Much published CRM advice is written for US advisers. Australian firms work under different rules, so test any system against these six requirements.
1 · Ongoing fee arrangement consent
The rules changed under the Delivering Better Financial Outcomes reforms (the Treasury Laws Amendment (Delivering Better Financial Outcomes and Other Measures) Act 2024). From 10 January 2025, the annual fee disclosure statement was removed and renewal was streamlined into one written client consent, signed and dated. Arrangements already in force moved to the new rules from their first anniversary after that date.
Under ASIC’s current guidance, the renewal period starts 60 days before the arrangement’s anniversary, or an agreed “reference day”, and ends 150 days after it. If no written consent is in place by then, the arrangement terminates and no further fees can be charged under it. A consent to deduct fees from an account must state the account holder’s name, the account number and the fee amount or a reasonable estimate. These records must be kept for at least five years. ASIC INFO 286 ↗
“FDS” and “opt-in renewal” are terms from the old rules, described in ASIC’s earlier guidance (INFO 256 ↗). On the current rules, track the consent window instead.
What the software needs: each arrangement’s anniversary or reference day, the window dates, consent status, the deduction consent details, and the signed form kept with the client.
2 · File notes and record keeping
ASIC expects licensees to keep records of how personal advice was given. Its examples include the advice document, file notes and records of conversations, fact-finding documents and audio recordings. Records of personal advice must be kept for at least seven years after the advice is given. ASIC RG 175.333–175.342 ↗
What the software needs: file notes on the client and meeting, with author and date; documents filed with the right client; and history you can still find years later.
3 · SoA and RoA workflow
A Statement of Advice (SoA) is still the document for personal advice to a retail client. For further advice, where the client’s relevant circumstances and the basis of the advice have not significantly changed, a Record of Advice (RoA) can be kept instead. ASIC says it looks at the full client file, not an RoA in isolation. ASIC INFO 266 ↗
What is changing, and what is not. In March 2025, Treasury released draft legislation proposing to replace the SoA with a “client advice record”. On 19 August 2026, the Government said it would progress legislation for a wider reform package (Minister’s release ↗), and industry bodies report that streamlined statements of advice are part of it (FAAA DBFO hub ↗). As at October 2026, none of this has changed the law. The current SoA and RoA rules still apply.
What the software needs: each piece of advice tracked from request to SoA or RoA, with who prepared and checked it, every version kept, and templates you can change when the law does.
4 · Review cycles
Clients with ongoing advice usually have an annual review, on a different date from the fee consent window. Both need tracking.
What the software needs: review dates driven from the client record, and a record of the services delivered under each fee arrangement, so the firm can show what the client paid for.
5 · Investment platforms and data feeds
Client holdings usually sit with investment platforms, super funds and insurers, and many advice systems take data feeds from them.
What the software needs: feeds that are live today for the providers your clients use, a known update frequency and cost, and a plan for when a feed stops. Don’t assume a connection exists until you have seen it working.
6 · Privacy, security and data location
For organisations covered by the Privacy Act, Australian Privacy Principle 11 requires reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. OAIC: APP 11 ↗ The Act does not require data to be stored in Australia. But under APP 8, a firm that discloses personal information to an overseas recipient is generally accountable for how that recipient handles it. OAIC: APP 8 ↗
Cybersecurity is also a licensing matter: in 2022, the Federal Court found that AFS licensee RI Advice had failed to adequately manage its cybersecurity risks. ASIC 22-104MR ↗ And from 10 December 2026, privacy policies must explain where a computer program is used to make or inform decisions that significantly affect individuals. OAIC, 30 September 2026 ↗
What the software needs: a clear answer on where data, backups and AI processing sit; multi-factor sign-in; access by role; and a log of who changed what.