APRA imposes licence conditions on Bendigo and Adelaide Bank

APRA has imposed licence conditions on Bendigo and Adelaide Bank Limited after an independent root cause analysis found longstanding and pervasive weaknesses in the bank's non-financial risk management framework. The action, announced on 18 August 2026, follows a December 2025 direction requiring Bendigo Bank to commission the review after an earlier investigation into suspected money laundering at a branch raised broader concerns about the bank's risk management, which also prompted AUSTRAC to open an enforcement investigation.

Deloitte's root cause analysis, completed ahead of the August 2026 action, found that non-financial risk management weaknesses are prevalent across the organisation, that the bank lacks a clear, complete and reliable view of its regulatory obligations, material risks and key controls, and that there are material deficiencies in governance, accountability, compliance management, risk oversight and risk management capability. The analysis also found that these weaknesses had persisted despite several years of remediation activity under the bank's enterprise-wide risk transformation program, known as BEN+. On that basis, APRA said it was not satisfied the bank had addressed the underlying causes of its deficiencies or delivered sustainable improvement, despite having had significant opportunity to do so.

The licence conditions, imposed under section 9AA of the Banking Act 1959 with effect from 18 August 2026, require Bendigo Bank to undertake a comprehensive rectification program and engage an independent assurer to monitor its progress. APRA also confirmed it will keep in place the 50 million dollar operational risk capital add-on first applied in December 2025. The action illustrates that APRA expects entities under remediation to demonstrate measurable and sustained improvement in risk controls, rather than treating the completion of a program's milestones as sufficient evidence that underlying weaknesses have been resolved.