ASIC reviews offshore outsourcing in fund administration
Written By
ASIC's review of offshore outsourcing found that responsible entities manage the associated risks to very different standards. ASIC also reported that, across its reviews of responsible entities and advice licensees, some entities had no framework in place. The regulator's position is clear: a responsible entity can outsource a function, but it cannot outsource its obligations. For funds that rely on offshore providers for administration, registry or transaction processing, that makes governance, oversight and control the central questions.
What ASIC reviewed
On 10 October 2025, ASIC published Review of offshore outsourcing – Responsible entities, covering the use of offshore service providers by responsible entities of registered managed investment schemes.
The review ran in two phases:
- Phase one: 30 responsible entities were examined, and 17 had outsourced at least one business function to an offshore provider in the preceding two financial years.
- Phase two: ASIC looked more closely at 10 firms that outsource functions such as fund administration, investment processes, custody and transaction processing.
Across both phases, the responsible entities involved were responsible for 392 funds and roughly $191 billion in assets under management. ASIC also noted that responsible entities are more likely to outsource business functions as their assets grow.
What responsible entities remain accountable for
ASIC's message is that outsourcing changes who performs a task, not who answers for it. As Commissioner Alan Kirkland put it, firms can outsource services but "they cannot outsource their fundamental obligations".
In practice, a responsible entity must:
- Select providers with due skill and care.
- Monitor performance on an ongoing basis.
- Act on breaches of service level agreements or of the responsible entity's general obligations.
ASIC found the sophistication of these arrangements varied significantly. Four responsible entities had dedicated governance boards, risk teams and provider registers. Seven covered offshore providers under a broader outsourcing or vendor management framework.
Risks ASIC identified with offshore service providers
The review highlighted several areas of concern, and ASIC noted that risk rises with the importance of the outsourced function:
| Risk | What it means in practice |
|---|---|
| Loss of control | Less direct oversight of key tasks and of the people performing them |
| Operational disruption | Exposure to infrastructure that may be less reliable than local alternatives |
| Data & technology | Risks to the protection of client information, including where a provider subject to foreign laws must follow directions that conflict with Australian law |
| Cyber security | Difficulty detecting and managing cyber incidents and data breaches |
ASIC also flagged the possibility of conflicting obligations where an offshore provider is subject to foreign laws. The paper sets out considerations and good practice for responsible entities developing, modifying or reviewing offshore arrangements.
How in-house fund administration addresses these risks
Offshore outsourcing has benefits. It also adds risks that a responsible entity must then govern. Any evaluation should therefore weigh an in-house model alongside it.
An in-house approach, supported by the right systems and processes, speaks directly to the concerns in ASIC's review:
- Control: Operations, people and data stay within your own organisation, so there are fewer handovers to supervise.
- Service quality: You set the standard, observe it first-hand and correct problems without working through a third party.
- Security: Keeping data under your own security controls narrows the cyber and data protection questions ASIC raised.
In-house administration does not remove accountability. It does mean the people responsible for a function are the ones overseeing it, which is simpler to evidence to a regulator.
Where Titanium fits in
In-house administration only works when the technology supports it. Unitise is Titanium's funds management software, built for responsible entities, fund managers and investment managers.
It covers fund administration, registry, onboarding and day-to-day fund operations in one platform from one provider. That lets you run critical functions securely and locally, without stitching together separate systems or handing core tasks to an external party. Titanium is ISO 27001 certified for information security.
If you are weighing offshore outsourcing against an in-house model, a demonstration of Unitise will show how it works against your own operating requirements. Book a free demo to see how it would support your funds.