3DCL Insight, September–October 2026: legal and regulatory developments for boards, company secretaries and general counsel

From the Principal: who answers for what the market is told

Two themes ran through September and October. First, accountability for what the market and the board are told. The Rex proceedings produced a penalty and disqualification for the former executive chair and a win for the non-executive directors, and ASIC is now seeking leave to appeal that win. ASIC has also sued a former ASX 200 chief executive over an undisclosed conflict.

Second, the compliance basics are being enforced. Late financial reports, AML/CTF enrolment and cyber controls are all drawing penalties that are hard to explain to shareholders.

New ASX Listing Rules took effect on 21 October, putting a shareholder vote in the path of large scrip deals by ASX 300 companies. December brings a new privacy obligation for automated decisions, and several Treasury consultations close in November. The compliance calendar below sets out the dates.

David Walker, Principal

At a glance

Lead development: Rex — the executive chair pays, the non-executives win, for now

Act now Governance & directors' duties · For: Board / C-suite, general counsel

On 20 October 2026 the NSW Supreme Court disqualified Lim Kim Hai, former CEO and executive chair of Regional Express Holdings (Rex), for four years and ordered him to pay an $800,000 penalty. He had admitted breaching his duty of care and diligence (s 180(1)) over a profit forecast released to the ASX on 28 February 2023, and being involved in Rex's later continuous disclosure contraventions (s 674A(3)).

In June the Court found Rex breached its disclosure obligations from 14 April 2023, but that the three non-executive directors had not breached their duties. On 23 October ASIC announced it is seeking leave to appeal those findings, citing possible errors by the primary judge. It is not appealing the findings about Rex itself.

Why it matters. The executive who controlled the forecast bore the personal consequences. Until the appeal is decided, boards should not treat the first-instance result as a safe harbour for non-executive oversight of guidance. The case also shows that disclosure is continuous: the breach began weeks after the forecast, once it should have been updated.

Questions boards should be asking

1. Who owns our earnings guidance between releases, and how often is it tested against the latest management accounts?
2. Does our disclosure policy set a trigger for the board to consider updating or withdrawing guidance?
3. What did the non-executive directors receive before our last forecast, and could we show it to a regulator?
4. Are the executive chair's and the independent directors' roles on disclosure decisions clearly separated?
5. Does our D&O cover respond to ASIC civil penalty proceedings and the cost of an appeal?

Sources: ASIC 26-250MR, 20 October 2026 · ASIC 26-255MR, 23 October 2026

ASIC sues former Super Retail Group CEO over undisclosed conflict

Prepare Governance & directors' duties · For: Board / C-suite, general counsel

What happened. On 21 September 2026 ASIC commenced civil penalty proceedings against Anthony Heraghty, former CEO and managing director of Super Retail Group. ASIC alleges he failed to disclose and manage a conflict arising from an alleged undisclosed relationship with a senior executive, including by taking part in decisions on that executive's pay and redundancy, and that information given to the board and the market was misleading because it omitted the relationship (ss 180 and 1309(2)). These are allegations only.

Why it matters. ASIC says the case is about managing conflicts, not private relationships. It treats what the board is told as seriously as what the market is told: misleading the board is a contravention in its own right.

• Check that the conflicts policy covers personal relationships within reporting lines
• Make sure the chair, not the CEO, controls complaints that involve the CEO
• Ask management to confirm board papers on sensitive people matters are complete

Source: ASIC 26-223MR, 21 September 2026

Late financial reports: $4.16m in infringement notices for one group

Act now Financial reporting · For: Company secretary, board / C-suite

What happened. On 21 October 2026 ASIC announced that 21 Visy/Pratt group companies each paid a $198,000 infringement notice, $4.158 million in total, for allegedly lodging their 30 June 2025 financial reports after the 31 October 2025 deadline. ASIC's late-lodgement surveillance has produced 48 notices totalling more than $9.3 million since August 2025.

Why it matters. Penalties apply entity by entity, so groups with many reporting subsidiaries face them in multiples. Financial reporting is an ASIC enforcement priority. For 30 June balancers, this year's deadline is 31 October 2026.

• Confirm today that every reporting entity in the group will lodge by 31 October
• Keep a register of which subsidiaries are large proprietary companies, and test it yearly
• Check any relief instruments or deeds of cross guarantee the group relies on

Source: ASIC 26-252MR, 21 October 2026

Treasury proposes higher large proprietary company thresholds

Prepare Company secretarial · For: Company secretary, general counsel

What happened. Treasury has released a draft regulation implementing the 2026–27 Budget measure. It would lift the consolidated revenue threshold for a large proprietary company from $50 million to $100 million, and gross assets from $25 million to $50 million. A company is large if it meets two of the three tests. Consultation closes on 2 November 2026.

Why it matters. The thresholds decide which proprietary companies prepare audited financial reports and sustainability reports. Some mid-sized groups could fall out of both, but only once the regulation is made and commences.

• Model each proprietary entity against the proposed thresholds
• Keep FY26 lodgement plans unchanged: the current thresholds still apply
• Consider a submission by 2 November if commencement timing matters

Source: Treasury consultation c2026-811281

Automated decision transparency starts 10 December 2026

Act now Privacy, cyber & AI · For: General counsel, board / C-suite

What happened. From 10 December 2026, an APP entity that uses a computer program, with personal information, to make or substantially inform decisions that could significantly affect an individual's rights or interests must say so in its privacy policy (APP 1.7–1.9), including the kinds of information used and decisions made. The OAIC published a fact sheet, flowchart and updated APP 1 guidelines on 30 September.

Why it matters. This is the first AI-specific disclosure duty in Australian privacy law. Credit, pricing, eligibility, recruitment, fraud and claims tools are likely in scope, and a silent policy is easy for a regulator to spot.

• Inventory automated and AI-assisted decision tools that use personal information
• Run each tool through the OAIC flowchart and record the result
• Update the privacy policy before 10 December and table it at board or risk committee

Source: OAIC statement, 30 September 2026

Cyber: larger breaches, and another penalty for weak controls

Prepare Privacy, cyber & AI · For: Board / C-suite, general counsel

What happened. The OAIC received 667 notifiable data breach reports for January to June 2026. Breaches affecting 500,000 to 1,000,000 people rose from none to three, and criminal attacks remain the main cause. Separately, on 14 October the NSW Supreme Court ordered Fortnum Private Wealth to pay $1.35 million after it admitted failing to manage cyber risk across its advice network, including a lack of cyber expertise and risk systems.

Why it matters. Regulators now ask whether the organisation had the people, policy and oversight to manage cyber risk, not only what happened in the breach. The Privacy Commissioner is also pressing data minimisation.

• Ask who holds cyber expertise in management and how the board oversees it
• Set retention periods for personal information, and enforce them
• Test the response plan against a breach affecting more than 500,000 people

Sources: OAIC, 26 October 2026 · ASIC 26-244MR, 14 October 2026

AUSTRAC issues first infringement notices for failing to enrol

Act now AML/CTF & financial crime · For: General counsel, company secretary

What happened. On 30 September 2026 AUSTRAC began issuing infringement notices to real estate, accounting and jewellery businesses it believes did not enrol within 28 days of providing a designated service: $21,840 for companies and $4,368 for individuals, which can accrue daily. The regime expanded on 1 July 2026 to legal, accounting, real estate, conveyancing, trust and company service providers and precious metal dealers.

Why it matters. Groups that own businesses in newly regulated sectors must check enrolment. Every company should expect advisers to ask for more customer due diligence, including beneficial ownership.

• Check whether any group entity provides a designated service
• Prepare a standard beneficial ownership and KYC pack
• Allow time for due diligence in transaction timetables

Source: AUSTRAC media release, 30 September 2026

ACCC flags private equity roll-ups under the new merger regime

Prepare M&A & competition · For: Board / C-suite, general counsel

What happened. Reporting on the first nine months of mandatory merger control on 15 October 2026, ACCC Chair Gina Cass-Gottlieb said acquisition rates are high in medical, dental and veterinary services, aged care, hospitality and supermarkets, often by private equity or investment funds rolling up smaller businesses. The few deals not approved or approved with conditions include supermarkets, petrol stations and insurance.

The ACCC says it is now seeing deals it previously would not have known about.

Why it matters. Serial acquisitions are now visible and will be assessed together. Buy-and-build strategies in consumer services should expect questions about cumulative effect, not just the deal at hand. For the mechanics of the regime, see our guide to how ACCC merger review works in 2026.

• Build notification analysis into the acquisition pipeline, not deal by deal
• Keep internal documents on deal rationale accurate and measured
• Allow for ACCC review periods in completion timetables and long-stop dates

Source: ACCC media release, 15 October 2026

Supplier admits cartel conduct; $12m penalty to be proposed

Watch Competition & consumer · For: General counsel

What happened. On 26 October 2026 the ACCC announced that Perfection Fresh had admitted fixing the prices of broccoli, cauliflower and iceberg lettuce supplied to ALDI in NSW on eleven occasions in 2019–2020. The parties will jointly propose a $12 million penalty and continued implementation of a competition compliance program. The Court has not yet decided whether to make those orders; the case against other suppliers and individuals continues.

Why it matters. Cartel risk arises in supply relationships too, including coordination between suppliers to one large customer. Compliance programs are increasingly part of court orders.

• Refresh competition training for sales and procurement teams
• Review how pricing information is shared with competitors who are also suppliers or customers

Source: ACCC media release, 26 October 2026

ASIC reviews first sustainability reports; ACCC issues emissions claims guide

Prepare ESG & sustainability reporting · For: Board / C-suite, company secretary

What happened. ASIC's Report 839 (21 September 2026) reviewed 40 sustainability reports for years ending 31 December 2025. It found marked improvement on voluntary reporting, but room to improve forward-looking and judgement-based disclosures on strategy, metrics and targets, and set out eight action items. ASIC will review Group 1 reports for 30 June 2026 year-ends next. On 20 October the ACCC issued guidance on emissions claims to consumers, covering purchased credits, double counting and claims about the future.

Why it matters. Two regulators, applying different laws, now review climate statements. What the annual report says about transition plans and what marketing says about emissions must be consistent and supported.

• Map the REP 839 action items against the FY26 sustainability report
• Review consumer-facing emissions and carbon neutral claims against the ACCC guide
• Give one owner responsibility for consistency between the two

Sources: ASIC 26-222MR, 21 September 2026 · ACCC, 20 October 2026

Digital asset rules, ASIC priorities and FAR changes

Watch Financial services & markets · For: General counsel, board / C-suite

What happened. ASIC's Consultation Paper 392 (15 October 2026) proposes standards and guidance for digital asset and tokenised custody platforms under the Digital Assets Framework Act, which commences on 8 April 2027; submissions close 27 November. On 30 September ASIC published its first annual supervisory letters for banking, super, insurance and markets. Treasury is consulting until 20 November on lifting the FAR enhanced notification threshold for banks from $20 billion to $30 billion.

Why it matters. Businesses holding or dealing in digital assets, including existing AFS licensees, may need new or varied licences before April 2027.

• Check whether any part of the business holds digital tokens for clients
• Have regulated entities' boards consider their sector's ASIC supervisory letter

Sources: ASIC 26-245MR · ASIC 26-232MR · Treasury c2026-813364

New Listing Rules on dilutive acquisitions in force from 21 October

Act now Capital markets & ASX · For: Board / C-suite, company secretary, general counsel

What happened. ASX's amendments on shareholder approval of dilutive acquisitions and changes in admission status took effect on 21 October 2026 (ASX Notice 1204.26.10). S&P/ASX 300 entities now face a 25% shareholder approval threshold when issuing scrip for a regulated takeover or merger under Listing Rule 7.2 exceptions 6 and 7. A higher threshold, up to 100%, can be approved by ordinary resolution under new Listing Rule 7.3B for up to three years. Moving to an ASX Foreign Exempt Listing now needs an ordinary resolution, and the issue period after a reverse takeover approval rises from 6 to 12 months.

Why it matters. Large scrip-funded deals may now need a shareholder vote. Deals announced before 21 October generally stay under the old rules, unless materially changed.

• ASX 300 boards: consider seeking an LR 7.3B approval at the next AGM
• Build a possible shareholder vote into scrip bid and merger timetables
• Check pending delistings or admission changes against the transitional rules

Source: ASX recent rule amendments; consultation response, 18 September 2026

Fifth edition Governance Principles: final recommendation due by end of 2026

Watch Corporate governance · For: Board / C-suite, company secretary

What happened. Consultation on the draft 5th edition of the ASX Corporate Governance Principles and Recommendations closed on 14 September 2026. ASX says the draft refines rather than redesigns the framework, keeping the eight Principles and "if not, why not", simplifying remuneration and addressing board composition. A recommendation on final changes is due to the ASX Board by the end of 2026; no start date has been set.

Why it matters. Changes flow straight into the annual corporate governance statement and board charters.

• Compare charters and the governance statement against the draft
• Watch for the final edition and its first reporting period

Source: ASX consultations; media release, 21 July 2026

The month ahead: actions by role

Board / C-suite

1. Ask how earnings guidance is tested between releases (Rex)
2. Review the conflicts policy for personal relationships (Super Retail)
3. Note the privacy policy update for automated decisions before 10 December

Company secretary

1. Confirm every reporting entity lodges by 31 October 2026
2. Model proprietary entities against the proposed new thresholds
3. Prepare a standard KYC and beneficial ownership pack

General counsel

1. Complete the automated decision-making inventory and policy update
2. Check AML/CTF enrolment for any regulated group business
3. Review emissions claims against the ACCC guide

Compliance calendar: the next three months

All dates 2026. Confirm deadlines that apply to your entities against the primary source.

On the horizon: what to watch over the next six to twelve months

How 3DCL can help

If any of these developments affects your organisation, we can help you work out what it means and what to do next: governance and disclosure, capital markets, M&A and foreign investment, AML/CTF, and privacy and cyber.