Author: admin

A financial services firm’s website is much more than a brand asset that happens to mention products. It is a conduct record. Every headline, testimonial, calculator, performance chart and call to action can create a representation about the firm, its services, internal controls, a financial product, a likely outcome, or the level of risk involved. The relevant regulatory question is not whether each sentence is technically defensible in isolation, but whether the communication, viewed as a whole and received by the audience likely to see it, creates a false, misleading or deceptive impression.

ASIC’s updated Regulatory Guide 234, Advertising financial products and services (including credit), sets the standard. RG 234 is directed to promoters of financial products and financial advice services, and to publishers of advertising. Its core requirements are straightforward: statements must be true, accurate and capable of being substantiated; predictions about future returns or risk require reasonable grounds; and an intention not to mislead does not prevent a communication from being misleading. The overall impression matters as much as the individual words. The audience reached matters as much as the audience intended.

That framing has a direct compliance implication and marketing review should be treated as a front-end conduct control, integrated into the AFSL holder’s broader system of supervision, monitoring, record-keeping and accountability. A polished approval workflow is not enough if published claims remain unbalanced, unsupported or impossible to reconstruct after the fact.

ASIC’s June 2026 Update Changes What Firms Must Review

On 9 June 2026, ASIC reissued RG 234, the first substantial rework of the document since it was introduced in 2012. The revision drew on more than a decade of enforcement and regulatory action and followed a public consultation that ran from November 2025 to January 2026. The biggest structural change is the absorption of Regulatory Guide 53, The use of past performance in promotional material, into RG 234. RG 234 is now the single reference point for ASIC’s advertising expectations, with no stated transition period. Which means the revised guidance is now in effect.

The update also added AI-generated content, AI specific claims, and a greenwashing enforcement example, expanded guidance on the distinction between required warnings and general disclaimers, clarified the performance-period comparison rules for products with less than five years of history, and added further commentary on what constitutes an “ordinary and reasonable person” when assessing how an advertisement lands.

The practical message is that the firm must ensure that any communication is fair, balanced, clear, accurate and supported by evidence, with qualifications presented in a way that an ordinary member of the intended audience can notice and understand. A disclaimer cannot reliably fix a dominant headline that communicates an inconsistent promise.

A Claim-Level Benchmark Makes Regulatory Exposure Visible

A useful approach to marketing review does not attempt to declare a breach or confirm that copy is free from risk. It identifies individual claims, maps them to relevant risk themes and assigns a triage status. A report of this type might present a result such as 79 out of 100 across 42 claims, with 23 green, 18 yellow and 1 red. The value lies less in the numbers than in the audit trail behind it detailing the exact wording, the page location, the issue classification, the evidence required, the accountable owner and the remediation status.

As a concrete example, a sentence such as “It is this level of total care that ensures expert advice to get you where you need to be” may warrant a red classification because “ensures” may convey an absolute guarantee about both the quality of advice and the outcome.

A report of this type should be treated as an internal screening tool, not as an ASIC-issued finding or an independently verified legal conclusion. Its governance value is that it converts a large body of website text into a prioritised remediation queue.

The thresholds for green, yellow and red should be written down and calibrated to the firm’s risk appetite. A firm that treats a yellow finding as an acceptable residual is making a deliberate decision. A firm that discovers its yellow findings are proliferating across channels is detecting a systemic pattern. The score is a diagnostic, not a verdict and shows where the lines sit and how often the firm crosses them. What the firm does next is the real test of its governance.

Three Failure Patterns Appear Repeatedly in AFSL Marketing

Misleading promotional claims understate what the firm is promising

Absolute words such as “guaranteed”, “ensures”, “always”, “never”, “risk-free”, “best” or “no downside” deserve immediate scrutiny. They may be acceptable in a narrow factual context. In financial services marketing, however, they can imply certainty about an investment outcome, the quality of advice, the suitability of a strategy or the absence of risk.

The review should test the net impression the claim creates. “Helping clients pursue their objectives” is materially different from “ensuring clients achieve their objectives”. “We provide tailored advice” is different from “our advice will get you where you need to be”. The second formulation in each pair may require proof the firm cannot realistically provide and may overstate what advice can achieve.

A sound review examines adjacent text, page design, imagery, testimonials and calls to action together. A modest qualification buried below a bold guarantee may not change the overall impression. A claim can also mislead through omission if a reasonable consumer would need material information to understand its significance.

Disclaimers that are present but ineffective provide false comfort

Disclaimers are not a universal safe harbour. They can be important where a communication needs context, but they must be specific, readable, proximate and consistent with the main message to carry any protective weight. A generic statement such as “past performance is not indicative of future performance” does not, by itself, explain fees, volatility, relevant time periods, portfolio composition, assumptions, conflicts or the possibility of loss where those matters are material to the impression created.

The review should distinguish between a missing disclaimer and an ineffective one. A disclaimer may be present yet ineffective if it is hidden behind a link, placed far from the claim it qualifies, displayed in unreadable type, contradicted by the headline, or drafted in language the audience is unlikely to understand. The firm should record not only the disclaimer text but also its location, formatting, presentation across device types and relationship to the specific claim. Any advice business copy should also be checked against the boundary between factual information, general advice, personal advice and a promotional invitation to engage.

Performance statements create an incomplete picture

Performance content carries a high risk of presenting a partial account. A favourable return figure may be technically correct yet misleading if the period, benchmark, fees, tax treatment, volatility, drawdowns, assumptions or risk of loss are unclear. Cherry-picked periods and isolated success stories can produce a stronger impression than the underlying evidence supports.

The June 2026 update consolidates all past-performance advertising guidance into RG 234. A practical review should ask: what exactly is being measured, and over what period? Is the result gross or net of fees? Is the comparison like-for-like? Are negative or less favourable periods relevant to understanding the claim? Is the benchmark appropriate? Are forecasts or projections clearly distinguished from historical results? Can the firm reproduce the data and methodology that generated the number?

The same discipline applies to testimonials and case studies. A statement such as “we helped this client retire early” may imply a typical or repeatable outcome even if it describes one client’s experience. The firm should assess whether the example is representative, whether material qualifications are needed, and whether the audience could mistake an individual result for a promise.

A Defensible Claim-Review Process Starts With a Complete Inventory

A firm that reviews its marketing reactively, one page at a time, when someone raises a concern, is not running a control but responding to incidents. A defensible review process starts with a complete inventory of every public-facing channel: the main website, landing pages, calculators, downloadable guides, newsletters, paid search copy, social channels, adviser biographies, webinars, podcasts, third-party profiles and any influencer content. ASIC monitors for misleading or deceptive representations and unlicensed financial services, which supports treating digital channels as part of the controlled perimeter rather than as informal exceptions.

Each piece of content should then be decomposed into claims, that might not be limited to a sentence. It may be a number, superlative, visual comparison, implied promise, omission, testimonial or a combination of headline and design. The reviewer should capture the precise wording, URL or channel, screenshot or archived version, date observed, intended audience, product or service involved, risk theme, evidence required, decision and owner.

Classification rules should be written down before review begins. A red rule might include an absolute guarantee, an unsupported future-return prediction, a material misstatement, a claim contradicted by available evidence, or a missing qualification that would change the audience’s likely decision. Yellow might include unclear scope, weak substantiation, poor disclaimer prominence, stale data, ambiguous comparisons or an outcome-oriented testimonial. Green should mean “no issue identified under the tested criteria”, not “approved forever”.

The Pattern of Findings Tells You More Than the Score

The most valuable question after a review is not “What was our score?” It is “What does the pattern of findings say about our controls?” If most yellow items relate to missing context, the problem may sit in the copy template or brand guidelines. If red items are concentrated in adviser biographies, the training and approval process may be underperforming. If stale performance numbers recur, ownership and review triggers may be unclear. If the same issue appears on the website and across social channels, the content management process may lack a single source of truth.

A governance committee or responsible manager should review aggregate results alongside remediation ageing, repeat findings, approval exceptions, complaints, incidents and regulatory changes. Management information should distinguish between newly detected issues, accepted residual risk, items awaiting evidence and items closed after independent verification. A numerical score should never conceal a serious single issue: one unqualified guarantee can warrant more attention than many low-risk wording observations.

Red and Yellow Findings Require Concrete Action, Not Just Documentation

A red finding should trigger prompt containment. The firm should preserve the relevant version of the content, confirm whether it is still live, assess the channels and audiences affected, and escalate under its incident and breach-reporting framework where appropriate. It should then decide whether to remove, pause, correct or qualify the communication, documenting the rationale and approval.

For yellow findings, the response should be proportionate and concrete. The firm may need to obtain evidence, narrow the claim, replace certainty language, add context, correct a comparison, improve disclaimer prominence or introduce an expiry date. The revised copy should be tested as a whole, because adding words at the bottom of a page may not fix the impression created at the top.

In both cases, remediation should include a look-back. Search for similar wording, related claims and syndicated versions across web pages, social posts, PDFs, email journeys and third-party channels. A review is most useful when it reveals a pattern that can be corrected systematically, not a single sentence that is edited in isolation.

Marketing Review Is a Control System, Not a One-Time Exercise

ASIC’s advertising guidance places the emphasis on substance and overall impression. For AFSL firms, that means marketing-copy review must be integrated with evidence management, approvals, disclosure controls, monitoring and remediation. It cannot be treated as a one-off brand exercise or an annual tidy-up.

A benchmark result, whether 78 out of 100 or any other score, provides a useful starting point for management discussion. Its real value is the claim-level detail underneath: which words create risk, what evidence is missing, how prominent the qualification is, who owns the fix and whether the control environment learns from the result. Used that way, marketing review becomes more than a surveillance exercise. It becomes a practical test of whether the firm’s governance and review processes are producing the outcomes the firm expects, before a regulator asks the same question.

Contact us to explore how to automate your marketing review process.

References

[1] ASIC, RG 234 Advertising financial products and services (including credit), issued 9 June 2026. https://www.asic.gov.au/regulatory-resources/find-a-document/regulatory-guides/rg-234-advertising-financial-products-and-services-including-credit/

[2] ASIC, INFO 269 Discussing financial products and services online. https://www.asic.gov.au/regulatory-resources/financial-services/giving-financial-product-advice/discussing-financial-products-and-services-online

The most reliable path to AI is to build a clean operating system for the business, then use AI and automation to make that system faster, clearer, and easier to govern.

For most financial advice businesses, AI looks like a fast productivity win. It can read client documents, summarise meetings, prepare drafts, answer internal questions, and cut repetitive administration. The temptation is to pick a tool, connect some files, and let the team experiment.

That is rarely the right starting point. If client information is spread across spreadsheets, email, task boards, shared drives, and specialist platforms, AI will not remove the complexity but increase it. It may generate polished language or save time on a specific task, but it cannot determine which record is authoritative, whether a document is current, who owns the next decision, or whether the required evidence has been captured and with each added tool complexity, mistakes, and gaps increases.

The more durable approach treats AI implementation as a systems-design programme. First, design the operating environment: its workflows, data, ownership, permissions, and records. Then introduce AI on top of that clean foundation. The result is an implementation that improves efficiency without sacrificing the consistency, traceability, and professional accountability that advice businesses require.

ASIC’s October 2024 report, Beware the Gap, reviewed 624 AI use cases across 23 Australian financial services licensees and found that AI adoption is outpacing the governance frameworks meant to manage it. Nearly half of licensees had no policies addressing consumer fairness or bias. ASIC’s conclusion was direct: build the governance before you build the capability.

This six-step sequence provides a practical roadmap to build the governance, as you build the . The order is deliberate and prevents the practice from automating disconnected work or giving AI access to poorly governed data.

Step 1: Map every workflow before touching anything

Before writing code, buying software, or selecting an AI vendor, map the firm’s full operation. The aim is to understand the advice lifecycle as one connected system: how a prospect becomes a client, how data is collected, how advice is prepared and reviewed, how documents are issued, how client actions are implemented, and how ongoing review obligations are managed.

The map should follow work from the initial trigger to the final outcome. It needs to show every handoff, decision, system touchpoint, data re-entry, approval, wait state, and exceptions. It should also show where important evidence is created, stored, amended, or lost.

The most important practical rule: walk each process with the person actually doing the work. The practice principal may describe onboarding as a clear, linear sequence. The client services officer may reveal a different operational reality: information copied from a fact find into a spreadsheet, then entered into planning software, then checked against documents in a shared drive, with missing information chased by email. Both perspectives matter but the detailed operational view is the one that should shape the future system.

The output is a prioritised workflow inventory. You will find issues but do not attempt to fix everything immediately. Start with the department or journey losing the most manual hours, generating the most rework, or creating the greatest operational risk. In many practices, client onboarding, review preparation, advice-document production, and post-meeting administration are sensible early candidates.

Step 2: Consolidate the stack, absorb, keep, and kill

Workflow mapping nearly always reveals an overlapping technology stack. Team members may initiate work through email, track it in Monday.com or Trello, maintain client information in spreadsheets, store documents in a shared drive, and then re-enter the same information into planning or accounting software. Individually, each tool may appear useful. Together, they obscure ownership and create significant manual coordination overhead.

The next step is to sort the stack into three categories: absorb, keep, and kill.

Consolidation does not require replacing every specialist system with one giant platform. Advice businesses will continue to need purpose-built tools for planning, portfolio management, accounting, and related functions. The aim is to create a central operating environment that coordinates work, holds the core relationships, manages permissions, and gives the team a reliable view of each client and process.

A simple design question provides a useful test: where should a team member go to understand the current state of a client, task, document, review, or exception? If the answer is “it depends”, the stack is not ready to support AI effectively.

Step 3: Build a single source of truth

A central system is valuable only when its data model is clear. The third step is to define the core nouns of the practice and the relationships between them. This is the foundation of the single source of truth.

For an advice business, those core nouns include clients, households, entities, advisers, portfolios, accounts, advice engagements, Statements of Advice, invoices, meeting notes, documents, approvals, obligations, exceptions, and remediation actions. Each item needs a unique identity, a clear owner, a defined lifecycle, appropriate access rules, and a history of material changes.

The relationships matter as much as the nouns.

The governing rule is this: if client information belongs in the central system, it must not also be maintained in an uncontrolled side spreadsheet. This does not prohibit reporting exports or specialist-system records. It means the practice must be able to identify the authoritative record, secure it, update it in one place, and trace material changes.

This structure also makes governance easier, producing exactly what ASIC expects. When core relationships are explicit, the practice can show what is associated with a client, which document version was approved, who made a decision, and what follow-up work remains outstanding. Without this structure, AI will retrieve only fragments of the story.

Step 4: Move the team into one home before adding anything else

Only after the central system and its data model are ready should the practice migrate teams. Move one department at a time, starting with the function carrying the greatest manual load or experiencing the most rework.

This is not simply a data-migration project but a change-management exercise. Each team needs views that match how it thinks about work. A client services officer may need a queue of missing information, documents awaiting filing, forthcoming review activity, and tasks blocked by a client response. An adviser may need a client-centric view of meetings, outstanding actions, portfolios, advice documents, and review dates. A compliance manager may need visibility of higher-risk cases, incomplete evidence, overdue reviews, and unresolved remediation work.

The immediate objective is adoption. People should be able to complete their normal work from the central environment without maintaining a parallel process elsewhere. This requires clean data, useful views, clear ownership, sensible access permissions, and active support during the transition.

Do not automate anything yet. Clean the data and make the central system the team’s home first.

Premature automation is understandable when a team is already overloaded, but automation built on inconsistent records or unclear responsibility simply repeats poor process more quickly. Establish a stable operating rhythm first: staff trust the data, leaders can see the work, and exceptions are recorded rather than hidden. Only then should automation be introduced.

Step 5: Add AI agents once the data is ready

Once the practice has one working home, reliable data, defined records, and appropriate permissions, AI can become useful by augmenting and expanding the decision making. It can retrieve information from the governed environment, prepare drafts, identify missing information, and support routine work without requiring staff to search across disconnected systems.

Early AI use cases should be narrow, high-value, and easy to supervise. The focus should be on reducing repetitive administrative effort and improving access to existing information, not on replacing accountable professional judgement.

Every agent should have a defined purpose, approved data scope, bounded actions, visible source traceability, an audit history, and a named human owner. Users should understand which sources informed an answer, what may be incomplete, and how to correct a record or escalate a concern.

The line between assistance and accountability must remain clear. An agent can retrieve, draft, classify, summarise, check, and route. Decisions with material client, professional, legal, or compliance consequences must remain within appropriately authorised and reviewable human processes.

Step 6: Automate the background so the foreground stays human

Once the central workflows are established and AI is operating inside clear boundaries, automate the background work that keeps the practice organised. This is where the operating system eliminates low-value coordination without removing visibility or control.

Examples include status updates, compliance reminder triggers, review scheduling, document filing, requests for missing information, task creation, approval routing, exception-expiry notices, and data-quality checks. These processes should run quietly in the background while making the need for human attention clear when a decision or exception arises.

Each automation should be observable and governed. The practice should be able to see what ran, what changed, what failed, and who owns the resulting exception. Background processes reduce administrative burden. They must not become invisible black boxes.

A useful by-product of working through this sequence is that AI governance develops naturally alongside it. Identification of the use cases, classifying data clearly, identifying the owner and where a human-in-the-loop is required, understanding what third-party vendor tools actually do, and establishing logging, validation, and audit trails are not separate governance tasks. They emerge from building the system correctly in the first place and allows producing effective Governance guidelines, policies, and procedures that regulators expect easy.

The sequence works because daily utility drives adoption

Systems change and software adoption is rarely a training problem. It is more often a daily-utility problem. Staff adopt systems that simplify their work, help them find the right information, and remove unnecessary follow-up. They resist systems that add another place to log activity or create obligations without making the work easier.

This sequence changes the experience of work before it adds intelligence. First, it maps reality. Then it removes duplicate tools, establishes one source of truth, and moves teams into a practical home. Only after the operating environment is stable does it add AI and background automation.

For a financial advice and other regulated businesses, this is the practical path to AI implementation: design the operating system, establish the data foundation, move the team into one home, then automate and augment with control. The result is not only a more modern technology stack. It is a more coherent, usable, and scalable practice. If your practice is ready to build this foundation, get in touch and we can help you design and implement each step.