Your questions answered: a closer look at the new 'fit and proper' and 'use it or lose it' requirements

In brief 11 min read

The first 'use it or lose it' deadline is looming. AFS and credit licensees, who were authorised to provide a financial service on the date that the 'Stronger Regulators' legislation was enacted, must have provided that service by 18 August this year, or may otherwise face having their licence cancelled by ASIC.

Licensees and applicants for licences have also spent some of the last few months grappling with the new 'fit and proper person test'.

In this Insight we explore some of the common questions that have arisen as a result of the new requirements.

A reminder of the background

The Financial Sector Reform (Hayne Royal Commission Response—Stronger Regulators (2019 Measures)) Act 2020 (Cth) was enacted on 18 February 2020 and made a number of significant amendments to the Australian financial services (AFS) and credit licences regimes.

Amongst other things, the following new features were introduced by the Act:

• Fit and proper - Before a licence can be granted or varied, ASIC must now be satisfied that there is no reason to believe that the applicant, or any relevant persons associated with the applicant (such as its officers, partners, trustees and controllers), are not 'fit and proper persons'.
• 'Use it or lose it' - In a bid to end 'warehousing' and the onward sale of licences, if an AFS licensee does not provide a financial service covered by their licence before the end of six months after the licence is granted, the licensee must lodge a notification with ASIC before the end of 15 business days after the end of the six months. Equivalent notification requirements apply to holders of credit licences. Related to this, ASIC has the power to cancel a licence if the licensee does not provide a financial service within this period and a strict liability offence applies for failing to notify ASIC that a financial service has not been provided. Transitional provisions also apply to licensees who were already authorised to provide financial services on the Act's commencement day of 18 February 2020 (we explore this more below).
• Information gathering - ASIC may now request information from an applicant and deem their application as withdrawn where that information is not provided.
• Change of control - Licensees must notify ASIC of a change of control within 30 business of that change (as opposed to the previous requirement to notify a change a control within 10 business days of becoming aware of that change). A strict liability offence applies for failure to notify ASIC within this time period.

We have concentrated on some of the common questions we are being asked in relation to 'fit and proper' and 'use it or lose it', but licensees should note that the Act also introduced a number of other important 'Stronger Regulator' changes. These include enhanced search warrant and banning order powers for ASIC, permission for it to receive and use intercepted information for its investigations and prosecutions and changes to the offences for false and misleading information.

Fit and proper

We need to apply for our licence. Who are the relevant fit and proper persons?

A wide range of people are captured by the fit and proper person test. For example, where a body corporate makes the application, the test applies to the applicant and its officers. 'Officer' has its usual meaning under section 9 of the Corporations Act 2001 (Cth) (Corporations Act). Where a partnership or trustees of a trust is the applicant, information will need to be submitted in respect of each of the partners or trustees and any 'senior managers' of the partnership or the trust.

ASIC must also be satisfied that each of the controllers of the applicant are a fit and proper person. In addition to introducing a new, wide-ranging definition of 'control' for these purposes,^[1] the Act also provides that where the controller is a body corporate, this includes the controller's officers, and where the controller is a partnership or multiple trustees of a trust, the test also applies to the partners or trustees of that controller.

Various definitions apply and applicants will need to undertake the exercise of identifying the relevant people at any given point.

For applicants in a simple corporate structure, this should (hopefully) be straightforward.

However, where the applicant is part of a large, global group, identifying the relevant people and providing this information to ASIC is an onerous and expensive exercise, and is particularly complicated where the controllers and officers, partners or trustees of the interposed entities are overseas. We recommend that this information-gathering process is started as early as possible.

Does this information also need to be provided where we are applying to vary our licence?

For new licence applications, section 913B(1) of the Corporations Act provides that ASIC 'must not' grant a licence unless the fit and proper person test is satisfied.

However, where a licensee applies to vary their licence, new section 914B(2) provides that ASIC 'may' refuse to grant the application where the fit and proper person test is not satisfied.

It is yet to be seen whether this discretion affords licensees any leniency in respect of the information they need to provide where, for example, a simple licence variation is made.

Whilst there may be some merit in applying to ASIC before the variation application is made to understand whether ASIC is prepared to grant some relief in respect of the full test, at this stage our recommendation is licensees should approach a variation as if they were required to make an application for a new licence. Records of the information required in relation to 'fit and proper people' should be maintained and updated annually, such that, if a licensee wishes to make a variation, this information is readily available.

What information do we need to provide to ASIC about the relevant 'fit and proper persons'?

ASIC must consider certain matters specified in the legislation^[2], and it has set out the information required to be provided by applicants for each of the applicant's 'fit and proper people'. This information can be divided into two parts:

• Identity of the fit and proper persons: For new licence applications and variation applications, in the case of both financial services and credit licences, the applicant must provide various information about each of its fit and proper people (having undertaken the identification exercise we have described above). This includes their full name and address, their position and a short description of their duties. If they are a fit and proper person due to their relationship with the controller of the applicant, the details of the controlling entity should also be provided.
• People Proofs: These must be no more than 12 months old and include in respect of each fit and proper person:
  1. criminal and bankruptcy checks; and
  2. a completed 'Statement of Personal Information'.

There have been instances where ASIC has rejected criminal and bankruptcy checks that have been undertaken by a third party provider, such as Experian, in relation to searches conducted outside of Australia. Where an applicant proposes to use a third party provider to run these checks, we recommend confirming with ASIC at the outset that these checks will be accepted. Otherwise, the checks will need to be obtained directly from the relevant criminal and credit bureau, and if the fit and proper person resides (or has resided) overseas, this can be challenging. There have been instances where international checks have taken a number of months to obtain.

The Statement of Personal Information contains a list of questions relevant to the person's fitness and propriety. The statement must be signed by the fit and proper person and a witness is required.

Is there any exemption from the requirement to provide information to ASIC?

ASIC has provided a limited exemption from the requirement to provide People Proofs in relation to officers of controlling entities, other than the ultimate parent entity.

Applicants may provide a certification that fit and proper people who are officers of a controller of the applicant are fit and proper to perform one or more of the functions relevant to their position.^[3] If the applicant provides the certification, it is not required to submit People Proofs for these officers. However, ASIC may still subsequently require the applicant to provide People Proofs (including police and bankruptcy checks) in relation to any of the applicant’s fit and proper people when assessing the application, so this is not complete freedom from the requirements.

For applicants seeking to rely on this exemption, we recommend that appropriate internal due diligence processes are put in place in relation to all possible fit and proper persons well in advance of the application, such that the applicant is able to confirm that the necessary vetting has been completed at the time of its application. It may also be helpful to update the due diligence annually in case any future variations are needed.

Use it or lose it

We provided a financial service some time back, but have not done so in the last few months. Do we need to notify ASIC?

Under the new requirements in section 912DB, if an AFS licensee does not provide a financial service covered by the licence before the end of six months after the licence is granted, the licensee must lodge a notification with ASIC before the end of 15 business days after the end of the six months.^[4] Equivalent notification requirements apply to holders of credit licences.^[5]

This requirement applies only to new AFS licence holders who do not use an authorisation under their licence, or new credit licensees who do not engage in a credit activity covered by the licence, within the first six months of acquiring the licence. It does not apply to licensees who use a licence authorisation or engage in credit activities (respectively) in the first six months, but subsequently cease relying on the authorisation.

However, the Act also includes transitional provisions for licences in force immediately before the commencement day (which was 18 February 2020).

How do we notify ASIC that we have not used a financial service? Do we need to make a formal licence variation?

Section 912DB of the Corporations Act and section 53B of the NCCPA provide that a licensee must notify ASIC if they do not provide a financial service or engage in credit activities in the prescribed or approved form.

The Explanatory Memorandum to the Act also states that ASIC intends to provide further guidance as to the 'use it or lose it' requirements.^[6] ASIC has since reissued INFO 240 which provides additional information on the fit and proper person test and proofs needed when making an application.

However, it is yet to confirm the process for making a notification that a financial service has not been used.

We expect that a formal licence variation is not required provided that these authorisations were previously relied on at some point. It is possible that Form FS20 Change of details for an Australian financial services licence will be the appropriate form for this purpose for AFS licensees, although the pro forma Form may need to be updated to allow for this. For credit licensees, we expect the change will be able to be notified through the credit registers portal. However, licensees may wish to confirm this with ASIC before making any such notification.

Additionally, if a licensee expects that it will not rely on an authorisation in the future (at any point), this is more likely to indicate that a full licence variation is required.

COVID-19 has put a number of our plans on pause. We are worried we will not provide the financial services for which we are authorised before the end of six months since our licence was granted. Is there any reprieve?

The power for ASIC to cancel a licence is discretionary.

The Explanatory Memorandum to the Act indicates that it is open to ASIC to work with licensees if there are genuine reasons for not being able to commence its business within the six-month timeframe.^[7] The ASIC Enforcement Review Taskforce also recommended providing licensees an extension of time where this is the case.

To the extent that a licensee is concerned it will not be able to provide the services for which it is authorised in the first six months from when its licence was granted, we recommend that an application for an extension is made. This should detail the reasons why the licensee has been unable to commence providing the services to date and provide ASIC with a timeframe in which it expects to be able to start providing those services.

We are also aware that ASIC is exploring whether the six-month transitional period may be extended more generally in light of COVID-19, and licensees who are concerned about the services they have (not) provided should keep a watching brief for any announcements in this respect.