With ASIC's breach reporting clock always running, Australian capital markets compliance teams gain most from agents that triage incidents, surveillance alerts and personal trading exceptions, and draft target market reviews. Officers keep every decision on what is reportable. ASIC's market integrity and licensing obligations, CPS 230 where APRA regulates the firm, and the Privacy Act frame the work.
What does capital markets compliance involve in Australia?
Licensees, from broking firms and market participants to fund managers, carry a general obligation to provide their services efficiently and fairly, with integrity, and to keep adequate compliance arrangements. Compliance teams turn that general duty into daily work: surveillance, monitoring tests, approvals and reporting.
Market participants watch order and trade flow for signs of insider trading and manipulation, and notify ASIC of suspicious activity. Analysts review alerts that the surveillance system generates, most of which turn out to be ordinary trading around news or index events.
Breach reporting is the other heavy load. Licensees must report certain breaches and suspected breaches to ASIC within a fixed period after they start investigating, so compliance must decide quickly whether an incident is reportable. Add design and distribution obligations for products sold to retail investors, personal account dealing, conflicts registers and marketing approvals, and the week is full.
Where can AI agents help?
- Surveillance alert triage (depth 2). The agent reads the alert, the order book around it, announcements and news timing, and the trader's history, then drafts a disposition. An analyst closes or escalates.
- Breach triage (depth 2). For each incident logged, the agent drafts an assessment against the reportable situation criteria, citing the facts and the rule, and calculates the reporting deadline from the date investigation began. The compliance officer decides.
- Personal trading checks (depth 1). The agent compares staff trade requests and broker statements with restricted and watch lists, holding periods and conflicts, and lists exceptions.
- Target market reviews (depth 2). The agent reads complaints, distribution data and sales outside the target market, and drafts the review triggers for the product governance team.
- Monitoring tests (depth 1 to 2). The agent runs sample-based tests against the compliance plan and drafts findings. Our playbook on how to run compliance monitoring tests with an AI agent sets out the method.
Breach triage is the most valuable of these in Australia because the reporting clock forces fast, consistent decisions. It is also the most sensitive, so certify it on the firm's own past incidents before live use.
What stays with compliance officers?
Whether an incident is a reportable situation, and whether to notify ASIC of suspicious trading, are judgements the licensee must make and stand behind. The agent's assessment is a draft with its reasoning shown; the decision, and the record of who made it, belong to a person.
Disciplinary outcomes for staff, such as findings that a trader breached the personal dealing policy, stay human for fairness and employment reasons. So does any decision to stop distributing a product outside its target market, which affects clients and distributors.
The agent informs and the officer decides. That is the stance behind AI compliance agents: second line, never the last word, and it matters more where the regulator expects the licensee to be able to explain its own judgement.
Which rules apply in Australia?
ASIC is the conduct and markets regulator. Its market integrity rules apply to market participants, including suspicious activity notification and record-keeping, and its licensing regime imposes the general obligations, breach reporting, and design and distribution obligations. APRA supervises banks, insurers and superannuation trustees; where a capital markets business sits inside an APRA-regulated entity, CPS 230 on operational risk management applies to the agent and its supplier.
The Privacy Act 1988, overseen by the OAIC, applies to personal information about clients and staff, including the communications an agent reviews. There is no AI-specific law; the government has published a voluntary AI safety standard. Our overview of how AI agents are regulated in Australia covers the rest.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What does a 90-day start look like?
In the first month, pick breach triage and assemble a set of past incidents with the decisions that were made. Replay the agent against them and study every case where it would have reached a different reportability conclusion.
In the second month, run personal trading checks at depth 1 alongside the existing process. These are rules-based and easy to verify, and they build confidence with front-office staff.
By the third month, decide whether breach triage is ready for depth 2 on live incidents, with every draft held for the compliance officer. If your firm is APRA-regulated, complete the CPS 230 service provider documentation first.
Questions people ask
Can an AI agent notify ASIC of suspicious trading?
It should not. It can draft the notification and assemble the evidence, but the decision to notify and the submission stay with the market participant's compliance staff.
Does CPS 230 apply to a fund manager's compliance agent?
Only if the firm is APRA-regulated, such as a superannuation trustee. Otherwise ASIC's licensing obligations on adequate resources and risk management are the relevant frame.
How does Australia compare with Nigeria for capital markets compliance?
Both rely on the securities regulator's rules rather than an AI law, but the market structure and reporting duties differ. See our brief on compliance agents in Nigerian capital markets.