The notification clock starts with the AFS licence detail change

An AFS licence detail change starts the relevant notification period when the change occurs. ASIC says an AFS licensee must notify ASIC of changes within 10 business days of the change occurring.

That is the practical point in ASIC’s guidance published on 24 August 2026. The guidance identifies the Regulatory Portal transaction for notifying ASIC of changes to licence details. The timing rule, however, is tied to when the change occurs.

It is reasonable for a practice to think of licence administration as beginning with the form. Someone notices a change, opens the portal, completes the transaction and keeps a record. If the portal has not been opened, the task can feel as though it has not started.

The relevant question is different: when did the licence detail change occur? A practice that waits for a regular compliance meeting, a monthly administration cycle or a convenient filing task may be working from the wrong date.

Consider a change to the principal business address. The practice response should identify when the address changed, who is responsible for the notification and how completion will be confirmed within the applicable period. The same approach can be applied to other details that are handled in different parts of the business.

The form is the visible end

ASIC’s transaction covers more than a change to the name of the licensee or a principal business address. The listed details include whether the licensee uses a website to carry on its financial services business, changes to a website address, the principal website address, the address for service of notices, business names, the ongoing contact person and the details of the external dispute resolution scheme.

The guidance also covers obtaining an Australian business number and changing the name of the licensee, although the name change option is not available to Australian registered body corporates.

These details create a practice design issue. A practice might assign website changes to technology or marketing, address changes to operations, and contact person changes to governance or people and culture. Each internal task can be completed while the related licence notification remains unassigned.

That is why the suggested control should follow the business event. A practice can record the nature of the change, the date it occurred, the person responsible for assessing the notification and the date the Regulatory Portal transaction was completed.

The CPD item has a different clock

A design risk is treating every item in the transaction as subject to the same deadline. ASIC’s guidance identifies a separate rule for advising or changing the licensee’s continuing professional development year.

For advising or changing the licensee’s CPD year, ASIC says the change must be advised within 30 business days from the day the licence is granted or the day the CPD year is to begin if it is a change.

The 30 business day rule is therefore the separate timing rule for the CPD year. ASIC’s guidance gives the 10 business day rule for other changes, with the CPD year as the exception to that timeframe.

For a practice, the safer design is to classify the event before calculating the due date. The internal record can identify whether the matter is an AFS licence detail change or a CPD year change, record the date that starts the relevant period and assign a person who is accountable for completion.

Those are suggested internal controls, not additional requirements stated in ASIC’s guidance. Their purpose is to prevent a single workflow from applying the wrong timing rule to different types of change.

Put a control around the event

The guidance establishes the timing rule. The following is a suggested practice response.

• Map the internal events that can produce a notification. That could include changes handled by operations, people and culture, technology, marketing, governance and compliance. The aim is to make the regulatory consequence visible when the business change is approved or implemented.
• Give each event an owner. The owner does not necessarily have to complete the Regulatory Portal transaction personally, but someone should be responsible for deciding whether notification is required, identifying the applicable timing rule and confirming completion.
• Retain an internal record. It could show the nature of the change, the date it occurred, the person who assessed it, the applicable timing rule and the notification completed through the Regulatory Portal. This is a proposed recordkeeping control, rather than a claim that ASIC requires a particular register or audit trail.
• Test the process against changes that are easy to overlook. A practice could test a website update, a new ongoing contact person or a change to the address for service of notices, as well as an obvious address change. The objective is to check whether the process captures the event wherever it occurs in the business.

The test is whether the practice sees the change

The Regulatory Portal is where the transaction is made, but ASIC’s timing rule runs from the change occurring.

ASIC’s guidance gives licensees a 10 business day rule for changes, while the CPD year has its separate 30 business day rule. The practical response is for each practice to connect internal change events to an owner, the relevant date and the applicable timing rule before anyone needs to open the Regulatory Portal.¹