Australian Securities and Investments Commission v BSF Solutions Pty Ltd (Penalty) [2026] FCA 450

This decision sits at the end of a substantial enforcement process. ASIC had already succeeded in obtaining declarations of contravention in 2024 against BSF Solutions Pty Ltd, Cigno Australia Pty Ltd and two individuals, Brenton James Harrison and Mark Swanepoel. The Full Court then dismissed the respondents' appeal in July 2025. The 2026 judgment therefore deals with penalty, not primary liability.

The commercial arrangement was a small-loan model described as the No Upfront Charge Loan Model. BSF advanced the loans. Cigno marketed the loans, processed applications and managed repayments. Consumers entered into a loan agreement with BSF and a separate services agreement with Cigno. The services agreement covered the practical administration of the loan relationship, including application processing, repayment handling, default monitoring, repayment schedule changes, statements, reminders, consumer communications and remittance of funds to BSF.

The judgment glossary records that Cigno entered into 150,112 services agreements during the relevant period. It also records that, under a Loan Management Facilitation Agreement dated 20 July 2022, BSF charged Cigno an assessment fee of $19.99 for each loan application BSF received, whether or not the application was approved. That level of operational detail matters because the Court was looking at the real commercial structure, not just the labels used in the paperwork.

The reasons also explain that this model did not appear in a vacuum. The respondents had been involved in earlier lending structures, including the Teleloans model and later models associated with Cigno Pty Ltd, GSSF and BHF. Earlier court decisions had, at least for a time, treated similar structures as lawful. Later developments, including ASIC's 2019 product intervention order and the Full Court's 2022 decision in the BHF proceeding, changed the legal landscape. That history became important at penalty because it cut both ways. It showed experience with these kinds of models, but it also showed that the respondents had sought legal advice and made changes in response to legal developments.

Once declarations of contravention had been made under s 166, the Court had power under s 167(2) of the National Consumer Credit Protection Act 2009 (Cth) to order the respondents to pay pecuniary penalties that the Court considered appropriate, subject to the statutory maximum. The orders expressly state that the penalties were imposed under s 167(2).

The Court also recorded that ASIC sought injunctions under s 177 of the Credit Act restraining Mr Harrison and Mr Swanepoel from engaging in credit activity or being involved in a business engaged in credit activity. However, the final detail of that relief is not fully clear from the text available here, so any firm statement about the injunction outcome should be checked against the complete judgment.

The judgment sets out the statutory penalty factors in s 167(3). In deciding the appropriate penalty, the Court had to take into account all relevant matters, including: the nature and extent of the contravention, the nature and extent of any loss or damage suffered because of the contravention, the circumstances in which the contravention took place, and whether the person had previously been found by a court to have engaged in similar conduct. Those factors are not exhaustive, and the Court also referred to broader civil penalty principles developed in other cases.

Jackman J emphasised orthodox penalty principles. The purpose of civil penalties is deterrence, both specific and general. Penalties are not about retribution. They must be high enough that contravention is not treated as an acceptable cost of doing business, but they must also avoid oppressive severity. The Court also discussed maximum penalties, course of conduct and totality. In large-scale cases involving many transactions, the theoretical maximum can become so large that it is not numerically useful, although it still indicates how seriously Parliament treats the conduct.

One of the most commercially useful parts of the judgment is the Court's treatment of legal advice. The catchwords and reasons show that the Court directly considered whether obtaining and implementing legal advice could be a mitigating factor in determining penalty. The answer was not a simple yes or no. The Court accepted that the respondents had sought legal advice and made necessary changes to trade legally according to that advice. That was relevant context and part of the factual picture.

But the Court did not treat legal advice as a shield. Substantial penalties were still imposed. That means legal advice may help explain how a business got to a particular structure and may be relevant to whether conduct was deliberate or reckless, but it does not erase contraventions once they have been found. For business readers, that is an important distinction. Advice can be a factor in mitigation, but it is not a substitute for a lawful model.

The Court also accepted ASIC's submission that Mr Harrison and Mr Swanepoel had a long history of operating lending models that were not designed to be, or were designed not to be, regulated by the legislative regime. However, Jackman J was careful to note that there were elements of that history which favoured the respondents. Earlier Federal Court decisions had found related models lawful, including the Teleloans decision in 2015 and the first instance BHF decision in 2021. The Full Court's 2022 BHF decision then changed the position by holding that a key fee was, in commercial substance and practical commercial sense, a charge for providing credit.

This balanced treatment matters. The Court did not reduce the case to a simple narrative of blatant disregard. Instead, it recognised a more complicated commercial and legal history while still concluding that significant penalties were appropriate. That is often how penalty cases work in practice. A business may have some contextual points in its favour and still face serious sanctions.

Another important feature was remediation. The catchwords expressly refer to the respondents having failed to remediate consumers, and the reasons treat that as relevant to penalty. The available text does not set out every detail of what remediation ASIC said should have occurred, but the point is clear enough for business readers: once a contravention issue emerges, the Court may look closely at whether affected customers were compensated or otherwise put right. A business that focuses only on defending the legal characterisation of its model, while doing little for customers, may worsen its penalty position.

In practical terms, remediation is not just a public relations exercise. It can become part of the Court's assessment of seriousness, compliance culture and future deterrence. Businesses should therefore think about refunds, fee reversals, contract changes, customer communications and governance records as soon as a credible breach issue is identified.

The Court ordered BSF Solutions Pty Ltd to pay a pecuniary penalty of $3,000,000, Cigno Australia Pty Ltd to pay $3,000,000, Brenton James Harrison to pay $500,000 and Mark Swanepoel to pay $500,000. The orders required payment to the Commonwealth within 28 days. Costs were not finally determined in the orders. Instead, the Court set a timetable for affidavits and written submissions on costs unless the parties agreed the appropriate order.

The Court also ordered that the originating application otherwise be dismissed. Because ASIC had sought injunctions, and because the available text does not fully spell out the final treatment of that relief, the complete judgment should be checked before drawing a final conclusion about whether any injunctions were granted, refused or dealt with in another way.

On the reasoning, Jackman J said the theoretical maximum penalties calculated by ASIC were not themselves useful in arriving at the appropriate total penalties in this case, although they did help show the seriousness with which Parliament views contraventions of ss 29(1) and 32(1). ASIC's calculations produced extremely large figures because of the number of contraventions alleged across many transactions. The Court accepted that in a case of this scale, those maximums can become practically meaningless as a direct numerical guide.

The Court also rejected the respondents' argument that ASIC's calculations should be confined to the original relevant period ending when proceedings were commenced on 3 October 2023. Jackman J held that contraventions between 3 October 2023 and 24 May 2024 were consequential on the contraventions occurring during the relevant period, and that the precondition for a pecuniary penalty order under s 167(2) had been satisfied by the liability judgment. That aspect of the reasoning is important because it shows that exposure may continue to grow after proceedings begin if the conduct continues or its consequences continue.

First, this case is a warning against relying on separate contracts and separate entities to solve a consumer credit problem. Here, one company advanced the loans and another company handled the customer-facing services and charged fees under a separate agreement. That structure did not prevent serious enforcement consequences. If your business model depends on splitting the lender from the service provider, you should assess the whole arrangement together, including all fees, all operational steps and all customer communications.

Second, the case shows that directors and senior decision-makers can face personal penalties. The Court imposed penalties on Mr Harrison and Mr Swanepoel as well as on the companies. For founders and executives, that means governance around product design, legal sign-off, compliance escalation and response planning is not just a corporate issue. It is also a personal risk issue.

Third, legal advice helps only up to a point. The Court considered the fact that advice had been obtained and that changes were made to trade according to that advice. But once contraventions were established, those matters did not stop the Court from imposing substantial penalties. Businesses should therefore treat legal advice as part of an ongoing compliance process, not as a one-off immunity document. Advice should be tested against the actual customer experience, the commercial substance of the arrangement and later legal developments.

Fourth, remediation matters. The Court treated the failure to remediate consumers as relevant to penalty. If a business identifies a credible risk that customers have been charged unlawfully or exposed to an unlawful model, it should consider remediation early. That may include refunds, fee reversals, contract amendments, customer notices and board-level oversight. Waiting until the penalty hearing is too late.

Finally, this case shows how courts think about penalty in large-scale regulatory matters. The Court focused on deterrence, not punishment for its own sake. It recognised that very large statutory maximums may be of limited practical use where there are many contraventions, but it still treated those maximums as a sign of legislative seriousness. Businesses should not take comfort from the fact that a maximum figure looks unrealistic. The real question is whether the final penalty will be high enough to sting and to deter future conduct.

For businesses operating in or near consumer finance, the safest reading of this case is that product design, legal structuring, compliance governance and remediation planning all need to work together. A model that appears technically segmented may still be judged by its commercial substance, and a business that keeps operating after the risk becomes clear may significantly increase its exposure.

The key procedural sequence is clear. The liability judgment was delivered on 24 May 2024. The Full Court dismissed the appeal on 10 July 2025. Evidence rulings for the penalty hearing were delivered on 3 March 2026. The penalty hearing took place on 8 April 2026, and judgment was delivered on 17 April 2026.

This page explains the penalty decision using the Court's published reasons and orders. It is suitable for public reading, but the final detail of the injunction position and some remediation detail should be checked in the complete judgment if those points become central to any advice or publication.