Compliance reference · ASIC RG 277
ASIC Regulatory Guide 277 sets the expectations for how AFS and credit licensees should run remediation programs. The framework has six phases. Most programs falter at the seam between two of them, where evidence stops travelling cleanly. This page is the plain-English version.
What it actually requires
RG 277 frames consumer remediation as an end-to-end pipeline. Each phase produces evidence the next phase depends on. A program that loses the chain at any seam is the program that struggles in regulator review.
Recognise that a remediation event may be required. Triggers come from complaints, file reviews, breach reporting, internal audit, or whistleblower disclosures. A licensee that misses the trigger is the licensee that ends up explaining themselves to ASIC.
Define which consumers were affected, the period in scope, and the categories of conduct. Scoping decisions need documented evidence behind them — assumptions, exclusions, and the rationale for both. ASIC expects scope to be set with reference to the consumer, not to the cost of remediation.
Decide how the remediation will be calculated — fee refunds, foregone earnings, opportunity cost, interest. The methodology needs to be defensible, tested, and consistently applied. Document the methodology before running it on a single account.
Run the methodology across the cohort with full chain of custody on inputs and outputs. Each consumer outcome traces back to the source data and the documented methodology. Manual spreadsheet calculations are where most programs lose ASIC.
Notify each affected consumer in plain English, explain the issue, the remediation, and how the amount was calculated. Make the payment, retain the evidence. RG 277 has specific expectations for tone, timing, and what good looks like.
Report to ASIC at the cadence required, close out the program with evidence of completeness, and feed lessons learned into the control environment. A program that closed without changing how the firm operates was a refund exercise, not a remediation.
Four failure modes that show up in nearly every program review.
Complaint files in one system, breach reports in another, audit findings in a third, file reviews in a shared drive. No single feed surfaces the cross-pattern that says "remediation event."
You learn about the issue from the regulator, not internally.
Months of legal review before the cohort is agreed. By the time scope is locked, the evidence has aged, customer contact details have moved, and the methodology assumptions need re-validating.
Your program ages while the issue keeps compounding.
Methodology lives in a model owned by one person. Each consumer outcome is the product of a chain of formulas no audit team can defend. ASIC asks for the workings; you produce screenshots.
Your defence rests on a single Excel file.
Letters drift from the template. Some consumers get the wrong amount. Some get reached on the wrong channel. Each lapse is itself a remediation issue, and the program quietly grows new tails.
You remediate the remediation.
How BackPro maps to RG 277
BackPro is the source of record for every phase, with the audit chain that connects them. Each row below maps an RG 277 phase to the part of the platform that does the work.
RG 277 phase
Complaint files, breach reports, file reviews, audit findings, and whistleblower disclosures are ingested into a single source of record. The Risk Correlator agent surfaces cross-domain patterns that suggest a remediation event before any single channel raises it formally. Findings carry severity, dedup keys, and source attribution.
RG 277 phase
Cohort criteria, exclusions, and rationale live in the platform with full edit history. Each scoping assumption links to the evidence that supports it. Versioning means the scope at any point in time is reconstructible — useful when ASIC asks why a decision was made on a particular date.
RG 277 phase
Methodology documents are versioned, signed, and chained. Test runs against representative samples are recorded with results. The audit log captures who approved what, when, and against which test outputs.
RG 277 phase
Calculations run as deterministic templates with explicit inputs, outputs, and intermediate workings. Each consumer outcome has a source trail back to the underlying transactions and the methodology in force at the time. No screenshots, no detached spreadsheets.
RG 277 phase
Letter templates are generated against the methodology and the consumer record. Tone, timing, and channel are configured once and applied consistently. Each communication links to the calculation that backs it. Payment evidence ties to the consumer outcome.
RG 277 phase
ASIC reports are generated from the source of record, not assembled from spreadsheets. The chain of evidence — identification, scoping, methodology, calculation, communication, payment — is exportable as a single audit package. Closure documentation links lessons to control changes.
Three roles carry RG 277 accountability more than any others.
What licensees ask before bringing AI inside a remediation program.
One walkthrough covers architecture, audit chain, deployment model, and how the platform maps to each RG 277 phase.