Regulatory Radar

Superannuation trustees could begin mapping the revised SRS 607.0, SRS 611.1 and SRS 101.0 requirements against the data they currently hold, to identify where new collection or system work would be needed well before the expected late 2027 start of data collection. Given the streamlined data requirements and new reporting practice guide, trustees that found the earlier draft burdensome may want to revisit their original concerns and consider a submission by 9 October 2026 if issues remain. Boards and risk committees may also wish to track how retirement phase reporting obligations interact with existing retirement income strategy and member outcomes assessment requirements.

Authorised deposit-taking institutions and other APRA-regulated entities could use this matter as a prompt to independently validate the calculation logic, data lineage and system controls behind key prudential metrics such as the Liquidity Coverage Ratio, rather than relying solely on the metric's reported output. Boards and risk committees may wish to confirm that internal audit or an equivalent independent function periodically tests whether prudential reporting reflects the underlying methodology set out in the relevant prudential standard. Entities that identify a similar miscalculation may want to consider their own notification obligations to APRA promptly, consistent with the approach ING Australia is reported to have taken.

Entities covered by the Financial Accountability Regime may wish to review their current accountability maps and register submissions against the two proposed changes, particularly where key functions or direct report information is currently compiled as part of a wider governance or org-design process rather than specifically for FAR reporting. Given the short consultation window closing 2 October 2026, entities with a view on the practical effect of either change may wish to consider lodging a submission before that date.

Superannuation trustees may wish to review the methodology paper to understand how the Comprehensive Product Performance Package metrics and the legislated performance test are calculated, and to consider modelling their own products against that methodology ahead of future publication cycles. Trustees whose products have previously been identified as underperforming, or whose products are approaching repeated test failure, may want to assess what remediation steps APRA would expect to see documented, given its stated intention to apply heightened supervisory scrutiny where pockets of underperformance persist.

Boards of APRA and ASIC regulated entities may wish to confirm that a documented risk appetite for frontier AI exists and has been considered at board level, covering matters such as escalation authority and recovery priorities, rather than being left to management alone. It may also be worth testing whether incident response and recovery plans have been exercised against scenarios involving AI-accelerated attacks, given the regulators' point that such incidents can unfold faster than traditional cyber events.

Regulated financial entities and their material service providers may wish to benchmark their own cyber and operational resilience arrangements, including patching, access controls, backup integrity and incident response testing, against the themes identified in this publication. Boards could consider whether governance arrangements for escalation, risk appetite and recovery decisions are adequately defined in advance of an incident, given the compressed response timeframes associated with frontier AI related threats. Entities relying heavily on a small number of third party service providers may also want to assess concentration risk in that context.

Banks, insurers and superannuation trustees regulated by APRA may wish to compare their annual risk and compliance plan against the priorities set out in the 2026-27 Corporate Plan, particularly the stated focus on cyber resilience, geopolitical risk and the use of frontier artificial intelligence. Boards and risk committees could use the Plan to anticipate the likely focus of supervisory engagement and thematic reviews over the next 12 to 18 months, and to identify any gaps between current risk management practices and the pace of change APRA has flagged as expected of regulated institutions.

Superannuation trustees, particularly platform trustees with extensive investment menus, may wish to begin assessing whether their current investment governance capability, including onboarding, monitoring and offboarding processes and management of conflicts, is proportionate to the complexity of the options they offer. Trustees could also consider member level diversification practices and oversight arrangements ahead of APRA's consultation on detailed reform proposals. Businesses providing investment options through platforms may want to monitor the consultation for potential capital or governance requirements that could affect product availability or commercial arrangements with trustees.

Authorised deposit-taking institutions running their own risk transformation or remediation programs may wish to test whether those programs can demonstrate actual improvement in control effectiveness and risk culture, rather than relying on program milestones or project completion as the primary measure of success. APRA's willingness to maintain a capital add-on and impose licence conditions after years of remediation activity suggests that evidence of sustained outcomes, not just documented processes, is what regulators are looking for.

Authorised deposit-taking institutions may wish to check whether known weaknesses identified through penetration testing or other security reviews have been remediated within a reasonable timeframe, since unaddressed findings of that kind contributed to the admitted contravention in this matter. It may also be worth confirming that cyber incident response plans and customer authentication control testing programs map clearly to the accountable persons named under the Banking Executive Accountability Regime or its successor, so that responsibility for remediation of known control weaknesses is clearly assigned before an incident occurs rather than after.

Level 3 conglomerate groups may wish to update internal policy and compliance documentation to reference the remade versions of 3PS 221, 3PS 222 and 3PS 310 once they take effect ahead of the 1 October 2026 sunset of the current standards. Because the changes are administrative only and do not alter substantive obligations, no operational changes are expected to be needed beyond confirming that internal references, templates and audit programs cite the correct, current version of each standard.

Foreign bank holding companies, foreign bank treasury companies, multilateral development banks and foreign subsidiaries of Australian banking groups that issue debt securities in Australian wholesale markets may wish to check whether they now fall within the broadened exempt class and can rely on the class exemption rather than seeking individual consent from APRA before using restricted terms such as bank or banking in connection with an issuance. This may simplify the documentation process for upcoming wholesale debt raisings.

Fintech and payment businesses considering deposit-taking in Australia may wish to review the restricted to full ADI authorisation pathway and the prudential expectations APRA applies at each stage, using this grant as a reference point for the type of capital, governance and risk management maturity APRA looks for before granting an unrestricted licence. It may also be useful to consider the lead time involved, since Revolut's application process extended over several years before the licence was granted.

Regulated entities and their advisers could read APRA's Statement of Intent alongside ASIC's equivalent statement, published on the same day, to gauge the overall direction of supervisory focus and any stated commitment to reducing regulatory burden while maintaining prudential safety. Boards and risk committees of APRA regulated institutions may find it useful context when considering upcoming supervisory engagement or prudential reviews. As a statement of intent rather than a legislative instrument, it does not itself require any immediate compliance action, though it may signal how APRA approaches discretionary decisions.

Capital and regulatory reporting teams at authorised deposit-taking institutions may wish to review the proposed change to the credit conversion factor for undrawn servicer cash advances under APS 120, since this affects a capital calculation rather than being purely a drafting correction, notwithstanding APRA's description of the broader package as technical. Entities across all affected industries may find it useful to check the finalised package, expected in November 2026, against their current reporting templates before the intended 1 January 2027 effective date.

Authorised deposit taking institutions and insurers that rely on credit ratings for regulatory capital purposes may wish to confirm that the rating agencies they currently use remain recognised as External Credit Assessment Institutions under the updated guidelines, and to note that insurers are now expressly referenced in the guidelines alongside banks. It may also be worth checking that internal capital calculation processes correctly map ratings from recognised agencies to the applicable credit rating grade under the relevant prudential standard, given the clarified recognition pathways.

Superannuation trustees and their reporting teams could begin scoping the system and process changes needed to submit asset allocation and membership profile data through APRA Connect rather than the decommissioned D2A platform, including testing data mapping against the proposed amended definitions in SRS 101.0. It may be worth identifying which existing internal reports rely on the baseline SRS 001.0 collection that APRA proposes to revoke, so that any internal processes depending on that collection can be adjusted. IT and data governance teams could also be briefed on the migration timeline to avoid disruption to regular reporting obligations.

General insurers may wish to review their reinsurance arrangements and capital treatment processes against the finalised standards, GPS 115, GPS 116, GPS 230 and CPS 320, ahead of the 1 January 2027 commencement date. Given the expanded role for appointed actuaries in determining capital treatment of certain reinsurance arrangements, insurers may also want to consider whether internal governance and sign off processes for actuarial determinations need updating, and to monitor the release of updated reporting forms in the APRA Connect test environment expected in September 2026.