ASIC has no separate rulebook for AI agents. It applies the obligations licensees already carry: provide services efficiently and fairly, avoid misleading conduct, lend responsibly, keep adequate resources and risk management, and handle complaints properly. An agent's statements and actions are the licensee's, so each obligation must hold at the moment the agent acts.
What does ASIC expect, in plain words?
ASIC regulates conduct in Australian financial services, consumer credit and markets. Its approach to AI is that existing law is technology-neutral and applies in full, whether a person or a system does the work. ASIC has also said publicly that licensees' AI governance needs to keep pace with how fast they adopt AI.
In substance, the obligations that bite on agents are these. Licensees must provide their services efficiently and fairly, and with honesty. They must not engage in misleading or deceptive conduct. They must have adequate resources, including technological resources, and adequate risk management systems. Credit licensees must make reasonable inquiries and verifications before credit is provided, and must not provide credit that is unsuitable. Product issuers and distributors must design and distribute products to the right target market. Licensees must run internal dispute resolution that meets ASIC's standards.
For where ASIC sits among other supervisors, see who regulates AI agents in financial services.
Who does ASIC's regime apply to?
Holders of Australian financial services licences and Australian credit licences, their authorised representatives and credit representatives, and market participants. APRA-regulated banks and insurers fall under ASIC for conduct and under APRA for prudential matters, so they meet both sets of expectations.
The agent's vendor is not the licensee. The obligations stay with the firm that holds the licence and uses the agent, regardless of who built it.
What does it mean when the agent acts rather than assists?
An assistant that helps staff look things up raises few conduct issues on its own. An agent that talks to customers, recommends products, assesses loan applications or closes complaints performs licensed activity. Four boundaries need watching.
General versus personal advice. A product enquiry agent can drift from describing a product into considering the customer's circumstances and recommending one. Once it does, it may be giving personal advice, which brings duties the agent's design probably does not meet. Bound the capability so the agent refuses or hands over when a conversation turns personal.
Responsible lending. A credit agent that reads statements and calculates affordability is doing the inquiries and verification the law requires. The licensee must be able to show those were reasonable for each application, which means keeping the evidence the agent used and where it came from.
Statements to customers. If the agent tells a customer that a fee will be waived or a claim is covered, that statement is the licensee's. A wrong statement can be misleading conduct even if no person said it.
Complaints. An agent that triages or responds to complaints is part of internal dispute resolution and must meet the same standards on recognising complaints, timeliness and written responses.
Some actions cannot easily be undone once taken, a theme explored in irreversibility in public services; the same reasoning applies to credit decisions and claim denials.
How do you meet ASIC's expectations for agents?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Efficient, fair and honest services | Agent bounds set per capability; outcomes monitored for unfair patterns | Outcome reviews and remediation records |
| No misleading conduct | Agent statements grounded in sealed or signed sources; commitments held for a person | Verdict records showing source provenance and held commitments |
| Adequate technological resources | Agent certified on the licensee's own cases before taking on work | Certification results and renewal dates |
| Adequate risk management | Every action checked against role scope, certificate, sources, licensee limits and platform guardrails | Filed verdict per action, naming the deciding bound |
| Responsible lending inquiries | Credit agent records each document read and calculation made | Application-level evidence trail |
| Advice boundaries | Agent refuses or hands over when personal circumstances are raised | Refusal and hand-over records |
| Complaints handled properly | Complaint detection tested; responses reviewed before sending | Complaint register and review records |
What will ASIC or your compliance team ask?
- Which of your agents interact with retail customers, and what can each one do?
- How do you stop an agent from giving personal advice?
- Show us the inquiries the credit agent made on this application.
- What did the agent tell this customer, and what was it based on?
- How do you know the agent recognises a complaint when a customer does not use the word?
- Who in senior management oversees the agent programme, and what do they receive?
What does ASIC's regime not cover?
It does not deal with prudential and operational resilience requirements for APRA-regulated entities, which sit in APRA CPS 230. It does not cover privacy, which the OAIC oversees under the Privacy Act 1988. It does not reach the vendor directly. And it applies only in Australia: groups with EU operations face DORA, as set out in DORA and AI agents: what financial entities must do, and US groups face supervisors such as NYDFS, covered in NYDFS and AI agents in New York financial services. The voluntary AI safety standard published by the Australian government can help structure governance but does not replace any of these duties. For the full map, see AI agent regulation mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Does an agent need to be authorised like a representative?
No. Agents are not people and are not authorised. The licensee is responsible for the agent's conduct, and the staff who oversee it must be competent for the activity it supports.
Can an agent give general advice?
It can describe products and give general information if it is designed to stay there. The risk is drift into personal advice, so design for refusal and hand-over rather than relying on disclaimers.
Is a disclaimer that the agent "may make mistakes" enough?
No. A disclaimer does not cure misleading conduct or unfair treatment. Controls that stop wrong statements and hold commitments for a person are what reduce the risk.