The corporate watchdog has raised alarms over the offshore outsourcing practices of financial services advice licensees after a review found weaknesses that could expose consumers to harm.

“We are concerned that most of the advice licensees reviewed did not have adequate arrangements in place for the assessment, appointment and ongoing monitoring of offshore outsourced services used by their representatives,” the Australian Securities and Investments Commission said.

“Instead, they rely on the representative to ensure risks are managed appropriately.”

Among the 10 licensees reviewed, more than 300 representatives used offshore service providers at some point over the past two years.

The review also included six intermediary businesses providing offshore services to advice licensees.

Insurance application and client communications are among the functions provided by these six groups.

The commission says advice licenses and their representatives that are using intermediaries “appear to rely on the representations made by those businesses in relation to cybersecurity, without independent assessment or verification”.

ASIC reminds advice licensees to be aware of dangers from using offshore service providers, including the risk of operational disruption that can harm consumers and issues related to the detection and management of data breaches or cyber incidents.

It also flags the protection of sensitive client information, as foreign jurisdictions may have laws that “conflict” with Australia’s legal framework.

ASIC commissioner Alan Kirkland says financial services licensees are ultimately responsible for their operations, even when they outsource offshore services directly or through an intermediary.

“Advice licensees … can outsource services but they cannot outsource their fundamental obligations,” he said. “Financial services firms cannot drop their guard. The risks can be exacerbated when outsourced functions are not supervised adequately, particularly if they are outsourced internationally.”