ASIC Flagged Missed Reference Checks on the Advice Side. The Same Instrument Binds Your Credit Licence — and Gives Your Competitor 10 Business Days

What ASIC actually said, and who it was said to

The starting point matters, because it is easy to read a headline and conclude that brokers have been caught doing something wrong. That is not what happened, and it is worth being precise about it.

ASIC’s September 2026 financial advice update flagged that some licensees had been appointing representatives without completing the mandatory reference checks first. As reported by The Adviser and Australian Broker, the failures ASIC pointed to came through breach reports and concerned financial advisers. No finding was made against mortgage brokers, and no broker or brokerage was named. Treat it as a regulator repeating an obligation, not as an enforcement outcome.

The same update also flagged a professional indemnity insurance issue on the advice side. According to Insurance Business, ASIC identified 10 licensees that had reported holding less than $2 million in cover; nine of those had understated their cover through data entry errors, while the tenth had misunderstood its obligations, held a non-compliant policy, has since lodged a breach report and has begun winding up its licence. That detail is advice-specific and is included here only to show the character of the update: routine supervisory housekeeping, published so the industry can self-correct before ASIC has to.

So why should a mortgage broker care about a financial advice update? Because the reference checking obligation is not confined to advice. The protocol covers both populations under one instrument, and the broker half of it is the half that gets less airtime.

The instrument that reaches your credit licence

The current instrument is the ASIC Corporations and Credit (Reference Checking and Information Sharing Protocol) Instrument 2024/647. ASIC’s own guidance describes it as being made under section 912A of the Corporations Act 2001 and section 47 of the National Consumer Credit Protection Act 2009. That second limb is the one that matters to you: it is the general conduct obligations provision of the National Credit Act, which is the same architecture that carries your obligation to do all things necessary to engage in credit activities efficiently, honestly and fairly.

In other words, this is not a side rule bolted on to recruitment. It attaches to the same obligation set that underpins Best Interest Duty, your compliance arrangements and your responsible lending processes. ASIC’s guidance notes that non-compliance can be met with civil penalties, or with administrative action including licence suspension, cancellation, or the imposition of additional licence conditions.

Two dates are worth having in your head. The 2024 protocol commenced on 20 August 2024. A transitional period ran until 28 February 2025, during which licensees could use either the 2021 or the 2024 template forms. From 1 March 2025, the 2024 templates are the only compliant ones. If your brokerage built a reference pack in 2022 and has not touched it since, it is out of date by more than eighteen months.

Who you must ask, and why 12 months is the hinge

The core obligation on a recruiting licensee is to take reasonable steps to obtain a reference from a referee licensee before employing or authorising a prospective representative. ASIC’s guidance describes those reasonable steps as seeking the prospective representative’s written consent and, if consent is given, requesting a reference from the referee licensee.

The consent comes first and it is not optional wording. The protocol supplies template consent forms and template reference requests. Licensees may make minor formatting amendments, but they cannot alter the questions. This is a rare piece of Australian financial regulation where the actual document is prescribed rather than the outcome, which is helpful: there is no drafting judgement to get wrong.

Who counts as a mandatory referee turns on the candidate’s employment history, and the pivot is the twelve-month mark:

• If the candidate is currently employed or authorised, you must approach their current licensee.
• If they have been with that current licensee for less than 12 months, you must also approach their most recent former licensee from the past five years.
• If they are not currently employed or authorised, you must approach the most recent former licensee from the past five years — and if that stint also ran under 12 months, the next most recent one as well.
• If the candidate is a licensee in their own right, that licensee is the referee.

The twelve-month rule is the detail that most often gets missed in practice, and it is worth understanding why it exists. A short tenure is precisely the pattern a reference check is designed to illuminate. A broker who has moved twice in eighteen months generates two mandatory referees, not one. If your recruitment process assumes a single phone call to the current employer, it will under-collect on exactly the candidates the protocol is most concerned with.

Beyond the mandatory minimum, a recruiting licensee may also request references from other former licensees within the past five years, and from current or former mortgage intermediaries. Those are optional, and the other party is not obliged to answer.

The clock problem nobody plans for

Here is the part that belongs in your business plan rather than your compliance manual.

Under the protocol, a referee licensee must respond in writing within 10 business days, unless both licensees agree to a longer period, up to a maximum of 30 business days. You cannot authorise the broker until you have taken reasonable steps to obtain that reference. Which means the gate on your new hire writing their first loan is held by the business you are hiring them from.

Ten business days is a fortnight. Thirty is six weeks. In a channel where experienced brokers are recruited actively and where a competitor has an obvious commercial interest in a slow, minimal, strictly-compliant response, that window is not theoretical. It is the single most under-modelled delay in broker recruitment.

The practical response is sequencing, not shortcuts. Consent can be sought early in the process, as soon as a candidate is genuinely engaged. Requests can go out the same day consent is received rather than at the end of an interview round. And where a candidate has two mandatory referees, both requests should go out together rather than in series, because running them sequentially can double a fortnight into a month.

The sub-authorisation trap

This is the structural point that catches growing brokerages, and it deserves more attention than it gets.

Many broker businesses do not hold their own credit licence. They operate as a corporate credit representative of an aggregator’s licence, and they sub-authorise their individual brokers. ASIC’s guidance is explicit that where a corporate representative sub-authorises individuals — under section 916B of the Corporations Act or section 65 of the National Credit Act — reference checking must be conducted on each sub-authorised individual in accordance with the protocol.

The assumption that “the aggregator handles compliance” is a reasonable one for a lot of obligations. It is a dangerous one here, because the sub-authorisation is the act that triggers the check, and the sub-authorisation is performed by your business. If you have onboarded brokers under a corporate representative structure without a documented protocol-compliant reference process, that is the first conversation to have with your licensee this week — and it is a conversation worth having in writing.

You are also on the answering end

Almost every article written about reference checking treats the licensee as the recruiter. In practice, a brokerage of any size spends just as much time as the referee, because brokers leave as well as arrive.

The obligations running the other way are specific. On receiving a properly made request accompanied by the candidate’s written consent, a referee licensee must provide a written reference addressing all of the template questions. ASIC’s guidance says the responses must be complete, accurate, and based on documented, verified facts; must be objective, relevant and substantiable; and must cover both current circumstances and historical performance. If you cannot answer one of the template questions, you must explain in writing why not.

There is also a hard stop in the other direction: a referee licensee must not give a reference if the requesting licensee has not supplied a copy of the candidate’s written consent, or has notified you that consent has been withdrawn. Answering a friendly call from a competitor without a consent form on file is not a favour. It is the wrong side of the protocol.

The template questions cover four areas: background and licensing details including ASIC reference numbers; compliance audits, their results and any remedial action taken; conduct, including reportable situations lodged with ASIC concerning that individual, dishonesty, unprofessional conduct, gross incompetence or negligence, and conduct that would justify instant dismissal; and any unresolved inquiries or investigations on foot at the date of the reference.

Read that second category again, because it is the one with a hidden dependency. “Remedial action” is a broad concept in the protocol — ASIC’s guidance describes it as extending to additional training, increased monitoring, performance management, financial consequences, formal warnings, suspension, corrective disclosure and client compensation. If your brokerage manages broker performance informally, by conversation, you will struggle to answer that question accurately from documented, verified facts when the request lands and the fortnight starts running.

Qualified privilege only works inside the template

The obvious objection to all of this is defamation risk. A referee licensee is being asked to put adverse information about a former representative in writing, to a competitor, where it may affect that person’s livelihood.

The protocol addresses this directly. ASIC’s guidance states that the defence of qualified privilege applies when information is shared in accordance with the protocol. But that protection has edges, and they are worth knowing precisely. It attaches to the information the referee licensee is obliged to provide under the protocol, about the conduct of current or former representatives. ASIC’s guidance is clear that it does not extend to information provided outside the template questions, or to conduct falling outside the five-year period the reference is meant to cover.

That produces a counter-intuitive rule for anyone answering a request: the safest reference is the one that answers the template and stops. Volunteering extra context, adding colour about a departure, or reaching back seven years to an old matter takes you outside the questions you were obliged to answer, and outside the protection that came with them. Similarly, a recruiting licensee may ask for information beyond the template, but the other side is under no obligation to provide it, the privilege does not cover it, and any such request has to be handled consistently with the Australian Privacy Principles.

Information you do collect is also constrained in use. ASIC’s guidance limits it to assessing the candidate’s suitability, complying with the protocol, and meeting your general conduct obligations. It is not general-purpose intelligence about a competitor’s business.

Where aggregators now sit

The 2024 protocol added a layer that did not exist in 2021, and it is specific to this channel. Mortgage intermediaries — aggregators — are brought into the framework. A future mortgage intermediary may request a reference about a mortgage broker, with the broker’s written consent, to help decide whether to act as their intermediary. The referee licensees in that scenario are the broker’s current or former licensees, or their current or former mortgage intermediaries, over the past five years.

Note the verb: may. This is a permission rather than a duty, and the additional references it enables are optional ones. But the practical effect for an individual broker is that the aggregator you left is now a potential source of reference information about you, and the aggregator you are joining has a mechanism to ask. For principals running multi-broker businesses, that widens the set of people who can be asked about how your brokerage handled a departure.

Legal commentators, including Bright Law, have also noted that the 2024 protocol introduced a new question covering warnings or reprimands issued by ASIC and the Financial Services and Credit Panel, and that ASIC updated Information Sheet 257 to support implementation. If your process was built on the 2021 forms, that is another reason the pack needs replacing rather than editing.

What to review this week

None of this requires a project. It requires an hour and an honest look at four things.

The strategic read

It is tempting to file this under administration. A form, a signature, a fortnight’s wait. But the reference checking protocol is one of the few obligations that sits at the exact intersection of compliance and growth, and it behaves differently from the rest of your compliance stack in one important way: the timing is not within your control.

Every other obligation in a brokerage — file notes, preliminary assessments, BID documentation, credit guide delivery — you can resource, systematise and accelerate. This one has a counterparty, and the counterparty is usually a competitor with no commercial incentive to hurry. The brokerages that handle it well are not the ones with the best forms. They are the ones that start the sequence early, run mandatory requests in parallel, and have already decided who answers the phone when the request comes the other way.

ASIC’s reminder landed in an advice update. The obligation has been sitting in your credit licence since 2021, in its current form since August 2024, and without transitional relief since March 2025. The regulator has now said, in effect, that it is looking at whether the step is being taken before appointment. The cheapest moment to find a gap in your process is before someone else finds it in a breach report.