ASIC accepted an EU from CBA entities CommSec and the Australian Investment Exchange on 17 December 2013.
Under the terms of the original EU, the two CBA group entities were required to appoint an independent expert to review their money-handling procedures and put processes in place to remediate clients where necessary.
The variation to the EU, released on Friday, requires CommSec to engage the independent expert to provide monthly progress reports to ASIC and CommSec on the progress of the implementation of the remediation plan.
The monthly reports must be given to ASIC and CommSec on the 20th day of each month up to and including July 2015 (or the month that is one month after the final due date of the remediation plan).
The newly varied EU also requires that CommSec ensures ASIC staff are not prevented from meeting with the independent expert "independently of CommSec and obtaining information from the independent expert about the engagement".
The independent expert must immediately notify CommSec and ASIC "if the independent expert or the independent expert's staff become aware of information that adversely affects their ability to exercise objective and impartial judgment in relation to the engagement".
The varied EU stipulates that this includes, but is not limited to, circumstances where the independent expert or the independent expert's staff:
"Become aware of any conduct of CommSec, or its past or present directors, officers or employees involving action or exert undue influence on the independent expert or staff of the independent expert".
CommSec must also permit the independent expert to have access to "their books, to interview employees, contractors, agents and/or consultants, to attend project group and working group meetings" in the course of carrying out the monthly reports.
The variation to the EU stipulates that the final report be provided to ASIC and CommSec "on or before 4 September 2015".
