam preparation guidance v6.0, Sept 2026). Reading list item 6 names Parts II (interpretation), III (information privacy), IIIC (notifiable data breaches), VIA (emergencies and disasters), VIB (enforcement) and Schedule 1 (the APPs).
Scenario questions ask you to classify information, decide whether a use or disclosure is allowed, respond to a request, or judge whether a breach is notifiable. Our practice questions drill each. Statutory extracts are supplied, so test the facts against each condition.
The APPs bind APP entities: agencies and organisations. A small business operator is not an organisation, and a business is small if its turnover for the previous financial year was A$3m or less (s6D(1)). That exemption rarely helps an AFS licensee:
| Personal information | Sensitive information | |
|---|---|---|
| Meaning (s6) | Information or an opinion about an identified or reasonably identifiable individual, true or not, recorded or not |
Every note. Every question. One pass.
7 more sections of this note are part of Premium.
Passes from A$59, pay once, no auto-renew
Answer each one before you tap to see the answer and why. All are from the practice bank.
In one week at Mallee Advice (annual turnover A$5m), a staff member opens a client's file without a work reason and closes it at once, and a former client asks for a copy of her file. Under the Privacy Act, Mallee … (i) must notify the OAIC of the staff member's access, whatever the risk of harm. (ii) may charge the former client a fee for making her access request.
Answer: D. (i) False, (ii) False
Answer: (i) False, (ii) False. Only an eligible data breach, one likely to result in serious harm, must be notified, and an organisation may never charge for the making of an access request.(i) False. An eligible data breach requires that a reasonable person would conclude the access would be likely to result in serious harm (s26WE(2)(a)); a brief internal look, closed at once, may well not meet that test, although Mallee should still assess it (s26WH) and deal with the staff member.
| A listed subset, including health, ethnic origin, religious or political views, union or professional association membership, sexual orientation and criminal record |
| Collect (APP 3) | If reasonably necessary for the organisation's activities (3.2) | Also needs consent, unless an APP 3.4 exception applies (3.3) |
| Secondary use (APP 6.2(a)) | Related purpose the client would reasonably expect | Directly related purpose the client would reasonably expect |
| Direct marketing (APP 7) | Within APP 7.2 or 7.3, with an opt-out | Only with consent (7.4) |
Consent can be express or implied (s6). The OAIC requires it to be informed, voluntary, current and specific, and given with capacity (APP Guidelines Chapter B, para B.38).
Case study FAE-C72, question 4 of 5: The lost laptop. Willow Advice Pty Ltd is a financial planning practice in Melbourne with 420 clients, six staff and annual turnover of about A$4.2m. Its director, Martin Hale, is a relevant provider. Willow has a privacy policy but no data breach response plan, and its staff routinely copy client files to laptops so they can work at home. On Tuesday 2 June, Willow's paraplanner, Jess, took an unencrypted work laptop home and left it on a train. The laptop held all 420 clients' fact finds, tax file numbers and bank account details and, for 60 clients, health information collected for insurance applications. It was protected only by a simple password. By Friday the laptop has not been recovered, and the train operator's lost property office has no record of it. Martin wants to 'wait a few weeks to see if it turns up' before doing anything. He says the clients 'will only panic if told', and that most of them are retirees who 'wouldn't know what to do anyway'. Jess has offered to check the train company's lost property office each day. Martin tells the board that Willow can handle the loss quietly. Under Part IIIC of the Privacy Act, Willow … (i) need notify the OAIC only if it can show that a client has already suffered harm. (ii) may take as long as it likes to assess whether an eligible data breach has occurred.
Answer: D. (i) False, (ii) False
Answer: (i) False, (ii) False. Part IIIC turns on likely serious harm, and it sets a time limit for the assessment.(i) False. The test for an eligible data breach is whether the access or loss would be likely to result in serious harm to any of the individuals, not whether harm has already happened (s26WE); a missing unencrypted laptop holding tax file numbers, bank details and health information for 420 clients is the kind of loss where serious harm is likely.(ii) False. An entity that suspects an eligible data breach must carry out a reasonable and expeditious assessment and take all reasonable steps to complete it within 30 days (s26WH).Watch out: Waiting a few weeks to see whether the laptop turns up is not an expeditious assessment, and it leaves clients unable to protect themselves.Rule: Notification is required where serious harm is likely, and a suspected breach must be assessed expeditiously, with all reasonable steps taken to finish within 30 days.Source: Privacy Act 1988 (Cth) Part IIIC, ss26WE, 26WH (compilation No. 104, 4 Jun 2026)
Case study FAE-C107, question 3 of 4: Marketing to former clients. Juniper Wealth Pty Ltd is an AFS licensee in Sydney with 3,200 clients and annual turnover of about A$14m. Its director, Hamish Reid, is a relevant provider; its marketing manager is Brooke Lin. Brooke plans an email campaign to 1,500 people promoting a new 'retirement income review' costing A$990. The list includes current clients, former clients who left up to ten years ago, and 600 people whose email addresses Juniper bought from a list broker. The emails will be sent from 'info@juniper' with no physical address or ABN, and with no way to unsubscribe, because 'people can just reply if they want to stop'. Brooke says the campaign is 'only to people who know us anyway'. Juniper still holds detailed records, including tax file numbers, for former clients who left more than eight years ago, although no law now requires it to keep them. Most of those former clients have moved to other advisers. Hamish likes having the old files 'just in case', and says a long client history helps when former clients come back. Brooke argues that current clients 'have already said yes to hearing from us' by signing their ongoing fee arrangements. For those current clients, the accurate statement about the Spam Act is that…
Answer: A. consent may be inferred from the relationship, but an unsubscribe is still required
Answer: Consent may be inferred from the relationship, but an unsubscribe is still required. Consent can be express or reasonably inferred from conduct and business relationships (s16 and Sch 2 cl 2), so Juniper may well rely on it for current clients where the offer relates to their advice relationship, but every commercial email must still identify the sender and include a functional unsubscribe facility (ss17-18).Why not the others:• no consent is needed for current clients…: consent is still needed, though it may be inferred, and the unsubscribe facility cannot be left out.• each current client must give fresh express consent…: fresh written consent before each campaign is not required where consent can be inferred.• the Act does not apply to emails that promote…: the Act covers commercial emails about financial services like any other.Watch out: Inferred consent never covers the 600 bought addresses, and Brooke's 'just reply' approach, with no unsubscribe statement in the message, falls short of s18.Rule: Consent under the Spam Act may be express or inferred, but inferred consent never removes the sender identification and unsubscribe requirements.Source: Spam Act 2003 (Cth) ss16-18 and Sch 2 cl 2 (compilation No. 10, 10 Mar 2016)
Case study FAE-C174, question 7 of 7: Owen's insurance file. Bellbird Financial Pty Ltd is an advice practice in Geelong with annual turnover of A$5.8m and a written privacy policy. Rosa Martinez is a relevant provider authorised by Bellbird Financial Pty Ltd. Owen Fraser, 46, is a self-employed electrician earning about A$140,000 a year. He and his wife, Kate, 44, a part-time teacher, have three children and a A$520,000 mortgage on their A$1.1m home. Owen has A$190,000 in super, no life cover outside it and a moderately conservative risk profile. His goal is to protect the family's income if he cannot work. At the fact-find meeting Owen agrees to Rosa recording his medical history for income protection and life insurance applications: type 2 diabetes and treatment for depression, including a hospital admission in 2019. Without being asked, he also tells Rosa that Kate is being treated for anxiety 'in case it matters', and Rosa types this into his file notes. Bellbird is not advising Kate. Owen signs an authority letting Bellbird give his accountant, Philip Tan, 'details of my insurance premiums for my tax return'. A week later Philip emails Rosa asking for the premium details and 'the medical reports too, so I understand his position'. The same day, Rosa emails Owen's draft SOA, which sets out his medical history, to the wrong person: her email software filled in Owen Frazer, another Bellbird client. Within half an hour Mr Frazer rings to say he saw the name and deleted the email without opening the attachment, and he confirms this in writing. Bellbird's practice manager briefs Rosa on handling Owen's correction request. Decide whether each statement correctly completes her sentence: 'Under APP 13, Bellbird …' (i) may charge Owen a modest fee for attaching his statement to the record. (ii) would have to tell the insurer of any correction it made to information previously sent to it, even if Owen never asked.
Answer: D. (i) False, (ii) False
Answer: (i) False, (ii) False. Correction is free in every respect, and notifying another entity of a correction depends on Owen asking for it.(i) False. APP 13.5(b) bars an organisation from charging for the making of a correction request, for correcting the information or for associating a statement with it; unlike access under APP 12.8, there is no permitted fee.(ii) False. APP 13.2 requires reasonable steps to notify another APP entity of a correction to information previously disclosed to it only where the individual asks, and even then not if that is impracticable or unlawful; Bellbird may choose to tell the insurer, but the duty depends on Owen's request.Rule: Under APP 13 an organisation may not charge for any part of a correction request, and it must notify a correction to another APP entity that previously received the information only when the individual requests it.Source: Privacy Act 1988 (Cth) Sch 1, APPs 12.8, 13.2 and 13.5 (compilation No. 104, 4 Jun 2026)
