How to MacGyver your financial advice website

Yes. Under the Corporations Act 2001 and ASIC’s guidance on advertising financial services, fee information published on a website must not be misleading or deceptive. This includes presenting fee ranges in a way that understates the likely total cost, omits material conditions, or implies a fixed price where the actual fee depends on individual circumstances. A statement like “fees from $X” may be technically accurate but misleading if the vast majority of clients pay significantly more.

Where fees are disclosed publicly, they should be accompanied by enough context for a prospective client to form a realistic expectation. This does not mean publishing a full fee schedule, but it does mean being honest about what the range represents and noting that individual fees are confirmed following an initial consultation. Separately, your Financial Services Guide (FSG) remains the primary disclosure document for fees and must be kept current and consistent with what is presented on your website. Seek your own legal or compliance advice on how fee transparency obligations apply to your specific business model.

Live chat introduces two risks that are worth managing carefully. The first is advice risk. If a staff member responding to a live chat answers a question about a specific financial product, strategy, or client situation, that response may constitute personal financial product advice under the Corporations Act 2001, regardless of the channel through which it was delivered. Staff operating live chat should be briefed on what they can and cannot discuss, and responses should be limited to logistical or general information unless the person responding holds the appropriate authorisation.

The second risk is a data and record-keeping risk. Live chat conversations that contain personal information or financial discussions are business records. Your licensee’s record-keeping obligations under the Corporations Act apply. Confirm with your web provider or chat tool vendor whether conversations are logged, where that data is stored, and whether you can export transcripts for your compliance records. Many chat platforms store data on overseas servers, which triggers Australian Privacy Principle 8 obligations. Seek your own legal or compliance advice before implementing live chat.

Educational content published on a financial advice website is subject to ASIC’s regulatory framework for advertising financial services, set out in Regulatory Guide 234. Where blog content explains a financial concept, strategy, or product without reference to a specific person’s circumstances, it may constitute general advice. If it does, a General Advice Warning must be prominently displayed, stating that the advice does not take into account the reader’s personal objectives, financial situation, or needs.

The warning cannot be buried in a footer or presented in a way that a reasonable person would miss it. Content that explicitly or implicitly recommends a course of action without that warning may breach the misleading and deceptive conduct provisions of the Corporations Act. Before publishing educational content regularly, establish a review process with your compliance manager or licensee to ensure each article is assessed and appropriately disclaimed. This is general information only. Seek your own legal or compliance advice.

Whether you host feedback forms on your own website or use a third-party platform, the same Privacy Act 1988 obligations apply to the personal information collected. What changes is where the data sits and who controls it. A form built into your own WordPress site using a plugin like Gravity Forms stores submissions in your own website database, which you control directly. A third-party platform like Typeform stores that data on its own servers, which may be located overseas. Under Australian Privacy Principle 8, if you disclose personal information to an overseas recipient, you are required to take reasonable steps to ensure it will be handled consistently with Australian privacy standards, and you remain accountable if it is not.

In practice, this means reviewing the third-party platform’s data processing terms, confirming where data is stored, and disclosing the use of that platform in your Privacy Policy. Hosting forms on your own site gives you more direct control but does not eliminate the obligation to secure that data adequately. Seek your own legal or compliance advice on your specific setup.

Plugins, third-party form tools, and live chat integrations are common entry points for website breaches, particularly when plugins are outdated or misconfigured. If a breach through any of these channel’s results in unauthorised access to personal information, you are required under the Notifiable Data Breaches scheme to assess whether the incident is likely to result in serious harm to any affected individual. If it is, you must notify both those individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable. A firm that cannot demonstrate it maintained reasonable security practices, such as keeping plugins updated, restricting data access, and vetting third-party integrations, may face regulatory scrutiny from the OAIC in addition to the notification obligation. ASIC has also flagged cyber resilience as a supervisory concern for AFS licensees.

Recovery costs, including forensic investigation, remediation, and notification, are not covered by professional indemnity (PI) insurance, which covers errors or omissions in professional services. Cyber liability insurance is the relevant product for this exposure. Ask your broker: “Does my cyber liability policy cover breaches originating through third-party website integrations, such as plugins or embedded tools?” Review the OAIC’s guidance at oaic.gov.au/privacy/notifiable-data-breaches. This is general information only and not insurance or legal advice.