AFSL Compliance Checklist: 8 Essential Controls

By Panbo Ye, CFP^®, FCPA, SMSF Specialist Advisor · Founder of Everglow · Updated 28 August 2026

An effective AFSL compliance checklist is a living control system, not a one-off document. The licence holder should map each obligation to an accountable owner, supporting evidence, review date and breach or remediation pathway, with reportable situations generally notified to ASIC within 30 calendar days of awareness.

A complaint or regulatory query can expose the weakness quickly. The policies may exist, but nobody can say who reviewed the relevant advice file, whether the licence condition register is current, or where the evidence supporting a decision is stored. A workable checklist should connect governance, licence conditions, competence, risk controls, conduct, disclosure, records, training, outsourced arrangements, regulatory reporting and remediation.

By Panbo Ye, CFP® | FCPA | SSA® | Founder, Everglow

Who this article is for: Australian financial services licence holders, responsible managers, compliance officers and advice practice leaders who need a practical operating framework rather than a static list of documents.

Currency note: This article reflects Australian rules, thresholds and regulator guidance current as at 08/2026.

1. Client identity verification and anti-money laundering screening

Client onboarding is a control point, not an administrative formality. An Australian Financial Services Licence (AFSL) holder should establish who the client is, understand the ownership and control structure where relevant, and retain evidence showing that the checks were completed before services commence.

For corporate clients and trusts, the file should identify beneficial owners and controllers, not merely the person who sends an email or signs an engagement letter. The Australian Transaction Reports and Analysis Centre (AUSTRAC) provides the broader regulatory framework for businesses covered by Australia's anti-money laundering and counter-terrorism financing regime. AFSL operators should confirm which obligations apply to their business rather than assuming that every client or service presents the same risk.

A Sydney medical practice offering investment advice to staff still needs a disciplined onboarding process for each person seeking personal financial advice. Familiarity with a client doesn't replace documented verification. Similarly, a Chinese enterprise establishing an Australian fund may need to organise translated and appropriately certified ownership documents before an application or engagement can progress, depending on the circumstances.

Make the file auditable

A central register should link each client to identity evidence, verification date, ownership information, screening results, risk classification and any enhanced due diligence. Access controls matter because these records contain sensitive personal and commercial information.

Useful operating controls include:

• Named onboarding owner: Assign responsibility for completing and approving verification, rather than leaving it to whoever opens the file.
• Screening evidence: Retain the search result, date, system used and reviewer's decision, including the reasoning for any escalation.
• Risk review rhythm: Reassess higher-risk relationships and material changes through a documented workflow. Don't treat the initial check as the end of monitoring.
• Exception pathway: Stop or escalate onboarding where documents are incomplete, ownership is unclear or screening produces a potential match.

Practical rule: If a reviewer can't reproduce the onboarding decision from the file, the control isn't complete.

For broader client onboarding context, see Everglow's guide to know-your-customer requirements.

2. Product Disclosure Statement preparation and distribution

A Product Disclosure Statement (PDS) is part of the client decision process for applicable retail financial products. The AFSL compliance checklist should therefore treat the PDS as controlled product documentation, with an owner, approval record, version history and distribution control.

The document should explain relevant features, risks, costs, benefits, significant conditions and complaint pathways in language the intended retail client can understand. A Brisbane financial planning practice launching a managed portfolio service, for example, should ensure that adviser fees, underlying product costs and other material costs are disclosed accurately before accepting clients. The exact content depends on the product and the applicable disclosure requirements.

A Sydney fund manager changing its investment allocation or process should not rely on an informal email to update disclosure. Product changes need to trigger a documented assessment of whether the PDS, Financial Services Guide, website material, application forms and client communications also need review.

Control the document lifecycle

ASIC's regulatory guidance on disclosure and product documentation should be considered alongside the product's legal and operational requirements. A PDS template can support consistency, but it doesn't replace a product-specific review. The person approving the PDS should be able to demonstrate that fees, risks, investment assumptions and distribution arrangements were checked.

• Change trigger: Link product, fee, investment strategy and key-person changes to a disclosure review.
• Version register: Record the approved version, approval date, effective date and locations where the document is distributed.
• Distribution evidence: Retain how and when the relevant document was provided or made available to the client.
• Accessibility review: Consider whether the format and language are suitable for the intended audience, including electronic access.

A PDS that is technically complete but difficult to understand can still create conduct risk. The better test is whether the disclosure gives the client a fair basis for deciding, not whether the file merely contains a document.

Everglow's explanation of a Product Disclosure Statement provides further educational context.

3. Financial adviser Statements of Advice and record-keeping

A Statement of Advice (SOA) should tell the story of the advice. It should connect the client's relevant circumstances and objectives to the recommendation, explain material costs and conflicts, and preserve the reasoning that supports the adviser's decision.

Dr Anya Sharma is a fictional example used to show how the rules work. She is not an Everglow client.

Dr Anya Sharma, a Sydney sole trader GP, might receive advice about consolidating superannuation accounts and diversifying into property. If that advice is provided, the file should capture her relevant income, objectives, time horizon, risk tolerance, existing arrangements and the reasons the recommendation may address those circumstances. If a mortgage broker referral fee is relevant, the file should disclose and explain it rather than leaving the client to infer the connection.

The same discipline applies when advice is given to a not-for-profit board about an investment policy. The advice record should address the organisation's objectives, liquidity needs, governance authority and risk considerations. A generic template can help, but it shouldn't become a substitute for analysis.

Preserve the reasoning, not just the final document

Keep the fact-find, meeting notes, research, modelling, product comparisons, approvals, client instructions and final SOA together in a controlled file. Version control and access logs can help show who prepared, reviewed or changed a document.

The retention period for SOAs and supporting records must be confirmed against the applicable law and record-keeping obligations. ASIC's general obligations framework under section 912A of the Corporations Act 2001 links advice quality to broader duties of competence, compliance and supervision. A missing working paper can make a sound recommendation difficult to defend.

The strongest advice file allows an independent reviewer to understand what the adviser knew, what the client wanted, what alternatives were considered and why the recommendation was selected.

Everglow's documentation standards resource may help practices consider how their evidence is organised.

4. Ongoing client advice and annual portfolio reviews

Ongoing advice creates an additional stewardship responsibility. Where a client continues to receive personal advice or portfolio management, the AFSL holder needs a process for identifying changed circumstances and assessing whether existing recommendations remain suitable.

Margaret and David in Wahroonga might have received advice to hold a diversified portfolio. At review, the adviser should ask about income needs, health, spending, liquidity, estate objectives, other assets and tolerance for loss. If circumstances haven't changed and no adjustment is recommended, that conclusion still needs a documented reason.

Wei, a new Sydney migrant professional, may be paying down a home loan while building investments. A change in salary, family responsibilities, lending commitments or residency circumstances could affect the assumptions behind earlier advice. The adviser should update the fact-find where material and explain whether the advice changes.

Build reviews into operations

A review calendar should identify upcoming client meetings, responsible advisers, outstanding information and overdue actions. Linking review dates to service agreements and billing processes can improve visibility, but commercial convenience shouldn't drive a review that isn't appropriate for the client.

• Pre-review information: Request updated financial and personal information before the meeting.
• Material-change prompts: Ask about employment, debt, dependants, health, goals, liquidity and risk tolerance.
• No-change rationale: Record why the prior advice remains appropriate if no recommendation changes.
• Escalation: Refer overdue reviews, unresolved client information or identified suitability concerns to the responsible manager.

The value of a review isn't measured by how many products are changed. It lies in demonstrating that the advice remains connected to the client's circumstances and that unresolved concerns are acted on.

5. Conflicts of interest management and disclosure

Section 912A requires an AFS licensee to maintain adequate arrangements for managing conflicts of interest. ASIC's RG 104 guidance on meeting the general obligations treats conflict management as a continuing control, not a disclosure exercise completed once at onboarding.

A conflict may arise through remuneration, ownership, referral arrangements, related entities, product relationships or personal interests. A Sydney advice practice that owns a related insurance agency should identify the relationship, assess how it could influence recommendations and explain the arrangement to affected clients. Disclosure alone may not be enough if the conflict can't be managed adequately.

Use a live register

A conflicts register should identify the conflict, affected service or client group, inherent risk, mitigation, disclosure method, approval and review date. A Brisbane mortgage broker who also provides financial advice may need to document how lender remuneration is considered and how recommendations remain client-focused.

Review the register when a new product, referral arrangement, ownership interest or remuneration model is introduced. A quarterly review can be useful where the business changes regularly, but the appropriate cadence depends on the firm's size, complexity and risk profile.

• Conflict owner: Assign a person responsible for monitoring each material conflict.
• Client disclosure: Link the register entry to the relevant FSG, SOA, engagement letter or other disclosure.
• Mitigation evidence: Record recusal, independent review, product restrictions or remuneration controls where used.
• Board or manager oversight: Escalate conflicts that can't be managed through ordinary controls.

Everglow's conflicts of interest policy resource offers related educational material.

6. Complaints handling and external dispute resolution registration

ASIC states that AFS licensees must maintain dispute resolution arrangements consisting of internal dispute resolution procedures and membership of the Australian Financial Complaints Authority (AFCA), where the relevant obligations apply. The complaints process should be visible, accessible and operational, with ownership that doesn't depend on the adviser whose conduct is being questioned.

A Sydney adviser may receive a complaint that liquidity risk in a structured product wasn't explained. The complaints officer should secure the relevant SOA, PDS, file notes, communications and approval records, then assess the issue independently. If the complaint indicates a possible breach, the matter should enter the breach and reportable-situation workflow rather than remain only in the complaints register.

Turn complaints into control information

A central register should record the date received, issue, affected service, owner, investigation steps, response, remediation and closure approval. It should distinguish dissatisfaction, service issues, suspected misconduct, financial loss and matters that may require escalation.

AFCA membership and internal procedures should be checked against the licence holder's current obligations and client base. The firm should also explain to clients how to complain and how an external pathway operates.

A complaint file should show not only how the firm answered the client, but also what the firm learned and what changed afterwards.

Monthly management reporting can identify recurring themes, while periodic trend analysis can reveal training, disclosure, product or supervision weaknesses. Remediation should be proportionate, documented and approved by an accountable decision-maker. For context on Australian financial services businesses, see Everglow's financial services companies guide.

7. Adviser competence, authorisation and ongoing training

An AFSL holder must take reasonable steps to ensure representatives comply with financial services laws. That obligation requires more than collecting certificates during recruitment. The licensee needs to know what each person is authorised to do, whether the person is competent for that role, how supervision operates and what evidence supports the conclusion.

ASIC's licensing framework also requires applicants to demonstrate organisational competence. RG 104 identifies competence, resources and risk management as part of the statutory architecture. A firm expanding into advice, credit, investment management or a more complex product area should reassess whether its responsible managers and representatives have the relevant experience and capability.

A Brisbane practice may maintain personnel files containing qualifications, memberships, experience, role scope, authorisation approvals, training records and competency assessments. A new adviser may require supervised work before independent authority is granted. The duration and structure should reflect the role and the firm's risk assessment, not an arbitrary standard.

Supervision needs evidence

A training policy should identify required learning, role-specific modules, assessment methods, completion tracking and escalation for overdue requirements. When a complaint or breach occurs, the licensee should assess whether competence, supervision or training contributed to the issue.

• Authorisation register: Record each representative's approved activities, products, limitations and approval date.
• Training matrix: Map training to role, service type, product risk and identified gaps.
• Assessment records: Retain results, reviewer comments and follow-up actions.
• Supervision evidence: Keep file reviews, coaching notes and escalation records where relevant.

Training attendance isn't proof of competence by itself. The stronger control combines learning with observation, file testing, feedback and documented decisions about authorisation.

8. Financial adviser remuneration transparency and best interests duty

Remuneration must be visible to the client and understandable to the reviewer. The AFSL compliance checklist should connect the best interests duty, fee disclosure, product costs, referral benefits and related-party arrangements to each advice process.

Wei may receive an advice proposal listing a $3,000 advice fee, an optional $1,500 annual fee, no commissions and no related-party benefits. The adviser should explain what the client receives, how each fee is calculated and whether indirect costs may apply. Figures in a client example must be current and accurately reflected in the engagement documents.

A Brisbane mortgage broker may receive lender remuneration. The file should identify the benefit, explain how lender options were considered and show how the recommendation was assessed against the client's circumstances. A medical professionals' practice using a fixed retainer may reduce some incentive concerns, but it still needs disclosure, a defined service and conflict controls.

Test the incentive, not just the wording

Review remuneration when products, referral partners, ownership interests or service models change. The compliance team should compare disclosed remuneration with invoices, payments, product information and related-party records.

A practical control register should assign an owner, retain evidence and set a review cadence. Escalate unexplained differences, missing disclosures or advice that does not show the client-focused reasoning.

• What is received: Identify direct fees, commissions, referral payments, non-cash benefits and related-party benefits.
• Who receives it: Record the adviser, licensee, related entity or external referrer.
• When is it disclosed: Match disclosure to the relevant advice and engagement stage.
• How is it managed: Record product selection controls, supervision, approval and client choice.

The best interests assessment should be evident in the advice file. A clear fee statement cannot cure advice that is unsuitable, poorly reasoned or inadequately supervised. Retain the disclosure, supporting calculations, approval records and review outcome so a later file test can trace the decision from remuneration through to recommendation.

AFSL Compliance, 8-Point Comparison

Turn the checklist into a living control register

The eight controls should sit inside one operating register, supported by the licence holder's governance framework. Each row should name the responsible role, control activity, evidence retained, review cadence, escalation trigger and suggested timeline. This approach converts section 912A obligations into observable actions and gives responsible managers a practical way to test whether systems work in practice.

The register should also include cross-cutting checks for licence conditions, representative registrations, organisational competence, financial resources, risk management, dispute resolution, compensation arrangements where relevant, outsourced providers, incident response and regulatory reporting. ASIC says licensees must notify the regulator within 30 business days of changes involving relevant providers or authorised representatives, while reportable situations are generally reported through the ASIC Regulatory Portal within 30 calendar days. These are workflow controls, not footnotes.

Offshore outsourcing deserves its own risk treatment within the register. If an external IT, administration or advice-support provider handles client information or a critical process, retain due diligence, contract approvals, access controls, service monitoring, incident escalation and contingency testing. ASIC's licensing liaison material highlights organisational structure, compliance arrangements and dispute-resolution detail, reinforcing the need to evidence oversight of outsourced functions.

Application and variation work also belongs in the governance view. ASIC's licensing materials may require a signed application, business description, organisational information and responsible-manager evidence. Recent licensing process commentary has highlighted more specific “people proofs”, meaning a firm may need to demonstrate readiness before authorisation or variation, not only after operations begin.

Worked example with Dr Anya Sharma

Dr Anya Sharma is a Sydney sole trader based in the suburb of Surry Hills. She is considering financial advice about consolidating three superannuation accounts and diversifying into property, with an early-retirement objective in 15 years and a moderate risk tolerance. The advice may involve a $2,500 flat fee and a mortgage broker referral fee, depending on the engagement and recommendation.

The AFSL register should assign an adviser to confirm Anya's identity and relevant circumstances, a responsible manager to oversee advice quality, and a compliance owner to check disclosure and conflict records. The file should retain the fact-find, research, SOA, fee disclosure, referral arrangement, approval evidence and any client instructions. If Anya's income, liabilities or objectives change, the review owner should reassess the advice rather than assume the original strategy remains suitable.

This example doesn't establish that the recommendation is appropriate. It shows how the decision context, dollars, evidence and escalation pathway can be connected without treating a checklist as a substitute for professional judgement.

An effective AFSL compliance checklist assigns ownership, preserves evidence, reviews controls and escalates issues promptly. It should operate as a control register that supports stewardship, not as a document that is filed away after licensing.

Frequently asked questions

What should an AFSL compliance checklist include?

It should cover the section 912A general obligations, licence conditions, representatives, competence, resources, risk management, client conduct, disclosure, complaints, conflicts, records, outsourcing, incident reporting and remediation. The checklist should assign an owner and identify the evidence needed to demonstrate that each control operates continuously.

How often should an AFSL compliance checklist be reviewed?

There isn't one universal cadence for every licensee. Review timing should reflect the firm's services, clients, products, structure and risk profile. Some triggers are event-based, such as a new product, representative change, outsourced provider, complaint, breach or licence variation. Fixed review dates should sit alongside those event triggers.

When must a reportable situation be notified to ASIC?

ASIC guidance states that AFS licensees generally report reportable situations within 30 calendar days of becoming aware that a reportable situation has arisen or may have arisen. The licence holder should maintain an escalation workflow, decision record and evidence trail, and should confirm the current reporting requirements for its circumstances.

Does a policy prove AFSL compliance?

No. A policy explains the intended process, but compliance also requires implementation, supervision, testing, evidence and remediation. A reviewer should be able to see who performed the control, when it was performed, what was found and what happened when an exception or failure arose.

How should offshore outsourcing appear in the checklist?

Treat each material outsourced function as a live risk item. Record due diligence, contract terms, access and data controls, service monitoring, incident notification, business continuity arrangements, review dates and exit options. Escalate failures affecting client information, critical systems, advice delivery or regulatory obligations.

What does ASIC expect from responsible managers?

ASIC expects applicants and licensees to demonstrate organisational competence appropriate to the proposed services and business structure. Responsible-manager evidence should be current, relevant and supported by the organisation's supervision, resources, risk controls and compliance arrangements. The exact evidence depends on the licence scope and the circumstances of the applicant.

An effective AFSL compliance checklist assigns ownership, preserves evidence, reviews controls and escalates issues promptly. The right approach depends on the licence holder's services, clients, structure and circumstances.

If you would like clarity on how these principles may apply to your own circumstances, contact Everglow on 1300 913 929 or email contact@everglow.au.

To book directly: Book a meeting with Panbo.

Suggested WordPress tags: AFSL compliance checklist, Australian Financial Services Licence, ASIC compliance, financial advice governance, responsible managers, AFCA complaints, outsourcing risk, financial services compliance