---
title: FMA 72-Hour Cyber Notification for FAPs | NSP
description: The FMA proposes giving financial advice providers 72 hours to report cyber incidents. What it means for NZ advisers and brokers, and how to prepare.
---

[NSP Insights for NZ Businesses](https://blog.nsp.co.nz)

# [FMA 72-Hour Cyber Notification for FAPs | NSP](https://blog.nsp.co.nz/fma-72-hour-cyber-incident-notification-financial-advice-providers-nz)

 Written by [NSP Marketing](https://blog.nsp.co.nz/author/nsp-marketing) | Nov 1, 2026, 9:00:01 PM

# FMA 72-Hour Notification for FAPs

On 8 October 2026, the Financial Markets Authority opened consultation on a single, consolidated set of standard conditions for every type of market services licence it issues. Most of the coverage has focused on the housekeeping: one rulebook in place of several, aligned wording, and five conditions removed altogether.

For financial advice providers, one change matters more than the rest. According to Dentons' analysis of the consultation, FAPs would move into the same notification window other licensees already work to. They would have 72 hours, down from the current ten working days, to notify the FMA of any event that materially affects the operational resilience of their critical technology systems.

That is a significant shortening. Ten working days is two calendar weeks. Seventy-two hours is three days, and the clock does not stop for weekends or public holidays.

The proposal arrives at a time when the cyber threat to NZ businesses handling client money and personal financial information is rising. The NCSC handled 162 incidents linked to criminal or financially motivated actors in 2025/26, an 18% increase on the previous year. On 15 October, the Reserve Bank and the FMA jointly set out their expectations for how regulated entities manage cyber risk from frontier AI, with a clear message about getting the basics right.

For a large financial institution with a security team, 72 hours is a process. For a ten-person advice practice whose IT is handled by an external provider during business hours, it is a much harder ask. This post covers what the FMA is proposing, who it applies to, when the clock starts, and what FAPs should have in place before the new conditions take effect.

## What Is the FMA Proposing?

The FMA currently imposes a separate set of standard conditions on each type of market services licence under Part 6 of the Financial Markets Conduct Act 2013. For businesses that hold more than one licence, that creates overlap, slightly different wording for the same obligation, and more complexity than the rules require.

The consultation proposes to fix that in four ways.

**One rulebook -** All standard conditions would be consolidated into a single document, with a matrix showing which conditions apply to which licence type. Some conditions would continue to apply only to specific services.

**Five conditions removed -** MinterEllison Ruddwatts reported that the FMA proposes to revoke the existing standard conditions on compliance, governance arrangements, notification of material changes, professional indemnity insurance for independent trustees, and skills and expertise.

**Aligned wording -** Conditions that cover the same ground across different licences would be reworded consistently, with updated explanatory notes.

**A six-month lead time -** Once the conditions are finalised and formally notified, the FMA proposes a six-month implementation period to give licensees time to update their policies, processes, systems and controls.

### Where the 72-hour change comes in

The business continuity and technology systems condition is one of the conditions being aligned. Under the current rules, the FMA's own 2024 submissions report confirms the split: financial advice providers have up to ten working days to notify the FMA of a material event affecting their critical technology systems, while other licence types have 72 hours.

Dentons' analysis of the 2026 consultation is that FAPs would be brought into line with everyone else. The law firm has also questioned the change, arguing that a business dealing with a serious incident should be focused on fixing it, and that a short notification deadline draws management time away from recovery.

That debate is part of what the consultation is for. For FAPs, the practical point is that the direction of travel is clear. The FMA has applied 72 hours to financial institutions, managed investment scheme managers, DIMS providers, peer-to-peer lenders and crowdfunding platforms, and the 2026 proposal would extend it to advice providers.

### The timeline

Submissions close on 11 December 2026. If the FMA finalises the conditions in 2027 and allows the proposed six months to implement, the new notification window would likely apply from mid to late 2027. That is an estimate. The FMA has not yet set a commencement date.

## Who Does the 72-Hour Rule Apply To?

The change affects businesses that hold a financial advice provider licence from the FMA. Under the financial advice regime that came into force in March 2021, any business giving regulated financial advice to retail clients needs to operate under a FAP licence, either its own or one held by the business it works through.

In practice, that covers a wide range of NZ SMEs:

- Financial planning and investment advice practices
- Mortgage advice firms
- Insurance advisers and brokers that hold a FAP licence and give regulated advice to retail clients
- KiwiSaver and retirement advice businesses
- Accounting practices and other professional services firms that hold a FAP licence for their advice services

Many of these businesses are small. A typical FAP might have a handful of advisers, a practice manager and administrative staff, with IT handled by an external provider. Business continuity and technology systems was, for many small advice businesses, their first formal cyber security obligation when FAP standard conditions were introduced in 2020.

### Businesses already on 72 hours

For some licensees, nothing changes. Licensed financial institutions under the Conduct of Financial Institutions regime already notify within 72 hours. So do managers of registered schemes, DIMS providers, derivative issuers, peer-to-peer lending providers and crowdfunding service providers, under the standard condition the FMA introduced in July 2024.

The proposal brings advice providers into the same framework. For a business that holds both a FAP licence and another market services licence, the consolidated rulebook also removes the current situation where the same incident carries two different notification deadlines.

### What about businesses that don't hold a licence directly?

Advisers who work under another business's FAP licence aren't the licence holder, but their systems and conduct still sit within that licensee's obligations. If an adviser's laptop or mailbox is compromised, the licence holder is the one with the notification obligation. That makes adviser devices, email accounts and home working arrangements part of the licensee's critical technology picture.

## What Counts as an Event That Materially Affects Critical Technology Systems?

The notification obligation turns on two phrases: critical technology systems, and events that materially affect their operational resilience. Neither is defined by a fixed list, which means each FAP needs to apply them to its own business.

### Critical technology systems

The FMA's wording describes critical technology systems as those that, if disrupted, would materially affect the licensee's ability to provide its service or meet its other licence obligations. Operational resilience means preserving the confidentiality, integrity and availability of information and systems.

For a small advice business, that usually includes:

- **Client relationship and practice management systems -** Where client files, fact finds, statements of advice and compliance records are held
- **Email -** The main channel for client communication, document exchange and, often, payment and settlement instructions
- **Document storage -** SharePoint, OneDrive or a file server holding client records
- **Third-party platforms -** Investment platforms, KiwiSaver providers, insurer and lender portals that advisers log into on clients' behalf
- **Adviser devices -** Laptops and phones that hold or access client information, including those used from home

### Events that are likely to be material

The judgement depends on the business, but some events will almost always meet the threshold for an advice practice:

- Ransomware that encrypts the client file system or practice management platform
- An adviser or administrator mailbox accessed by an attacker, particularly where client documents or payment instructions pass through it
- Client personal or financial information copied out of the business's systems
- An outage of a core platform that stops advisers delivering the service for a sustained period
- A breach at a third-party provider that exposes the business's client data or access credentials

### Events that need a judgement call

Other events sit in the middle. A phishing email that a staff member reports without clicking is unlikely to be material. A phishing email that captured an adviser's password, followed by a login from an unfamiliar location, may be. A short Microsoft 365 outage affecting everyone is different from one that only affects your business because of a configuration change.

The point is that the materiality decision has to be made quickly, by someone with authority, using criteria agreed in advance. With 72 hours on the clock, a business that starts debating what "material" means after an incident has already lost a day.

## When Does the 72-Hour Clock Start?

Under the existing 72-hour condition, the FMA's wording is that a material event must be notified as soon as possible, and no later than 72 hours after discovering it. The clock runs from discovery, which may be well after an attacker first got in.

That detail cuts both ways. A business is not penalised for an intrusion it had no way of knowing about. But it also means the window starts the moment someone in the business becomes aware, whether that is a Tuesday morning or 5pm on Christmas Eve.

### Ten working days versus 72 hours

The difference is easiest to see over a holiday period. Take an incident discovered at 9am on Thursday 24 December. (The new conditions won't be in force this Christmas, but the comparison shows how the change plays out.)

| Notification window | When the deadline falls |
| --- | --- |
| Ten working days (current FAP rule) | Well into January, once weekends and public holidays are excluded |
| 72 hours (proposed) | 9am on Sunday 27 December |

Under the current rule, a FAP could assess the incident after the break, with its IT provider and advisers back at work. Under the proposed rule, the assessment, the materiality decision and the notification would all need to happen over Christmas Day and the weekend that follows.

### Discovery depends on detection

The harder question is how quickly a small advice business would discover a serious incident in the first place. Many of the incidents that hit professional services firms are quiet by design. An attacker who has access to an adviser's mailbox has every reason to avoid being noticed while they wait for a large transaction to intercept.

As we covered in our post on [how long your business was exposed before anyone noticed](https://blog.nsp.co.nz/how-long-was-your-business-exposed-breach-detection-nz), many businesses only find out about an intrusion weeks after it began, often because a client, a bank or a third party tells them. A FAP in that position wouldn't breach the 72-hour rule, because the clock hadn't started. It would still be facing a regulator, affected clients and an insurer with an incident that had been running unnoticed for weeks.

The 72-hour rule sets the deadline for reporting. How quickly a business can detect an incident determines how much damage is done before that deadline even begins.

## Why Is 72 Hours Hard for a Small Advice Business?

Large financial institutions meet 72-hour notification obligations with security operations teams, incident response retainers, legal counsel on call and documented escalation paths. Most FAPs have none of these in-house. The obligation would be the same, but the resources behind it are very different.

Four practical constraints stand out.

**No one whose job is security -** In a small practice, security usually sits with the practice manager, a principal adviser or the external IT provider. None of them is watching for incidents full-time, and the first sign of a problem may be a client calling to ask about an unusual email.

**IT support contracts built around business hours -** Many SME IT support arrangements cover helpdesk requests during the working week. They may not include after-hours incident response, forensic investigation or the kind of rapid assessment a notification decision depends on. A FAP that discovers an incident on a Friday evening needs to know who it calls, and whether that call is covered.

**Dependence on third parties -** Advice businesses rely heavily on platforms they don't control: investment platforms, insurer and lender portals, CRM and practice management software, Microsoft 365. An incident at a provider can materially affect the FAP's own service, and the FAP may depend on that provider for the information it needs to assess and report the event.

**No agreed decision-maker -** The notification requires someone to decide that an event is material and to make the call to the FMA. In a small business, the people most likely to make that decision are also the people serving clients, managing the incident and fielding calls. Without a named decision-maker and a deputy, the decision tends to drift.

None of this is unusual. It is how most small professional services businesses are set up. The issue is that a 72-hour window leaves very little time to work these questions out once an incident is underway.

## What Should FAPs Have in Place Before the Rule Takes Effect?

The proposed six-month implementation period gives FAPs time to prepare, and the work is mostly about decisions and documentation, with a small number of technical controls behind them. A FAP that has the following in place would be well positioned to meet a 72-hour window.

**A business continuity plan that reflects how the business runs today -** Standard condition 5 already requires FAPs to have a business continuity plan. Many were written in 2020 or 2021 and haven't been revisited since. A plan written before the move to Microsoft 365, the new CRM or the current platform providers is describing a business that no longer exists.

**An incident response plan with an FMA notification step -** The plan should set out who is contacted first, who assesses the incident, who decides whether it is material, and who notifies the FMA. It should include after-hours contact details for the IT provider, the cyber insurer's incident line and any legal adviser. The FMA has developed a notification template for operational incidents, and the plan should reference it.

**Written materiality criteria -** A short, agreed list of the events the business treats as material, the events it treats as non-material, and how it handles anything in between. Deciding this in advance turns a difficult judgement under pressure into a quick check against criteria the business has already agreed.

**A named decision-maker and deputy -** One person with the authority to make the materiality call and approve the notification, and a second who can act when the first is unavailable. Over a holiday period, that deputy matters.

**Monitoring that detects incidents quickly -** The 72-hour clock only helps a business that finds out about incidents promptly. Continuous monitoring of identity, email and endpoint activity is what turns a compromised mailbox into an alert within minutes instead of a client complaint weeks later. That is the role of [Managed Detection and Response](https://nsp.co.nz/cybersecurity/managed-detection-response/): analysts watching for suspicious activity around the clock and acting on it as it happens.

**Clarity with third-party providers -** For each critical platform and provider, the business should know how that provider will notify it of an incident, how quickly, and what information it will receive. Where that isn't clear in the contract, it is worth asking now.

**A tested plan -** A plan that has never been tested is a set of assumptions. A [tabletop exercise](https://nsp.co.nz/tabletop-exercise/) walks the people involved through a realistic scenario, such as ransomware discovered on a Friday evening before a long weekend, and shows where the plan holds up and where it doesn't.

### Who owns this work?

For most FAPs, whether these elements exist comes down to ownership. [Our post on what a vCISO is and whether your business needs one](https://blog.nsp.co.nz/what-is-a-vciso-and-does-your-business-need-one) covers how smaller businesses access senior security leadership without hiring a full-time security executive. Incident planning, materiality criteria and regulatory readiness are exactly the kind of work a [vCISO](https://nsp.co.nz/cybersecurity/vciso-strategy-services/) is designed to lead.

## How Does This Fit With the Privacy Act and Other Obligations?

The FMA notification is rarely the only one. A single cyber incident at an advice business can trigger several obligations at once, each with its own threshold, timeframe and audience.

| Who | What triggers it | Timeframe |
| --- | --- | --- |
| FMA | An event that materially affects the operational resilience of critical technology systems | Currently ten working days for FAPs; 72 hours proposed |
| Office of the Privacy Commissioner | A privacy breach that has caused, or is likely to cause, serious harm | As soon as practicable |
| Affected clients | The same notifiable privacy breach | As soon as practicable |
| Cyber insurer | Set by the policy wording, usually any actual or suspected incident | Usually as early as possible |

The triggers overlap but aren't identical. A ransomware attack that takes the CRM offline for two days may be material to the FMA without any personal information leaving the business. A compromised mailbox that exposes client statements of advice may be a notifiable privacy breach whether or not the business's systems were disrupted. Both could also be claims events for the insurer.

For FAPs with clients or data offshore, the picture can extend further. Aon warned on 21 October that a single cyber incident can trigger reporting obligations across several jurisdictions, as Asia-Pacific regulators tighten breach notification requirements and increase penalties.

### One plan, several notifications

The practical response is to plan for all of these together. The incident response plan should identify each notification the business may need to make, who makes it, and in what order. In most cases, the insurer's incident line is the first call, because many policies provide access to incident response, legal and forensic support that helps with every notification that follows.

### The regulators' broader message

The 72-hour proposal sits alongside wider regulatory attention on cyber resilience. On 15 October, the RBNZ and FMA outlined their supervisory expectations on cyber risks from frontier AI, delivered at an industry roundtable co-hosted with DPMC and the NCSC. The message from RBNZ Assistant Governor Angus McGregor was that regulated entities should maintain strong foundational cyber controls and security posture, focusing on getting the basics right.

For advice providers, those basics and the notification rule are connected. A business with sound controls, clear ownership and active monitoring is less likely to have a material incident, and far better placed to report one within 72 hours if it does.

## Should Your Business Make a Submission?

The consultation is open to anyone, and the FMA is actively seeking feedback from licensees. Submissions close on 11 December 2026. The consultation paper, the proposed standard conditions and the submission form are available on the [FMA's consultation page](https://www.fma.govt.nz/business/focus-areas/consultation/standard-conditions-for-fma-market-services-licences/).

FAPs with a view on the notification window have a reason to take part. When the FMA consulted on the 72-hour condition for other licensees in 2023, its regulatory impact statement acknowledged submissions seeking a longer reporting period and more guidance on what counts as material. It kept 72 hours, and it developed a notification template to help licensees report incidents.

Useful points for an advice provider to raise could include:

- How a small practice without in-house security staff would assess materiality within the window
- Whether further guidance or worked examples of material events would help
- How the obligation applies where the incident occurs at a third-party platform or provider
- How notification works over extended public holiday periods

Whether or not a business makes a submission, the consultation is a useful prompt. The six-month implementation period is time to prepare, and the preparation is the same whichever way the final wording lands.

## Frequently Asked Questions

**When will the 72-hour rule apply to financial advice providers?**

No commencement date has been set. The FMA's consultation closes on 11 December 2026, and the FMA has proposed a six-month implementation period once the new standard conditions are finalised and formally notified. On that timeline, the change would most likely take effect in mid to late 2027. Until then, FAPs remain under the current ten working day window.

**Does the 72-hour rule apply to insurance brokers?**

It applies to insurance brokers and advisers that hold a financial advice provider licence, or that give regulated advice under another business's FAP licence. Brokers giving regulated financial advice to retail clients generally operate under a FAP licence. Brokers unsure of their position should check their licence details with the FMA or their compliance adviser.

**What if we're not sure whether an incident is material?**

The business needs to make a judgement within the notification window, so it helps to agree materiality criteria in advance. Events that disrupt client service, expose client information or compromise core systems such as email or the CRM are likely to be material. Where the business is genuinely uncertain, notifying the FMA early is generally safer than missing the deadline.

**Does a phishing email count as a material event?**

A phishing email that is reported and deleted without anyone clicking is unlikely to be material. A phishing email that captures an adviser's credentials and leads to unauthorised access to a mailbox or client system may well be. The test is the impact on the confidentiality, integrity or availability of critical technology systems, rather than the method of attack.

**Who in the business should notify the FMA?**

The obligation sits with the licence holder, so the business should name a decision-maker with authority to judge materiality and approve the notification, plus a deputy for when that person is unavailable. In a small FAP, this is often the principal or the person responsible for compliance. The incident response plan should record both names and their after-hours contact details.

**How is FMA notification different from Privacy Act notification?**

FMA notification is triggered by an event that materially affects critical technology systems, whether or not personal information is involved. Privacy Act notification is triggered by a privacy breach that has caused or is likely to cause serious harm, whether or not systems were disrupted. A single incident can trigger both, and each notification needs to be assessed separately.

## Is Your Business Ready for a 72-Hour Window?

The FMA's proposal gives FAPs a clear direction and a reasonable amount of time to prepare. The businesses that will find the change straightforward are the ones that know who makes the call, have agreed what counts as material, and find out about incidents quickly.

NSP's vCISO service gives smaller advice businesses access to senior security leadership to build exactly that: an incident response plan with the FMA step built in, materiality criteria, provider arrangements and a tested process. Paired with 24/7 monitoring through our Managed Detection and Response service, it means incidents are found early and handled by people who know what the business needs to report.

[**Talk to our team about vCISO →**](https://go.nsp.co.nz/vciso-services-nz)

Or call us directly: **0508 010 101**

### Related Reading

- [What Is a vCISO and Does Your Business Need One?](https://blog.nsp.co.nz/what-is-a-vciso-and-does-your-business-need-one)
- [How Long Was Your Business Exposed Before Anyone Noticed?](https://blog.nsp.co.nz/how-long-was-your-business-exposed-breach-detection-nz)
- [vCISO Strategy Services - NSP](https://nsp.co.nz/cybersecurity/vciso-strategy-services/)
- [Managed Detection and Response - NSP](https://nsp.co.nz/cybersecurity/managed-detection-response/)
- [Tabletop Exercise - NSP](https://nsp.co.nz/tabletop-exercise/)

[View full post](https://blog.nsp.co.nz/fma-72-hour-cyber-incident-notification-financial-advice-providers-nz)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "NSP Marketing"
  },
  "dateModified" : "2026-11-01T21:00:01.012Z",
  "datePublished" : "2026-11-01T21:00:01Z",
  "headline" : "FMA 72-Hour Cyber Notification for FAPs | NSP",
  "image" : {
    "@type" : "ImageObject",
    "height" : 944,
    "url" : "https://6376769.fs1.hubspotusercontent-ap1.net/hubfs/6376769/After-hours%20financial%20office.png",
    "width" : 1680
  },
  "mainEntityOfPage" : "https://blog.nsp.co.nz/fma-72-hour-cyber-incident-notification-financial-advice-providers-nz",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "NSP Blog "
  }
}
```