## 1. The 2012 Revised Core Principles ## Source details **Canonical URL:** [1. The 2012 Revised Core Principles](https://www.imf.org/-/media/files/publications/cr/2019/1ausea2019006.pdf) ## Other formats - [Markdown version](/-/media/files/publications/cr/2019/1ausea2019006.pdf.md) - [Structured JSON version](/-/media/files/publications/cr/2019/1ausea2019006.pdf.json) --- ### Summary findings on APRA and reforms - APRA has kept an active pace in implementing reforms to enhance the resilience of the Australian financial system. - APRA implemented key elements of the international regulatory reform agenda, at times going beyond the agreed minimum standards to provide additional resilience. - Focus areas of APRA’s reforms include: - strengthening the capital framework, - implementing Basel III liquidity standards, - reinforcing sound mortgage lending standards, - improving governance and accountability, - strengthening crisis management and preparedness. - Other broad policy reforms enacted include: - a cross-industry risk management standard, - a governance and risk management framework for conglomerates, - a phased approach to licensing. - APRA reorganized specialist risk and supervision teams and created a risk and data analytics function combining specialists in statistics, industry analysis, and risk. - Supervisory activities have focused on banks’ practices and underwriting standards in residential mortgages and commercial real estate lending. - APRA has achieved a high degree of compliance with the Basel Core Principles (BCPs), with clear progress in supervision of liquidity and credit risk, and enhancements to banks’ capital adequacy requirements. - Planned implementation: an “unquestionably strong” capital framework in line with the recommendations of the 2014 Financial System Inquiry (FSI) remains on APRA’s priority agenda. ### Key supervisory assessments and ratings - Overall BCP-related assessments and notable principle outcomes (preserve source language where given): - Principle 1 — Assessment: Compliant (with main gap: parliamentary disallowance risk for prudential standards). - Principle 2 — Assessment: Materially Non-Compliant (concerns: ministerial direction power, parliamentary veto, budgetary/remuneration constraints). - Principle 3 — Assessment: Compliant (good cooperation framework domestically and internationally). - Principle 4 — Assessment: Compliant (banking business defined; exemptions tightly constrained). - Principle 5 — Assessment: Compliant (thorough licensing framework; Restricted ADI route introduced). - Principle 6 — Assessment: Materially Non-Compliant (transfer of significant ownership: FSSA 15 percent threshold; delegation limits; reporting gaps). - Principle 8 — Assessment: Largely Compliant (supervisory approach robust but resolution planning work in progress). - Principle 9 — Assessment: Compliant (mix of onsite/offsite; PAIRS/SOARS/SAP tools). - Principle 10 — Assessment: (findings integrated; APRA has broad powers to collect/verify data). - Principle 11 — (corrective powers strong; recommendation to escalate more promptly). - Principle 12 — (consolidated supervision well underpinned; Level 1/2/3 framework). - Principle 13 — Assessment: Largely Compliant (home–host relations strong, supervisory colleges recommended). - Principles 14–29 — mixture of Compliant, Largely Compliant and areas for enhancement (detailed below by theme). ### Banking sector structure and key statistics (exact figures preserved) - Banks and other ADIs represent nearly 67.6 percent of all APRA-regulated financial system assets, equal to around 2.3 times the level of nominal GDP. - Banks account for 98.8 percent of ADI assets in March 2018. - General insurance, life insurance, and superannuation industries together account for around 32.4 percent of total APRA-regulated financial assets. - Australia’s four major domestic banks accounted for 76.4 percent of total ADI assets in March 2018. - Rest of ADI sector: 4 mid-sized banks and a few other small Australian-owned banks — 9.8 percent of total ADI assets. - 51 foreign-owned banks (44 branches and 7 subsidiaries) — 12.6 percent of total ADI assets. - Building societies and credit unions — 1.2 percent of total ADI assets. - Profitability (year ended March 2018): - Aggregated after-tax profits: A$36.4 billion, up 9.3 percent from the previous year. - Return on equity: 12.3 percent (compared to 11.7 percent for all ADIs). - Return on assets: 0.8 percent (compared to 0.7 percent during the previous year). - Ratio of nonperforming loans (NPLs) to gross loans and advances: just under 0.4 percent. - Asset exposures and funding: - Residential mortgages account for over half of banks’ loans portfolio; about a quarter of these are interest-only mortgages. - Wholesale funding remains high at about one-third of total liabilities, of which nearly two-thirds is from international sources. - Australian-owned banks have reduced international lending exposures since 2015, except for lending to New Zealand entities (increased faster than banks’ total assets). ### Capital adequacy outcomes (exact figures preserved) - Drivers of capital strengthening: implementation of Basel III since 2012; APRA’s raising of residential mortgage risk weights for IRB banks to an average of at least 25 percent; preparation for ‘unquestionably strong’ capital requirements. - Capital outcomes (as of March 2018): - Aggregate Tier 1 capital ratio for locally-incorporated banks: 12.6 percent of risk-weighted assets (up from 10.5 percent in March 2013). - Total capital ratio: 14.8 percent. - Aggregate banking system capital level referenced later: 14.5 percent, with both large firms and smaller firms having averages above that level. ### Liquidity and payments infrastructure - New Payments Platform (NPP) launched February 2018: open access, near real-time 24/7 retail payments; RBA built the Fast Settlement Service to settle transactions individually on a 24/7 basis. - APRA implemented LCR and NSFR for major banks; October 2017 RCAP confirmed Australia’s Basel III LCR is overall compliant. - Liquidity reporting changes effective 2018 to include NSFR, add HQLA 2B to LCR reporting, and enhance daily liquidity reporting requirements. - CLF features and parameters preserved: - Facility fee: 15 basis points; - CLF eligible assets: all debt securities accepted for RBA market operations; - CLF sizing determined annually by APRA; CLF does not substitute for HQLA holdings required to meet 100 percent LCR. ### Crisis management and public safety net (exact figures preserved) - Financial Claims Scheme (FCS) (established October 2008): - From October 2008 FCS applies to deposit balances up to A$1 million per account-holder per ADI. - In September 2011 Government announced FCS limit would be reduced to A$250,000 from February 1, 2012. - FCS is post-funded; APRA entitled to recover payouts in winding up; APRA has priority claim on assets of ADIs for such amounts; any shortfall can be recovered through an industry levy. - Financial Sector Legislation Amendment (Crisis Resolution Powers and Other Measures) Act 2018 significantly expanded crisis resolution powers and clarified APRA’s mandate on resolution planning; APRA planned consultation on a prudential framework for recovery and resolution planning in 2019. ### Supervisory methodology and tools - Core supervisory framework and tools: - PAIRS (Probability and Impact Rating System): two dimensions (probability, impact) with Probability of Failure ratings: Low, Lower Medium, Upper Medium, High, Extreme; Impact ratings: Low, Medium, High, Extreme. - SAI (Supervisory Attention Index) = square root of product of probability and impact indices. - SOARS (Supervisory Oversight and Response System): four stances — ‘Normal,’ ‘Oversight,’ ‘Mandated Improvement,’ and ‘Restructure’. - SAP (Supervisory Action Plan): forward plan linking PAIRS/SOARS outputs to supervisory activities over next 1–2 years. - Risk & Data Analytics (RDA) division and Program Athena: data modernization and enhanced analytics; APRA to refine and likely increase reporting from firms to enhance large data set analysis. - Supervisory cadence and communications: - Baseline coverage and annual baseline review for all ADIs; intensity driven by PAIRS rating. - Communications classify findings as: ‘requirement,’ ‘request for information,’ ‘recommendation,’ and ‘suggestion’; responses to ‘requirements’ expected within 20 business days. ### Governance, independence, resourcing and legal protections (exact statutory references preserved) - Institutional design and constraints: - APRA Act subsection 8(1) main purposes and 8(2) balancing of objectives; Banking Act subsection 12(1) duty to protect depositors and promote financial system stability. - Ministerial direction power: Section 12 of APRA Act permits Minister to give APRA written directions; direction must be published in Gazette and tabled in Parliament (failure does not affect validity); power never exercised to date. - Prudential standards are legislative instruments under the Legislation Act 2003 and can be disallowed by Parliament within 15 sitting days. - Resources and funding (exact figures and program references preserved): - APRA funded primarily by industry levies under Financial Institutions Supervisory Levies Collection Act 1998; majority of funding via standing appropriation. - 2017–18 Federal budget: APRA obtained an additional A$40 million, approximately, of new funding over four years (A$7 million in 2017/18) to cover initiatives including stress testing, IT security, review of industry remuneration practices, data analytics, and FCS administration. - Revised staffing complement: funding sufficient for 626 staff, net increase of 21 staff. - APRA’s expense budget increased by an annual average of around 2.7 percent since 2014. - Employment and remuneration constraints: - APS Workplace Bargaining Policy imposes constraints including an annual cap of 2 percent on remuneration increases. - Voluntary turnover: overall 7.5 percent in May 2018; turnover for Risk and Data Analytics Division around 13.75 percent in May 2018. - Legal protections: - Section 58 of the APRA Act protects APRA members, staff, or agents from liability for acts/omissions in exercise of powers if not acting in bad faith. - APRA lacks express indemnity for legal defence costs; relies on Legal Services Directions 2017 and Directors’ and Officers’ Liability insurance. ### Licensing, ownership control and restricted ADIs (exact thresholds and rules preserved) - Section 9 — APRA is licensing authority; phased (restricted) licensing regime introduced May 2018. - Restricted ADI guidance: - APRA does not expect restricted ADIs to have a balance sheet greater than A$100 million; this equates to approximately A$20 million of equity under Restricted ADI minimum capital requirements. - Restricted ADI minimum capital during restricted phase: higher of A$3 million plus a resolution reserve; or 20 percent of adjusted assets. - Typical resolution reserve: A$1 million; APRA retains discretion to increase reserve. - Restricted ADIs must transition to full ADI within a maximum of two years or surrender authority. - Transfer of significant ownership: - FSSA threshold: 15 percent prior-approval requirement; Treasurer may delegate to APRA for banks with assets less than A$1 billion; delegation revocable. - Assessors recommend legal changes to give APRA power to approve significant ownership changes and require reporting of ultimate beneficiary owners. ### Risk-specific supervisory findings and recommendations (selected) - Capital (Principle 16) — Assessment: Compliant - Minimum PCR ratios: - common equity tier 1 ratio of 4.5 percent; - tier 1 ratio of 6.0 percent; - total capital ratio of 8.0 percent. - Capital conservation buffer: no less than 2.5 percent. - Sum of CET1 PCR plus CCB determined by APRA will be no less than 7.0 percent. - D-SIB buffer: Australia’s four D-SIBs required to hold an additional one percent of CET1. - APRA consulting on minimum leverage ratio; no current minimum leverage ratio requirement. - Recommendation: continue emphasis on ICAAP, stress-testing, and firm internal capital processes; review PAIRS weighting on access to new capital (25 percent significance) given stress reliability. - Credit risk and provisioning (Principles 17–18) — Assessments: Principle 17 Compliant; Principle 18 Largely Compliant - APS 220 requires credit risk frameworks; APRA to revise APS 220 to align with expected loss approaches (IFRS 9/AASB 9) and BCBS guidance. - Recommendation: develop formal methodology to validate sufficiency of loan loss provisions; increase prudential reporting granularity (past due buckets, CRE subcategories, geographic breakdowns). - Concentration and large exposures (Principle 19) — Assessment: Compliant - Revised APS 221 adopts Basel large exposure framework; large exposure threshold = 10 percent of Tier 1 Capital; aggregate single counterparty limit = 25 percent of Tier 1 Capital (with specified exceptions). - Reporting: ARF 221.0 submitted quarterly. - Related-party transactions (Principle 20) — Assessment: Largely Compliant - APS 222 current limits and definition gaps identified; APRA released July 2, 2018 draft revisions to broaden definition and tighten limits and governance. - Recommendation: finalize revised APS 222 to align with Basel definitions and strengthen board approval/conflict rules. - Liquidity (Principle 24) — Assessment: Compliant - LCR and NSFR applied to large ADIs; MLH regime for smaller ADIs (minimum nine percent). - APRA collects ARF 210.1A, ARF 210.1B, ARF 210.3, ARF 210.4; introduced NSFR reporting in 2018 forms. - Recommendation: continue CLF sizing discipline and oversight of HQLA scarcity effects. - Operational risk and IT/cyber (Principle 25) — Assessment: Compliant - CPS 232 Business Continuity Management; CPS 231 outsourcing; draft CPS 234 on Information Security consulted March 2018. - Recommendation: expand IT/cyber specialist resourcing and analytic toolkits; continue development of prudential standard on operational risk. - Governance, internal audit, and supervision intensity (Principles 14, 26) - CPS 510 and CPS 520 set governance and fit-and-proper requirements; BEAR became effective July 1, 2018 for major banks. - Observed shortcoming: PAIRS places relatively low weight on assessment of board and senior management; recommendation to increase focus on periodic end-to-end reviews and deeper internal audit effectiveness assessments. - AML/CTF and abuse of financial services (Principle 29) — Assessment: Largely Compliant - AUSTRAC oversees AML/CTF for over 14,000 reporting entities; statutory immunity under section 235 of AML/CTF Act; supervisory findings identified reliance on firm self-reporting has failed in some cases. - Recommendations: - AUSTRAC: increase formal corrective actions and conduct in-depth periodic assessments for major banks; - APRA: integrate AUSTRAC findings into prudential assessments and increase entity-specific coordination. ### Cross-cutting supervisory recommendations (selected and preserved wording) - Conduct periodic comprehensive assessments of banks’ risk management and governance frameworks to ensure risk-based supervisory processes remain focused on key gaps in banks’ management and risk culture. - Strengthen supervisory assessment by incorporating banks’ management of nonfinancial risks through closer engagement with domestic agencies, mainly ASIC and AUSTRAC. - Continuously develop APRA’s resources and skillset to match the evolution in banking services and risks, particularly: - IT, - cyber risk, - fintech. - Ensure APRA’s resources remain adequate to discharge increasing responsibilities, notably: - implementation of the Banking Executive Accountability Regime (BEAR), - introducing and implementing a recovery and resolution planning framework. - Grant APRA sufficient autonomy and flexibility in budgeting and staffing to attract and retain needed skills. - Enhance use of thematic reviews, periodic end-to-end reviews at largest firms, and more active escalation from “recommendation” to “requirement” and directions where firms do not cooperate. *Source: Detailed Assessment Report — 1. The 2012 Revised Core Principles* ### 1. The 2012 Revised Core Principles _____________________________________________________________ 11 ### 1. The 2012 Revised Core Principles ### Summary findings on APRA and reforms - APRA has kept an active pace in implementing reforms to enhance the resilience of the Australian financial system. - APRA implemented key elements of the international regulatory reform agenda, at times going beyond the agreed minimum standards to provide additional resilience. - Focus areas of APRA’s reforms include: - strengthening the capital framework, - implementing Basel III liquidity standards, - reinforcing sound mortgage lending standards, - improving governance and accountability, - strengthening crisis management and preparedness. - Other broad policy reforms enacted include: - a cross-industry risk management standard, - a governance and risk management framework for conglomerates, - a phased approach to licensing. - APRA reorganized specialist risk and supervision teams and created a risk and data analytics function combining specialists in statistics, industry analysis, and risk. - Supervisory activities have been focused on banks’ practices and underwriting standards in residential mortgages and commercial real estate lending, among other risk areas. - APRA has achieved a high degree of compliance with the Basel Core Principles for Effective Supervision (BCPs), including clear progress in supervision of liquidity and credit risk, and enhancements to banks’ capital adequacy requirements. - Planned implementation: an “unquestionably strong” capital framework in line with the recommendations of the 2014 Financial System Inquiry (FSI) remains on APRA’s priority agenda. ### Recommendations and supervisory enhancements - Conduct periodic comprehensive assessments of banks’ risk management and governance frameworks to ensure risk-based supervisory processes remain focused on key gaps in banks’ management and risk culture. - Strengthen supervisory assessment by incorporating banks’ management of nonfinancial risks through closer engagement with domestic agencies, mainly ASIC and AUSTRAC. - Continuously develop APRA’s resources and skillset to match the evolution in banking services and risks, particularly: - IT, - cyber risk, - fintech. - Ensure APRA’s resources remain adequate to discharge increasing responsibilities, notably: - implementation of the Banking Executive Accountability Regime (BEAR), - introducing and implementing a recovery and resolution planning framework. - Grant APRA sufficient autonomy and flexibility in budgeting and staffing to attract and retain needed skills. ### Methodology of the assessment - The assessment is part of the FSAP undertaken by the IMF in 2018 and reflects the regulatory and supervisory framework in place as of the date of completion of the assessment. - The assessment reviewed laws, regulations, manuals, and other materials mainly provided by APRA, and included meetings with APRA, Australian Treasury, RBA, AUSTRAC, ASIC, banks, external audit firms, and the Australian Banking Association. - Authorities provided a BCP self-assessment, responses to additional questionnaires, and access to supervisory documents, files, staff, and systems. - The assessment focused on banking supervision and regulation in Australia and did not cover the specificities of regulation and supervision of other financial institutions. - Proportionality: the assessment considered the structure and complexity of the Australian banking system and applied a proportionate approach consistent with the BCP methodology. ### The 2012 Revised Core Principles (Box summary) - Revisions reflect developments since the prior revision and lessons from the 2008/2009 financial crisis. - Emphasis areas include: - greater supervisory intensity and allocation of adequate resources for systemically important banks, - application of a system-wide, macro perspective to microprudential supervision, - increased focus on crisis preparation, recovery, and resolution measures, - fostering robust market discipline through corporate governance, disclosure, and transparency. - Supervisors are required to assess bank risk profiles in terms of risks banks run and risks they pose to the banking and financial systems, considering macroeconomic environment and business trends, with a forward-looking approach and early intervention. - Quantitative changes in the revised methodology: - number of principles increased from 25 to 29, - number of essential criteria expanded from 196 to 231, - introduction of 35 new essential criteria, - for countries choosing assessment against additional criteria, there are 16 additional criteria. - The revised BCPs reinforce proportionality so expectations on supervisors and standards imposed on banks are commensurate with banks’ risk profile and systemic importance. ### Institutional and market structure — APRA’s mandate - APRA is responsible for prudential regulation and supervision of Authorized Deposit-taking Institutions (ADIs) in Australia. - APRA’s remit also covers prudential oversight of general, life, and private health insurance companies, and most of the superannuation industry. - In performing functions and powers, APRA must balance objectives of financial safety and efficiency, competition, contestability, and competitive neutrality, and in balancing these objectives, is to promote financial stability in Australia. *Source: Detailed Assessment Report — 1. The 2012 Revised Core Principles* ### 13. Australia’s financial regulatory framework include three other financial sector ### 13. Australia’s financial regulatory framework include three other financial sector ### Financial sector authorities - The Treasury - Responsibility: advising the Government on financial stability issues and on the legislative and regulatory framework underpinning financial system infrastructure. - The RBA - Role: Australia’s central bank responsible for monetary policy as well as the safety and efficiency of the payments system and for overall financial stability. - ASIC - Role: Responsible for the registration and supervision of corporations and, in the financial sector, for licensing of financial service providers, credit providers and market conduct. ### Council of Financial Regulators (CFR) - Composition: RBA (Chair), APRA, ASIC, and the Treasury. - Purpose: - Primary coordinating body for Australia’s main financial sector agencies. - Ensures a structured, multilateral coordination process across the relevant agencies. - Governance and responsibilities: - Each member is fully responsible for discharging its own responsibilities within its statutory mandate. - Objectives: to promote stability of the Australian financial system and contribute to the efficiency and effectiveness of regulation. - Meets typically four times a year; may meet out of session if necessary. - Minutes of meetings are not published; RBA reports on CFR activities in its half-yearly Financial Stability Review. - Forms working groups with agreed terms of reference for detailed policy development. - Not a statutory body: no legal personality or powers separate from member agencies; arrangements underpinned by a Memorandum of Understanding (MoU). ### AUSTRAC - Role: Administers Australia’s anti-money laundering and counter-terrorism financing laws; Australia's Financial Intelligence Unit. - Responsibilities: - Fight serious and organized crime and terrorism financing. - Regulator for AML/CFT, overseeing compliance of more than 14,000 Australian businesses ranging from major banks and casinos to single-operator businesses. ### Financial System Inquiry (FSI) - Established: late-2013. - Chair: David Murray. - Purpose: Assess how Australia’s financial system could most effectively help the economy be productive, grow, and meet the financial needs of Australians. - Three principles the financial system needed to satisfy: - To efficiently allocate resources and risks. - To be stable and reliable. - To be fair and accessible. - Key recommendations: - Continue to align prudential framework with internationally agreed standards. - Maintain efforts to encourage competition. - Focus on fostering innovation. - Move beyond relying on disclosure to regulate fair outcomes for consumers interacting with the financial system. - Re-affirmed that the twin peaks architecture (independent regulators responsible for consumer outcomes and prudential regulation) remained appropriate. - Recommended establishment of an ‘unquestionably strong’ capital framework, with a baseline target in the top quartile of internationally active banks. ### Overview of the Banking Sector — Key statistics and structure - Banks and other ADIs represent nearly 67.6 percent of all APRA-regulated financial system assets, equal to around 2.3 times the level of nominal GDP. - Banks account for 98.8 percent of ADI assets in March 2018. - General insurance, life insurance, and superannuation industries together account for around 32.4 percent of total APRA-regulated financial assets. - Major banks concentration: - Australia’s four major domestic banks accounted for 76.4 percent of total ADI assets in March 2018. - Rest of ADI sector: 4 mid-sized banks and a few other small Australian-owned banks — 9.8 percent of total ADI assets. - 51 foreign-owned banks (44 branches and 7 subsidiaries) — 12.6 percent of total ADI assets. - Building societies and credit unions — 1.2 percent of total ADI assets (share gradually declining). - Profitability (year ended March 2018): - Aggregated after-tax profits: A$36.4 billion, up 9.3 percent from the previous year. - Return on equity: 12.3 percent (compared to 11.7 percent for all ADIs). - Return on assets: 0.8 percent (compared to 0.7 percent during the previous year). - Ratio of nonperforming loans (NPLs) to gross loans and advances: just under 0.4 percent (near record lows; around this level since 2015). - Asset exposures and funding: - Residential mortgages account for over half of banks’ loans portfolio; about a quarter of these are interest-only mortgages. - Wholesale funding remains high at about one-third of total liabilities, of which nearly two-thirds is from international sources. - Australian-owned banks have reduced international lending exposures since 2015, except for lending to New Zealand entities (increased faster than banks’ total assets). ### Capital adequacy - Drivers of capital strengthening: - Implementation of Basel III since 2012. - APRA’s raising of residential mortgage risk weights applied by banks using internal models to an average of at least 25 percent. - Preparation for APRA’s ‘unquestionably strong’ capital requirements. - Capital outcomes (as of March 2018): - Aggregate Tier 1 capital ratio for locally-incorporated banks: 12.6 percent of risk-weighted assets (up from 10.5 percent in March 2013). - Total capital ratio: 14.8 percent. - Methods of capital strengthening: equity raisings, dividend reinvestment plans, and retained earnings. ### Preconditions for effective banking supervision — Macroeconomic and institutional context - Macroeconomic conditions: - Australian economy: relatively benign conditions with growth trending upwards while inflation remains low. - Australia has delivered 26 years of uninterrupted growth. - RBA’s inflation target range: 2 to 3 percent (inflation below target since 2014). - Nominal and real wage growth have declined. - Modest impact of the commodity shock between mid-2014 and 2016 due to diversification, monetary easing, floating exchange rate, flexible labor markets, relatively high population growth, and strong institutions. - Housing and household debt: - Housing boom has supported the economy but led to housing market imbalances and higher household debt. - House prices in Melbourne and Sydney have risen sharply over past few years. - Household debt ratios have risen significantly since the previous FSAP and are high by international comparison. - Mandates for financial stability: - Both the RBA and APRA have mandates to promote financial system stability. - APRA must balance financial safety and efficiency, competition, contestability, and competitive neutrality. - ASIC and the Treasury also promote financial stability, independently and via CFR involvement. ### Legal and institutional infrastructure - Judiciary: - Strict separation between Judiciary and Parliament/Executive. - Only a court can exercise judicial power of the Commonwealth. - Judicial independence is supported by third-party reports. - Chapter III of the Constitution vests judicial power in the High Court of Australia and other federal courts. - Business laws and dispute resolution: - Contract law: provides rules for creation, performance, and termination of contractual rights, duties, and liabilities. - Alternative dispute resolution options: mediation, conciliation, conferencing, neutral evaluation, arbitration. - Internal and external dispute resolution mechanisms are generally a license condition for retail financial firms. - Australian Financial Complaints Authority (AFCA): - New single external dispute resolution scheme commencing on November 1, 2018. - Replaces the two ASIC approved EDR schemes and the statutory Superannuation Complaints Tribunal. - AFCA will be free of charge for consumers and able to deal with a broad range of complaints (including complaints from small businesses and primary producers) about banking, credit, loans, general insurance, life insurance, financial advice, investments, stock broking, managed funds, and superannuation. - Property rights and insolvency: - Strong protection of property rights; law recognizes real property and personal property. - Corporations Act sets down corporate insolvency law: external administration options include liquidation, voluntary administration and deeds of company arrangement; receivership also available. ### Regulatory framework for financial services and reporting - Licensing and authorizations: - Australian financial services (AFS) license — issued by ASIC; required to carry on a financial services business in Australia (unless exempt). - Credit license — issued by ASIC; required to engage in consumer credit activities (unless exempt). - Authorization to carry out banking or insurance business and license to be a trustee of a registrable superannuation entity (RSE) — issued by APRA; required to operate in a prudentially regulated industry. - Accounting and auditing standards: - Australian equivalents to International Financial Reporting Standards (A-IFRS) adopted for reporting periods beginning on or after January 1, 2005. - Accounting standards made by the Australian Accounting Standards Board (AASB); AASB participates in the IFRS standard-setting process and reviews IFRS text for Australian appropriateness. - Auditing standards made by the Auditing and Assurance Standards Board (AUASB); based on the International Standards on Auditing and reviewed for fit with Australia’s regulatory environment. - Financial Reporting Council oversees effectiveness of the financial reporting framework and provides oversight of AASB and AUASB. - Auditor independence (Corporations Act requirements): - General requirement for auditor independence. - Restrictions on auditors’ employment and financial relationships with clients. - Two-year ‘cooling-off’ period before an audit firm partner can become an officer of a client. - Requirement for lead and review auditors of listed companies to rotate after five years. - Extensive disclosure requirements for listed companies regarding non-audit services provided by their auditors. - Auditors and audit firms must be registered with ASIC; ASIC conducts ongoing audit inspection program. - Comprehensive Credit Reporting (CCR) reforms: - No public credit registries; providers of negative credit reporting exist. - CCR reforms involve amendments to the National Consumer Protection Act and the Privacy Act. - Mandate: the four major banks to provide comprehensive credit information on 50 percent of their active accounts to Australia’s three largest credit bureaus by end-September 2018. - CCR data on remaining accounts must be supplied by end-September 2019. - Current industry framework operates on reciprocity; mandatory inclusion of major banks expected to incentivize other banks and credit providers to join voluntarily. ### Payments clearing system - RBA responsibilities: - Primary regulatory responsibility for Australia’s payments system, including systemically important payment systems. - Day-to-day operation of the high value payments system RITS. - Payments System Board: - Determines RBA payments system policy to contribute to: controlling risk in the financial system; promoting efficiency of the payments system; and promoting competition in the market for payment services, consistent with overall financial stability. - Composition: Governor as chair, one other RBA appointee, an appointee from APRA, and up to five other members. - Legal powers: - Most powers derive from the Payment Systems (Regulation) Act 1998: - Allows RBA to obtain information from payments system participants, designate a payment system, and set access regimes and standards for designated payment systems. - Powers have been used mainly in the retail space (e.g., regulation of card schemes’ interchange fees and regulation of surcharges added by merchants to card payment transactions). - RBA can provide additional legal certainty regarding settlement finality in approved RTGS systems and netting arrangements. *Source: 1ausea2019006 - 13. Australia’s financial regulatory framework include three other financial sector* ### 39. Launched in February 2018, the New Payments Platform provides an open access ### Launched in February 2018, the New Payments Platform provides an open access ### New Payments Platform (NPP) and Fast Settlement Service - Launched in February 2018, the New Payments Platform provides an open access infrastructure for fast payments in Australia. - Designed via industry collaboration to enable households, businesses, and government agencies to make simply addressed payments, with near real-time funds availability to the recipient, on a 24/7 basis. - The infrastructure supports the independent development of “overlay” services to offer innovative payment services to end-users. - The RBA built the settlement component, known as the Fast Settlement Service, which allows transactions to be settled individually on a 24/7 basis, in close to real time. ### Clearing and Settlement (CS) regulatory framework - CS facilities operating in Australia are required to be licensed or exempted under Part 7.3 of the Corporations Act; requirement applies to both domestic and overseas facilities. - The Corporations Act establishes conditions for licensing and operation of CS facilities and gives ASIC and the RBA separate but complementary powers and regulatory responsibilities for supervision. - ASIC and the RBA have agreed a MoU intended to promote transparency, help prevent unnecessary duplication of effort, and minimize the regulatory burden on CS facilities. ### Framework for Crisis Management, Recovery and Resolution - The CFR focused on strengthening Australia’s financial crisis management arrangements and alignment with international standards and best practice. - The CFR members entered into an MoU on Financial Distress Management in 2008 setting out objectives, principles, and processes for managing distress in the Australian financial system; circumstances include distress in an ADI, general insurer, life insurer, superannuation fund, and interruptions to FMIs. - APRA’s statutory powers to respond to distress include enforcing compliance with prudential requirements, investigation and information powers, and a range of resolution powers (e.g., enforceable undertakings, court injunctions, directions to regulated institutions). - The Financial Sector Legislation Amendment (Crisis Resolution Powers and Other Measures) Act 2018: - Significantly expanded crisis resolution powers. - More clearly defined APRA’s mandate regarding resolution planning. - Provides APRA formal direction powers related to resolution planning and removing barriers to resolvability of regulated entities or groups. - Allows directions requiring an ADI to address barriers to orderly resolution (e.g., changes to systems, business practices, or operations). - APRA intends to develop its formal prudential framework for resolution planning, with a view to starting consultation on a prudential framework on recovery and resolution planning in 2019. - APRA recovery planning program: - Initiated pilot in 2011 focused on the 6 largest banks, including Australia’s four D-SIBs. - Extended requirement to 12 medium-sized banks (with assets greater than A$5 billion) in 2013, and later to three key service providers. - 2016 thematic review of recovery planning involved the 9 largest banks; APRA provided feedback based on benchmarking. - Final phase of thematic review underway with entity-specific feedback due to be provided in 2018. - Recovery planning applied on a case-by-case basis for smaller banks and ADIs, proportionate to size and the risk/impact of failure. ### Public Safety Net: Financial Claims Scheme (FCS) - In October 2008, the Australian Government established the Financial Claims Scheme (FCS) for ADIs and general insurers. - For ADIs, the FCS protects account-holders and provides prompt access to deposits if an ADI fails. - The Treasurer can declare the FCS activated for an ADI when APRA has determined the ADI is insolvent and has applied to the court to be wound up. - From October 2008, the FCS applies to deposit balances up to A$1 million per account-holder per ADI; the A$1 million limit was established in the context of the global financial crisis to reinforce depositor confidence. - In September 2011, on the CFR’s recommendation, the Government announced the FCS limit would be reduced to A$250,000 from February 1, 2012. - The FCS is post-funded: - Initial funding provided via standing appropriations under the Banking Act 1959 and Insurance Act 1973. - APRA, on behalf of the Government, is entitled to recover payouts in the winding up of the entity. - In the case of ADIs, but not general insurers, APRA enjoys a priority claim on the assets of the entity for such amounts. - Any shortfall for both ADIs and general insurers can be recovered through an industry levy. ### Effective Market Discipline - Disclosure requirements underpin Australia’s regulatory regime for consumer protection and securities market confidence. - Market participants and investors must be provided information on specific occasions, at regular planned intervals, and pursuant to continuous disclosure obligations. - Disclosure requirements are contained in the Corporations Act; listed companies must also comply with relevant listing rules. - Entities subject to disclosure requirements must prepare a financial report and a directors’ report each financial year; similar requirements exist for half-year reports. - Competition law is in the Competition and Consumer Act, applied across all industries including financial sector; ACCC enforces prohibitions on anti-competitive conduct, including misuse of substantial market power. ### Main findings — Responsibilities, Licensing, Supervision, and Supervisory Approach A. Responsibilities, Objectives, Powers, Independence (CP1–2) - APRA has broad powers and clear responsibilities underpinned mainly in the Banking Act and the APRA Act. - The APRA Act states promoting financial stability is to be pursued while balancing other objectives: financial safety, efficiency, competition, contestability and competitive neutrality. - Recommendation/observation: consider clarifying further the primary nature of APRA’s financial stability objective and that other objectives are subordinate to the financial stability mandate. - APRA’s prudential standards can be disallowed by Parliament, which weakens APRA’s prudential standard setting powers, though this has not occurred to date. - APRA operates under a robust governance framework and solid accountability mechanism: internal policies and processes, independent-majority internal committees, and strong accountability to Parliament and government via published reports. - Potential constraints on independence: - Minister has power to issue directions to APRA about policies to pursue (has not been exercised but is a potential concern). - APRA Act should require public disclosure of reasons for removal of an APRA Member (recommended). - The statement of expectations (SOE) and APRA’s statement of intent (SOI) serve as public platforms; clarity recommended to ensure SOE does not conflict with APRA’s primary mandate. - Budgetary and staffing constraints: - APRA subject to “efficiency dividends”; additional budget proposals need Government approval. - Uncertainty over medium-term budget could present resource planning difficulties. - Constraints on staff employment and remuneration (e.g., APS workplace bargaining policy) limit ability to attract and retain specialized skills for oversight of digital business models and cyber risk. B. Licensing, Change in Control, and Acquisitions (CP 4–7) - APRA’s licensing framework is thorough; assessments include ADI strategy, financial viability, business plan, owner/management suitability, governance, and risk management. - Removal of minimum initial capital for licensing ADI was intended to encourage entry; APRA ensures applicants can comply with prudential capital adequacy requirements from the start. - Phased (restricted) licensing regime introduced to encourage new market entrants: - Encourages competition, allows gradual licensing and closer APRA oversight. - Limits placed on size and operations of restricted licensees to reduce financial stability risks. - Requires a two-year conversion strategy to full ADI and an exit strategy with some resolution funds. - Recommendation: APRA should adopt prudence and build capacity on fintech developments and associated operational, IT, and cyber risk issues. - Change in significant ownership regime: - Financial Sector Shareholdings Act (FSSA) gives the Treasurer power to decide on ownership changes > 15 percent. - Treasurer delegated APRA for approvals for banks with assets of less than A$1 billion; delegation is partial and withdrawable. - “National interest” criteria in FSSA are not defined; unclear how fitness, propriety, and suitability are considered. - In practice Treasurer would seek APRA’s advice for banks with assets exceeding A$1 billion, but APRA’s advice is not binding. C. Supervisory Cooperation and Cross Border Supervision (CP3,12,13) - APRA has good interaction with domestic authorities but relationships could be enhanced with some agencies: - Good cooperation with RBA on financial stability and systemic risk; CFR provides discussion platform. - Cooperation with ASIC has intensified; building more thorough interaction will enhance APRA’s understanding of risks, especially under the BEAR. - Cooperation with AUSTRAC has been limited and primarily high-level; both agencies should increase frequency and substance of interaction. - International cooperation: - Close working relationships with foreign regulators, particularly RBNZ, supported by MoUs and letters of understanding. - APRA conducts onsite reviews for major banks’ subsidiaries in New Zealand and has conducted supervisory colleges for two banks (last one about three years ago). - Recommendation: consider supervisory colleges for banks with significant cross-border presence and implement resolution planning coordination with foreign authorities for major cross-border banking groups. - APRA’s consolidated supervisory approach: - Prudential standards and financial data collected on a consolidated basis. - Reviews oversight of foreign operations by management and application of group risk management on a consolidated basis. - Introduced in 2017 a governance and risk management framework for conglomerates covering risk management, fit and proper, and governance. - Recommendation: enhance understanding and review of risks from nonbanking activities in wider financial groups and be prepared to act as needed. D. Supervisory Approach (CP 8–11) - APRA’s supervisory approach emphasizes responsibility of boards and management to ensure prudent operation and compliance. - Supported by formal requirements, supervisory processes and tools, and enforcement authorities. - APRA generally prefers less formal engagement (consultation and recommendation) but retains formal powers to identify, monitor, and address escalating situations. *Source: 1ausea2019006 - 39. Launched in February 2018, the New Payments Platform provides an open access (PDF chapter/section).* ### 61. A key challenge of this approach is achieving the right balance between relying on ### 1ausea2019006 - 61. A key challenge of this approach is achieving the right balance between relying on ### Supervisory approach and verification - Key challenge: achieving the right balance between relying on firms’ attestations/reporting and supervisors verifying with a high degree of confidence that critical governance, risk management, and control processes are in place and effective. - APRA practice: well executed supervisory reviews of key practices based on a solid risk-focused approach. - Recommended enhancement: greater focus at the largest firms on periodic “end-to-end” reviews across firms of an identified set of practices APRA deems of particular importance to strengthen supervisory confidence and firms’ incentives to maintain solid practices. - Supervisory analytics: APRA has solid, if still developing, practices for analyzing emerging risks and developments across the system; further enhancements will require APRA to continue to refine and likely increase required reporting from firms and to become increasingly proficient in gathering and analyzing large data sets from its supervised firms. - Supervisory stance: need to balance maintaining good working relationships with firms and willingness to take strong supervisory actions; recommendation to escalate more quickly from “recommendation” to “requirement” and to use formal corrective actions, such as directions, more actively when firms misreport or do not cooperate. ### Corporate Governance and Internal Audit (CP 14, 26) - Governance requirements: APRA has appropriate requirements for governance structures and processes. - Assessment shortcomings: - PAIRS covers necessary areas but may obscure root causes or ultimate accountability for problems. - Board and senior management effectiveness assessments are primarily captured in the “risk governance” assessment rather than specific assessment categories for boards and senior managers, weakening articulation of expectations. - PAIRS places a relatively low weight on the assessment of the board and senior management in the overall rating, appearing misaligned with APRA’s supervisory philosophy and CPS 220 intentions. - Inter-agency assessment integration: APRA should better incorporate findings from AUSTRAC (AML/CTF) and ASIC (conduct) into governance assessments where material; increased cooperation with both agencies will foster more comprehensive bank risk profiles. - Internal audit: - APRA assesses internal audit effectiveness in a general sense and maintains frequent contact through ongoing supervision but does not collate supervisory conclusions into a formal risk assessment of internal audit. - Supervisors have not done an in-depth evaluation of internal audit functions across major banks for a number of years. - Recommendation: greater emphasis on all aspects of internal audit effectiveness as an element of governance by the board. - Prudential standards could better and more comprehensively outline main criteria and requirements for an effective internal control environment and internal audit function. ### Capital (CP 16) - Regime and ratios: APRA has a conservative regulatory capital regime and ADIs exhibit relatively strong regulatory capital ratios. - Focus gaps: APRA could increase focus on processes that support decision making around capital planning at the largest firms, including more in-depth reviews of inputs into and controls around ICAAPs and stress testing programs. - Recent steps: move towards putting in place “unquestionably strong” capital benchmarks on top of full and conservative use of Basel risk-based standards is a positive step. - Continued emphasis: APRA should continue focusing on processes that help identify risks that may emerge under stress but not be well captured in the regulatory framework to understand firms’ capacity under stressful environments. ### Risk Management (CP 17–25) - Emphasis on board: supervision places a strong emphasis on board responsibilities, supported by a solid, if understaffed in some areas, supervision program across major risk categories. - Staff and tools: supervisors are knowledgeable and supported by detailed policies, procedures and guidance for supervisory reviews. - Thematic reviews: increased use of thematic reviews across groups of firms is a good practice; recommended to utilize this practice to the greatest extent possible for the largest firms to improve knowledge and consistency of assessments. - CPS 220: since the last FSAP in 2012, APRA issued an integrated risk management standard (CPS 220) requiring regular attestations and reporting of its effectiveness by the board and management relative to firm size and risk profiles. - ICAAP and stress testing: - APRA should put more focus on assessing components of firms’ ICAAP and firm-wide stress testing practices. - Current heightened focus on achieving “unquestionably strong” capital thresholds has reduced focus on ICAAP assessments for the time being. - Recommendation: dedicate more time to assessing risk measurement, management, and control practices around firm-wide stress testing, including reviewing key inputs (methods and models) and governance and controls around them. - Credit risk: - Supervisors have increasingly assessed banks’ credit risk management, focusing on underwriting and serviceability assessments via thematically planned reviews (residential mortgages and commercial real estate). - Recommendation: continue these reviews and consider more thorough periodic analysis of banks’ credit risk management frameworks, particularly for major banks. - Enhance reviews of credit and concentration risk to examine concentration in common forms of collateral, particularly real estate. - APRA should proceed with its plan to revise prudential standards on credit quality (particularly treatment of problem assets) and related parties to be further aligned with international standards.5 - Liquidity risk: - Since the last FSAP, APRA strengthened capacity, tools, and prudential framework for liquidity oversight, established a team of risk specialists dedicated to liquidity, and implemented LCR and NSFR requirements for major banks. - The October 2017 RCAP confirmed that Australia’s Basel III LCR is overall compliant with Basel requirements. - APRA’s liquidity risk specialist team produces quarterly liquidity risk review reports and dashboards of key liquidity and funding metrics. ### Disclosures and Transparency (CP 27–28) - Disclosure regime: APRA regulations and the Corporations Act require significant disclosures allowing public understanding of bank conditions and risks. - Pillar 3: APRA requires a wide range of Pillar 3 disclosures including quantitative and qualitative elements. - Reporting cadence: banking statistics are made public on a monthly and quarterly basis; Australian incorporated banks must issue audited financial reports annually and half-yearly. - External audit oversight: ASIC reviews external audits, including asset valuations, and carries out ongoing surveillance of financial reporting. ### Abuse of Financial Services (CP 29) - AUSTRAC powers: AUSTRAC has the authorities and supporting processes to oversee money laundering and anti-terrorism financing. - Reliance on self-reporting: significant reliance on firms self-identifying and reporting weaknesses has not always proved effective. - Firm responsibilities: AUSTRAC requires firms to have a senior officer responsible for compliance who reports to the board on control process effectiveness; review of these reports plus risk-focused supervisory reviews are key parts of the supervisory approach. - Recent failures: events revealed some banks’ processes for ensuring compliance were not working as reported, resulting in failures to comply with rules and laws. - Recommendations for AUSTRAC: consider steps to increase confidence in firms’ internal reporting, including taking swift and formal action when banks’ control processes for ensuring compliance are missing key areas; likely require end-to-end thematic reviews of these processes at major banks on a periodic basis. *Source: 1ausea2019006 - selected pages from IMF PDF chapter/section.* ### 76. Table 1 below provides a detailed principle-by-principle assessment of the BCP. The ### 1ausea2019006 - 76. Table 1 below provides a detailed principle-by-principle assessment of the BCP. ### Overview - Table 1 provides a principle-by-principle assessment of the Basel Core Principles (BCP) for Australia. - The table structure: - “description and findings” sections: provide information on the legal and regulatory framework, and evidence of implementation and enforcement. - “assessment” sections: contain one line stating whether the system is “compliant,” “largely compliant,” “materially non-compliant,” “non-compliant,” or “not applicable.” - “comments” sections: explain why a particular grading is given and reflect the assessment team's judgment on strengths and areas for further improvement. - Emphasis: primary goal is to identify areas needing additional attention; comments accompanying each principle are emphasized over the individual grades. ### EC1 — Responsibilities and objectives (Description and findings) - Legal framework and entities: - APRA: Australian Prudential Regulation Authority established by the Australian Prudential Regulation Authority Act 1998 (APRA Act) (Section 8). - APRA administers the Banking Act 1959 (Banking Act) and the Financial Sector (Transfer and Restructure) Act 1999. - Treasury: advises Government on financial system matters; Minister (Treasurer) may give APRA written directions (APRA Act section 12). - Reserve Bank of Australia (RBA): established by the Reserve Bank Act 1959 (RBA Act); responsible for monetary policy, issuing currency, ensuring price stability, and overseeing the payments system. - ASIC: operates under the Australian Securities and Investments Commission Act 2001 (ASIC Act) and the Corporations Act 2001 (Corporations Act); responsible for market integrity, consumer protection, and regulation of investment banks and finance companies. - AUSTRAC: financial intelligence agency; oversees compliance with the Financial Transaction Reports Act 1998 and the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 for ADIs. - CFR: Council of Financial Regulators (APRA, ASIC, RBA, Treasury) — non-statutory body chaired by the RBA; coordinates and advises on financial regulatory arrangements. - Clear statutory definition and public disclosure: - Responsibilities and objectives of APRA, ASIC, and the RBA are clearly defined in different legal texts. - Trans-Tasman cooperation: APRA must support New Zealand authorities and avoid actions likely to have detrimental effects on New Zealand financial stability; mirrored by Section 68A of the Reserve Bank of New Zealand Act 1989. ### EC2 — Primary objective of supervision (Description and findings) - APRA objectives and statutory duties: - APRA Act subsection 8(1) main purposes: - regulating bodies in the financial sector in accordance with other laws of the Commonwealth that provide for prudential regulation or for retirement income standards; - administering the financial claims schemes provided for in the Banking Act and the Insurance Act 1973 (Insurance Act); - developing administrative practices and procedures to be applied in performing that regulatory role and administration. - APRA Act subsection 8(2): APRA is to balance the objectives of financial safety and efficiency, competition, contestability, and competitive neutrality and, in balancing these objectives, is to promote financial system stability in Australia. - Banking Act subsection 12(1): duty of APRA to exercise powers and functions for the protection of depositors of ADIs and for the promotion of financial system stability in Australia (Part II, Division 2 powers include seeking information, investigating, appointing a statutory manager, giving recapitalization directions, applying for winding up of ADIs). - Observations by assessors: - APRA is focused on financial stability but balancing with competition and other objectives may require delicate trade-offs and sufficient supervisory resources and skills. - Assessors suggest further clarification that APRA’s financial stability mandate is primary and other objectives are subordinate, to better clarify expectations regarding prudential policy making and supervisory decisions. ### EC3 — Legal framework to set and enforce prudential standards (Description and findings) - Prudential standards and guidance: - APRA can issue legally binding prudential standards under section 11AF of the Banking Act 1959 (as amended by the Financial Sector Legislation Amendment (Crisis Resolution Powers and Other Measures) Act 2018). - APRA also issues non-legally-binding prudential practice guides and has power under section 13 of the FSCODA to make reporting standards by legislative instrument. - Prudential standards are legislative instruments under the Legislation Act 2003 and subject to Parliamentary scrutiny (section 42 of the Legislation Act 2003). - Section 17 of the Legislation Act 2003: APRA must be satisfied that appropriate and reasonably practicable consultation has been undertaken before making a prudential standard; failure to consult does not affect validity. - Section 50 of the Legislation Act 2003: Prudential Standards are automatically repealed after 10 years (sunsetting) if not revoked earlier. - Scope and levels of application: - APRA’s three-level definition for banks and banking groups: - Level 1 means the ADI itself. - Level 2 means either: the consolidation of the ADI and all its subsidiary entities other than non-consolidated subsidiaries; or, if the ADI is a subsidiary of an authorized NOHC, the consolidation of the immediate parent NOHC of the ADI and all the immediate parent NOHC’s subsidiary entities. Consolidation at Level 2 must cover the global operations of an ADI and its subsidiary entities, as well as any other controlled banking entities, securities entities and other financial entities, except for entities involved in insurance; acting as manager, responsible entity, approved trustee, trustee, or similar role in relation to funds management; nonfinancial (commercial) operations; and securitization special purpose vehicles. - Level 3 means the conglomerate group at the widest level. - Most prudential standards apply to level 1 and level 2 entities; some non-financial prudential requirements apply at levels 1, 2, and 3 (risk management, governance, fit and proper, business continuity, outsourcing). - Discretions and tailoring: - Section 11AF permits standards to provide for APRA to exercise powers and discretions, including to approve, impose, adjust or exclude specific prudential requirements in relation to specified ADIs or authorized NOHCs or subsidiaries, and to impose different requirements for different situations or classes of entities. - In practice APRA varies requirements based on risk profile and systemic importance, notably for capital (including pillar capital add-ons) and liquidity. - Examples: - larger banks: subject to DSIB buffers, can apply advanced approaches for capital requirements, required to apply LCR and NSFR; - smaller banks: apply standardized approaches for capital requirements and simpler measures of liquidity. - Enforcement powers: - Banking Act Part II, Division 1BA (section 11CA) gives APRA power to issue directions to an ADI or an authorized NOHC under circumstances including contravention of the Banking Act or prudential standards, material deterioration in financial condition, or conducting affairs in an improper or financially unsound way. - Directions may include: compliance with legislation or prudential standards; ordering an audit at the entity’s expense by an APRA-chosen auditor; removal or appointment of directors or senior officers; removal or appointment of auditors; prohibition of accepting deposits or borrowing; prohibition of dividend payment; prohibition of deposit payment or undertaking financial obligations; reconstruction or amalgamation of the business or group. - Failure to comply with a direction results in an offense against the ADI, the authorized NOHC or the relevant body corporate. - Section 11AG: an ADI, authorized NOHC or a subsidiary to which a prudential standard applies must comply with the standard; breach of a prudential standard is a breach of Section 11AG and a breach of the Act, triggering certain powers under the Banking Act (e.g., injunctions). ### Key observations, limitations, and procedural safeguards - Parliamentary scrutiny and potential risk: - Prudential standards are legislative instruments subject to being tabled in Parliament and may be disallowed within 15 sitting days under the Legislation Act 2003; this has not occurred in practice but could, in extreme circumstances, impede introduction of key prudential standards. - Consultation and sunsetting: - Requirement to be satisfied that appropriate and reasonably practicable consultation has been undertaken before making a prudential standard (section 17, Legislation Act 2003); failure to consult does not invalidate a standard. - Prudential Standards automatically repeal after 10 years (sunsetting) if not revoked earlier (section 50, Legislation Act 2003). - Practical supervisory tailoring: - APRA uses statutory discretions to tailor prudential requirements by risk profile and systemic importance, especially in capital and liquidity regimes. *Source: Australia — Detailed Assessment (Table 1 content).* ### Section 65A, revocation of authority under Section 9A(2). ### Section 65A, revocation of authority under Section 9A(2) ### EC4 — Updating of banking laws, regulations and prudential standards; public consultation - Treasury is responsible for providing advice to the government regarding the legislative framework for the financial system in Australia. - Amendments to banking and financial laws require Government approval and are made most commonly in response to recommendations through reviews and inquiries (for example, the Financial System Inquiry (FSI) or the Parliamentary Review into the four major banks) or at the request of regulators. - The Treasury and CFR agencies collaborate to identify and discuss with the Government amendments to the legislative framework to ensure continued relevance and effectiveness. - Amendments to banking laws are subject to public consultation before introduction into Parliament. - The financial system framework was subject to a comprehensive review in 2014 and significant new reforms have been legislated. - A FSI was launched in 2013 by the Treasurer; the final report of the FSI was released in December 2014. - The FSI included 44 recommendations in several financial sector areas, including on the resilience of the financial system and the strength of the regulatory system. - Recommendations on financial system resilience called to: - enhance capital standards so that ADIs’ capital ratios are “unquestionably strong,” - narrow mortgage risk weight difference between IRB and standardized ADIs, - implement a framework for minimum loss absorption and recapitalization capacity. - Regulation-related recommendations focused on the need to: - increase regulator accountability, - provide regulators with more stable and flexible funding, - strengthen ASIC funding and powers, - strengthen the focus on competition, - increase the time to implement complex regulatory changes and conduct more frequent post-implementation reviews. - Several reforms have been enacted and some are underway to implement the FSI recommendations. - The prudential framework is typically updated to respond to: - risks observed in the domestic and international environment, - ensure domestic application of international standards, - update outdated standards, - align requirements across regulated industries where appropriate. - APRA governance and policy development: - APRA’s internal Prudential Policy Committee (PPC) monitors the age and relevance of the prudential framework. - APRA’s Policy and Advice Division (PAD) maintains the effectiveness of prudential and reporting standards (and prudential practice guides). - APRA guidance known as the ’Red Guide’ guides prudential policy development. - The policy development process comprises 29 key steps detailed in corresponding modules. - The Red Guide includes a policy priority matrix approved biannually by APRA’s Executive Board (EB). - Initiatives in the policy priority matrix are classified according to size in terms of resourcing, urgency, and strategic priority for APRA. - Work on policy initiatives generally commences only when an item has been added to the policy priority matrix. - Sound governance arrangements include continuous internal consultation, project reporting requirements, and frequent communication. - Legislative instrument-making is governed by the Legislation Act 2003: - Chapter 3, Part 1, Section 17 stipulates that rule-makers should consult before making legislative instruments and be satisfied that consultation is appropriate and reasonably practicable. - Consultation may involve notification or advertisement of affected bodies or organisations, invite submissions by a specified date, or invite participation in public hearings. - APRA consultation practice: - APRA conducts extensive consultation before making, varying or revoking a prudential standard that is a legislative instrument. - The consultation period is typically eight weeks but is often longer for major reforms. - APRA addresses key comments in a response paper accompanying any final prudential standard released publicly. - All non-confidential submissions are published on APRA’s website. ### EC5 — Supervisory powers of access, group-wide review, and supervision of foreign banks - Statutory and prudential authorities: - The Banking Act and the prudential standards provide APRA with power to have full access to boards, management and records of banks and banking groups and to review prudential activities. - Specific legal powers and provisions: - Section 13 of the Banking Act requires ADIs to supply information (including books, accounts or documents) relating to the ADI’s financial stability as required by APRA in a written notice. - Section 62 of the Banking Act requires: - an ADI, an authorized NOHC, and their subsidiaries to give APRA information in relation to them or any member of a relevant group of bodies corporate of which they are a member; - where an ADI is a subsidiary of a foreign corporation: - (i) another subsidiary of the foreign corporation that is incorporated in Australia to give APRA information in respect of the subsidiary; or - (ii) another subsidiary of the foreign corporation that is not incorporated in Australia and carries on business in Australia to give APRA information in respect of its Australian operations; - any other person who carries on banking business in Australia to give APRA information in connection with the person’s banking business. - The requirement to supply information may include books, accounts, or documents; failure to comply is an offence. - Section 61 of the Banking Act gives APRA the power to appoint a person to investigate and report on prudential matters; a body corporate must give the investigator access to books, accounts and documents and required information and facilities; failure is an offence. - Prudential Standard CPS 510 Governance: - CPS 510 requires directors and senior management of a locally incorporated APRA-regulated institution and the senior management of a foreign ADI to be available to meet with APRA on request (Paras. 21 and 47 of CPS 510). - Monitoring and supervisory scope: - Part II, Division 1A, Section 11B of the Banking Act sets APRA’s functions to include: - the collection and analysis of information in respect of prudential matters relating to ADIs and authorized NOHCs; - the encouragement and promotion of sound practices by ADIs and authorized NOHCs in relation to prudential matters; - the evaluation of the effectiveness and implementation of those practices. - APRA conducts prudential reviews and prudential consultations covering ADIs (banks, banking groups, NOHCs), domestic and cross-border activities, and activities of foreign banks in Australia. - The Financial Sector (Collection of Data) Act 2001 (FSCODA) enables APRA to collect information to assist APRA to perform its functions or exercise its powers under other laws. - APRA seeks information from other jurisdictions under MoU arrangements and attends/hosts supervisory colleges for complex institutions where supervisory risks and activities information is exchanged. ### EC6 — Corrective action, sanctions, license revocation, and crisis resolution powers - Corrective Action Powers and Sanctions (Part II, Division 1BA of the Banking Act): - APRA may issue directions to ADIs, authorized NOHCs and subsidiaries when: - the body corporate has contravened, or is likely to contravene, the Banking Act, the FSCODA, a prudential requirement regulation, or a prudential standard; - the body corporate has contravened a condition or a direction under the Banking Act or the FSCODA; - the body corporate is conducting its affairs in an improper or financially unsound way or in a way that may cause or promote instability in the Australian financial system, is or is about to become unable to meet its liabilities, or there is or there might be a material deterioration in the body corporate’s financial conditions. - Possible directions and measures include: - an order to comply with the Banking Act, the FSCODA, or a prudential requirement regulation or standard; - an order to audit the affairs of the body corporate at its own expense; - removal of a director or senior manager or appointment of person(s) as director or senior manager as directed by APRA; - removal of an auditor and appointment of another for such term as APRA directs; - banning the body corporate from accepting deposits, borrowing, or undertaking any financial obligations on behalf of any person; - prohibiting the payment of dividends; - requiring changes to systems, business practices or operations; - reconstructing, amalgamating or otherwise altering all or part of the business, structure, or organization of the body corporate or the group constituted by the body corporate and its subsidiaries. - Non-compliance with a direction can result in criminal penalties. - Investigation and control powers: - APRA may investigate the affairs of an ADI, appoint an investigator, take control of the ADI’s business or appoint an administrator if: - the ADI informs APRA that it is likely to become unable to meet its obligations or about to suspend payment; - APRA considers that, without external support, the ADI may become unable to meet obligations, may suspend payment, or will be unable to carry on banking business in Australia consistent with depositors’ interests or financial stability; - the ADI becomes unable to meet its obligations or suspends payment; - an external administrator has been appointed to a holding company of the ADI (or similar in a foreign country) and APRA considers the appointment poses a significant threat to the ADI’s operation or soundness, depositors’ interests, or the stability of the financial system in Australia; - If the ADI is a foreign ADI, an application for or appointment of an external administrator or similar procedure in a foreign country has been made. - A statutory manager remains in control until APRA considers it is no longer necessary or if APRA has applied for the ADI to be wound up. - Crisis resolution and additional authorities: - The Crisis Resolution Act amended the Banking Act to give APRA additional powers for crisis management to facilitate an orderly resolution of distressed or failing regulated entities. - Disqualification and BEAR Act accountability measures: - Section 21 of the Banking Act allows the Federal Court, on APRA application, to disqualify a person from being or acting as a director or senior manager of an ADI (other than a foreign ADI) or an authorized NOHC, a senior manager of the Australian operations of a foreign ADI, or an auditor of an ADI or authorized NOHC if the Court is satisfied the person is not fit and proper; disqualification may be in relation to a particular ADI or authorized NOHC, or a class or all of them. - The Treasury Laws Amendment (Banking Executive Accountability and Related Measures) Act 2018 (BEAR Act) was enacted in February 2018 and becomes effective on July 1, 2018. - Under new Section 37J, APRA may disqualify a person from being or acting as an “accountable person.” - Accountable persons of an ADI include individuals holding positions with actual or effective senior executive responsibility for management or control of the ADI, or significant parts of its operations or corporate group, including: - board members, - general managers, - senior executive responsibility for management of the ADI’s financial resources, - overall risk controls and/or overall risk management arrangements, - management of the ADI’s operations, - information management (including information technology systems), - management of the ADI’s internal audit function, - management of the ADI’s compliance function, - management of the ADI’s human resources function, - management of the ADI’s anti-money laundering function. - The Banking Act also provides for accountable persons of an ADI’s subsidiary, where appropriate. - Other sanctions: - Various other sanctions are provided under the Banking Act, for example, injunctions under Section 65A, issuance of directions under Section 11CA, and civil penalties. - License withdrawals *Source: Section 65A, revocation of authority under Section 9A(2).* ### Section 9A of the Banking Act allows APRA to revoke a license to carry on banking business in Australia ### 1ausea2019006 - Section 9A of the Banking Act allows APRA to revoke a license to carry on banking business in Australia ### Section 9A: Grounds for revocation of an authority to carry on banking business - APRA may revoke a license under Section 9A of the Banking Act where any of the following circumstances apply: - the licensed entity provided, in connection with its licensing application, information that was false or misleading in a material issue; - non-compliance with the Banking Act or regulations/standards, FSCODA, a direction, a condition of its authority to carry on banking business in Australia or a provision of Australian federal law specified in regulations; - where it would be contrary to the national interest, financial system stability in Australia or the interests of depositors for the authority to continue; - the ADI is insolvent and unlikely to return to solvency within a reasonable period of time; - if the ADI is a foreign corporation, it is unlikely to meet its liabilities in Australia and is unlikely to be able to do so within reasonable time or its authority to carry on banking business in a foreign country has been revoked or withdrawn. ### Cooperation and coordination on resolution of banks - APRA is the lead resolution authority in Australia with a wide range of enforcement and crisis management powers to deal with institutions engaging in unsafe and unsound practices or which may be failing or likely to fail. - The Council of Financial Regulators (CFR) coordinates resolution activities and operates in accordance with a MoU on financial distress management that sets out objectives, principles, and processes for dealing with stresses in the Australian financial system. - Key cross-border and trans-Tasman arrangements: - CFR has a key relationship with New Zealand authorities via the Trans-Tasman Council on Banking Supervision (TTBC) operating under the Memorandum of Cooperation on Trans-Tasman Bank Distress Management. - A Protocol for Coordination of Crisis Communications was established in July 2014 by the TTBC setting out communication principles, areas of responsibilities, objectives, and development and coordination of media statements. - TTBC agencies have progressed work on resolution strategies, operational matters, and simulations; the latest TTBC crisis simulation was undertaken in September 2017. - Crisis Resolution Act enhancements and APRA powers: - The Crisis Resolution Act further enhanced and aligned APRA’s crisis management powers across regulated industries and strengthened the foundation for orderly resolution of financial institutions to protect beneficiaries’ interests. - APRA’s resolution powers include the right to appoint a statutory manager for problem ADIs acting with the same powers and functions of the ADI board, with the right to sell or otherwise dispose of the whole or any part of the ADI’s business. - Under section 16AAA of the Banking Act, APRA can apply to the Federal Court of Australia for an order that an ADI be wound up if APRA considers that the ADI is insolvent and could not be restored to solvency within a reasonable period. - Information sharing and MoUs: - Under Section 56(5)(a) of the APRA Act, APRA can share information with a foreign agency responsible for supervising or regulating financial institutions where the information will assist the agency to perform its functions or exercise its powers. - APRA’s approach to cooperation on cross-border crisis management is supported by MoUs with various domestic and international agencies. ### EC7 — Power to review parent and affiliated company activities (description and findings) - Legal powers to seek information (as per section 62 of the Banking Act): - APRA can seek information from an ADI, in respect of the ADI or any member of the relevant group of bodies corporate of which the ADI is a member; - an authorized NOHC, in respect of the NOHC or in respect of any member of a relevant group of bodies corporate of which the NOHC is a member; - a subsidiary of an ADI or an authorized NOHC, in respect of the subsidiary or in respect of any member of a relevant group of bodies corporate of which the subsidiary is a member; - another subsidiary of the parent foreign corporation of an ADI (whether or not the ADI is itself a foreign ADI) that is incorporated in Australia or carries on business in Australia, in respect of its Australian operations; - any person who carries on banking business in Australia, in connection with the person’s banking business. - Investigatory and authorization powers: - As per Section 61 of the Banking Act, APRA has the power to appoint an investigator to an authorized NOHC and subsidiaries of an ADI or authorized NOHC. - Under the Crisis Resolution Act, a new provision allows APRA to give a notice to a holding company of an ADI to require it to ensure that it or one of its subsidiaries becomes an authorized NOHC of the ADI (Section 11AE). - APRA may, at the point of authorizing an ADI, make the authority conditional on any holding company of the would-be ADI being an authorized NOHC (subsection 9AA(3)). - At authorization, APRA receives an undertaking from the foreign parent to keep APRA informed of any significant developments adversely affecting its financial soundness and/or reputation globally. - MoUs: - APRA has established MoUs with various international regulators through which it can seek information on the parent and group activities of foreign ADIs. ### Assessment of Principle 1 (Compliant) - Findings: - APRA has broad powers and clear responsibilities underpinned mainly in the Banking Act and APRA Act. - APRA is responsible for prudential regulation and supervision of ADIs; ASIC, the Treasury, and AUSTRAC also have roles relevant to banking regulation. - The APRA Act requires APRA to pursue the objective of promoting financial system stability while balancing other objectives such as financial safety, efficiency, competition, contestability, and competitive neutrality. - APRA appears focused on its financial stability mandate while permitting more competition in the banking sector; assessors suggest clarifying the primary nature of APRA’s financial stability mandate and that other objectives are subordinate to it. - APRA has broad powers to review activities of banks and banking groups and to take corrective actions and sanctions. - Prudential standards are legislative instruments subject to parliamentary scrutiny and could be disallowed by the parliament, which poses a potential concern to APRA’s regulation-setting powers. - Significant reforms have been passed recently to strengthen banks’ resilience through Basel III application and to strengthen APRA’s crisis management, resolution, and governance enforcement powers. - Main gap identified: - The need for APRA to table its prudential regulations in the Parliament, which could subject them to being disallowed by the Parliament. This could, in extreme situations, limit APRA’s ability to introduce or change key prudential standards and thus potentially limit APRA’s ability to achieve primary objectives. - This issue overlaps with Ministerial direction powers (CP2) and is dealt with in that assessment; a full grade was given to this standard due to avoidance of double jeopardy. Were it not for double jeopardy, the standard would have been graded as largely compliant. ### Principle 2 — Independence, accountability, resourcing, and legal protection for supervisors (EC1 and EC2) - EC1: Operational independence, accountability, and governance (description and findings) - APRA is established under Section 7 of the APRA Act and is a statutory authority legally separate from the Commonwealth; for PGPA Act purposes APRA is taken to be part of the Commonwealth. - Independence: - APRA’s operational processes are stipulated in the APRA Act and prudential powers are mainly based on the Banking Act. - The Government periodically issues a Statement of Expectations (SOE) to APRA; APRA responds with a Statement of Intent. Both are published on APRA’s website and are fairly high-level. - The latest Government Statement of Expectations with respect to APRA was issued in 2014. - An updated SOE was provided to APRA on June 27, 2018. APRA is required to respond by the end of September 2018 at which time they will both be released publicly. - The 2014 SOE expected APRA to take into account the Government’s broad policy framework including a deregulation agenda, look for opportunities to reduce compliance costs, comply with enhanced regulatory impact analysis, prefer principles-based regulation, and act in accordance with regulatory best practice. - APRA’s Statement of Intent supports the Government’s commitment to reducing red tape and compliance costs and highlights APRA’s risk-based approach to supervision. - APRA has the power to make Prudential Standards, issue enforcement orders, appoint a statutory manager, and take other prudential actions of its own initiative. - Section 12 of the APRA Act grants the Minister the power to give APRA a written direction about policies it should pursue or priorities it should follow. The Minister must notify APRA in writing that a direction is being considered and give the Chair an opportunity to discuss the need for the proposed direction. - Protections and constraints regarding Ministerial directions: - The Minister must not direct APRA about a particular case (i.e., decisions concerning individual institutions). - The APRA Act requires the direction to be published in the Gazette and tabled in the Parliament, but failure to do so does not affect validity. - To date, the Minister has never exercised this power to make directions to APRA. - The Treasurer has approval power for changes in ownership and merger and acquisition transactions in the financial sector; certain smaller transactions may be delegated to APRA to approve without Government involvement. - Governance: - APRA’s governance comprises a full-time Executive Board of at least three and no more than five members. - At least three APRA members must be appointed as full-time members; Executive Board members are appointed by the Governor-General by written instrument. - The Executive Board meets formally on a monthly basis and holds management meetings with senior management at least weekly. - Historically, the APRA Executive Board has comprised three members: a chair, a deputy chair, and a board member. - At the end of May 2018, the Treasurer introduced a Commonwealth bill to allow a second deputy chairperson to be appointed to APRA: the Treasury Laws Amendment (APRA Governance) Bill 2018 was introduced into the House of Representatives on May 24, 2018. If passed, the amendments will apply to the APRA Act 14 days after receiving the Royal Assent. - The Treasurer explained that permitting a second deputy chair will provide greater flexibility, enhance oversight, and assist with recruiting senior and experienced members. The amendments would permit, but not require, two deputy chairs and do not prescribe particular roles for each deputy. - At the end of May 2018, the Government nominated the current Treasury Deputy Secretary to become the additional Deputy Chair at APRA. This appointment will be for a five-year term and is conditional on Governor-General approval and on Parliament agreeing to the Bill allowing up to two Deputy Chairs. - Accountability: - Accountability mechanisms include preparation and publication of APRA’s Corporate Plan every year (covering the next four years), publication of an annual performance statement demonstrating performance against stated objectives, reporting against the Australian Government’s Regulator Performance Framework, and subjection to Australian National Audit Office (ANAO) financial and performance audits. - APRA can be asked by Parliament to appear before House and Senate Committees ad hoc and has a standing appearance before Senate Committees three times a year via its responsible Ministers, the Treasurer, and the Minister for Revenue and Financial Services. - EC2: Appointment and removal process for APRA heads and governing body members (description and findings) - The APRA Act provides for the appointment of APRA Members, restrictions on appointments, appointments of the APRA Chair and Deputy Chair, and acting appointments. *Source: 1ausea2019006 - Section 9A of the Banking Act allows APRA to revoke a license to carry on banking business in Australia* ### Section 16 of APRA Act states that APRA is to consist of not fewer than three members nor more than five ### 1ausea2019006 - Section 16 of APRA Act states that APRA is to consist of not fewer than three members nor more than five ### Composition and appointments (Section 16, Section 18) - APRA is to consist of not fewer than three members nor more than five members. - At least three of the APRA members must be appointed as full-time members; each of the other APRA members (if any) may be appointed as a full-time or part-time member. - APRA Members are appointed by the Governor-General, by written instrument, usually on the advice of the Treasurer. - The Governor-General appoints APRA’s Chair and Deputy Chair from among full-time APRA members (in practice based on the advice of the Treasurer). - Historically the APRA Executive Board has consisted of three members: a Chair, a Deputy Chair, and a Board Member; this is currently the case. - In May 2018 the Treasurer introduced a change to the APRA Act to allow appointing a second Deputy Chair. The Government has nominated the second Deputy Chair; confirmation is subject to enactment of the new Bill amending the APRA Act and the approval of the Governor-General. ### Appointment criteria and restrictions (Section 17) - The Minister must be satisfied that the person is qualified for appointment by virtue of his or her knowledge or experience relevant to APRA’s functions and powers. - A person cannot be appointed if s/he is a director, officer or employee of a body regulated by APRA. - A person who is a director, officer or employee of a body operating in the financial sector, other than a body regulated by APRA, may be appointed as an APRA member only if the Minister considers that the person will not be prevented from the proper performance of the functions of the office because of resulting conflicts of interest. ### Terms of office, acting appointments, and remuneration (Sections 20, 19, 22) - An APRA Member holds office for the period specified in the instrument of appointment. The period must not exceed five years. - Reappointments are not specifically covered in the APRA Act but occur regularly in practice. - Under section 19 the Minister can: - appoint a person to act as a full-time APRA member during any period when there are fewer than five persons who are APRA members; or - appoint a person to act as a part-time APRA member during any period when: (i) there are fewer than five persons who are APRA members; and (ii) there are at least 3 persons who are full-time APRA members; or - appoint a person to act in the place of a full-time APRA member or part-time APRA member during any period when the APRA member is acting as Deputy Chair, is absent from duty, or is, for any reason, unable to perform the functions of his or her office; or - appoint an APRA member to act as Chair or Deputy Chair in case of the vacancy of these posts or if the persons that were assuming these posts are absent from duty, or are, for any reason, unable to perform the functions of their office. - Persons appointed by the Minister under the first two points above and in case of filling a vacancy must not continue to act under the appointment for more than 12 months. - An APRA member is to be paid the remuneration that is determined by the Remuneration Tribunal as well as the allowances that are prescribed. If no determination by the Tribunal is in operation, the member is to be paid the remuneration that the Minister determines (though this has not happened in practice). ### Termination and grounds for removal - The functions of an APRA member terminate immediately if he takes a position with a body regulated by APRA. - The Governor-General may terminate appointments for fairly strict reasons, including: - Misbehavior, physical or mental incapacity, or bankruptcy; - Extended absence for full-time members or absence from three consecutive APRA meetings for part-time members (except in cases of leave from absence); - Engagement of a full-time member in another paid employment (without the Minister’s approval) or engagement of a part-time member that conflicts or could conflict with his or her APRA functions; - If the member becomes a director or officer of a body operating in the financial sector (other than APRA regulated entities) and the Minister considers that this causes a conflict of interest with the APRA functions of the member; - If the member has an interest that has been or should have been disclosed (to APRA members and to the minister) and this interest conflicts or could conflict with the proper performance of the member’s functions. - The APRA Act does not require public disclosure of the reasons for removal; authorities indicated they would expect the relevant minister to make such disclosure if the power were exercised. ### Accountability and public reporting (EC3) - Commonwealth entities must prepare and publish a Corporate Plan at the beginning of the reporting cycle setting out information on key strategies and activities over a rolling four-year period. APRA’s corporate plan for the period 2017–21 is published on its website and includes vision, mission, and strategic initiatives: Enhancing leadership, culture and opportunities for APRA’s people; Honing governance and workplace effectiveness; Sharpening risk-based supervision; and Building recovery and resolution capability. - APRA publishes an Annual Performance Statement included in APRA‘s Annual Report which is tabled in Parliament. The Annual Report includes the Performing Entity Ratio and Money Protection Ratio as indicators of supervisory performance. - APRA reports annually against the Australian Government’s Regulator Performance Framework (RPF); APRA’s self-assessment is externally validated by stakeholders through an approved stakeholder mechanism and results are published on APRA’s website. - APRA adheres to the Public Governance, Performance and Accountability Act 2013 (PGPA Act) and is subject to Australian National Audit Office (ANAO) financial and performance audits; audit reports and transcripts of appearances before Parliament are publicly available. - APRA appears before House and Senate Committees on an ad hoc basis and has a standing appearance before Senate Committees three times a year via its responsible Ministers (the Treasurer, and the Minister for Revenue and Financial Services). ### Internal governance, decision-making and escalation (EC4) - The APRA Act (Part 3, Division 3) details meetings of the Executive Board, quorum, voting, and conduct of meetings. APRA must hold meetings as necessary; the Chair determines time and place but must convene a meeting if requested in writing by two or more APRA members. - Quorum: two members if APRA consists of 3–4 members (otherwise, it is three); decisions are by majority of votes of present and voting members. - The Executive Board has an established Charter, meets monthly, and seeks consensus; where consensus is not possible, questions are determined by majority vote. The person presiding has a deliberative vote and, if necessary, a casting vote. - Procedures exist for passing resolutions without a formal meeting (Section 32), including telephone or video conference or by circular resolution. - APRA’s Executive Board is supported by internal governance committees: Risk Management Committee (RMC) and Audit Committee comprising an independent Chair, an independent member and APRA’s Deputy Chair. Independent members of committees are appointed by the APRA Chair. - Committees are governed by internal charters and supported by internal assurance functions including internal audit, risk management, and quality assurance; APRA is also subject to external ANAO audits. - APRA has an Enterprise Risk Management (ERM) framework, documented delegations and procedures for decision-making, and a supervisory escalation framework moving from Normal to Restructure with supervisory actions/interventions at each stage. - Conflict-of-interest avoidance provisions include requirements to disclose interests in writing to the Minister and other APRA members, refraining from deciding on matters where conflicts exist unless disclosed and consented, and immediate termination if becoming a director or officer of an APRA-regulated body. ### Integrity, staff conduct, stakeholder perceptions, and confidentiality (EC5) - APRA values: Integrity, Collaboration, Respect, Excellence, and Accountability. The Chair must determine APRA Values and uphold and promote them. - APRA conducts biennial stakeholder surveys; the latest survey published in October 2017 covered regulated entities (RE) and knowledgeable observers (KO). - Stakeholder survey ratings published in the 2017 survey (by value and respondent type): - Integrity: REs 96% ; KOs 82% - Professionalism: REs 94% ; KOs 80% - Collaboration: REs 82% ; KOs 68% - Accountability: REs 79% ; KOs 69% - Foresight: REs 71% ; KOs 57% - APRA Code of Conduct requirements for employees include: - carry out duties and responsibilities to the highest standards of professional and personal behavior and with diligence, impartiality and responsiveness; - be alert to situations where private interests of employees or immediate family (declared annually) could conflict with duties at APRA (particularly ownership of interests in securities of institutions regulated by APRA and those pending licensing approval); - decline offers of sponsored travel and expensive gifts or hospitality; modest gifts or hospitality may be accepted; - respect confidential or sensitive information and not take advantage of information obtained during employment; - disclose outside employment that may conflict with APRA responsibilities; - disclose equity holdings in APRA-regulated entities and abide by the Staff Disclosure of Interests Policy when acquiring financial holdings. - Reporting and enforcement: - Employees must immediately report suspected breaches to their immediate manager or to the General Manager, People, and Culture. - APRA may investigate complaints or alleged breaches; may suspend employment while investigating if appropriate; disciplinary action up to and including termination of employment may be applied. - Secrecy and confidentiality (Section 56): - Detailed secrecy and confidentiality obligations apply to APRA members and employees regarding protected non-public information and documents. - A person commits an offence and may face imprisonment for two years if disclosing such information or producing documents to another person when exceptions in section 56 do not apply. - Where disclosure is made under an exception, conditions may be imposed on the recipient; it is an offence for the recipient to fail to comply with a condition, with a maximum penalty of two years imprisonment. *Source: 1ausea2019006 - Section 16 of APRA Act states that APRA is to consist of not fewer than three members nor more than five* ### Section 57 of the APRA Act gives APRA the power to determine that a document given to APRA under a ### Section 57 of the APRA Act gives APRA the power to determine that a document given to APRA under a ### Confidentiality and Section 57 - Section 57 of the APRA Act gives APRA the power to determine that a document given to APRA under a reporting standard does not contain confidential information when APRA considers that the benefit to the public from disclosing the document or information outweighs any detriment to commercial interests that the disclosure may cause. - APRA should give the interested parties a reasonable opportunity to make representations in relation to the confidentiality of the concerned documents or information. - Section 56 imposes secrecy obligations and confidentiality restrictions that apply to APRA members, staff, and any other person who, because or in the course of his or her employment, has acquired protected information or has had access to protected documents. ### EC6 — Resources, funding, and operational independence (description and findings) - EC6 requirement: The supervisor has adequate resources for the conduct of effective supervision and oversight. It is financed in a manner that does not undermine its autonomy or operational independence. This includes: - (a) a budget that provides for staff in sufficient numbers and with skills commensurate with the risk profile and systemic importance of the banks and banking groups supervised; - (b) salary scales that allow it to attract and retain qualified staff; - (c) the ability to commission external experts with the necessary professional skills and independence, and subject to necessary confidentiality restrictions to conduct supervisory tasks; - (d) a budget and program for the regular training of staff; - (e) a technology budget sufficient to equip its staff with the tools needed to supervise the banking industry and assess individual banks and banking groups; and - (f) a travel budget that allows appropriate onsite work, effective cross-border cooperation and participation in domestic and international meetings of significant relevance (e.g., supervisory colleges). - (a) APRA Budget — findings - APRA is funded primarily by levies imposed on all regulated institutions with a smaller contribution of income from fees and charges. - Industry levies are raised according to the Financial Institutions Supervisory Levies Collection Act 1998 and industry-specific Supervisory Levy Imposition Acts; the Minister determines levy rates following consultation with industry prior to each financial year. - APRA’s budget is set by the Australian Government after consideration of funding requests proposed by APRA Members; ongoing funding (majority of APRA’s funding) does not need annual re-approval and Government does not sign off on how APRA distributes its resources. - APRA’s financial arrangements are governed by the PGPA Act. - APRA is periodically subject to efficiency dividends and potential budget constraints from Government; these have generally not impacted significantly on APRA’s overall operational ability. - If APRA is asked to undertake new activities or considers it is inadequately resourced it can submit a New Policy Proposal (NPP) to the Government; if approved by the Government, Parliamentary approval through legislation is sought prior to appropriations. - APRA has received special appropriations for particular matters (example: significant additional funding to deal with the global financial crisis). - In the 2017–18 Federal budget APRA obtained an additional A$40 million, approximately, of new funding over four years (of which A$7 million will be received in 2017/18) to cover initiatives including stress testing, IT security, review of industry remuneration practices, data analytics, and financial claims scheme administration. - As a result of these additional budget allocations, APRA’s expense budget will be sufficient to provide for a staffing complement of 626 staff which is a net increase of 21 staff compared to the previous budget. - APRA’s budget has increased by an annual average of around 2.7 percent since 2014, with this growth supported by the 2017–18 new funding. - Operational costs incurred per A$ 1000 of assets supervised declined from almost 3 cents in 2011 to a slightly higher than 2 cents in 2017. - The Government considered the FSI recommendation on adopting a three-year funding model for APRA and ASIC; to date the Government has no known plan to move ASIC or APRA to a three-year funding model. - Conclusion: APRA’s budget is subject to constraints (need for government endorsement for new funding, efficiency dividends) that could potentially limit APRA’s flexibility and visibility to plan activities and perform functions autonomously, despite successive governments providing support and additional funding in certain instances. - (b) Salary scales to attract / retain high quality staff — findings - Federal Remuneration Tribunal sets pay levels for APRA members; remainder of Executive Group remuneration is determined with reference to financial sector market data and APRA pay scales. - Workplace Bargaining Policy 2018 (administered by APSC) imposes constraints on APRA’s employment and remuneration policies, requiring approval of the APS Commissioner prior to discussing proposed increases with employees and setting a cap remuneration increase up to 2 percent per annum. - APRA is generally able to attract and retain qualified staff and adequate skills, but the policy constraints are increasingly limiting APRA’s ability to attract and retain specialist skills and capabilities, particularly those in high demand or at senior levels. - APRA has remuneration levers under its enterprise agreement and some individual flexibility arrangements to attract targeted specific skillsets. - APRA historically targets an average remuneration around the 25th percentile of the financial sector, with flexibility at each level; APRA appears now to be behind the target range and this position could worsen with APS limitations. - APRA cannot match the higher end of the sector in long-term incentives and bonuses. - APRA conducted a market survey in 2016; the survey confirmed the impact of current limitations on APRA’s ability to attract and retain needed staff. - Voluntary turnover: overall rate reached 7.5 percent in May 2018; turnover for the Risk and Data Analytics Division reached around 13.75 percent in May 2018. - (c) Ability to commission external experts — findings - The APRA Act (section 47) enables APRA to engage consultants or other people to provide advice or perform services for APRA; these persons are subject to secrecy obligations in section 56. - APRA has not yet commissioned external experts to do supervisory work, but requires banks to engage external auditors for limited or reasonable assurance reviews on aspects related to prudential issues. - (d) Training budget and program — findings - APRA invests heavily in training and development focused on core supervisory skills; training budget has remained stable and allows effective training. - APRA Capability Framework sets capabilities, skills and behaviors required; curriculum identifies three levels of predominantly technical training, with Stages 1 and 2 expected to be completed in first 18 months and Stage 3 for experienced employees. - Training is supported by on-the-job activities, coaching, secondments to other prudential regulators and agencies abroad, and a well-regarded graduate program with dedicated training during the first two years. - (e) Technology budget — findings - APRA continues significant investment in technology infrastructure, including a major data modernization program referred to as Program Athena. - Additional funding to replace APRA’s aged statistical data collection platform was provided in 2016/17. - (f) Travel budget — findings - Travel budget provides for onsite visits to ADIs (including offshore operations), attendance at supervisory colleges, and participation in international committees and working groups. - There do not appear to be restrictions on travel budget, but funding is secured late during the year which can delay execution of the travel plan and affect domestic travel. ### EC7 — Workforce planning and skills gap assessment (description and findings) - EC7 requirement: As part of annual resource planning, supervisors regularly take stock of existing skills and projected requirements over the short- and medium-term, and implement measures to bridge gaps. - Findings: - APRA’s operating divisions forecast resource needs (including skills and capabilities) annually as part of business plans and input to the overall APRA budget. - Where standing budget appropriation is insufficient, APRA submits requests for additional budget resources annually for Government endorsement; actuals against forecasts are monitored monthly. - APRA plans to enhance its strategic planning framework to conduct more holistic and forward-looking skills gap assessments and strategic/workforce planning at an organizational level. - APRA hired an external consultant to assist in developing strategic initiatives and assessing resource gaps and medium-term skills needs; this study is expected to be completed in August and should inform APRA’s budget planning. ### EC8 — Risk-based allocation of supervisory resources (description and findings) - EC8 requirement: In determining supervisory programs and allocating resources, supervisors take into account the risk profile and systemic importance of individual banks and banking groups. - Findings: - APRA has a risk-based framework blending offsite and onsite supervisory activities that takes into account entity risk profile and systemic importance. - Key tools for resource allocation: PAIRS (Probability and Impact Rating System) and SOARS (Supervisory Oversight and Response System). - PAIRS: - Two dimensions: probability and impact of failure. - Inputs include outcomes of offsite and onsite supervisory activities. - Supervisors consider inherent risks, management and controls, capital support, and overall risk profile. - Probability of Failure ratings: Low, Lower Medium, Upper Medium, High, Extreme. - Impact of failure ratings: Low, Medium, High, Extreme. - Supervisory Attention Index (SAI): - Calculated as the geometric average of the probability index and the Impact Index (SAI = square root of the product of the two Indices). - Each dimension equally weighted. - Designed to assist assessment of the size of APRA’s supervisory task, identify priorities, and assist planning and resource allocation. - SOARS: - Four supervisory stances: ‘Normal,’ ‘Oversight,’ ‘Mandated Improvement,’ and ‘Restructure’. - SOARS informs supervisory intensity; typical activities increase in frequency, scrutiny, and use of APRA’s powers across stances. - Supervisory Action Plan (SAP): - A forward plan of supervisory activities covering the next 1–2 years, linking PAIRS/SOARS outputs to timing, scope, objectives, and resources. - SAP includes a prescribed ‘baseline’ or minimum level of supervisory activity and draws on other industry information and work by APRA’s Risk & Data Analytics division. ### EC9 — Legal protections for supervisors and staff - EC9 requirement: Laws provide protection to the supervisor and its staff against lawsuits for actions taken and/or omissions made while discharging their duties in good faith; the supervisor and its staff are adequately protected against the costs of defending their actions and/or omissions made while discharging their duties in good faith. - Description and findings: (no additional detail provided in the supplied content beyond EC9 heading) *International Monetary Fund — Australia Financial Sector Assessment (excerpt).* ### Section 58 of the APRA Act protects APRA members, staff, or agents from any liability for any acts or ### 1ausea2019006 - Section 58 of the APRA Act protects APRA members, staff, or agents from any liability for any acts or ### Legal protections, indemnity, and costs of defence - Section 58 of the APRA Act protects APRA members, staff, or agents from any liability for any acts or omissions in the exercise or performance, or the purported exercise or performance, of powers, functions, and duties conferred or imposed on them, provided they do not act in bad faith. - The APRA Act does not expressly indemnify APRA or its staff for any costs of defending their actions and/or omissions made while discharging their duties in good faith. - APRA relies on the Legal Services Directions 2017 (LSD) issued by the Attorney General under section 55ZF of the Judiciary Act 1903 for approval of expenditure to cover legal costs of an employee defendant where: - the proceedings arose out of an incident that relates to their employment with the employing agency; and - the employee acted reasonably and responsibility (i.e.,, where the employee has not engaged in serious or willful misconduct or culpable negligence). - APRA’s Directors’ and Officers’ Liability insurance policy provides cover where a director or officer is legally liable to pay for the consequences of a wrongful act. ### Governance, independence, resourcing, and assessment (Principle 2 — Assessment: Materially Non-Compliant) - Assessment outcome: Materially Non-Compliant. - Key governance and statutory features: - APRA Act grants the minister power to give APRA a written direction about policies it should pursue, or priorities it should follow, in performing or exercising any of its functions or powers. - The Act requires the minister to pre-notify APRA in writing that he is considering giving the direction and give the APRA Chair adequate opportunity to discuss the direction. - The minister’s direction power has never been exercised to date and is described as “highly exceptional” by parties, but the Act’s text does not perfectly convey its exceptional nature. - Parliamentary veto powers exist over APRA’s prudential standards (discussed in BCP 1). - Consequences and assessors’ concerns: - Potential for interference by the Treasurer in relation to APRA policy priorities or decisions, which could constrain APRA’s independence in prudential standard setting. - These direction powers, combined with parliamentary veto powers, “seem to put some potential pressure on APRA’s independence.” - The constraints could, in extreme circumstances, “result in the failure to introduce key prudential standards and policies, which may impact APRA’s ability to fulfill its statutory mandate.” - Accountability and transparency: - APRA publishes a four-year corporate plan, an annual performance statement, and an annual report. - APRA reports against the Government’s regulator performance framework and is subject to financial and performance audits. - APRA has a regular standing appearance before Senate Committees. - The APRA Act provides a clear process for appointment and removal of APRA members; however, there is no requirement to publicly disclose the reasons for removal if it happens in practice. - Resourcing and budgetary arrangements: - APRA has maintained a relatively steady level of supervisory resources and budget, with some increase happening in the recent year. - APRA is funded primarily by industry levies; the budget is set by the government after consideration of funding requests by APRA members. - Successive governments have supported APRA and provided it with additional funding for specific tasks and projects recently. - Need to submit new proposals for funding increases could limit APRA’s flexibility in performing operations and implementing initiatives. - There is some forward view of expected funding, but “there is uncertainty over the medium-term budget which may present difficulties for APRA’s resource planning.” - The current budget process “does not offer a reasonable level of flexibility and autonomy for APRA to set objectives and implement them in a reliable way.” - The “efficiency dividend” imposed by the government poses another constraint on APRA’s budget. - Staff recruitment, retention, and capabilities: - APRA has generally been able to recruit and retain high caliber staff with competent skills. - APRA’s employment framework is subject to the APS Workplace Bargaining Policy, which sets constraints on staff remuneration, including an annual cap of 2 percent on remuneration increase and periodic approval every three years. - These limitations increasingly limit APRA’s ability to retain high quality staff and to attract highly specialized skills such as in cyber risk and advanced risk analytics. - Overall turnover rate reached 7.5 percent in May 2018. - Turnover rate for risk specialists reached 13.75 percent in May 2018. - APRA has invested in training and a capability framework defining skills needed at different levels. - Overall conclusion by assessors: - The combination of ministerial direction powers, parliamentary vetoes, budgetary constraints, and staff employment/remuneration limitations “cause significant concerns to APRA’s independence and its operational ability to effectively deliver on its mandate.” - These matters taken overall represent material non-compliance for this principle. ### Cooperation and collaboration framework (Principle 3 — EC1, EC2, EC3 findings) - EC1 — Domestic cooperation and information sharing: - Section 56 of the APRA Act enables APRA to provide confidential information to domestic financial authorities to enable them to carry out their supervisory functions. - APRA, ASIC, the RBA and Treasury cooperate via the Council of Financial Regulators (CFR), chaired by the RBA. - CFR role and arrangements: - CFR is a coordinating body (forum for coordination, not a decision-making body); each agency discharges its own responsibilities. - CFR provides advice to the Australian Government on the adequacy of Australia’s financial regulatory arrangements and oversees objectives and implementation of financial distress management. - An MoU was signed in September 2008 between CFR members setting objectives, principles and processes for dealing with stresses in the Australian financial system. - The CFR meets on a quarterly basis. - CFR working groups cover topics including housing, shadow banking, over the counter (OTC) derivatives, etc. - Bilateral MoUs and statements: - MoU with ASIC sets cooperation and coordination arrangements in relation to regulatory and policy development, effective information sharing and cost of information provision, international representation, and joint activities. - A statement clarifies APRA as prudential regulator and ASIC as conduct regulator and lays out cooperation, information sharing, dialogue and liaison arrangements. - APRA and ASIC coordinate closely: semi-annual high-level meeting of Chairs, designated liaison persons, and quarterly liaison meetings at different staff levels. - MoU with Treasury sets basis for policy and operational coordination; notes APRA members have prudential policy making responsibility (subject to override by the Treasurer only in exceptional circumstances) and that APRA will consult Treasury in substantive development of prudential policies. - MoU with the RBA (signed in 1998) sets complementary responsibilities, arrangements for full and timely exchange of information, and a joint Coordination Committee that meets every six weeks or so (or more frequently as required); chair alternates between RBA and APRA. - MoU with AUSTRAC (signed September 2016) sets principles for cooperation including mutual access to information, privacy and secrecy, handling of suspicious matter reports in line with the AML/CTF Act, and treatment of APRA confidential information in line with the APRA Act. - APRA–AUSTRAC engagement: - APRA and AUSTRAC have three scheduled meetings per year between senior executives. - These meetings discuss general issues and updates but “do not go deeper to discuss specific issues at each supervised entity level,” limiting feed into banks’ risk assessments. - APRA has MoUs with other domestic agencies including the Australian Competition and Consumer Commission and the Australian Bureau of Statistics, and liaises with the Australian Federal Police (AFP) and the Australian Criminal Intelligence Commission (ACIC) on enforcement matters. - EC2 — Foreign cooperation and information sharing: - Section 56(5)(a) permits APRA to share information with a foreign agency responsible for supervising or regulating financial institutions where the information will assist the agency to perform its functions or exercise its powers. - APRA has established 33 international MoUs/Letters of Arrangement (LA), including with foreign regulatory agencies supervising banking operations of material interest to APRA (notably New Zealand and the U.K.). - Cooperation arrangements cover sharing of confidential information, ongoing supervision matters, and policy development proposals. - APRA participates in supervisory colleges and is the home supervisor for several Australian banks with material overseas operations. - APRA and RBNZ cooperation: - Strong links supported by information sharing arrangements, joint onsite reviews and periodic meetings. - APRA and RBNZ coordinate joint supervisory stress tests on the major banks. - The Trans-Tasman Banking Council (TTBC) and the Financial Sector Legislation Amendment (Trans-Tasman Banking Supervision) Act 2006 support trans-Tasman cooperation. - Trans-Tasman crisis simulations and continued work through the TTBC to develop resolution strategies and coordinate crisis responses. - APRA’s international engagement includes membership of the BCBS and Financial Stability Board committees and working groups. - EC3 — Conditions on providing confidential information: - Section 56 provisions allow APRA to provide confidential information to domestic authorities or foreign supervisors for supervisory purposes; APRA must take reasonable steps to determine that the receiving party will use information only for bank-specific or system-wide supervisory purposes and treat it as confidential by the receiving party. *Source: 1ausea2019006 - Section 58 of the APRA Act protects APRA members, staff, or agents from any liability for any acts or* ### Section 56 of the APRA Act establishes general confidentiality obligations not only for APRA members and ### 1ausea2019006 - Section 56 of the APRA Act establishes general confidentiality obligations not only for APRA members and ### Confidentiality framework (Section 56 of the APRA Act and MoUs) - Section 56 of the APRA Act imposes strict confidentiality requirements on APRA, its staff and any other person who, because of his or her employment or in the course of that employment, acquires protected information and/or documents. - APRA’s Code of Conduct reinforces the confidentiality obligations under section 56. - Under section 56: - APRA members, staff and other persons cannot directly or indirectly disclose protected information or documents received in the course of their duties to any other person or court if the information or document is protected (i.e., contains confidential non-public information). - There are very limited exceptions, for example disclosure to an auditor providing professional services to an ADI if the disclosure is for the purposes of the performance of APRA’s functions, or the exercise of APRA’s powers. - APRA cannot be required to disclose to a court any protected information except when necessary for the purposes of one of the laws the APRA administers. - Section 56 exempts APRA from the requirement to disclose confidential information under the Freedom of Information Act 1982. - Memoranda of Understanding (MoUs) with domestic and foreign agencies: - Include confidentiality clauses requiring parties to use their best endeavors to preserve confidentiality and to use confidential information exclusively for lawful supervisory purposes. - Prohibit disclosure of information exchanged under the MoUs to third parties except where legally compelled to do so; if so compelled, the disclosing party should notify the originating authority indicating the nature of the information to be released and the circumstances surrounding its release. - APRA maintains an internal procedure/protocol around the release of confidential information. - APRA’s position: the APRA Act and MoUs provide reasonable assurance that confidential information released will be used solely for supervisory purposes and treated confidentially by the receiving party. ### EC4 (Cross-border confidentiality practices and legal compulsion) - EC4 standard expectations summarized in source: - The supervisor receiving confidential information from other supervisors uses the confidential information for bank-specific or system-wide supervisory purposes only. - The supervisor does not disclose confidential information received to third parties without the permission of the supervisor providing the information and is able to deny any demand (other than a court order or mandate from a legislative body) for confidential information in its possession. - If legally compelled to disclose confidential information received from another supervisor, the supervisor promptly notifies the originating supervisor, indicating what information it is compelled to release and the circumstances surrounding the release. - Where consent to passing on confidential information is not given, the supervisor uses all reasonable means to resist such a demand or protect confidentiality. - Description and findings re EC4 in the source: - APRA’s statutory and contractual arrangements (section 56, Code of Conduct, MoUs) align with EC4 expectations. - MoUs signed by APRA with other domestic and foreign agencies set strict confidentiality rules and require prompt notification to the originating supervisor if disclosure is legally required. ### EC5 and resolution-support processes (APRA as supervisor and resolution authority) - APRA serves as both the supervisor and the resolution authority in Australia. - Internal processes supporting recovery and resolution planning/actions: - Escalation procedures through Supervisory Oversight and Response System (SOARS) moving from Normal to Restructure with appropriate supervisory actions/interventions at each stage. - Escalation and Enforcement Committee (EEC): - Chaired by the General Manager of Resolution and Enforcement. - Acts as formal escalation framework for addressing banks experiencing stress. - Comprises members of APRA’s supervision, resolution, and legal functions. - Meets on a monthly basis. - Maintains a watchlist of problem entities based on SOARS ratings and other supervisory information. - Escalation to the EEC is the first step where there is a reasonable prospect of APRA exercising powers in respect of an entity. - The EEC is an advisory body; final decisions rest with the ‘delegate’ (a member of APRA’s senior management at a specified level of seniority), usually from frontline supervision divisions, who consults with relevant parties including the General Manager of Resolution and Enforcement and the General Counsel. - In more severe circumstances (e.g., imminent failure of a bank), the EEC is likely to recommend convening a Financial Crisis Management Team (FCMT): - FCMT comprises senior staff from APRA’s executive and relevant supervisory, resolution, enforcement, and legal teams. - FCMT provides strategic direction, takes urgent critical decisions, and coordinates APRA’s engagement with other CFR agencies and the public concerning resolution. - APRA cooperates with other domestic agencies through the Council of Financial Regulators (CFR) and a MoU on Financial Distress Management among CFR agencies sets out principles for dealing with stresses in the financial system. - Statutory constraints and ministerial roles: - The consent of the Treasurer is required if APRA considers using certain resolution powers (e.g., directing a compulsory transfer of business from a bank, a holding company of a bank, or a subsidiary of a bank). - The declaration of Australia’s national deposit insurance scheme (the Financial Claims Scheme) is the responsibility of the Treasurer rather than APRA. ### Assessment of Principle 3 (Cooperation and information sharing) - Assessment: Compliant. - Comments from the source: - APRA has developed cooperation agreements and MoUs with various domestic and foreign regulators providing a good platform for interaction, discussion, and information sharing in relevant areas. - Cooperation has been extensive with ASIC, RBA and as part of the CFR. - There is some cooperation with AUSTRAC, but the source notes room for more frequent and entity-specific interaction. - APRA has established 33 international MoUs/Letters of Arrangement (LA), including with relevant foreign regulatory agencies with supervisory responsibility for banking operations of material interest to APRA (notably New Zealand and the U.K.). - APRA has a good framework for exchanging and preserving confidentiality of supervisory information. - As both supervisor and resolution authority, APRA has internal mechanisms and processes for dealing with distressed banks and for escalation to appropriate levels/bodies. ### Principle 4 — Permissible activities (overview and EC1–EC4 findings) - Principle statement: Permissible activities of institutions licensed and subject to supervision as banks are clearly defined and the use of the word “bank” in names is controlled. - EC1 — Definition of “bank” / “banking business” - The term “Bank” is not defined in legislation; the term “banking business” is defined in Section 5 of the Banking Act as: - a business that consists of banking within the meaning of paragraph 51(xiii) of the Constitution; or - a business that is carried on by a corporation to which paragraph 51(xx) of the Constitution applies and that consists, to any extent, of: - both taking money on deposit (otherwise than as part-payment for identified goods or services) and making advances of money; or - other financial activities prescribed by the Banking Regulations for the purposes of this definition. - The Banking Act further defines the term “ADI” as a body corporate that has been granted an authority to conduct banking business in Australia. - Section 66 of the Banking Act restricts the use of the word ‘bank’ in relation to financial business without APRA approval; section 66 expressly permits the use of “bank” by ADIs, and section 66AA gives APRA power to restrict use by a particular ADI or class(es) of ADIs. - EC2 — Permissible activities of licensed institutions - ADIs authorized by APRA can carry on banking business as defined in the Banking Act. - The range of permissible activities of licensed entities is not exhaustively defined in laws or regulations. - The Banking Act states that banking business involves taking money on deposit and making advances of money. - Subsection 66(1AC) allows all ADIs to use the word ‘bank’ in relation to their financial business unless APRA determines otherwise under section 66AA. - The Banking Act (section 66(4)(c)) provides that ‘financial business’ means a business that: - consists of, or includes, the provision of ‘financial services’; or - relates, in whole or in part, to the provision of ‘financial services.’ - APRA’s guidance: the term ‘financial services’ is not defined in the Banking Act but generally encompasses a broad range of activities, including (verbatim list from source): - banking business as defined in the Banking Act; - the provision of financial products as defined in the Corporations Act 2001 including: financial advice and planning business, investment business, or insurance business; - the provision of finance as defined in the Financial Sector (Collection of Data) Act 2001; - the provision of products and services regulated under the National Consumer Credit Protection Act 2009; - finance brokers; - financial services comparison websites; - specialist financial services directory websites; - superannuation funds (except for self-managed superannuation funds); - borrowing, lending, and other transactions (such as entering into hire-purchase agreements or financial leases or providing credit in other forms) in which the subject of the transaction is finance; and - conduct of activities in Australia by an entity that carries on banking business in a foreign country but does not carry on banking business in Australia. - The source notes that this definition of “financial services” does not intend to limit or specify permissible activities of banks; APRA allows banks to undertake different activities without limitation provided banks understand and manage the inherent risks and establish sound risk management frameworks. - A body corporate applying for a banking authority must undertake to: - adhere to APRA’s prudential requirements as they relate to the proposed ADI at all times; - consult APRA and be guided by it on prudential matters as they relate to the proposed ADI, including new business initiatives; - provide APRA with any information required for prudential supervision of the proposed ADI (and its consolidated group). - APRA may impose conditions on an ADI’s authority, including limitations on activities; for large and complex groups APRA may request nonbanking activities be undertaken in other parts of the group (e.g., funds management). - EC3 — Use of the word “bank” and derivations - Section 66 restricts use of words/expressions in relation to a financial business including ‘bank,’ ‘banker,’ and ‘banking,’ without APRA consent. - Section 66A restricts use of ‘authorized deposit-taking institution’ and ‘ADI’ without APRA consent. - Legislative change: The Treasury Law Amendment (Banking Measures No. 1) Act 2018 (passed by Parliament on 15 February 2018, effective May 2018) allows all licensed ADIs to use the word ‘bank’ in relation to their financial business unless APRA determines otherwise; this effectively lifted the restriction on the use of the word ‘bank’ by ADIs with less than A$50 million capital. - APRA has provided an exemption allowing a foreign corporation authorized as a bank in its home country to use ‘bank,’ ‘banker,’ or ‘banking’ in relation to raising funds in the Australian wholesale capital market through issuing securities, subject to conditions: - the securities must be offered and/or traded in parcels of not less than A$ 500,000; and - the securities and related information memorandum must clearly state that the issuer is not authorized under the Banking Act, the entity is not supervised by APRA, and the investment in the securities are not covered by depositor protection provisions. - EC4 — Taking deposits reserved for licensed/supervised banks - The source introduces EC4 (the taking of deposits from the public is reserved for institutions that are licensed and subject to supervision as banks) but the provided excerpt ends before detailed description/findings for EC4 are given. *International Monetary Fund — Content extracted from the specified IMF PDF chapter/section.* ### Section 8 of the Banking Act provides that only the Reserve Bank and bodies corporate that are ADIs may ### 1ausea2019006 - Section 8 of the Banking Act provides that only the Reserve Bank and bodies corporate that are ADIs may ### Exemptions to section 8 — overview - Section 8 of the Banking Act reserves carrying on “banking business” in Australia to the Reserve Bank and bodies corporate that are ADIs. - Exemptions to section 8 can be granted under Section 11 of the Banking Act, generally by way of class order. - Two exemptions currently in force: Registered Financial Corporations (RFCs) and Religious Charitable Development Funds (RCDFs). - Exempted entities are subject to regulation (although not supervision) by other regulators. ### Registered Financial Corporations (RFCs) — conditions and regulatory regime - Banking Exemption No. 1 of 2015 exempts registered entities from section 8, provided they comply with specified conditions: - Where a registered entity offers, issues, or sells a debenture to a retail investor: the debenture must have a maturity period of at least 31 days and the retail investor must not be able to redeem any funds for 31 days from the date they are invested in the debenture. - When a debenture issued or sold by a registered entity to a retail investor reaches maturity, the registered entity must roll over the retail investor’s funds into another debenture with a maturity period of at least 31 days or repay the retail investor’s funds. - The registered entity must not offer the following facilities to retail investors in relation to an investment product: automatic Teller Machine (ATM) facilities; BPAY facilities offered by BPAY Pty Limited ACN 079 137 518; electronic funds transfer at Point of Sale facilities; or cheque account facilities. - A registered entity must not use or assume the words or expressions deposit or at-call, or any other word or expression of like import, in relation to an investment product offered, issued or sold to a retail investor. - Where a registered entity takes money on deposit by offering, and issuing or selling, securities, or a financial product; and the offer of the securities or the issue/sale of the financial product need disclosure to the investor respectively under Parts 6D.2 and 7.9 of the Corporations Act, a “prudential supervision warning” must be clearly and prominently set out in each disclosure document relating to the securities or product stating that: the registered entity is not authorized under the Banking Act and is not supervised by APRA, the investment will not be covered by the depositor protection provisions or by the financial claims scheme. - RFCs are subject to an Australian Financial Services (AFS) license regime under the Corporations Act regulated by ASIC. - RFCs provide aggregate and non-prudential reporting to APRA in its capacity as the national statistical agency. - New RFCs can be established (the exemption is not merely for pre-existing companies). - Requirements imposed by ASIC relate to prospectus, disclosure, licensing arrangements. ### RFCs — size and trends (exact figures preserved) - Retail deposits held by RFCs declined from 6.6 percent (A$2.4 billion) as a percentage of total RFC resident deposits in 2012 to 1.6 percent (A$455 million) as of December 2017. - This is very small in proportion to total resident deposits of over A$2 trillion held with banks as of December 2017. - The assessors noted deposit of RFCs reduced to less than 0.12 percent of the resident banking sector deposits. ### Religious Charitable Development Funds (RCDFs) - RCDFs are not-for-profit funds set up to borrow and use money for religious and charitable purposes. - Their retail products must have the sole or dominant intention of furthering the religious and charitable purposes of the Fund. - RCDFs may continue to raise funds from retail investors under restrictions similar to those for RFCs. - Conditions tightened following the Financial System Inquiry (FSI) recommendation: - Retail deposits must have a maturity that is longer than 30 days. - Consumers must be alerted that these institutions are not governed by the Banking Act. - These limitations have reduced RFC and RCDF activities to a very insignificant amount relative to the size of the banking sector. ### Other institutional note - A government-owned insurance and banking organization operating in the Northern Territory that was not supervised by APRA was sold in 2014; the banking component is run by one of the credit unions in Australia. ### Publication and accessibility of licensed ADIs (EC5) - APRA publishes and maintains a list of ADIs on its website. - The register of ADIs is categorized as: - Australian-owned banks; - foreign subsidiary banks; - branches of foreign banks; - building societies; - credit unions; - restricted ADIs; and - other ADIs. - APRA also maintains a list of authorized non-operating holding companies (NOHCs) on its website. ### Licensing authority, powers and routes (EC1, EC2) - APRA is both the licensing authority and the supervisor of ADIs in Australia (section 9 of the Banking Act). - APRA may impose conditions on an institution’s license under section 9AA of the Banking Act, as amended by the Financial Sector Legislation Amendment (Crisis Resolution Powers and Other Measures) Act 2018. Conditions must relate to prudential matters and may have effect despite anything in the prudential standards or the regulations. - APRA introduced a phased approach to ADI licensing in early May 2018 with two licensing routes: - Direct route: applicants demonstrate ability and readiness to comply with the ADI prudential framework and may conduct intended banking business from licensing. - Restricted route: eligible applicants may obtain a restricted ADI license to conduct limited banking business while developing capabilities and resources; subject to simpler prudential requirements; must transition to an ADI full license within a maximum period of two years or surrender banking authority and exit the banking industry. - Characteristics and indicative guidance for restricted ADIs: - Restricted ADIs will be strictly limited in their activity and would not be expected to actively conduct banking business during the restricted period. - APRA would expect applicants using the restricted route to be at the smaller end of the banking industry. - APRA does not expect institutions applying for a restricted ADI license to have a balance sheet greater than A$100 million, which would equate to approximately A$20 million of equity under the Restricted ADI minimum capital requirements. - Institutions with balance sheet assets greater than A$100 million; have more than A$20 million of equity; and/or have parent institutions able to invest equity of more than A$20 million in establishing an ADI subsidiary would typically be expected to apply via the direct route. - In May 2018, APRA granted the first license under the restricted licensing regime to a digital bank. - Section 9 of the Banking Act states APRA may, by legislative instrument, set criteria for granting authority to carry on banking business. APRA has instead set out criteria and information requirements in the ADI Authorization Guidelines available on APRA’s website. ### Assessment and comments (Principle 4 and related) - Assessment of Principle 4: Compliant. - Comments: - The Banking Law defines “banking business” and includes a general definition of activities that can be carried on as banking business. - APRA supplements the broad definition with guidelines about activities within the area of “financial services.” - APRA usually relies on the understanding of the ADI Board about activities and associated risks. - Exemptions granted to RFCs and RCDFs have been strictly tightened since the last FSAP by: - preventing them from taking retail deposits with a maturity of less than 31 days, and - obliging them to include a “prudential supervision warning” in disclosure documents clearly stating they are not authorized under the Banking Act. - These changes and the sale in 2014 of a state-owned institution not subject to APRA supervision are viewed as positive developments. - Assessors concluded the conditions and scope of RFCs and RCDFs are very tight and their size is extremely small relative to the ADI sector; current situation does not impact compliance with the substance of this core principle. *Source: https://www.imf.org/-/media/files/publications/cr/2019/1ausea2019006.pdf* ### Section 9A of the Banking Act, as amended by the Crisis Resolution Act, outlines the circumstances where ### Section 9A of the Banking Act, as amended by the Crisis Resolution Act, outlines the circumstances where ### Revocation, reconsideration, and appeals - APRA may revoke a banking authority if the ADI has provided information that was false or misleading in connection with its application for authorization (Section 9A(2)(a) of the Banking Act as amended by the Crisis Resolution Act). - The Banking Act (Part VI) allows persons affected by an APRA decision who are dissatisfied with the decision to write to APRA (within 21 days) requesting it to reconsider the decision while explaining the reasons for the request. - APRA must reconsider the decision and may confirm, revoke, or vary it as APRA sees fit. - APRA should notify the person informing about the outcome of the reconsideration and the underlying reasons. - If the person is still dissatisfied with APRA reconsideration, the person can apply to the Administrative Appeals Tribunal for a review of the decision. - APRA’s decisions to refuse a license are subject to review by Administrative Appeal Tribunal (AAT). ### Licensing assessment focus (general) - APRA assesses: sources of initial capital, ownership, governance, risk management and internal control systems, compliance, information and accounting systems, external and internal audit arrangements, financial projections and strategic and operating plans. - The criteria for assessing a licensing applicant are overall consistent with APRA’s ongoing supervision requirements, which are set out in the prudential framework. - APRA’s ADI authorization guidelines (published in 2008) set criteria representing the minimum requirements for authorization under the Banking Act; these guidelines are in the process of being amended to take into account the new restricted ADI licensing regime. - In its licensing process, APRA focuses on: business plan, owners and controllers, governance framework (including board and senior management), risk management framework, financial resources (including sources of funding), IT and outsourcing strategies. ### EC3 — Consistency of licensing criteria with ongoing supervision - Licensing criteria require applicant to demonstrate to APRA’s satisfaction that the proposed new ADI will have: - strategic and financial viability, - an effective risk management framework, - compliance with legislative obligations and APRA’s prudential requirements at point of licensing and on an ongoing basis. - For Restricted ADIs: - Initial requirements and ongoing requirements during the ensuing two-year period may be simpler or different. - At the end of the restricted period (a maximum of two years), a Restricted ADI must have met APRA’s licensing criteria and information requirements to be granted a full ADI license (with or without conditions) including compliance with APRA’s prudential requirements. - If the Restricted ADI is unable to meet the licensing requirements, the Restricted ADI would cease to be an ADI. - Main areas where criteria for Restricted ADI licenses are simpler or different at time of granting include: Board and management, capital, liquidity, risk governance, IT infrastructure, recovery plan, and business continuity plan. - Applicants for restricted ADI licenses must prepare: - a strategy outlining their plan to meet the prudential framework and transition to an ADI license by the end of the restricted period, - an exit plan identifying avenues to exit banking business without impacting financial stability, relying on the financial claims scheme, or requiring use of APRA’s crisis management powers. ### EC4 — Assessment of legal, managerial, operational, and ownership structures - APRA supervisors assess proposed legal, managerial, operational and ownership structures of a proposed ADI and its wider group as part of the licensing application process. - ADI application must include: brief history, identity of direct and ultimate substantial shareholders and their respective shareholdings, details of related entities in Australia (or substantial shareholders of the foreign bank for a foreign ADI), proposed organizational structure, proposed activities and scale of operations (including specialized services and material outsourcing arrangements), details of risk management systems and procedures (including for offshore operations of proposed locally incorporated ADIs), and details of existing or proposed subsidiaries and associates. - APRA ensures that the overall structure of the proposed ADI will not hinder effective supervision on both standalone and consolidated basis. - Where applicant is part of a wider group, APRA assesses group-wide operations and reporting lines and may require the holding company of the conglomerate group to be authorized as a NOHC. - Similar assessment applies to Restricted ADI applications; APRA must be satisfied of sufficiency of structure and governance, identity and capacity of owners to support the institution and how that may change over time. - There are no shell banks operating in Australia and APRA does not allow such banks to operate. ### EC5 — Suitability and transparency of major shareholders - APRA requires applicants to identify names of substantial shareholders, both direct and ultimate, and their respective shareholdings, ownership structure, source(s) of initial capital and potential additional capital sources. - Applicants must demonstrate that all substantial shareholders are fit and proper, are well-established and financially sound entities of standing and substance, and represent a long-term commitment with capacity to contribute additional capital if required; declarations to that effect are required as part of licensing. - For restricted ADIs: - Applicants must clearly identify owners, including direct and ultimate owners, controllers, and provide a group structure chart showing ownership structure and any subsidiaries and related companies and details of related entities’ business and proposed linkages (e.g., outsourcing). - Shareholders of Restricted ADIs, if not able to demonstrate capacity to contribute additional capital, must demonstrate credible plans for seeking additional shareholders and divesting their shareholdings during the restricted period or according to the Financial Sector (Shareholdings) Act 1998 (FSSA). - FSSA ownership limits and delegations: - Ownership in locally incorporated ADIs is governed by the FSSA, which limits shareholdings of an individual shareholder, or group of associated shareholders, in an ADI to 15 percent of the ADI’s voting shares. - Depending on the nature of the acquisition, either the Treasurer or APRA (within delegations provided by the Treasurer) may approve shareholdings in excess of 15 percent where satisfied that it is in the national interest. - Under the current threshold of delegation the Treasurer has delegated approval authority to APRA in respect of ADIs with assets less than A$1 billion. - For cases falling below the threshold of delegation there is no provision in the FSSA for the Treasurer to overrule APRA’s decision. However, the Treasurer can overrule the delegation such that the decision reverts to the Treasurer. - In considering what is in the national interest, the Treasurer is able to consider a wide range of issues including prudential, competition and taxation effects. - While assessment of suitability of a shareholder over 15 percent might be made ultimately by the Treasurer, the Treasurer will seek APRA's opinion on the suitability of a shareholder. ### EC6 — Initial capital requirements - The ADI Authorization Guidelines specified that proposed new ADIs must have at least A$50 million in Tier 1 capital to use the word “bank” unless they are a branch of a foreign bank. However, this requirement has been recently removed. - Parliament passed the Treasury Law Amendment (Banking Measures No. 1) Act 2018 on February 15, 2018, that lifted, effective May 2018, the restriction on the use of the word ‘bank’ by ADIs with less than A$50 million capital. - No minimum initial capital is stipulated for new ADIs; applicants must satisfy APRA that they are able to comply with APRA Prudential Standard on Capital Adequacy (APS 110) from the commencement of the proposed ADI’s banking operations. - Australian branches of foreign banks: - Are not required to have or maintain endowed capital in Australia, but the foreign bank must meet the capital requirements of the home regulator, which must be comparable. - Licenses granted for Australian branches of foreign ADI restrict them from accepting retail deposits. - Foreign ADIs are not permitted to accept initial deposits (and other funds) from individuals and non-corporate institutions of less than A$250,000. - They can accept deposits and other funds in any amount from incorporated entities, non-residents and their employees. - Depositors with foreign ADIs do not have the same protections under the Act as depositors with locally incorporated ADIs. - Restricted ADI minimum capital during restricted phase: - A Restricted ADI will at all times need a minimum capital of the higher of: A$3 million plus a resolution reserve; or 20 percent of adjusted assets. - The resolution reserve is typically set at A$1 million, representing the likely costs of APRA resolving the entity which may, as a last resort, include administration of the Financial Claims Scheme if activated by the Australian Government. - APRA retains discretion to increase the size of the resolution reserve if a Restricted ADI is deemed particularly complex to resolve. - Capital for the restricted phase must meet the definition of Common Equity Tier 1 Capital. ### EC7 — Fit and proper assessment of Board and senior management - APRA licensing guidelines require applicants to satisfy APRA that persons holding key positions are fit and proper, in accordance with CPS 520. - As part of licensing, APRA reviews information demonstrating fitness and propriety of proposed directors and senior management in accordance with CPS 520. - CPS 520 establishes minimum requirements for regulated institutions in determining fitness and propriety, while ultimate obligation rests with the Board of Directors to ensure responsible persons are fit and proper. - Key CPS 520 requirements include obligation for a regulated institution to have a Fit and Proper Policy and to: - assess fitness and propriety of a responsible person prior to initial appointment and annual re-assessment, - submit information regarding responsible persons and the institution’s assessment to APRA. - CPS 520 sets criteria for determining whether a person is fit and proper, including: - Possession of the competence, character, diligence, honesty, integrity and judgment to perform properly the duties of the position; - The need for the person not to be disqualified under an applicable prudential act from holding the position; - The absence of a conflict of interest by the person in performing duties or a prudent determination that the conflict will not create a material risk preventing proper performance. - APRA undertakes independent checks and detailed assessment of directors and senior management if there are concerns about expertise and integrity; APRA will direct removal of unfit persons and will not grant a license until satisfied. - APRA assesses compliance with APRA Prudential Standard on Governance (CPS 510), which requires the Board to ensure directors and senior management collectively have the full range of skills needed. - CPS 520 equally applies to Restricted ADIs; CPS 510 applies to Restricted ADIs with minor concessions, including: - lower number of independent directors (minimum of two), - no requirement for board committees, - no policy for board renewal or procedures for assessing board performance. - Assessment for restricted ADIs applies proportionality; some restricted ADIs may finalize executive appointments and staff recruitment during the restricted phase so assessment of fitness and propriety of these persons may occur later in the process. *Source: 1ausea2019006 - Section 9A of the Banking Act, as amended by the Crisis Resolution Act, outlines the circumstances where* ### 2018. This will further strengthen APRA’s fit and proper requirements and will be effective in July 2018 for ### EC8–EC11: Licensing framework, assessment, and ongoing supervision; Assessment of Principle 5; Principle 6 EC1 ### EC8 — Licensing review of strategic and operating plans - Licensing authority (APRA) reviews proposed strategic and operating plans, including: - assessment that an appropriate system of corporate governance, risk management, and internal controls (including those related to the detection and prevention of criminal activities) will be in place; - oversight of proposed outsourced functions; - operational structure reflecting the scope and degree of sophistication of proposed activities. - Applicants must provide supporting documents and information, including: - information on ownership, board and management of the proposed ADI; - a three-year business plan that includes the business structure and financial projections of the entity; - details of risk management systems, accounting systems, business continuity plan, internal audit and outsourcing arrangements; - details of proposed subsidiaries and other information. - APRA’s assessment covers: - Board and management suitability and governance framework; - risk management and control systems, information and accounting systems, internal and external audit arrangements; - compliance with relevant prudential standards: governance, capital, internal control and audit, credit risk, market risk and operational risk; - proposed outsourcing arrangements. - APRA applies the principle of proportionality: plans, policies and procedures must be commensurate with the nature, scale and complexity of the proposed ADI. ### Business plan requirements (as part of EC8) - The three-year business plan should cover the first three years of operation of the ADI and ADI group (where relevant), including all controlled entities. - Plan must include: - business structure and proposed activities; - detailed financial projections, including key financial and prudential ratios. - APRA evaluates plans with regard to the nature, scale and complexity of the proposed ADI’s business operations. ### Governance - Applicants must satisfy CPS 510 governance requirements regarding Board composition and functioning. - Applicants must demonstrate policies ensuring persons holding key positions are fit and proper. - APRA may consult domestic and foreign regulators regarding personnel suitability. ### Risk management and internal control systems - Applicants must satisfy APRA that systems are adequate and appropriate for monitoring and limiting risk exposures for domestic and, where relevant, offshore operations. - Required policies and procedures include monitoring/managing: - credit risk (including related party lending, large exposures, problem asset recognition and impairment); - market risk from banking and trading activities; - liquidity risk; - operational risk (including outsourcing arrangements and business continuity management) in accordance with relevant APRA Prudential Standards. - APRA requires that risk control systems be relevant and proportionate to the risks inherent in the proposed business strategy. - APRA may conduct onsite reviews, tests, and walk through demonstrations. - Foreign bank applicants must demonstrate arrangements for reporting to foreign bank parents or head offices. ### Compliance - License applicants must demonstrate processes and systems adequate for ongoing compliance with APRA’s Prudential Standards and other regulatory and legal requirements. ### Information and accounting systems - Applicants must demonstrate systems capable of maintaining up-to-date records of all transactions and commitments to keep management informed of the ADI’s condition and risks. - Systems must be capable of producing all required statutory and prudential information accurately and timely from commencement of operations. - APRA assesses integrity, security, and business continuity per CPS 232. - Outsourcing of material data processing must satisfy CPS 231 Outsourcing. ### External and internal audit arrangements - Applicants must meet CPS 510 requirements for board audit committees and internal audit. - Applicants must have external auditor arrangements in accordance with APS 310 Audit and Related Matters (APS 310), including external auditor reporting to APRA on APRA data collections, internal controls and compliance with prudential requirements. ### Restricted ADIs (overview and requirements) - Restricted ADI application requires a reduced documentation set focused on: - business case, key senior appointments, approach to governance, strategic planning (business plan, financial projections, strategy to become full ADI, exit plan), risk management, and proposed activities. - APRA assesses risks during the Restricted ADI phase, capabilities to manage those risks, and requires: - description of risk profile and high-level systems and controls; - strategy for implementing adequate systems and controls that should be in place prior to conducting the licensed banking business. - APRA expects Restricted ADI licenses to be granted more quickly if information quality is sufficient. - Restricted ADIs must demonstrate ongoing capital adequacy and sufficient liquidity, focus on building capabilities and systems, and show credible plans to progress to a full ADI license within two years. - Restricted ADIs: - are subject to a minimum initial capital of A$3 million plus a resolution reserve; - must demonstrate ability to comply with prudential capital adequacy requirements from the start of operations; applicants may be required to have more than A$3 million if operations warrant it. - If a Restricted ADI fails to complete required capital raisings it would be expected to surrender its banking authority and cease to be an ADI. ### EC9 — Review of pro forma financial statements and projections - APRA requires detailed financial projections as part of the three-year business plan, including: - balance sheet, cash flow and earnings projections; - key financial and prudential ratios for the proposed bank and banking group (where relevant). - Projections must include sensitivity analysis covering expected, up-side and downside scenarios. - APRA requires more conservative and stressed estimates if initial projections are not perceived as robust or realistic. - Applicants must demonstrate that all substantial shareholders are well-established and financially sound entities of standing and substance, able to show: - long-term commitment; - ability to contribute additional capital if required. - APRA supervisors assess the quality of financial information provided. - For Restricted ADIs, applicants must provide a credible business plan incorporating (exact items preserved): - the rationale for applying to become an ADI; - the goals of the first three years of operation; - the proposed activities (including details of products and services to be offered) and target market; - scale of operations and target volume of business; - financial projections for at least five years, with scenario analysis setting out upside and downside cases; - a demonstration that the applicant will have the skills, competence, and governance arrangements appropriate to managing a banking business, including setting out the proposed organizational structure, Board, board Committees, senior management, and governance arrangements; - the likely business and regulatory risk factors and the way to monitor and control them. - strategy to full compliance with the prudential framework; - intended means of distribution channels; - estimated number of staff; and - proposed commencement of operations. - Restricted ADI shareholders are not necessarily required to be able to contribute additional capital, but the restricted ADI must have a credible plan to raise sufficient capital to support its strategic plan. ### EC10 — Foreign banks: home supervisor consent and consolidated supervision - ADI Authorization Guidelines require foreign bank applicants to provide a statement of consent from the relevant home supervisor. - Only applicants authorized as banks in the home country will be granted authority to operate as a foreign bank in Australia. - APRA must be satisfied that the home supervisor supervises the foreign bank applicant on a consolidated basis in accordance with the Basel Concordat, and is prepared to cooperate with APRA in supervision of the bank in Australia. ### EC11 — Monitoring progress of new entrants - New entrants are subject to ongoing supervision under APRA’s Framework for Prudential Supervision, which includes: - assessment of ADIs against stated strategic and business goals; - monitoring compliance with APRA’s prudential framework and any specific requirements imposed on an individual banking authority. - APRA’s Licensing team is involved in monitoring progress of Restricted ADIs against business plans and strategy to ensure full compliance within the proposed maximum of two years. ### Assessment of Principle 5 (Licensing) - Assessment outcome: Compliant - Key observations: - APRA licensing powers derive from the Banking Act. - APRA has a thorough licensing framework and process consistent with ongoing supervision requirements. - APRA reviews ADI strategy, financial viability, business plan, suitability of owners and management, governance framework, and risk management framework. - For foreign banks, APRA ensures no objection from the home supervisor and that the home authority performs consolidated supervision. - The change allowing all ADIs to use the term “bank” negated the minimum initial capital of A$50 million that was applied to banks; there is no minimum amount of capital to be an ADI. - Restricted ADIs are subject to a minimum initial capital of A$3 million plus a resolution reserve; APRA considers this a strict floor even for other ADI license applications. - Applicants must show ability to comply with prudential capital adequacy requirements from the start of operations; applicants can be required to have much more than A$3 million if warranted by operations. - Most current new licensees are branches or subsidiaries of foreign banks, where licensing involves analysis of foreign parent support. - The restricted regime may encourage competition and allow gradual licensing with closer APRA follow-up; caps, conversion strategies, and exit strategies with some resolution funds are intended to limit financial stability impact. - Recommendation highlighted in the text: - APRA should be prudent in licensing new restricted ADIs to ensure success without causing financial stability issues if ADIs fail to convert to full ADIs within the targeted timeline. - APRA should build capacity in IT risks, including cyber risk issues and fintech, to oversee new firms with different technology-driven business models. ### Principle 6 EC1 — Definitions of “significant ownership” and “controlling interest” - The Financial Sector Shareholding Act 1998 (FSSA) contains criteria related to transfer of significant ownership and indirectly defines “significant ownership” through the concept of an “unacceptable shareholder situation.” - Under the FSSA, an unacceptable shareholding situation is an unapproved stake higher than 15 percent; therefore “significant ownership” is indirectly defined as any stake higher than 15 percent. - “Stake” is defined under the FSSA (clause 10 of Schedule 1) as the aggregate of the direct control interest in the company that a person and that person’s associates hold at a particular time, where direct control interest represents the percentage of voting power, including through an intermediate company. - The FSSA allows the Treasurer to declare that a person has “practical control” of a financial sector company even if that person does not hold a stake or holds not more than 15 percent, if the Treasurer is satisfied that: - the directors of the company are accustomed, or under a formal or informal obligation, to act in accordance with the directions, instructions, or wishes of that person (alone or together with associates), or if the person (alone or together with associates) is in a position to exercise control over the company; and - it is in the national interest to declare that the person has practical control of the company. *Source: AUSTRALIA INTERNATIONAL MONETARY FUND (excerpt).* ### Section 22 of the FSSA explains that control includes cases of control as a result of, or by means of, trusts, ### 1ausea2019006 - Section 22 of the FSSA explains that control includes cases of control as a result of, or by means of, trusts, ### Control and change-of-ownership framework (EC2–EC6) - Section 22 of the FSSA: control includes cases of control as a result of, or by means of, trusts, agreements, arrangements, understandings, and practices, whether or not having legal or equitable force and whether or not based on legal or equitable rights. - Prior approval requirements: - Prior approval by the Treasurer required where a person proposes to acquire a stake in a financial sector company (including a bank or ADI) of greater than 15 percent, and where a person proposes to increase their stake beyond the level of an existing approval. - Application must specify the percentage of the stake (if any) the person holds and the percentage for which approval is sought, and the reason for the application. - Approval to hold a stake in a bank in excess of 15 percent is given only where the applicant satisfies the Treasurer or, where applicable, APRA as the Treasurer’s delegate, that the proposed acquisition is in the ‘national interest.’ - The FSSA applies to both domestic and non-domestic stakeholders. - Delegation and practice: - The power to grant approval is with the Treasurer; delegation to APRA exists for banks with assets less than A$1 billion. - As a matter of practice, the Treasurer seeks APRA’s advice for banks with assets exceeding A$1 billion, but APRA’s advice is not binding. - The Treasurer may withdraw delegation powers given to APRA for banks with assets less than A$1 billion. - Interaction with FATA (Foreign Acquisitions and Takeovers Act 1975): - FATA sets thresholds for actions significant to national interest; substantial FATA changes in December 2015 carved out certain foreign non-government investments in APRA-regulated entities where an FSSA approval is also required. - Practical arrangements after FATA changes: - For a greater than 15 percent stake in entities with asset size greater than A$1 billion and where there is a foreign ownership component, FATA approval is not required and the Treasurer will consider the investment under the FSSA, with input from APRA on prudential issues. - For a greater than 15 percent stake in entities with asset size of A$1 billion or below and where there is a foreign ownership component, FATA approval is not required and delegation is with APRA; APRA will refer these applications to the Treasury for an initial assessment because the FSSA requires a ‘national interest’ test broader than prudential assessment. - Competition law interface: - If a merger or acquisition would have the effect of substantially lessening competition, it is prohibited under Section 50 of the Competition and Consumer Act 2010 (CCA). The ACCC assesses Section 50 compliance; authorization can be sought from the Australian Competition Tribunal (ACT) under Section 95AT of the CCA if merger parties consider there will be a net benefit to the public. - EC3 (supervisor’s power to reject or reverse): - FSSA restrictions apply equally to new banks and changes in ownership of existing banks, including beneficial ownership. - Treasury (or APRA as delegate for banks with assets less than A$1 billion) may reject or approve proposed changes exceeding 15 percent. - Treasurer or APRA may revoke or vary existing approvals; Federal Court orders (including disposal of shares) may be obtained. - EC4 (information on significant shareholders): - FSSA approval assesses aggregate voting power of a person and associates. - APRA does not routinely collect names and holdings of significant shareholders as part of ongoing supervision; APRA can request full owner details under Section 62 of the Banking Act on a case-by-case basis. - Regulations under subsection 26(5) of the FSSA could empower the Treasurer to require specified ownership information by written notice. - For Restricted ADIs, APRA will receive regular reporting on major shareholders and significant changes in shareholding. - EC5 (powers to address unapproved changes): - Unacceptable shareholding situations arise where a person holds a stake in excess of 15 percent without Treasurer approval. - The Treasurer may apply to the Federal Court for remedies including divestment orders; Section 11 of the FSSA makes it an offence to acquire shares knowing or recklessly as to whether the acquisition will result in an unacceptable shareholding situation. - APRA has delegation from the Treasurer to make applications to the Federal Court with no limit on the size of the institution, but the delegate is subject to directions of the Treasurer (Subsection 44(2)). - If a merger/acquisition breaches Section 50 of the CCA, the Federal Court can order divestiture or declare the acquisition void on application by the ACCC or any person. - EC6 (notification of material information affecting suitability): - No explicit legal/regulatory/prudential standard requirement for banks to notify APRA as soon as they become aware of material information affecting suitability of a major shareholder or controlling party. - Paragraph 34 of APS 222 requires an ADI to notify APRA of any circumstances that might reasonably be seen as having a material impact and potentially adverse consequences; APRA expects timely alerts by a bank’s Board or senior management. ### Assessment: Principle 6 — Major deficiencies (Materially Non-Compliant) - Key assessment points: - FSSA sets the 15 percent prior-approval threshold but leaves approval criteria to broad “national interest” discretion without a definition or criteria in the FSSA. - APRA’s delegated powers for banks with assets of less than A$1 billion are partial and revocable; APRA’s ability to act depends on continued delegation. - Uncertainty exists regarding consideration of fitness, propriety and suitability of significant shareholders and ultimate beneficial owners, particularly in complex multi-layered ownership structures. - Lack of regular reporting by banks/ADIs to APRA about significant owners and ultimate beneficiary owners prevents APRA from routinely knowing about changes in owners or unapproved changes. - No explicit legal/regulatory requirement for banks to notify APRA immediately upon becoming aware of material information affecting shareholder suitability. - Conclusion: assessors believe there is a material non-compliance with Principle 6. ### Major acquisitions and investments (Principle 7: EC1–EC5, AC1) - Legal and prudential requirements (EC1): - APS 222 (Associations with Related entities) sets APRA requirements for consultation/approval and notifications; prior consultation/approval required before: - establishing or acquiring a subsidiary (unless special purpose financing vehicle); - committing to acquire an equity interest of more than 20 percent in another entity; - taking up equity interest from work-out of a problem exposure where thresholds are exceeded. - Prior written approval required for: - establishment or acquisition of a regulated presence domestically or overseas; - proposed exposures in excess of prudential limits on exposures to related parties in APS 222. - Exposure to a related entity is the aggregate of all claims, commitments and contingent liabilities on- and off-balance sheet. - Treasurer approval under FSSA required for stakes in Australian financial sector companies in excess of 15 percent. - 3PS 222 requires Level 3 ITE policy to include limits on acceptable levels of intra-group transactions and exposures (ITEs); APRA may require the Level 3 Head to limit or reduce ITEs where exposure is significant. - Notification requirements: - ADI must: - report equity investments not subject to prior consultation in writing to APRA within three months of undertaking the investment (paragraph 33 of APS 222); - notify APRA (section 62A of the Banking Act) of any material breach of prudential limits on exposures to related entities; - notify APRA of any circumstances that might reasonably be seen as having a material impact and potentially adverse consequences for an ADI in the group or for the overall group (paragraph 34 of APS 222). - Criteria for assessing proposals (EC2): - Prudential standards and internal APRA guidelines guide assessments; Section 14 of the FSSA gives Treasurer broad discretion on national interest grounds. - CPS 220 expects a comprehensive group-wide view of all material risks; CPG 220 requires contagion risks from related parties be captured. - APRA’s internal guideline assessment factors include: - strategic rationale and business plans; - funding and impact on capital and profitability; - quality and effectiveness of due diligence; - where relevant, national interest elements: prudential conduct, unsuitable influential person, economic power, national interest (stability of banking industry, deposit holders, foreign investment policy). - When assessing prudential conduct, supervisors consider capital position, capital management, financial viability, risk management, governance, fit and proper, and integration issues. - Prudential safeguards (EC3–EC5): - APRA can withhold consent if an ADI cannot comply with prudential or reporting requirements post-acquisition; powers under Section 11CA of the Banking Act include direction not to proceed or to divest. - For cross-border acquisitions, APRA considers quality of host-country supervision and may seek discussions with relevant authorities. - APRA assesses adequacy of financial, managerial, and organizational resources (EC4) through documentation requests including due diligence reports, capital management plans (typically three years), revised organizational structures, business plans, credit and operational risk policies, project management plans, revised funding plans, and financial/prudential reporting plans. - Nonbanking activities risk (EC5): CPS 220 and APS 222 require boards and ADIs to have frameworks to identify, monitor, manage contagion risks; APRA may require additional controls, reporting, or higher PCRs and limit ITEs where necessary. - AC1 (acquisitions by other entities in the banking group): - Prior consultation/approval under APS 222 applies to subsidiaries; APRA expects Heads of Level 3 groups to notify APRA of material acquisitions and contagion risks. - Assessment of Principle 7: Compliant - APS 222 defines clear approval/notification requirements; APRA internal guidelines provide detailed assessment criteria. Consultative revisions on July 2, 2018, include main criteria APRA considers for major acquisitions. ### Supervisory approach and forward-looking assessment (Principle 8: EC1–EC8) - Supervisory philosophy and risk framework (EC1–EC2): - APRA’s regime is principles-based, risk-focused; significant supervisory resources target large firms (the four major banks hold over 80 percent of banking system assets). - PAIRS is APRA’s risk assessment framework focusing on probability of failure and impact; PAIRS components: inherent risk, management and controls, capital support; PAIRS includes Board, Management, Risk Governance, Strategy and Planning, Liquidity, Operational Risk, Credit Risk, Market and Investment Risk, Insurance Risk, Capital Support (including access to new capital). - PAIRS ratings: five probability of failure categories — ‘Low,’ ‘Lower Medium,’ ‘Upper Medium,’ ‘High,’ or ‘Extreme’; four impact of failure ratings — ‘Low,’ ‘Medium,’ ‘High,’ and ‘Extreme.’ Impact rating primarily a function of balance sheet size and market share of liabilities; manual adjustments possible for substitutability, interconnectedness, or complexity. - SOARS translates PAIRS into supervisory intensity categories: ‘Normal,’ ‘Oversight,’ ‘Mandated Improvement,’ and ‘Restructure.’ - Supervisory Action Plans (SAPs) outline 1–2 year supervisory activities; SAPs may be revised with delegated manager sign-off. - Resolvability and crisis preparedness (EC1, EC6–EC7): - APRA is developing a resolution planning regime; APRA is the resolution authority following the Financial Sector Legislation Amendment (Crisis Resolution Powers and Other Measures) Act of 2018. - APRA undertakes case-by-case resolution planning and is engaged in a resolution planning project with one large bank assessing critical functions, shared services, and resolvability to inform prudential framework for resolution planning. - Enforcement and Escalation Committee (EEC) advises on actions for banks in stress; EEC maintains a ‘watch list’ and escalates to Financial Crisis Management Team (FCMT) in severe cases; FCMT is the principal decision-making body for ADI resolution. - APRA works with CFR and other agencies; APRA’s approach prefers working with firms to address barriers to resolution, issuing formal directions as last resort. - Systemic and macro considerations (EC4–EC5): - Risk & Data Analytics Division produces Quarterly Industry Outlooks, analytic dashboards, industry stress tests, annual banking industry reports, and participates in CFR meetings with the RBA. - APRA’s ADI Industry Group meets monthly to discuss current and emerging risks; actions can include thematic reviews or working groups (example: mortgage lending benchmarks). - Assessment of Principle 8: Largely Compliant - Strengths: robust risk-focused supervisory approach combining onsite/offsite reviews, PAIRS/SOARS/SAPs, and cross-agency coordination. - Areas for development: formal resolution planning regime and more periodic in-depth reviews of key internal control processes; greater proactive actions to address resolvability barriers may be needed. ### Supervisory techniques and tools (Principle 9: EC1–EC12, AC1) - Mix of onsite and offsite supervision (EC1–EC3): - APRA employs a mix of onsite and offsite activities; frontline supervisors integrate both into PAIRS/SAPs. - Baseline coverage: annual baseline review for all ADIs; frequency of more intensive reviews driven by PAIRS impact rating (e.g., firms rated ‘low’ may be reviewed every three years, ‘extreme’ may be annual). - Onsite activities: prudential reviews, thematic reviews, prudential consultations, meetings with external auditors, and informal assessments. - Offsite activities: periodic analysis of prudential reports (monthly/quarterly/annual), ICAAPs, strategic plans, analyses for approval proposals, publicly available information, and liaison with foreign supervisors. - Quality assurance: Supervision Framework Team (SFT), Quality Assurance function, APRA management oversight, and Internal Audit provide independent assessment and improvement inputs. - Planning, coordination, and information use (EC2–EC5): - SAP is the integrated plan for onsite/offsite work; supervisors prioritize risks and update PAIRS and SAPs after significant activities. - APRA uses a variety of information: prudential reports, ICAAPs, external auditor reports, public information, regulatory capital reconciliations, market data, and additional stress-period data. - Tools include dashboards, toolkits, exception reports, and Program Athena (to modernize data collection/storage/analysis). - APRA conducts industry stress tests and thematic reviews; monitoring covers credit growth, asset quality, concentrations, liquidity (including LCR data), and funding profiles. - Internal controls, governance, and contact (EC6–EC9): - APRA assesses internal audit functions in PAIRS risk governance; reliance on internal audit work is limited—APRA primarily uses supervisory reviews and firm attestations. - Regular contacts: meetings with management and boards (audit and risk committee chairs) at least annually for larger firms; prudential consultations typically once a year at largest firms. - Communication of findings: letters after onsite reviews outlining findings, PAIRS rating and SOARS stance; categorization of issues into ‘requirement,’ ‘request for additional information,’ ‘recommendation,’ and ‘suggestion.’ - Follow-up: responses requested within 20 business days; tracking via AIMS and planned migration to Supervision System Q; supervisors validate implementation and may escalate or apply formal powers where necessary. - Notification requirements (EC10): - CPS 220 requires notification to APRA no more than 10 business days after becoming aware of significant breaches or material deviations in risk management framework or material/prospective changes to size/business mix/complexity; CPS 232 requires notification of major disruptions with material impact potential. - APS 222 requires notification of material breaches of prudential limits on exposures to related entities and reporting of certain equity investments within three months. - If a firm becomes aware it or the group is not in a sound financial position, immediate reporting to APRA is required. - Information systems, third-party use and quality assurance (EC11–EC12, AC1): - APRA information systems include: Supervision system (Q), AIMS (planned decommissioning with migration to Q), Information Management (IM), and various dashboards/toolkits. - APRA may use independent third parties; APS 310 requires external auditors to provide ‘reasonable’ assurance for data tied to audited financial statements and ‘limited’ assurance for non-accounting sourced data. - Quality Assurance: APRA QA team, Internal Audit, ANAO external audits, Risk Management Committee, external reviews (e.g., 2014/2015 international expert panel) and SFT periodic updates. - Assessment of Principle 9: Compliant - Strengths: adequate supervisory tools, robust planning and execution of onsite/offsite work, strong communications, and quality assurance processes. - Observations: PAIRS quantitative roll-up could obscure underlying issues; suggested review/refresh of PAIRS (noted refresh planned in 2018/19) and reconsideration of weightings for board and senior management assessments. ### Supervisory reporting (Principle 10: EC1–EC7) - Legal powers and scope (EC1, EC6–EC7): - APRA powers to require information stem from Section 62 of the Banking Act and Section 13 of the Financial Sector Collection of Data Act; Section 13 requires APRA to define reporting standards. - APRA can obtain information from banks, NOHCs, and group members; can change reporting frequency by written notice; can request internal management information and additional data in stress periods (e.g., daily liquidity reporting). - APRA has power to access all bank records for supervisory work and access bank Boards, management and staff when required. - Reporting content and frequency (EC1, EC4–EC5): - Required periodic reports include financial position and performance, on- and off-balance sheet assets and liabilities, capital adequacy (standardized and advanced), large exposures, international exposures, asset quality, loan loss provisioning, exposures to related entities, asset risk concentrations, interest rate risk, market risk, liquidity, operational risk losses, and responsible persons (fit & proper). - Reporting frequencies: monthly, quarterly, semiannual, annual; APRA tailors reporting to nature, scale and complexity with higher thresholds for more extensive reporting (e.g., A$50 billion asset threshold for greater reporting). - Major banks required to submit the full set of ADI reporting; APRA serves as national gatherer of statistical data for RBA and ABS. - Data collections are standardized; ad hoc data collections are used for evolving supervisory needs but lack formal data quality processes akin to routine collections under FSCODA. - Accounting and valuation standards (EC2–EC3): - Reporting standards specify required accounting standards; Australian Accounting Standards are based on IFRS (adopted January 2005). - Where prudent, APRA may require different treatments (e.g., General Reserve for Credit Losses under APS 220). - APS 111/112/113/116 and APS 220 provide valuation and capital measurement requirements; APRA requires Level 1/Level 2/Level 3 fair value classifications. - APRA monitors valuations and may investigate excessive Level 3 inputs or unexplained transfers; APRA can make Pillar 2 capital adjustments if valuation methodologies are unsatisfactory. - APS 310 requires external auditors to provide assurance on reliability of data and effectiveness of internal controls for reporting. - Data quality and systems (EC12): - APRA uses validation rules in data collection systems; data quality policy outlines procedures and responsibilities; external auditor assurance is required for reliability of data; APRA may commission external reviews. - Information systems include Supervision system (Q), AIMS (to be decommissioned), IM, and dashboards/toolkits. Program Athena aims to modernize collection, storage and access to data. - Assessment of Principle 10: (findings integrated above) - APRA has broad statutory powers to collect, verify and analyze prudential reports and statistical returns on solo and consolidated bases, with comprehensive reporting requirements and supporting assurance mechanisms via external auditors and data validation. *Source: 1ausea2019006 - Section 22 of the FSSA explains that control includes cases of control as a result of, or by means of, trusts,* ### Section 62 of the Banking Act authorizes APRA to have full access to all bank records. ### 1ausea2019006 - Section 62 of the Banking Act authorizes APRA to have full access to all bank records. ### Legal authority to access records - Section 62 of the Banking Act authorizes APRA to have full access to all bank records. - Under Section 16B of the Banking Act, APRA is authorized to require an auditor of a bank to provide information—or produce books, accounts or documents—about a bank that APRA believes will be of assistance in performing prudential supervision. ### Access to personnel - APRA can request information from all relevant officers (directors, management, and staff) as needed. - CPS 510 requires members of the board of directors and senior management to be available to meet with APRA on request. ### Reporting, responsibility, and enforcement (EC8) - EC8: The supervisor has a means of enforcing compliance with the requirement that the information be submitted on a timely and accurate basis. The supervisor determines the appropriate level of the bank’s senior management is responsible for the accuracy of supervisory returns, imposes sanctions for misreporting and persistent errors, and requires that inaccurate information be amended. - Description and findings re EC8: - APRA’s reporting standards require the submission of data for specified reporting periods and timeframes. - Failure to meet the requirements of a reporting standard can result in a criminal sanction. *Source: 1ausea2019006 - Section 62 of the Banking Act authorizes APRA to have full access to all bank records.* ### Section 14 of Financial Sector Collection of Data Act (FSCODA) requires the Principal Executive Officer of a ### 1ausea2019006 - Section 14 of Financial Sector Collection of Data Act (FSCODA) requires the Principal Executive Officer of a ### Legal and reporting obligations; notification and penalties - Section 14 FSCODA: Principal Executive Officer of a bank must notify the Board as soon as practicable if there has been a failure to meet a reporting requirement. Failure or refusal to notify the Board is an offence under the Act. - Under FSCODA it is an offense for a bank not to provide APRA with information required within a specified period or by a particular time; a penalty can be applied to the bank, board, management and/or individuals for breaching this requirement. - If an auditor has reasonable grounds to believe a bank will or has failed to comply with the Banking Act, FSCODA, a prudential standard or the bank’s banking authority, it must write a report to APRA setting out details within 10 business days (Section 16B of Banking Act). - Under sections 137.1 and 137.2 of the Criminal Code Act 1995, giving false or misleading information or documents to APRA can carry imprisonment for 12 months, provided the person has been notified that such provision constitutes an offence. ### APRA data integrity, validation and external assurance (EC9–EC11) - APRA requires inaccurate information to be resubmitted by institutions; if APRA considers a reporting document incorrect, incomplete, or misleading, it may issue a written notice requesting a written explanation or specific information. - If a firm fails to provide an adequate response (including correct or complete information), APRA may issue a written ‘direction’ for the institution to rectify problems or provide the required information. Failure to comply with a direction is a criminal offence. - APS 310 requires banks to ensure external auditors report to APRA annually on the reliability of data submitted to APRA; for certain reports external auditors must provide ‘reasonable’ or ‘limited’ assurance that the information is reliable and in accordance with prudential and reporting standards. - APRA’s three primary mechanisms to ensure integrity of reported data: - i. validation rules within D2A to validate data prior to submission; - ii. post submission reviews to identify potential errors, inconsistencies and large variations from prior periods; entities are expected to promptly explain or correct identified issues; - iii. Quarterly Financial Analysis (QFA) during which supervisors routinely analyze D2A submissions for inaccuracies or non-compliance. - APS 310 sets requirements for appointed auditors (fit and proper, independence, not subject to a direction under the Banking Act). APRA meets periodically with appointed external auditors to provide feedback and discuss expectations. - APRA may directly engage other external experts (less frequent, typically to supplement enforcement actions); external engagements are subject to internal control procedures. ### Periodic review of supervisory data collections (EC12) - APRA typically revises data collection when: 1) there is a new/revised prudential standard; 2) in response to supervisory needs or observed risks domestically/internationally; 3) to allow for domestic application of revised international standards or when collections are outdated; or 4) to align requirements across regulated industries where needed. - APRA has used extensive revisions and additions to required prudential reports over recent years but often supplements periodic reporting with ad hoc information requests. - Recommendation: APRA should take stock of expected data needs over the next five years, compare against current required reporting, and expand required prudential reporting—particularly where ad hoc requests are used regularly. ### Corrective and sanctioning powers (Principle 11: EC1–EC7, AC1–AC2) - APRA supervisory communications after onsite reviews: letters to CEO or Board chair; four classifications—‘requirement,’ ‘request for information,’ ‘recommendation,’ and ‘suggestion.’ - For ‘requirements’: management has 20 days to respond with proposed actions and timelines; APRA may accept or require re-submission; APRA requires progress updates. - Observed practice: majority of communications are in the ‘recommendation’ category; some recommendations and requirements have taken a long time to be effectively addressed. - APRA statutory and enforcement powers include: - appoint a person to investigate prudential matters (Section 61 Banking Act); - issue enforceable ‘directions’ to take specific actions; - accept an ‘enforceable undertaking’ (breach may lead to court orders); - remove a director or senior manager; - remove an auditor; - effect a compulsory transfer of business of a bank; - revoke a license; - apply for injunctions in Federal Court to restrain or require actions contravening the Banking Act or prudential standards. - Under the Banking Executive Accountability Regime (‘BEAR’) APRA has additional investigative powers, can require individuals to appear before an investigator, seek substantial fines, and more easily disqualify ‘accountable’ persons. BEAR “becomes effective July 1 for the major banks.” - APRA prefers cooperative remedies (increased supervisory intensity, prudential reviews, downward supervisory ratings, Pillar 2 capital charges) but assessors recommend being more proactive in early escalation and greater use of formal corrective actions when firms do not cooperate. - APRA can ring-fence banks from group entities using direction powers (stop payments to group entities; prevent adverse transactions). Crisis Resolution Act powers allow APRA to require changes to group structure and operations to improve resolvability. - Coordination: - CFR (Council of Financial Regulators) is the key forum for cooperation with domestic agencies; formal MoU across CFR agencies details roles in crisis situations. - APRA actively engages other regulators where relevant and coordinates as needed. - Additional findings: - No statutory timeframes compel prompt corrective action; APRA views discretion as enabling measured responses. ### Capital and thresholds (EC3, EC4) - APS 110 requires the Board to ensure appropriate capital commensurate with risks (ICAAP requirement). - Minimum APRA capital Prudential Capital Requirement (PCR) ratios: - common equity tier 1 ratio of 4.5 percent; - tier 1 ratio of 6.0 percent; - total capital ratio of 8.0 percent. - Capital conservation buffer requirement: no less than 2.5 percent. - Sum of common equity tier 1 PCR plus capital conservation buffer determined by APRA will be no less than 7.0 percent. - Banks must notify APRA if they fall below or are in danger of falling below minimum capital requirements and outline actions to address the breach; APRA can require specific recapitalization measures and use recovery/resolution powers if warranted. - APRA is implementing a recovery planning regime but currently lacks a formal authority to require a firm to begin actions in a recovery plan; however, APRA can require actions under EC2/EC4 powers. ### Consolidated supervision (Principle 12: EC1–EC7, AC1) - APRA supervisors use group structure charts, APS 330 disclosures (Regulatory Capital reconciliation), APS 222 (associated dealings and related party exposure limits), and CPS 220 notifications to understand and monitor banking group structures and material activities. - Supervisory scope: - APRA supervises ADIs on Level 1 (stand-alone) and Level 2 (banking group) bases; where required, on Level 3 (conglomerate) basis. - APRA has determined eight Level 3 groups. - APRA’s Level 3 framework (effective since July 2017) includes prudential standards for Heads of Level 3 groups: aggregate group exposures, intra-group transactions and exposures, audit and related matters, and risk management requirements. - Requirements and practices: - APS 222 requires consultation with APRA before establishing/acquiring subsidiaries; ADIs must notify APRA of circumstances materially impacting an ADI or group. - APRA may require capital and structural measures (e.g., intermediate holding company, additional capital at ultimate holding company) in complex group situations. - Assessment: APRA’s consolidated supervision is well underpinned by prudential standards and supervisory practice; APRA should continue enhancing analysis of nonbanking activities’ impact on group risk. ### Home–host relationships and cross-border supervision (Principle 13: EC1–EC10) - Supervisory colleges: - APRA convened supervisory colleges as home supervisor for two banks with material overseas operations; last college arranged by APRA was in June 2016. - Colleges included confidentiality declarations and sessions on APRA supervisory approach, group risks, and presentations from senior bank executives. - Assessors recommend APRA consider organizing supervisory colleges more regularly for large banks with material cross-border operations. - Information exchange and cooperation: - APRA is signatory to 33 bilateral and multilateral MoUs or equivalents with overseas regulators. - APRA organizes conference calls with host supervisors at least annually, often every three to six months. - APRA typically provides host supervisors with its risk assessment of the parent upon request and invites host supervisors to accompany prudential reviews. - Crisis cooperation and resolution planning: - For the four major banks with material New Zealand operations, APRA has strong coordination with RBNZ, NZ Treasury and NZ FMA under the TTBC; a Trans-Tasman crisis simulation took place in November 2017. - APRA is the resolution authority for ADIs in Australia; APRA’s resolution regime remains a work in progress. - APRA has not yet implemented a formal prudential requirement for group recovery or resolution plans; larger banks have developed recovery plans through thematic reviews; APRA intends to formalize recovery and resolution frameworks into prudential standards in the medium-term. - Host supervision and access: - Authorization by APRA is required to conduct banking business in Australia (subsidiary or branch). Foreign ADI branches are prohibited from financing themselves from retail sources below A$250,000 initial deposit from individuals/non-corporates. - Foreign bank subsidiaries are subject to the same regulatory, supervisory and reporting regime as Australian-owned banks; foreign ADIs with branch authority are exempt from some Banking Act provisions and APRA capital adequacy requirements (relying on comparable home country standards). - Assessment of Principle 13: Largely Compliant. ### Corporate governance (Principle 14: EC1–EC9, AC1) - Prudential standards and guidance: - CPS 510 (Governance) and CPS 520 (Fit and Proper) set minimum governance and fitness/propriety requirements; CPS 510 places governance responsibility on the board and requires group-appropriate governance where an institution is the head of a group. - CPS 510 specific requirements include Board size/composition, independent chair, Board renewal policy, Board Remuneration Committee, Board Audit Committee and Board Risk Committee. - APRA issued guidance to directors of ADIs in October 2014 and a clarifying letter in August 2015. - BEAR Act: - Banking Executive Accountability Regime (BEAR) amendments (passed February 2018) impose accountability, remuneration, key personnel and notification obligations on ADIs and persons in director and senior executive roles; APRA will consider changes to governance and fit and proper prudential requirements after BEAR implementation. - IMF assessors note BEAR “becomes effective July 1 for the major banks” and is expected to improve governance clarity and APRA’s supervisory authority. - Board composition and committees: - Board of a locally incorporated APRA-regulated institution: minimum five directors and a majority independent directors; variations exist for subsidiaries of APRA-regulated institutions or foreign ADIs. - Board Audit Committee: at least three non-executive members, majority independent, Chair independent. - Board Risk Committee: at least three non-executive members, majority independent, Chair independent. - Board Remuneration Committee: at least three non-executive members, majority independent, Chair independent. - Fit and proper, succession, remuneration oversight: - CPS 520 sets fit and proper criteria; boards must assess directors annually. - No specific prudential standard on succession planning though included in guidance; assessors did not observe specific assessments of boards’ effectiveness in overseeing senior management execution. - CPS 510 requires board-approved Remuneration Policy aligning remuneration with risk management; supervisors assess remuneration through prudential reviews, board paper reviews, and APS 330 disclosures (qualitative and quantitative). - APRA’s Governance, Culture and Remuneration (GCR) team performs reviews; an industry review of remuneration practices occurred in 2017. - Enforcement powers: - Under section 23 of the Banking Act APRA can remove a director or senior manager not fulfilling duties; section 11CA(2) allows directions to remove a director. - Banks must notify APRA within 10 business days if a responsible person is no longer fit and proper. - Assessment of Principle 14: Largely Compliant. - Recommendation highlights: - APRA should complement reliance on firms’ self-reporting with more detailed thematic reviews at largest firms and consider rapid formal actions where firms misreport effectiveness of practices. - APRA should use information from ASIC and AUSTRAC reviews more consistently to inform governance assessments. ### Risk management processes (Principle 15: EC1–EC6) - CPS 220 (Risk Management) requirements: - Firms must maintain a risk management framework (RMF) appropriate to size, business mix and complexity, including a board-approved risk appetite statement (RAS), risk management strategy (RMS), business plan, ICAAP, adequate MIS, independent risk management function, and periodic review processes. - Board must make an annual declaration to APRA on risk management, signed by the Board and Board Risk Committee chairs. - Independent review of RMF by competent experts required at least every three years; internal/external audit review annually. - Supervisor assessment and integration: - APRA assesses RMF in PAIRS (Inherent Risk and Management & Controls), which informs SOARS and Supervisory Action Plans (SAPs). - Supervisors use targeted onsite prudential reviews, review of board papers, prudential consultations, ICAAP reviews, liquidity/funding profile assessments, and industry stress tests. - Capital and liquidity adequacy processes: - APS 110 and the ICAAP require boards to consider all risks and ensure adequate capital over time; ICAAP must include stress testing and scenario analysis and reporting processes to board/senior management. - ADIs required to maintain board-approved liquidity management policy and program commensurate with nature, scale and complexity. - Use and oversight of models (EC6): - APRA permits internal models for IRB credit risk, AMA operational risk, IRRBB and market risk; six banks currently approved for internal models. - Standards and approvals governed by APS 113, APS 115, APS 117, APS 116. - RDA unit has three specialist modeling teams (credit, market/IRRBB/counterparty/XVA/initial margining, operational risk). - Supervisors hold quarterly meetings with advanced approaches firms; most model changes require APRA approval. - APRA conducts annual prudential reviews for advanced approaches banks; APRA can revoke approvals or impose conditions and require standardized approaches if models do not reflect underlying risks. - Observations and recommendations: - While supervisory reviews and attestations exist, it is not always evident that APRA’s work fully determines whether boards are aware of uncertainties and weaknesses inherent in their processes and model limitations on a firm-wide basis. - Assessors recommend APRA ensure prudential reviews and thematic work sufficiently evaluate firm-wide governance of risk measurement uncertainties and that board-level understanding is demonstrably robust. *Source: 1ausea2019006 - Section 14 of Financial Sector Collection of Data Act (FSCODA) requires the Principal Executive Officer of a — IMF country report content unit* ### 310. Risk specialist teams participate jointly with frontline supervisors (and modelling specialists, as needed) ### 310. Risk specialist teams participate jointly with frontline supervisors (and modelling specialists, as needed) ### Risk specialist participation and scope of onsite reviews - Risk specialist teams participate jointly with frontline supervisors (and modelling specialists, as needed) in regular onsite prudential reviews to assess inherent risk and related risk management and controls including how model outputs are used in decision making. - APRA supervisors review model outputs and results of model monitoring and validation during these onsite prudential reviews. ### Credit risk model reviews - APRA periodically reviews credit risk grading systems and scorecards used by banks for origination and ongoing loan management. - Reviews occur as part of: - credit risk reviews (for retail scorecards), and - IRB reviews (for non-retail models also used for regulatory capital purposes). - Reviews typically cover: - the use of the models, - the associated model governance and validation framework and practices, - model outputs and monitoring/validation results. ### Onsite benchmark reviews and modelling limitations - Benchmark onsite reviews cover banks’ internal models and other risk measurement tools not necessarily used for regulatory capital purposes. - For IRRBB and market risk models, benchmark reviews include specific sessions covering: - banks’ economic capital models, and - stress testing for these areas. - Onsite reviews assess economic capital models and other risk measurement tools used in day-to-day risk management (e.g., stress testing, sensitivities). - Modelling limitations and visibility around limitations (e.g., risks not in VaR) have been raised both during onsite reviews and supervisory discussions on regulatory capital models. ### EC7 — Management information systems (Description and findings) - EC7: Supervisor determines banks have information systems adequate under normal circumstances and in stress for measuring, assessing and reporting size, composition and quality of exposures bank-wide across all risk types, products and counterparties; reports reflect the bank’s risk profile and capital and liquidity needs; provided timely to Board and senior management in suitable form. - APRA practice and tools: - As part of PAIRS risk governance assessments, supervisors assess adequacy of information systems for measuring, assessing and reporting exposures. - APRA supervisory guidance for PAIRS includes a section on these assessments to assist supervisors reviewing management information provided to board, committees and senior management, including management information systems. - APRA has a team of IT risk specialists to assist assessments of banks’ management information systems. - Supervisory focus: - Supervisors assess whether reporting is sufficient for board and senior management to form an informed opinion on institution’s risks and effectiveness of controls. - Reviews are enterprise-wide (or group-wide) and include management reports for particular functions, sub-portfolios and exposure types as required. - The annual declaration from banks’ Board must include a specific attestation regarding establishment of systems to monitor and manage risks including adequate and timely reporting processes. ### EC8 — New products and major initiatives (Description and findings) - EC8: Supervisor determines banks have adequate policies/processes to ensure Boards and senior management understand risks inherent in new products, material modifications, and major initiatives; Boards/senior management able to monitor/manage these risks; major activities require Board or specific committee approval. - APRA findings: - No specific requirement for a new product approval process in CPS 220. - Supervisors assess risks associated with new products, material modifications, and major initiatives as part of ongoing supervision, prudential reviews, and reviews of board papers. - APRA expects ADIs to have robust product approval processes subject to risk assessments; where product exposes entity to significant risks or is in new/unfamiliar area, ADI is expected to consult with APRA. - New/varied products are covered in operational risk assessments and reviews. ### EC9 — Risk management function (Description and findings) - EC9: Supervisor determines banks have risk management functions covering all material risks with sufficient resources, independence, authority and Board access; duties segregated from risk-taking; subject to regular internal audit review. - CPS 220 requires risk management function that: - “is responsible for assisting the board of an APRA-regulated institution, board committees of an APRA-regulated institution and senior management of the institution to maintain the RMF; - is appropriate to the size, business mix, and complexity of the institution; - is operationally independent; - has the necessary authority and reporting lines to the board of an APRA-regulated institution, board committees of an APRA-regulated institution and senior management of the institution to conduct its risk management activities in an effective and independent manner; - is resourced with staff who have clearly defined roles and responsibilities and who possess appropriate experience and qualifications to exercise those responsibilities; - has access to all aspects of the institution that have the potential to generate material risk, including information technology systems and systems development resources; and - is required to notify the board of any significant breach of, or material deviation from, the RMF.” - Reviews and governance: - Compliance with CPS 220 and effectiveness of the RMF are subject to internal and/or external audit at least annually. - A comprehensive independent review of RMF is required at least every three years; results reported to ADI’s Audit Committee. - APRA assesses the risk management function as part of Risk Governance assessment in PAIRS and uses detailed internal guidance. - Meetings with internal auditors and review of related reports are factored into assessments. - APRA meets regularly with CROs to discuss key risks and adequacy/effectiveness of the risk management function. ### EC10 — CRO requirement (Description and findings) - EC10: Supervisor requires larger/complex banks to have a dedicated risk management unit overseen by a CRO; removal of CRO should be with prior Board approval and generally publicly disclosed; bank should discuss reasons with supervisor. - APRA findings: - APRA requires all ADIs to have a dedicated risk management function and to designate a chief risk officer. - No specific requirement for prior Board approval for removing a CRO nor a public disclosure requirement; APRA staff stated these generally do happen in practice. - APRA would expect the firm to discuss the reasons for the removal with supervisors. ### EC11 — Standards for material risks (Description and findings) - EC11: Supervisor issues standards related to credit risk, market risk, liquidity risk, interest rate risk in banking book and operational risk. - APRA framework: - Prudential standards exist for most material risks including credit risk, market risk, liquidity risk, and interest rate risk in the banking book. - No dedicated prudential standard for operational risk; APS 115 for AMA captures elements APRA would include in an Operational Risk Management standard. - CPS 220 contains general principles; there are standards for operational risk areas such as business continuity management and outsourcing. ### EC12 — Contingency arrangements and recovery planning (Description and findings) - EC12: Supervisor requires banks to have contingency arrangements addressing risks that may materialize and actions in stress conditions; where warranted, contingency arrangements include recovery plans; supervisor assesses adequacy and feasibility and seeks improvements. - APRA findings and actions: - APRA expects firms to have a range of capital-improving actions available in stress, including a graduated series of triggers above capital requirements. - APRA is developing a formal prudential framework for recovery planning and has developed guidance to be circulated to industry. - Past exercises: - Pilot review in 2011 at six of the largest ADIs. - Thematic review of the nine largest ADIs in 2016. - Final phase of this thematic review was being conducted, with feedback to firms to come in 2018. ### EC13 — Stress testing (Description and findings) - EC13: Supervisor requires forward-looking stress testing programs commensurate with risk profile and systemic importance; assesses that programs capture material sources of risk, adopt plausible adverse scenarios, integrate results into decision-making, and are documented/maintained; requires corrective action for material deficiencies. - APRA findings: - APRA requires firms to conduct stress tests covering various risk types as part of risk management and for stress testing to be routine. - Annual ICAAPs include simulations of a range of adverse scenarios. - Individual bank approaches to stress testing are discussed during onsite prudential reviews and supervisory interactions. - Supervisors review firms’ ICAAP reports as part of ongoing supervision. - Assessments of firm-wide stress testing carried out outside ICAAP are limited; few formal reviews of ICAAP or other firm-wide stress testing were noted in SAPs requested during the assessment. - With focus on achieving ‘unquestionably strong’ capital thresholds, focus on other assessments of capital has been reduced. - Recommendation: APRA should dedicate more time to assessing underlying risk measurement, management and control practices around firms’ use of firm-wide stress testing, including the role of the board and management and internal audit reporting. ### EC14 — Internal pricing and new product approval (Description and findings) - EC14: Supervisor assesses whether banks appropriately account for risks (including liquidity impacts) in internal pricing, performance measurement and new product approval processes. - APRA findings: - Supervisors review transfer pricing arrangements/practices in reviews of liquidity and liquidity risk management. - No APRA requirement for a formal new product approval process. - APRA supervisors noted firms have policies and processes for new product approvals and these are reviewed as part of normal ongoing supervision. ### Additional criteria AC1 — Other material risks - AC1: Supervisor requires banks to have policies/processes for assessing other material risks not directly addressed, such as reputational and strategic risks. - APRA findings: - APRA expects all material risks including reputation, contagion and strategic risks to be captured in the firm’s ICAAP and form part of determining capital adequacy under the PCR. - Supervisors are currently more focused on firms achieving ‘unquestionably strong’ thresholds than on PCR, ICAAP and internal stress testing for capital. ### Assessment of Principle 15 — Risk management and supervision - Assessment: Largely Compliant - Comments and observations: - Strong focus on Board responsibilities and the introduction of CPS 220 since 2012 are positive developments. - CPS 220 requires comprehensive policies/practices and reporting requirements; supervisors rely significantly on these reports as part of PAIRS risk governance assessments. - APRA uses risk-focused supervisory activities, combining firm knowledge with industry-wide risk assessments; offsite quantitative capabilities are being developed. - Thematic reviews across groups of firms are effective tools and APRA has increased their use. - Shortcoming: APRA reviews of internal stress testing typically do not deeply review inputs or controls around inputs, limiting confidence in reliability of outputs. - Very few recommendations or requirements observed for firms to address issues in ICAAP or stress testing practices. - APRA should continue implementation of the recovery planning program and create a formal and fully documented program and expectations for banks. ### Principle 16 — Capital adequacy (Essential criteria highlights and findings) - EC1 (laws/regulations require banks to calculate and observe capital requirements; define qualifying components of capital): - APRA’s regulatory capital requirements are set out in APS 110 and 111; consistent with Basel and apply on standalone and consolidated basis. - Minimum PCR ratios: - common equity tier 1 ratio of 4.5 percent; - tier 1 ratio of 6.0 percent; - total capital ratio of 8.0 percent. - Capital conservation buffer requirement of 2.5 percent unless determined otherwise by APRA. - Sum of CET1 PCR plus CCB determined by APRA will be no less than 7.0 percent. - Australia’s four D-SIBs are required to hold an additional one percent of CET1 capital applied as part of the buffer. - APS 110 requires ADIs to hold a countercyclical capital buffer, as determined by APRA, of between 0 and 2.5 percent of CET1 capital. - APRA can set higher PCRs and expects ADIs to hold a sufficient management capital buffer above PCR. - APS 110 constrains capital distributions when an ADI’s CET1 falls within the capital buffer (CCB plus any countercyclical buffer and the D-SIB buffer); requires APRA approval for capital distributions that result in reductions in capital including dividends in excess of 100 percent of earnings in the financial year and all share buybacks. - ADIs must have Board-approved ICAAP appropriate for size, business mix and complexity; typically provided to APRA annually. - APRA is consulting on determining a minimum requirement for the tier 1 leverage ratio; currently no minimum leverage ratio requirement. - Firms using IRB must publicly disclose leverage ratios in financial reports. - Per Financial Sector Inquiry recommendations, APRA will implement “unquestionably strong” capital benchmarks; ADIs expected to meet these benchmarks by January 1, 2020. - Increases in capital differ by approach: - Advanced approaches firms: capital requirements increasing by roughly 150 basis points; - Standardized approach firms: increase of approximately 50 basis points. - EC2 (alignment with Basel for internationally active banks): - APRA’s standards are consistent with applicable Basel minimum requirements. - BCBS RCAP 2014 noted APRA generally implemented definition of capital in line with Basel and chose not to permit threshold deduction treatment (increasing conservatism). - APRA received a ‘largely compliant’ assessment in 2014 RCAP due to (i) exemptions to Basel-required deduction for indirect investments in own capital instruments under certain circumstances, and (ii) not requiring issuance of new shares prior to public sector injection of capital. - EC3 (power to impose specific capital charges/limits): - APRA sets PCR and has authority to set PCRs above minimum levels; capital requirements cover on- and off-balance sheet exposures. - Several prudential standards allow APRA to require higher capital levels or other actions (including increasing loan loss reserves). - APRA can increase PCR, issue directions to undertake specific actions to increase capital or impose other conditions. - EC4 (PCR reflect risk profile and systemic importance): - APRA may set PCRs above required minimums based on entity risk profile and Pillar 2 assessments (corporate governance, senior management, risk management systems and controls). - APRA may use a countercyclical buffer up to 2.5 percent to raise sector capital requirements during excess credit growth periods. - Decision to require supervisory adjustment to capital is based on offsite analysis; reviews; PAIRS assessment/SOARS stance; ICAAP review; discussions with institution; institution’s plans to address concerns; any other information held or sought by APRA. - Prior to supervisory adjustment, APRA would likely seek institution-led remediation (operations, governance, risk/capital management frameworks). - APRA coordinates periodic industry stress tests based on macro-economic scenarios to inform vulnerabilities; results can inform PCR setting though not occurring in practice due to focus on 'unquestionably strong' benchmarks. - No explicit ‘post-stress requirement’ for minimum regulatory capital. - As of the end of 2017, the average total risk-based capital ratio for APRA-supervised banks was over [text ends]. *Source: 1ausea2019006 - 310. Risk specialist teams participate jointly with frontline supervisors (and modelling specialists, as needed)* ### 14.5 percent, with both large firms and smaller firms having averages above that level. ### 1ausea2019006 - 14.5 percent, with both large firms and smaller firms having averages above that level. ### Use of internal models and capital adequacy (EC5) - The supervisor approves the use of banks’ internal assessments of risk as inputs to regulatory capital calculation only if: - (a) such assessments adhere to rigorous qualifying standards; - (b) any cessation of such use, or any material modification of the bank’s processes and models for producing such internal assessments, are subject to the approval of the supervisor; - (c) the supervisor has the capacity to evaluate a bank’s internal assessment process to determine that qualifying standards are met and internal assessments can be relied upon; - (d) the supervisor has the power to impose conditions on its approvals; and - (e) the supervisor has the power to revoke approval if qualifying standards or conditions are not met. - Findings: - APRA allows internal models for regulatory capital under the IRB approach to credit risk, the Advanced Measurement Approach (AMA) for operational risk, and for IRRBB and traded market risk capital charges. - There are currently six banks approved for internal models for credit risk and IRRBB and, of these, five banks approved for AMA and traded market risk. - Qualifying standards and requirements are set out in prudential standards: APS 113 (IRB), APS 115 (AMA), APS 117 (IRRBB), APS 116 (market risk). - APRA’s RDA unit has three specialist teams for model review: credit risk modeling; market risk modeling (including IRRBB, counterparty credit risk, XVA, and initial margining); and operational risk modeling. - Supervisors meet quarterly with advanced approaches firms; most model changes require explicit APRA approval. - APRA conducts annual prudential reviews of advanced approaches banks’ use of internal models; APRA can revoke approvals, impose conditions, or require adoption of the standardized approach to RWA and regulatory capital ratios if material non-compliance exists. ### Forward-looking capital management and stress testing (EC6) - Supervisor powers and requirements: - The supervisor can require banks to set capital levels and manage capital in anticipation of possible adverse events or market changes. - The supervisor can require banks to have feasible contingency arrangements to maintain or strengthen capital in times of stress, appropriate to their risk profile and systemic importance. - Findings: - APRA has authority to make the EC6-type requirements. - APS 110 requires firms’ ICAAP to be forward-looking, including specific capital targets relative to risk profile, board-set risk appetite, and regulatory capital requirements; firms must have plans for meeting targets and ability to obtain new capital when needed. - ICAAP is a key input into APRA’s process for setting a firm’s PCR; APRA’s authority to set a PCR above minimum requirements allows forward-looking, stress-testing-based requirements. - IMF assessors did not see examples of stress testing being used to set required capital in practice. - Since the July 2017 publication of the information paper on “Strengthening banking system resilience - establishing unquestionably strong capital,” APRA has focused more on firms’ plans to achieve the unquestionably strong objective and less on traditional PCR use. - The information paper indicates capital is more likely to be “unquestionably strong” if firms can demonstrate maintenance of sufficient capital to continue raising funding and providing critical economic functions during stress. - The Capital assessment under PAIRS includes APRA’s assessment of an ADI’s ability to access new capital and gives it a 25 percent significance risk weight. - Assessment commentary: reliance on an ADI’s ability to access new capital is of limited value in significant stress; assessors suggest APRA consider reducing reliance on this metric in PAIRS to give more weight to capacity to hold sufficient capital under stress. ### Capital framework consistency and distribution (AC1, AC2) - AC1 findings: - APRA applies capital standards uniformly to internationally active and non-active banks; no distinction is drawn. - Six large banks use the IRB approach; smaller banks use the standardized approach. - AC2 findings: - APS 110 requires ADIs to maintain adequate capital on both a stand-alone and group basis. - For ADIs that head conglomerates or are heads of ‘level 3’ groups, boards must have Group ICAAPs reflecting type and distribution of risks and capital and ensure group-level capitalization consistent with risk profile. ### Assessment of Principle 16 — overall capital adequacy assessment - Rating: Compliant - Key observations: - APRA’s regulatory capital regime uses a conservative definition of capital and includes a conservative floor for RWA calculation for residential mortgages; reported regulatory capital ratios are conservative as a result. - The “unquestionably strong capital” benchmark adds a further buffer above Basel 3 and APRA requirements. - The PCR process allows APRA to increase required regulatory capital for individual firms, but PCRs are currently less emphasized than the unquestionably strong standard. - Recommendations by assessors: - APRA should continue to focus on stress-based measures of capital needs, firms’ internal capital adequacy assessment processes, and capital management and planning practices. - Emphasis is needed on firms carrying out ICAAP supported by strong risk measurement and management, robust internal controls, governance ensuring boards make capital decisions, and APRA’s assessment of firms’ notifications and understanding of risks and measurement challenges. ### Credit risk framework and supervisory practice (Principle 17; EC1–EC7) - EC1 — bank-wide credit risk management processes: - CPS 220 requires an RMF providing a comprehensive institution-wide view of material risks, listing credit risk among material risks. - RMF requirements include a risk appetite statement, policies and procedures, ICAAP, MIS adequate in normal and stress times, and review processes for RMF effectiveness. - APS 220 (credit quality) requires systematic and regular monitoring of credit risk, supports board/senior management in assessing adequacy of provisions, GRCL and capital, and requires regular review of credit risk management. - APG 223 (2017) provides prudent practices for residential mortgage lending; APRA expects residential mortgage lending to be specifically addressed where material. - Restricted ADIs must have adequate credit risk management prior to offering credit in the restricted phase. - APRA’s supervisory framework and DA team support assessment of credit risk appetite, exposures, asset quality, and CRMF. - Front-line supervisors and credit risk specialists perform onsite prudential reviews, offsite thematic reviews, credit conditions surveys, quarterly meetings with large banks, and ICAAP assessments. - EC2 — board and senior management oversight: - CPS 220 defines board responsibilities: set risk appetite, approve RAS and RMS, ensure senior management monitors and manages material risks, and ensure policies are consistent with RMS and risk appetite. - RMF must coordinate identification, measurement, evaluation, monitoring, reporting, and mitigation across the group in normal and stressed times. - CPS 220 and APS 220 require periodic audits and reviews, including: - Internal/external audit at least annually with results to Board Audit Committee. - Regular review of credit risk management system. - Comprehensive review every three years by operationally independent competent persons reported to Board Risk Committee. - Board must provide an annual risk management declaration confirming systems and resources for risk identification, measurement, monitoring and mitigation are in place. - PAIRS supervisory assessments include board/senior management oversight of credit risk, committee performance, robustness of policies/procedures, and are informed by targeted onsite reviews, prudential consultation meetings, and data/report reviews. - EC3 — policies, processes and controls for credit risk environment: - CPS 220 and APS 220 embed requirements for documented strategy, sound policies and processes, validation/approval/use of models, mitigation strategies, monitoring and escalation, conflict management, contingency arrangements, and review processes. - RAS must convey for each material risk the maximum level of risk (risk tolerance), processes for setting and monitoring tolerances, and actions when breached. - APS 220 requires credit risk management system elements: monitoring of credit quality, recognition of inherent credit risk, collateral recognition, impaired facilities identification and measurement, write-down/write-off processes, validation of credit assessment and provisioning, adequacy of provisions and reserves, and production of data for APRA reporting. - APRA expects more substantial/complex ADIs to implement a well-structured credit-risk grading system approved by the Board and notified to APRA; smaller homogeneous portfolios may be graded on a portfolio basis. - Onsite prudential reviews assess strategy, governance, credit policies, exceptions and approval processes, MIS, and independent assurance reports; thematic reviews are conducted where industry risks are identified. - EC4 — monitoring total indebtedness and risk factors: - APRA expects banks to consider total indebtedness and servicing obligations before granting credit; responsible lending obligations under the National Consumer Credit legislative framework apply. - Onsite reviews consider credit evaluation, approval policies, and RMF robustness, including MIS for aggregate exposures. - Limitation: current lack of comprehensive positive credit reporting system limits banks’ ability to monitor borrowers’ total indebtedness; banks primarily rely on borrower-disclosed information. Supervisors assess loan portfolio quality and default risk factors through quarterly risk reviews and targeted prudential reviews. - EC5 — arm’s-length credit decisions, conflict avoidance: - CPS 220 requires RMF to include processes for identifying, monitoring and managing potential and actual conflicts of interest. - APRA expects banks to have conflict of interest policies and supervisory guidance stresses examination of how banks deal with conflicts in credit decision-making. - EC6 — escalation/approval for major or especially risky exposures: - APS 221 (Large Exposures) requires the board to establish and monitor policies governing large exposures and concentrations, to review them at least annually, and to cover exposure limits, circumstances for exceedances and required authority (e.g., Board/Board Committee) and procedures for identification, review, control and reporting. - Prudential standards do not mandate that exposures exceeding certain capital-based limits must be decided by the board; APRA supervisors assess whether banks’ decision-making and delegation frameworks ensure larger or riskier loans are reviewed by higher management levels or committees. - EC7 — supervisor access to portfolio information and personnel: - Section 13 of the Banking Act requires ADIs to supply information (including books, accounts or documents) relating to financial stability as required by APRA in a written notice. - APRA therefore has full access to credit and investment portfolio information and to bank officers involved in assuming, managing, controlling and reporting on credit risk. *Source: 1ausea2019006 - 14.5 percent, with both large firms and smaller firms having averages above that level.* ### Section 62 of the Banking Act includes more detailed requirements about the needs for ADIs and NOHCs, ### 1ausea2019006 - Section 62 of the Banking Act includes more detailed requirements about the needs for ADIs and NOHCs, ### APRA access to information and supervisory practice - Section 62 of the Banking Act requires ADIs and NOHCs, and their subsidiaries, to supply information to APRA and give it full access to their records; the requirement may include supplying books, accounts, or documents, and failure to comply is an offence. - In practice APRA has full access to information concerning a bank’s credit and investment portfolios and to relevant staff; APRA meets senior management during onsite prudential reviews and may meet lending officers and other personnel involved in credit assessment. - Typical pre-onsite information requests are tailored to review scope and commonly include copies of: - policies and procedures, product profiles, management and board reports, papers to risk committees; - reports of internal and external parties, system descriptions; - information on exposures to facilitate file selection for onsite review. - APRA obtains a wide range of information from publicly available sources and data provided directly by banks, including a comprehensive suite of prudential returns provided at different frequencies. - Ad hoc information requests (including during heightened market unease) and specific auditor obligations under APS 310 supplement regular data flows. *Findings / supervisory implications* - APRA routinely uses onsite prudential reviews, offsite returns, thematic reviews, and stress testing to assess credit risk management and provisioning practices. - Reporting forms referenced include ARF 220.0, ARF 220.5, ARF 220.3, ARF 113.0, ARF 221.0, ARF 222.0, and ARF 731.3. ### EC8 / Principle 17 — Stress testing and forward-looking scenario analysis (Assessment: Compliant) - Prudential Standard CPS 220 requires an ADI’s RMF to include forward-looking scenario analysis and stress testing programs, commensurate with size, business mix and complexity, and based on severe but plausible assumptions; RMF must address material risks including credit risk. - CPG 110 (ICAAP guidance) expects ICAAP to consider all risks including credit, liquidity, market, interest rate in the banking book, and risks associated with securitization. - APRA expects stress test results to inform banks’ capital, credit and liquidity management. - Stress tests for banks are conducted at least annually. - APRA’s DA team coordinates industry stress tests regularly (annually for ADIs) and scenarios are developed in conjunction with the RBA. - APS 113 (IRB) requires sound stress testing processes, including identification of possible events or severe changes (economic/industry downturns, market-risk events, liquidity conditions) and assessment of ADI’s ability to withstand such events. *Supervisory comments and recommendations* - APRA prudential standards CPS 220 and APS 220 provide a thorough framework; APRA activities have focused on credit risk frameworks and exposures (including thematic reviews on residential mortgage loans and commercial real estate). - Recommendation: APRA should continue close watch on underwriting standards and serviceability assessments, ensure board oversight, perform periodic deep dives into ADI credit risk frameworks depending on ADI risk profiles, and consider issuing guidelines on CRE lending and incorporating those into planned revisions to APS 220. ### Principle 18 — Problem assets, provisions and reserves (Assessment: Largely Compliant) - APS 220 requires ADIs to have policies and procedures to ensure timely and reliable recognition of impaired facilities, with a documented analytical framework approved by the Board addressing: - identification of impaired facilities; - individual vs collective assessment; - measurement of impairment; - review of impairment amounts and methodologies. - APS 220 requires regular review of credit risk monitoring systems and that monitoring produce information on: - impaired and past due facilities; - fair value of security held against impaired facilities; - status of other sources of cash flows; - estimated future credit losses; - value of specific provisions and General Reserve for Credit Losses (GRCL). - APS 220 expects well-structured Credit-Risk Grading System (CRGS) for ADIs with substantial/complex credit exposures; smaller homogeneous exposures may be risk graded on a portfolio basis. - APRA is updating APS 220 to reflect BCBS Guidance (December 2015) and Guidelines on Prudential treatment of problem assets (April 2017). Key operational findings (EC2–EC7, EC12): - APRA regularly reviews CRGS, impairment and provisioning policies during on- and offsite reviews, and may require ADIs to amend policies, increase impaired assets, provisions, GRCL or capital. - APRA does not have a formal methodology to validate overall sufficiency of loan provisions nor a loan classification system; its approach includes: - high-level assessment of total provisions vs historical loss rate; - onsite review of methodology for collective and individually assessed provisions and file reviews to opine on provision sufficiency (including specific provisions and GRCL); - reliance on accounting provisions and external auditors’ opinions; APRA may require special purpose auditor engagements if under-provisioning is suspected across ADIs. - Reporting and monitoring: - Quarterly reporting: ARF 220.0 (impaired facilities), ARF 220.5 (movements in provisions), ARF 220.3 (Prescribed Provisioning methodology for simpler banks). - For IRB banks, ARF 113.0 is used to monitor expected losses vs provisions. - Supervisors use a standardized dashboard on ARF 220.0 quarterly to determine possible shortfalls in specific provisions and perform peer group analysis. - Off-balance-sheet exposures: - APS 220 includes on- and off-balance-sheet facilities in definition of impaired assets (direct credit substitutes, commitments, derivative exposures using current exposure or mark-to-market method, or APRA-approved methods). - IFRS 9 / AASB 9 (effective January 2018) introduces expected credit loss (ECL) model; APRA expects ADIs’ regulatory provisioning to comply with accounting ECL and BCBS guidance. - APS 220 still largely reflects IAS 39 concepts; APRA issued letters setting expectations for classification of IFRS 9 stages into GRCL and specific provisions (e.g., stage 1 = 12-month ECL => GRCL; Stage 2 = lifetime ECL => specific provisions with exceptions; Stage 3 = NPLs => specific provisions). - APRA plans to revise APS 220 to incorporate Basel guidelines and expected loss approaches. - Valuation and collateral (EC8): - APS 220 and APS 112/113 set requirements for collateral valuation; APS 220 requires policies/procedures for establishing, recording and reviewing collateral value, fair value valuation where possible, and that timing/intensity of reviews reflect reliance on collateral. - Asset classification and reclassification (EC9): - APS 220 lists indicators of impairment and requires experienced credit judgement; general threshold of 90 days past due for impairment but impairment can be recognized earlier where doubt exists. - Requirements for restoring impaired facilities to non-impaired status are specified (e.g., returned to original contractual terms; formally restructured; arrears below dollar equivalent of 90 days’ payments; fully performing for six months or three payment cycles; specific provisions no longer applicable). - Note: APS 220 currently allows loans considered “well secured” to not necessarily be impaired; APRA plans revisions to address this. - Board reporting (EC10): - APS 220 requires ADIs to establish criteria for identifying/reporting credit exposures of concern to senior management and Board; policies must specify reporting frequency and content, validation of models, and independent reviews with results reported to Board. - Individual vs portfolio assessment (EC11): - APS 220 expects significant potential credit loss facilities to be managed individually but does not prescribe a numeric threshold; no required thresholds for individual item basis. - Systemic trends and concentrations (EC12): - APRA monitors concentrations via quarterly risk reviews, industry credit risk reviews, thematic reviews, onsite reviews, and annual stress tests. - Recent observed buildups: concentrations in investment housing, interest only housing and commercial property; supervisory and prudential measures have been taken (e.g., DA housing team; measures to limit growth of interest-only and investor loans; strengthened RWA framework for housing). - APRA could deepen analysis on collateral efficacy given high share of residential mortgage portfolios. *Conclusions and recommendations (from source)* - APS 220 contains outdated concepts and needs revision to fully embrace expected loss provisioning and sound loan loss classification policies/practices. - APRA should: - continue close monitoring of underwriting and serviceability practices and ensure board oversight; - perform periodic deep dives into ADI credit risk frameworks depending on risk profile; - develop a formal methodology to validate overall sufficiency of loan loss provisions and consider enhancing loan classification systems; - enhance prudential reporting granularity (e.g., past due days, CRE loan categories, geographic breakdowns); - incorporate main guidelines related to residential mortgages and new CRE requirements in revisions to APS 220. ### Principle 19 — Concentration risk and large exposure limits (Assessment: Compliant) - APS 221 on large exposures revised to incorporate Basel III large exposure standard; revised APS 221 effective January 1st, 2019. - APS 221 requires ADIs to have large exposure policies covering: - exposure limits for governments, ADIs, corporate/individual borrowers, groups of related counterparties, industry sectors, countries, asset classes commensurate with risk appetite; - circumstances and authority for exceeding limits; - procedures for identifying, measuring, evaluating, monitoring, controlling and reporting large exposures and concentrations. - Reporting and systems: - ARF 221.0 Large Exposures submitted quarterly (ten largest exposures, exposures exceeding 10 percent or 5 percent of capital base depending on institution type). - Other data reported allow calculation of concentrations by currency, counterparty, country, instrument, maturity, sector, and by product (residential mortgage, commercial property). - Revised APS 221 specifics (large exposures and limits): - Large exposure threshold = 10 percent of Tier 1 Capital (Level 1 and Level 2). - Aggregate exposure limit to a single counterparty/group of connected counterparties = 25 percent of Tier 1 Capital, with exceptions: - exposures to foreign governments or central banks with zero risk-weight must not exceed 50 percent of Tier 1 Capital; - exposures between D-SIBs: exposures to other ADIs determined by APRA to be a D-SIB must not exceed 20 percent of Tier 1 Capital. - Limits apply net of eligible CRM techniques and excluded exposures; APRA may set specific limits on a case-by-case basis. - Stress testing: - APS 221 requires stress testing and scenario analysis of large exposures and risk concentrations. - APRA DA team coordinates annual industry stress tests; scenarios developed with RBA and RBNZ; recent stress tests have focused on residential mortgages, particularly investor and interest-only mortgages. *Assessment notes* - The revised APS 221 adopts Basel large exposure framework with a carveout for retail exposures from the definition of connected parties (deviation). - APRA conducts thematic reviews (e.g., CRE) and set internal triggers to monitor CRE concentrations. ### Principle 20 — Transactions with related parties (Assessment: Largely Compliant) - APS 222 (Intra-group Transactions and Exposures) sets requirements on associations with related entities; APRA’s current definition treats entities controlled by a bank or its ultimate domestic parent as “related entity” and excludes certain entities such as subsidiaries forming part of extended licensed entity and foreign parent overseas subsidiaries; APRA may deem other entities related on a case-by-case basis. - APRA’s current definition does not capture all parties in the Principle’s footnote (major shareholders, board members, senior/key staff, their related interests, close family members, corresponding persons in affiliated companies). - APS 222 requires: - Board policies on dealings with related entities to address risks as strictly as for unrelated entities; inconsistent terms vs benchmark must be Board-approved and documented in a register available for APRA inspection; - prudent limits on exposures to related entities (individual and aggregate); - procedures for resolving conflicts of interest; transparency requirements. - Current APS 222 limits (level 1 basis, expressed as percent of regulatory capital): - 50 percent to an individual related bank; - 150 percent aggregate to all related banks; - 25 percent to other individual regulated related entity; - 15 percent to individual unregulated related entity; - 35 percent aggregate to all related entities (other than related banks and related overseas-based equivalents). - Any proposed exposure in excess of prescribed limits requires APRA prior approval. - Reporting: - ARF 222.0 Exposures to Related Entities submitted quarterly by Australian-owned banks and foreign subsidiary banks (foreign banks submit Part C). - ARF 222.0 lists ten largest exposures to related entities and ELE-eligible subsidiaries, exposures to head office/branches/subsidiaries. - Gaps and planned changes: - APS 222 does not require board approval prior to related-party transactions or write-offs exceeding specified amounts, nor explicitly require exclusion of conflicted board members from approval processes. - Some APS 222 limits on related-party aggregates (e.g., 35 percent) are higher than large exposure limits (25 percent of Tier 1 Capital) in revised APS 221. - APRA released a revised draft APS 222 for consultation on July 2, 2018, broadening the definition of related parties, revising exposure limits, including contagion risk requirements, and updating reporting. *Assessment notes and recommendations* - APRA supervisors assess related party exposures as part of prudential reviews and receive regular reporting, but APS 222’s definition and some governance requirements fall short of the Principle’s full expectations. - Recommendation: adopt amended APS 222 to capture additional related-party categories, tighten limits and governance (including Board approvals and conflict-of-interest exclusions), and align aggregate limits with large exposure framework. *Assessment outcome from source*: Largely Compliant. ### Principle 21 — Country and transfer risks - APS 220 covers credit risk management; APS 221 requires inclusion of individual countries and geographic regions in large exposure policies; revised APS 221 strengthens expectations around country considerations and transfer risk (e.g., convertibility/transferability constraints). - Reporting: - ARF 731.3 (International Exposures) requires quarterly reporting of foreign country claims, off-balance sheet commitments and risk transfers on immediate borrower basis by maturity and on ultimate risk basis by country categorized by counterparty sector; distinction between cross-border and local claims; off-balance sheet categorized as derivatives, guarantees, credit commitments. - Data are reviewed by supervisors and provided to RBA for financial stability analyses. - Supervisory practices: - APRA’s onsite credit risk prudential reviews assess country and transfer risk where material; policies should specify acceptable country exposures and size limits. - Banks’ country exposures have been concentrated to New Zealand at the consolidated level (~10 percent of banks’ overall assets in December 2017); domestic-level country exposure is very limited. - Revised APS 221 requires ADIs to have adequate processes to identify, measure, monitor, report and control counterparty exposures regardless of source. *Findings* - APRA reviews country risk frameworks in the context of credit risk assessments and may perform focused reviews and require corrective actions where gaps are identified. *Overall supervisory assessments and recurring recommendations across themes* - APRA’s prudential standards and supervisory framework provide a comprehensive foundation for credit risk oversight, stress testing, large exposure management, related-party oversight, and country/transfer risk management. - Recurring recommendations include: - revise APS 220 to fully adopt expected credit loss concepts and Basel guidance, remove outdated concepts (e.g., exceptions for “well secured” loans not being impaired), and enhance provisioning validation methodology; - increase granularity of prudential returns (past due days, CRE classifications, geographic breakdowns); - formalize APRA’s methodology to validate sufficiency of loan loss provisions and loan classification systems; - finalise and implement revised APS 221 and APS 222 (consultation drafts exist) to align large exposure, related-party definitions and limits with Basel and close governance gaps; - continue thematic reviews, targeted onsite deep dives and stress testing, and strengthen Board-level reporting and oversight expectations. *Assessments cited in text* - Principle 17: Compliant - Principle 18: Largely Compliant - Principle 19: Compliant - Principle 20: Largely Compliant *Source: 1ausea2019006 - Section 62 of the Banking Act includes more detailed requirements about the needs for ADIs and NOHCs,* ### 11.5 percent of assets in December 2017. ### 1ausea2019006 - 11.5 percent of assets in December 2017. ### Country and transfer risk (EC3–EC6; Principle 21) - EC3 — Information systems, risk management and internal control: - APRA uses onsite credit risk reviews to assess banks’ information systems, risk management and internal control systems for aggregating, monitoring and reporting country exposures and adherence to country exposure limits. - Prudential reports and supervisory reviews consider country risk frameworks, limit-setting processes, and instances of limit breaches and remedial action. - Portfolio risk management and targeted operational and IT risk reviews inform supervisors on the integrity of risk management information systems. - APRA conducts prudential reviews of major overseas operations for Australian banks. - EC4 — Provisioning against country and transfer risk: - APRA’s framework does not explicitly require provisioning for country and transfer risk exposures; APRA expects banks to set sufficient provisioning levels in accordance with APS 220. - APRA requires the level of provisions and the GRCL to be regularly reviewed to ensure consistency with current expectations of credit losses. - Supervisors rely largely on accounting-based provisioning and use analysis tools and historical comparisons to assess provisioning adequacy. - Prudential forms applicable to asset quality and provisioning are reviewed by appointed auditors as per APS 310; external auditors consider provisioning in annual audits. - EC5 — Stress testing for country and transfer risk: - APRA has no specific prudential requirement mandating inclusion of country and transfer risk scenarios in firm stress testing, but ‘expects’ firms to include them if these risks are material. - APRA requests banks’ assumptions for overseas economic parameters where exposures are material and coordinates industry stress tests (including country-specific scenarios, e.g., New Zealand in collaboration with the RBNZ). - Supervisors monitor event-driven impacts on country exposures. - EC6 — Supervisory information and powers: - APRA receives extensive reports on foreign exposures, including BIS-aligned International Banking Statistics; the first reporting period for the enhanced reporting requirements was the period ending 31 December 2017. - Specific required reporting includes: - ARS 731.1 International Banking Statistics - Locational Data - ARS 731.3a International Banking Statistics - Immediate and Ultimate Risk Exposures - Domestic Entity - ARS 731.3b International Banking Statistics - Immediate and Ultimate Risk Exposures - Foreign Entity - ARS 731.4 International Banking Statistics - Balance Sheet Items - ARS 325.0 International Operations - Under the FSCODA and Section 62 of the Banking Act, APRA can seek additional information as needed. - APRA’s RDA team monitors country and transfer risk trends industry-wide and can require industry information as warranted. - Assessment of Principle 21: - Compliant - Comment: While APRA lacks an explicit prudential standard for country and transfer risks, CPS 220 and credit risk and large exposures standards are considered sufficient given the relatively small share of exposures in this category. Country risk is assessed as part of broader credit risk reviews, including appetite, limits and stress testing. ### Market risk (Principle 22) - EC1 — Market risk management framework: - Market risk RWA at major domestic banks: four of five banks have total market risk RWA of roughly 2.5 percent of total firm RWA and one with about 4 percent of total RWA. - CPS 220 requires an RMF that includes risk management strategy, policies, procedures, roles/responsibilities and a clear, concise risk appetite statement addressing material risks (including market risk). - Market risk is specifically covered under APS 116 and APG 116 (traded market risk, governance, valuation). APS 116 (capital standard) does not apply to local branches of foreign banks, but APRA applies similar qualitative standards to those branches. - Onsite prudential reviews of market risk management for banks with trading exposures are required at least once every three years; larger/domestic banks with IRB approval are reviewed more frequently, supported by market risk and modelling specialists. - APRA conducts targeted reviews of trading activities and thematic issues as warranted; supervisors assess market risks in firms’ ICAAP. - EC2 — Board and senior management oversight: - CPS 220 assigns board responsibility for risk management framework and approval of risk appetite statement; board oversight of implementation is required. - Supervisors review board and management awareness, MIS quality, and reporting; boards of major banks are met annually and material risk management issues are discussed. - Under APS 116 the board (or committee) must ensure adequate systems to identify, measure and manage market risk, including separation of duties and avoidance of conflicts. - EC3 — Market risk controls and MIS: - Firms must maintain MIS adequate for normal and stressed conditions for measuring and reporting material risks; limit frameworks must be board-approved and clearly articulated. - APRA prudential reviews assess limit frameworks relative to bank size, complexity and risk profile, frequency and nature of breaches, reporting and escalation to the board. - Onsite/offsite work assesses inherent market risk (PAIRS) and the adequacy of risk management and controls, including model limitations. - EC4 — Valuation controls: - Supervisors assess systems around trade capture, market rates collection, valuation methodologies and valuation reserves. - APS 116 requires policies for valuation methodologies, treatment of illiquid instruments, reserves for mark-to-market P&L, independent price verification, independent validation of valuation and risk models, and active monitoring of market liquidity. - EC5 — Capital and valuation adjustments: - APRA assesses capital adequacy via the PCR, reviewing ICAAP, actual vs required regulatory capital, and inherent risks relative to controls. - APRA’s market risk regulatory capital requirements were compliant with the Basel framework in the 2014 RCAP; practices unchanged materially since. - Market risk specialists review quarterly regulatory reporting and technical model changes; APRA approval is required for all material model changes. - APRA collects fair value measures for Level 1, 2, and 3 assets; Level 3 assets are a relatively small share. High share of Level 3 may trigger valuation adjustments or increased capital. - EC6 — Stress testing: - APS 116 requires routine and robust stress testing as a supplement to model outputs; results must be used in internal capital assessment and reflected in policies and limits and communicated to senior management and periodically to the board. - APRA reviews stress testing integration via onsite reviews and ICAAP assessments. Banks using internal models must carry out APRA-specified quarterly stress tests (matrix of price and volatility shocks by asset class). - Expectations differ by institution size, nature and complexity of trading exposures. - Assessment of Principle 22: - Compliant - Comment: APRA has solid processes; supervisors routinely monitor market risk positions, review models and stress-testing output, risk appetite statements and exposures against board-approved limits. ### Interest rate risk in the banking book (IRRBB — Principle 23) - EC1 — IRRBB framework and requirements: - CPS 220 provides core RMF requirements applicable to IRRBB. - APS 117 addresses IRRBB for advanced approaches banks; APRA treats IRRBB as a Pillar 1 risk for advanced banks and requires model approval to use internal models for IRRBB capital. - IRRBB internal model soundness standard: 99 percent confidence level and a one-year holding period; capital must cover repricing risk, yield curve risk, and unless exempted, basis and optionality risks. - Standardized banks are covered via APS 110 and are expected to conform to APS 117 general principles. - ARF 117 ‘Repricing Analysis’ is submitted quarterly, breaking repricing gaps into 14 time buckets and 35 categories by currency; key metric: economic value sensitivity (EVS) with a ±200 basis point parallel shift requirement. Firms expected to assess earnings impact to NII internally. - EC2 — Board approval and oversight: - APS 117 requires board inclusion of IRRBB in risk appetite and board-approved IRRBB exposure limits; CPS 220 requires board approval of major risk policies and oversight. - Supervisors review board/committee minutes and reporting used by management and the board. - EC3 — Measurement systems, models, limits, MIS: - APS 117 and APG 117 expectations include IRRBB measurement track record, data policies, internal model requirements, modelling repricing/Yield Curve, basis and optionality risks, material model change policy, 99 percent/1-year capital calculation, stress testing use, model validation and independent triennial review. - Supervisory reviews cover risk appetite, data and systems, governance, policy, risk measurement (earnings and economic value), stress testing, reporting and transfer pricing. - All material model changes for IRRBB must be approved by APRA; model assumptions should be documented and periodically approved by board or ALCO; models subject to periodic validation. - Limits must be consistent with board-approved risk appetite; ALCO expected to exercise oversight and receive regular reporting. - EC4 — Stress testing: - Advanced firms must stress test IRRBB (APS 117), including breakdowns in key modelling assumptions and yield curve shape/level shocks; results must be communicated to senior management and board/committee. - Standardized banks have no specific IRRBB stress testing requirement, but all banks report ARF 117 including impact of ±200 basis point parallel move. - IRRBB scenarios were included in the 2017 industry stress test. - Additional criteria: - AC1: Firms using internal models must measure maximum potential change in economic value at 99 percent confidence over one year; all banks report ±200bp impact in ARF 117. - AC2: APRA assesses ICAAP coverage of IRRBB; APS 110 requires ICAAP. APRA uses ARF 117 to identify outliers and market risk/models specialists assess internal economic capital models for advanced banks. - Assessment of Principle 23: - Compliant - Comment: APRA provides guidance; IRRBB is captured in ICAAP and as a Pillar 1 element for advanced banks. Supervisory monitoring and reporting are extensive. ### Liquidity risk (Principle 24 — EC1 excerpt) - EC1 — Liquidity requirements and monitoring: - APS 210 Liquidity and APG 210 set APRA’s liquidity framework; ADIs must have measurement, monitoring and management frameworks proportionate to nature, scale and complexity. - APRA requires large/complex ADIs to maintain an LCR of at least 100 percent (absent financial stress) and an NSFR of at least 100 percent. - Smaller/less complex ADIs may be designated as Minimum Liquidity Holding (MLH) ADIs and must hold a minimum of nine percent of liabilities in specified liquid assets, where liabilities are defined as total on-balance sheet liabilities and irrevocable commitments. - LCR versus MLH designation is based on size and complexity; no fixed triggers; APRA considers business model, funding sources and international activities. - An October 2017 RCAP assessment rated APRA’s LCR rules as ‘compliant’ overall; HQLA component assessed as largely compliant due to inclusion of securities eligible for RBNZ market operations. - APRA applies the NSFR to ADIs to which the LCR applies; NSFR rules comply with Basel principles with national discretions on interdependent assets/liabilities and treatment of certain off-balance exposures (e.g., 1percent RSF for unconditionally revocable facilities and 100 percent RSF for certain trade finance obligations using actual net outflows). - APRA monitors liquidity with metrics consistent with Basel: contractual maturity mismatch; available unencumbered assets; LCR by significant currency; concentration of funding. - APRA’s liquidity reporting forms were recently updated, with an effective date of January 1, (text supplied ends here). *Source: 1ausea2019006 - 11.5 percent of assets in December 2017.* ### 2018. The primary changes to the liquidity reporting forms are to include the NSFR, add HQLA 2B to the LCR ### 1ausea2019006 - 2018. The primary changes to the liquidity reporting forms are to include the NSFR, add HQLA 2B to the LCR ### Liquidity reporting and prudential framework - Primary changes to liquidity reporting forms: to include the NSFR, add HQLA 2B to the LCR reporting forms, and enhance daily liquidity reporting requirements. - APRA liquidity reporting comprises: - an all currency LCR which includes significant currency HQLA/outflows/inflows (ARF 210.1A); - Australian dollar LCR (ARF 210.1B); - spot contractual funded balance sheet maturity (ARF 210.3); and - a funded balance sheet forecast (ARF 210.4). - APRA also collects information relating to ADIs’ large liability exposures (ARF 210 from 1 January 2018). - Funding concentrations are assessed as part of routine supervision, primarily during onsite prudential reviews. - APRA’s DA team produces a Market and Economic toolkit to assist supervisors to identify and assess entity specific risks and monitor risks regularly. - Intraday liquidity management is primarily the responsibility of the RBA; APRA requires ADIs to explicitly consider intraday liquidity risk in APS 210 and APG 210. - Monitoring frequency: regular liquidity meetings generally quarterly for larger, complex ADIs and less frequently for smaller ADIs. ### Liquidity prescriptions and calibration (EC2) - Prudential calibration reflects bank size, complexity and liquidity risk profile: - larger, more complex locally incorporated ADIs: required to maintain LCR and NSFR ratios above 100 percent; - less complex, smaller domestic and foreign ADIs: may use the MLH regime (not subject to NSFR prudential requirement but must ensure activities funded with stable sources per APS 210); - modified liquid assets requirement for foreign ADIs: 40 percent LCR. - APS 210 requires ADIs to: - maintain an LRMF commensurate with exposures; - have a robust framework for projecting cash flows from assets, liabilities and off-balance sheet items. - APRA tailors liquidity requirements to the Australian market and macro environment and sets a Committed Liquidity Facility (CLF) with the RBA to cover shortfalls between available HQLA and net cash outflows. - Supervisory tools available to APRA include increasing minimum liquidity requirements and imposing enhanced liquidity reporting (ARF 210.5) or additional reporting during volatile funding markets. ### Committed Liquidity Facility (CLF) - Australian dollar HQLA defined to include government securities, semi-government and central bank liabilities. - Supply constraint: government debt is less than circa 40 percent of total GDP and 15 percent of total ADI assets, meaning insufficient HQLA supply to meet aggregate LCR demand. - RBA CLF features: - RBA commits to provide pre‑specified amounts of AUD liquidity to ADIs against a range of assets under repurchase agreement, subject to ADI having positive net worth; - facility fee: 15 basis points; - CLF eligible assets include all debt securities accepted for RBA market operations. - CLF sizing: - determined annually by APRA after rigorous review of ADIs’ funding plans and whether ADI has taken ‘all reasonable steps’ to minimize CLF through balance sheet management; - APRA grants full CLF only where satisfied with ADI’s proposed actions. - System-wide CLF requirement determined yearly based on RBA assessment of government and semi-government securities that can be held without unduly affecting market functioning. - CLF limitations: - CLF alone will not allow an LCR ADI to meet minimum 100 percent LCR; an LCR ADI must also hold HQLA; - Foreign ADIs are not eligible for CLF and are required to meet a 40 percent LCR. ### Liquidity risk management framework, governance and oversight (EC3–EC5) - APS 210 and CPS 220 set expectations for LRMF and RMF: - RMF requirements under CPS 220 include maintaining a Board approved risk appetite statement, Board approved risk management strategy, and a comprehensive review every three years. - APS 210 minimum LRMF content: Board‑approved liquidity risk tolerance; liquidity management strategy and policy; operating standards for identifying, measuring, monitoring and controlling liquidity risk; funding strategy; contingency funding plan. - Board responsibilities: ensure senior management has necessary experience, review liquidity management framework and practices at least annually, receive regular liquidity position reports. - Supervisory assessment practices: - supervisors review funding, LCR assumptions, liquidity risk appetite and limits, contingency funding arrangements, treasury function, liquidity reporting and data quality, and adequacy of controls under the three lines of defense during onsite reviews and offsite monitoring; - internal/external audit reviews and comprehensive independent review every three years (as required under CPS 220) are used to assess LRMF adequacy. - Funding strategy requirements (EC5): - ADIs must develop and document a three-year funding strategy, reviewed and approved by the Board at least annually; - strategy must be updated at least annually to reflect changed funding conditions or ADI strategy; APRA must be advised of material changes; - LCR ADIs must conduct entity wide stress tests to ensure adequate funding. - NSFR implementation: - since January 2018, larger, more complex ADIs required to maintain an NSFR greater than 100 percent. - Observed market adjustments since NSFR introduction: - ADIs increased funding from more stable sources such as deposits, equity and long-term wholesale debt and reduced reliance on short-term wholesale markets; - 30-day bank bills, which accounted for a quarter of ADI funding, have disappeared as a funding source due to 100 percent LCR treatment. ### Stress testing, contingency planning and supervisory stress exercises (EC6–EC7) - Contingency funding plans (CFP) (EC6) requirements: - CFP must be commensurate with complexity and role in financial systems, articulate contingency sources and estimated amounts, include escalation/prioritization procedures and lead times, be flexible, include retail depositor considerations, and be reviewed and tested annually or more frequently and approved by the Board. - APG 210 provides extensive guidance on CFP operational aspects. - CFPs are commonly assessed during onsite reviews; supervisors ensure CFPs are tested as part of ADI stress testing programs. - Stress testing requirements (EC7): - APS 210 requires LCR ADIs to conduct regular stress tests for a variety of short-term and protracted institution-specific and market-wide stress scenarios (individually and in combination). - APG 210 guidance: scenarios should cover customer type, product, business, currency and entity-specific stress events. - APRA‑coordinated stress tests (approximately once per annum) include larger entities and have been enhanced to include Australian mutual ADIs; foreign ADIs not included to date. - APRA stress tests assess funding under protracted stress and impacts on LCR and NSFR ratios. - Supervisors use stress test results to guide supervisory actions and to inform engagement with ADIs. ### Foreign currency liquidity management (EC8) - APS 210 expectation: ADIs active in multiple currencies must maintain liquid assets consistent with distribution of liquidity needs by currency. - ADIs are required to set risk appetite for acceptable currency mismatches and undertake separate analysis for each material currency, including stress testing and limits. - APG 210 clarifies expectations including operational restrictions, time zone differences, currency conversion risks and availability of government debt in relevant jurisdictions. - Supervisory engagement includes onsite reviews, periodic quarterly face-to-face liquidity updates supported by liquidity risk specialists, and assessment via annual CLF application processes. ### Encumbered assets and disclosure (AC1) - Under the LCR regime covering over 90 percent of Australian ADI assets, ADIs must hold unencumbered HQLAs to cover net cash outflows in a 30-day stress event; APS 210 requires these assets to be legally and contractually available. - ADIs using CLF must hold a stock of unencumbered assets as collateral. - APS 330 requires disclosures related to encumbered assets (coverage through LCR, leverage ratio, securitization). - Where supervisors identify excessive encumbrance risks, specific monitoring and reporting requirements are imposed. ### Assessment of Principle 24 - Overall assessment: Compliant. - APRA has: - established a liquidity risk specialist team; - implemented LCR and NSFR requirements for large, complex ADIs; - maintained a thorough prudential framework in APS 210 and APG 210; - quarterly liquidity risk review reports and dashboards showing key liquidity metrics and outliers. --- ### Operational risk framework (Principle 25, EC1–EC8) - General framework and standards: - No single prudential standard specifically on operational risk, but CPS 220 and APS 115 (AMA) cover many operational risk elements. - CPS 220 requires ADIs to have RMF to identify, measure, evaluate, monitor, control and report operational risk commensurate with nature, scale and complexity. - APS 115 (AMA) requires operational risk management framework for AMA‑approved ADIs to be robust for quantitative estimates; measurement system must be conceptually sound, comprehensive, transparent and independently reviewable. - Supervisory practices: - APRA supervisory framework provides guidance for assessing inherent operational risks and related management and controls, including IT risk and history of processing failures, fraud risk, and IT system environment. - Supervisors use onsite prudential reviews, interaction with boards and management, and specialist Operational Risk and IT Risk teams to assess operational risk. - Business continuity and disaster recovery (EC4): - CPS 232 Business Continuity Management requires Board-approved BCM policy, identification/management of continuity risks, annual reviews, internal audit or external expert review, and notification to APRA of certain disruptions. - CPG 233 Pandemic Planning supplements CPS 232. - IT risk and information security (EC5–EC6): - APRA has an IT risk team of 6–7 people supporting frontline supervisors and conducts IT-focused prudential reviews covering resilience, recovery, information security, governance, and disaster recovery. - APRA issued PPGs and information papers on outsourcing shared computer services including cloud, CPG 234 on Security Risk in Information and Information Technology, CPG 235 on Managing Data Risk, and an Information Paper on Cyber Security Survey results. - APRA consulted in March 2018 on draft CPS 234 Information Security. - APRA may need to invest more resources and skills in IT risk given fintech and digital banking developments. - Reporting and notification (EC7): - APRA receives quarterly operational risk data for capital adequacy, including operational risk losses; data is subject to audit testing. - ADIs must submit RAS, business plan and RMS on adoption and within no more than 10 business days after board approval; notification required for material changes and jurisdictional issues. - Outsourcing (EC8): - CPS 231 and PPG 231 require Board‑approved outsourcing policy for material business activities, due diligence, legally binding agreements for third-party outsourcing, consultation with APRA prior to outsourcing material activities outside Australia, and notification after entering such agreements. - Demonstrable business case, tender/selection process, due diligence, Board involvement, monitoring, renewal processes and contingency plans are required. - APRA may review service provider documentation and conduct onsite visits to service providers if necessary. ### Additional operational risk criteria and systemic oversight (AC1) - Operational risk specialists identify common points of exposure and vulnerabilities across ADIs via thematic reviews and industry risk registers; APRA increased thematic reviews in recent years. - RDA Division expected to play a key role in systemic operational risk identification and horizontal actions. ### Assessment of Principle 25 - Overall assessment: Compliant. - Comments: - CPS 220 and APS 115 provide a reasonable set of prudential requirements for operational risk. - APRA has specialized risk teams in operational risk and IT risk to support frontline supervisors. - APRA should continue to strengthen the IT risk team and analytical toolkits, and progress work on a prudential standard on operational risk management. --- ### Internal control and internal audit (Principle 26, EC1–EC5) - Internal control framework expectations: - APRA’s prudential standards indirectly cover organizational structure, accounting policies, checks and balances and safeguarding assets via risk management and governance standards (CPS 220, CPS 510, APS 310). - CPS 220 requires processes for identifying/assessing material risks; mechanisms for monitoring compliance; contingency arrangements and periodic review. - Board must annually attest that risk management and internal control systems are operating effectively; comprehensive review by independent experts at least every three years. - Supervisory assessment: - Onsite reviews and specialist risk teams assess adequacy of RMF and internal controls; outcomes captured in PAIRS and inform risk governance grading. - APRA assesses back office and control function resourcing and authority relative to business origination units during prudential reviews. - Compliance function (EC3): - ADIs required to have a designated compliance function with reporting independent of business lines; APRA assesses effectiveness through onsite reviews and supervisory interactions. - Internal audit function (EC4–EC5): - CPS 510 requires an independent internal audit function; APS 310 and CPS 510 set responsibilities including audit scope over compliance with prudential requirements and evaluation of RMF. - Board Audit Committee must review audit plans and findings; internal auditor must have full access to business lines and report to the Audit Committee. - Supervisors assess internal audit as part of ongoing supervision and prudential reviews, though APRA does not perform dedicated comprehensive assessments of internal audit effectiveness. - APRA guidance assists supervisors in assessing internal audit nature, structure, resources, independence, audit approach, planning and reporting. - Assessment of Principle 26: - Overall assessment: Largely Compliant. - Key observations: - Some main requirements on internal control and internal audit are not explicitly or comprehensively spelled out in APRA prudential standards; - APRA supervisors review internal audit work within theme-specific prudential reviews but do not consistently perform in‑depth, periodic reviews solely focused on internal audit effectiveness; - APRA could strengthen explicit standards and periodic deep reviews of internal audit and linkages to board assurance. ### Financial reporting and external audit (Principle 27, EC1–EC6) - Legal and supervisory responsibilities: - Corporations Act requires banks to prepare financial reports in compliance with IFRS; boards must make annual declaration of accounting standards compliance. - ASIC oversees directors’ reports and financial statements; APRA relies on Corporations Act and ASIC oversight for external audit assurance. - APRA reporting controls: - Data submitted to APRA must be subject to internal review and authorization procedures; board and senior management responsible under ARS. - External audit requirements: - Annual financial reports must be audited; half-year reports must be audited or reviewed (Chapter 2M of Corporations Act; Section 301 referenced). - APS 310 requires appointed auditor to provide assurance on reliability of data provided to APRA and controls over prudential reporting. - Auditing standards align with AUASB and IAASB standards. - Audit coverage expectations: - APS 310 details audit coverage: loan portfolio, loan loss provisions, nonperforming assets, asset valuations, trading and securities activities, derivatives, securitizations, consolidation of and involvement with off-balance sheet vehicles, and adequacy of internal controls over financial and prudential reporting. - Supervisory powers over auditors: - Both APRA and ASIC can take actions leading to removal of an auditor for inadequate expertise or independence. *Source: https://www.imf.org/-/media/files/publications/cr/2019/1ausea2019006.pdf* ### Section 17 of the Banking Act gives APRA the authority to remove a person from the position of auditor of a ### 1ausea2019006 - Section 17 of the Banking Act gives APRA the authority to remove a person from the position of auditor of a ### APRA authority to remove auditors; statutory bases - Section 17 of the Banking Act gives APRA the authority to remove a person from the position of auditor of a bank if APRA finds that the person has failed to adequately and properly perform the functions and duties of the position and does not meet the fit and proper criteria set out in the Prudential Standards. - ASIC or APRA can ask the ‘Companies Auditors Disciplinary Board’ to cancel or suspend an auditor’s registration if they fail to meet their duties or are not fit and proper (section 1292 of the Corporations Act). - The professional code of ethics for auditors covers auditor independence and has the force of law under the Corporations Act through legally enforceable auditing standards. - Auditors must provide an independence declaration, which is published with the financial report. ### External auditor rotation and independence (EC7) - Requirement: - Individuals with a ‘significant role’ in an audit can only carry out the audit for five consecutive years and for only five years out of any seven-year period. - This is covered in APRA’s CPS 510 and Section 324DA of the Corporations Act. - This rule does not apply to audit firms, but to individuals at audit firms only. - Exemptions: - An exemption may be granted if an individual provides services that are otherwise not readily available or when there are no other registered auditors available to provide adequate services. - APRA stated that in practice this is rare. - Additional statutory requirement: - The Corporations Act requires the rotation of the lead and review partners on an audit after five years for publicly listed banks. ### Supervisor engagement with external auditors (EC8) - APRA engagement: - APRA meets with the major audit firms as a group at least twice per year to discuss emerging issues and/or make any necessary clarifications on compliance and reporting obligations. - APRA accounting staff told assessors they meet regularly with auditors and had met with the industry seven times in the last two years. - APRA meets regularly with banks and their auditors to discuss the external auditor’s annual prudential assurance report, or issues related to a special purpose engagement, if applicable. - These meetings include discussions of issues identified during the course of the auditor’s financial report audit, as well as deficiencies in control frameworks related to prudential reporting or any other audit work requested by APRA as part of a special purpose engagement. - APRA may also meet with the appointed auditor bilaterally, if needed. ### Auditor reporting obligations to the supervisor (EC9) - Statutory reporting to APRA: - Under Section 16BA of the Banking Act, auditors must inform APRA if they have reason to believe that a bank is insolvent, or if there is a significant risk that it will become insolvent, or if an ‘existing or proposed state of affairs may materially prejudice the interests of depositors of the bank’. - Matters considered likely to ‘materially prejudice the interests of depositors’ generally are those related to capital adequacy, solvency and others that may affect a firm on a going concern basis. - Auditors must also inform APRA if they have grounds to believe that a bank has not complied with a provision of the Banking Act, the Banking Regulations of 2016, or FSCODA; a Prudential Standard; or a direction issued by APRA under its authorities in the Banking Act. - Under Section 70A of the Banking Act, auditors who report ‘in good faith’ cannot be held liable for breach of confidentiality. - Statutory reporting to ASIC: - Section 311 of the Corporations Act requires an auditor to report to ASIC within 28 days if they have reason to suspect a firm is failing to meet provisions of the Corporations Act. - This duty applies to audits of annual financial reports and to the audit or review of a semi-annual financial reports required by the Corporations Act. - Examples that would require notification would be failing to comply with accounting standards or ‘true and fair view’ requirements. ### Access to external auditors’ workpapers (AC1) - Both ASIC and APRA have the authority to require access to auditors workpapers. *Source: 1ausea2019006 - Section 17 of the Banking Act gives APRA the authority to remove a person from the position of auditor of a* ### Section 16B of the Banking Act gives APRA the authority to require auditors to provide information, produce ### Section 16B of the Banking Act gives APRA the authority to require auditors to provide information, produce ### Authority over auditors and reporting framework - Section 16B of the Banking Act authorizes APRA to require auditors to provide information and produce books, accounts or documents about specified entities. This applies to external auditors of banks, holding companies or their subsidiaries, and to external auditors of foreign bank subsidiaries incorporated or doing business in Australia. - ASIC has power to access external auditors’ working papers under Section 30A of the ASIC Act. - Under the Corporations Act, ASIC is the regulator responsible for external audits. All Australian incorporated banks are required to issue audited financial reports to the public on an annual basis and audited or reviewed financial reports at the half-year. - APRA supervisors regularly engage with external auditors; external auditors are required by prudential standards and laws to report to APRA where they believe a firm is not complying with prudential requirements. ### Principle 27 — Assessment - Assessment: Compliant - Comments: - ASIC reviews external audits, including asset valuations, and carries out ongoing surveillance of financial reporting. - ASIC and APRA have regular interaction; ASIC is expected to inform APRA if concerns arise in its reviews. ### Principle 28 — Disclosure and transparency (overview) - Principle statement: The supervisor determines that banks and banking groups regularly publish information on a consolidated and, where appropriate, solo basis that is easily accessible and fairly reflects their financial condition, performance, risk exposures, risk management strategies, and corporate governance policies and processes. - Assessment: Compliant ### EC1 — Periodic public disclosures (APS 330 and Corporations Act) - APS 330 requires publication of information on a quarterly, semi-annual and annual basis; disclosures are made on a consolidated group basis except for smaller ADIs where disclosures are generally made on a solo (ADI) basis. - Under APS 330 all ADIs must disclose their: risk profile; risk management practices; capital adequacy; capital instruments; and remuneration practices. - ADIs to which they apply must report information on their leverage ratio; liquidity coverage ratio (LCR); Net Stable Funding Ration (NSFR); and G-SIB indicators (there are currently no Australian GSIBs). - Corporations Act requires annual audited financial reports and semi-annual reports (at least reviewed). Financial reports must comply with Australian accounting standards consistent with International Financial Reporting Standards. - Publicly listed banks must make timely disclosures of developments material to the value of the firm’s securities. - Pillar 3 / APS 330 key disclosure requirements include: - composition of regulatory capital in a standard form; - reconciliation between regulatory capital and audited financial statements; - full terms and conditions of regulatory capital instruments; - quantitative and qualitative information about capital adequacy, credit and other risks; - where applicable, LCR, NSFR, leverage ratio disclosures; - information on remuneration including aggregate information on senior managers and material risk-takers; - where applicable, quantitative information on G-SIB indicators. ### EC2 — Scope and content of disclosures - APRA disclosures cover capital-related disclosures (Attachments A and B of APS 330), risk exposures and assessment (Attachments C and D), leverage ratio (Attachment E), LCR and NSFR (Attachment F), remuneration (Attachment G), and G-SIBs (Attachment H). - Capital disclosures: regulatory capital reconciliation and capital disclosure template; updates required within seven calendar days if capital instruments change. - Risk disclosures: both quantitative and qualitative; advanced approach banks must disclose more and more frequently; required elements include strategies and processes; structure of risk management function; scope and nature of risk reporting/measurement systems; hedging/mitigation policies and monitoring. - Corporations Act requires operating and financial review under section 299A covering business strategies and prospects. ### EC3 — Disclosure of group entities - No specific prudential reporting requirements on corporate structure; Corporations Act and accounting standards require disclosure of certain interests in other entities. - APRA requires regulatory capital reconciliation reporting showing legal entities included/excluded from accounting vs regulatory consolidation and for excluded entities ADIs must disclose total balance sheet assets; total balance sheet liabilities; and main activities. - Reconciliations must provide details of restrictions or impediments on transfer of funds or regulatory capital within the group. ### EC4 — Enforcement of disclosure standards - Banking Act gives APRA authority to require banks to comply with APS 330 and to address disclosure weaknesses or require further disclosure. - Corporations Act enforcement by ASIC for noncompliance with accounting standards; ASIC conducts surveillance and requires remedial actions where significant concerns are identified. ### EC5 — Aggregate publications on the banking system - APRA issues statistical publications monthly and quarterly with individual bank and aggregate banking sector data, including assets and liabilities, loans and advances, capital adequacy, financial performance and impaired assets; APRA also publishes articles on policy initiatives and developments. - The RBA provides aggregate information in its semi-annual Financial Stability Review and extensive banking sector data on its website. ### Additional criterion AC1 — In-period exposure information - Risk exposures are disclosed quarterly, semi-annually and annually on the stock of exposures at the end of the period. - Period-to-period changes allow analysts to calculate turnover from quarter end to quarter end but do not provide intra-period exposure dynamics. ### Principle 29 — Abuse of financial services (overview and assessment) - Principle statement: The supervisor determines that banks have adequate policies and processes, including strict customer due diligence (CDD) rules to promote high ethical and professional standards and prevent criminal use of banks. - Assessment: Largely Compliant - Comments: - AUSTRAC has authorities under laws and rules and supporting processes, but faces resource constraints and tensions from its dual role as supervisor and FIU. - Recent cases show challenges with partial reliance on self-reporting by firms; AUSTRAC should increase use of rapid, formal legal requirements for corrective actions and perform in-depth periodic assessments (internal or external). - APRA should ensure AUSTRAC-identified weaknesses inform APRA assessments of banks and consider how to gain comfort about firms’ control practices beyond self-reporting. ### EC1 — Legal framework and supervisory duties (AML/CTF regime) - Australia’s AML/CTF regime comprises Anti-Money Laundering and Counter-Terrorism Financing Act (AML/CTF Act), AML/CTF Rules, AML/CTF Regulations, and Financial Transaction Reports Act (FTR Act). - AUSTRAC is the AML/CTF regulator, supervisor and FIU; it oversees over 14,000 reporting entities across banking and other sectors. - AUSTRAC does not have criminal law enforcement authority and refers potential criminal matters to law enforcement agencies. - AML/CTF Act and Rules require covered entities to: - enroll with AUSTRAC; - register to provide certain services (remittance services and digital currency exchange); - conduct customer identification, verification and ongoing due diligence; - report suspicious matters, certain threshold transactions and all international funds transfer instructions; - develop and maintain an AML/CTF program; and - make and retain certain records for seven years. ### EC2 — Adequacy of banks’ policies and processes - AUSTRAC requires AML/CTF programs addressing operational details for compliance and managing product/service misuse risk; programs must include senior management oversight, employee due diligence, staff training, and regular effectiveness reviews. - AUSTRAC uses annual independent reviews (‘compliance reporting’) conducted by third parties; these reviews provide findings but not assurance of control effectiveness. - AUSTRAC uses a risk-focused supervisory approach informed by substantial data and suspicious matter reporting. ### EC3 — Reporting suspicious activities to supervisor - APRA’s APS 222 requires ADIs to notify APRA of circumstances with potentially material adverse consequences. - Banks must report suspicious activities to AUSTRAC; AUSTRAC would alert APRA if it discovered something ‘material’. APRA has access to AUSTRAC’s monitoring system. - AML/CTF laws do not require self-disclosure of matters that may be important for prudential purposes. - APRA and AUSTRAC have an MoU and meet periodically; assessors observed coordination and communication could be improved. ### EC4 — Supervisor informing FIU and sharing information - AUSTRAC refers legal matters to law enforcement and can be accessed by APRA and ASIC for information collected in either role. ### EC5 — CDD program requirements (elements a–f) - AML/CTF Act requires reporting entities to adopt and maintain an AML/CTF program (Part 7). Programs comprise: - Part A: identifying, managing and reducing ML/TF risks (Chapters 8 and 9 of AML/CTF Rules), including a risk-based transaction monitoring program capable of identifying complex or unusual transactions. - Part B: CDD procedures (Chapters 4 and 15 of AML/CTF Rules), including enhanced customer due diligence (ECDD) for high-risk situations. - ECDD triggers include high ML/TF risk, foreign PEPs, SMR obligations, and transactions involving prescribed foreign countries. - ECDD actions required: seek further information; detailed analysis of customer and beneficial ownership, source of wealth/source of funds where appropriate; verify/re-verify customer and beneficial owner information; enhanced transaction monitoring; senior management approval for establishing/continuing high-risk relationships. - Record-keeping requirements: - Transaction records relating to designated services; - Electronic funds transfer instruction records kept for seven years after the transfer; - Customer identification records kept for the life of relationship and for seven years after cessation; - Records of adoption of AML/CTF program and copy of program; - Records about due diligence on correspondent banking relationships. ### EC6 — Correspondent banking controls - AML/CTF Act prohibits entering correspondent relationships without determining to the best of its ability whether the other institution is a shell bank or has a relationship with a shell bank. - Preliminary risk assessment required before entering a correspondent relationship; thorough due diligence if warranted. - Senior officer approval required to enter correspondent relationships, taking into account Chapter 3 of AML/CTF Rules. - Ongoing regular risk assessments and due diligence as warranted. - In 2017 AUSTRAC conducted supervisory work on correspondent banking at 39 reporting entities. ### EC7 — Controls and systems to prevent/identify/report abuses - Reporting entities must have AML/CTF programs with appropriate risk-based systems and controls and AML/CTF risk awareness training for employees. - All banks required to report suspicious matters via Suspicious Matter Report (SMR) when reasonable grounds of suspicion exist in relation to provision of a designated service. - AUSTRAC’s SMR monitoring team provides feedback at quarterly AUSTRAC Inter-Bank Fora and with individual banks. - In 2017 AUSTRAC campaign reviewed more than 1,500 SMRs submitted by the top 37 higher-volume SMR reporters; findings were provided in writing and feedback sessions held with ten large financial institutions. - AUSTRAC plans a review of independent review process across the 18 largest reporting entities. ### EC8 — Enforcement powers - AUSTRAC has a range of powers under the AML/CTF Act and Rules from administrative to civil and criminal; AUSTRAC prefers to work with firms but will use formal powers when warranted. ### EC9 — Independent reviews, compliance officers, screening, training - AML/CTF programs must include independent review of risk assessment processes, governance and controls. - AUSTRAC CEO can require appointment of an external auditor and provision of audit reports. - Firms must designate an AML/CTF Compliance Officer at management level with expected reporting lines to the Chief Risk Officer. - Employee due diligence programs required for screening and rescreening employees who may facilitate ML/TF. - AML/CTF training programs must cover obligations, consequences of non‑compliance, types of ML/TF risk, and firm procedures relevant to employees’ work. - AUSTRAC supervisory reviews over three years covered ATM/IDM services, CDD/beneficial ownership/PEP implementation, correspondent banking obligations, and SMR processes. ### EC10 — Internal reporting policies and MIS - Firms required to regularly review effectiveness of compliance policies and systems and appoint an independent reviewer to assess program effectiveness and report to Board and senior management. - AUSTRAC uses these independent reviews in its supervisory assessments. ### EC11 — Immunity for good-faith reporting - Under section 235 of the AML/CTF Act, banks, officers, employees and agents have statutory immunity from any action, suit or proceeding in relation to anything done or omitted in good faith: - carrying out customer identification procedures; - fulfilling a requirement not to provide or continue a designated service; - compliance with any other AML/CTF Act requirement. - Statutory immunity subject to limited exceptions related to criminal and civil penalty provisions under the AML/CTF Act and proceedings under the Proceeds of Crime Act 2002. ### EC12 — Cooperation with domestic and foreign authorities - APRA and AUSTRAC entered into a reciprocal MoU in 2016 formalizing information sharing and cooperation. - AUSTRAC can provide financial intelligence to designated agencies including ASIC and APRA which have direct online access to AUSTRAC data under strict conditions outlined in an MoU. - AUSTRAC can share information with foreign governments typically via formal exchange agreements; some partner agencies can disclose AUSTRAC information to foreign counterparts with appropriate safeguards. ### EC13 — In-house expertise and FIU outreach - AUSTRAC does not have criminal law enforcement authority and refers criminal matters to law enforcement. - AUSTRAC publishes advisories, compliance guide, and leads the FINTEL Alliance to share intelligence with financial firms, NGOs, law enforcement and national security agencies. - AUSTRAC publishes information on potential risk areas to assist firms’ risk assessments. ### Key statistics and facts (preserved verbatim) - Over 14,000 reporting entities overseen by AUSTRAC. - APS 330 requires updates within seven calendar days if a new capital instrument is issued or changed. - Records retention periods: seven years; customer identification records for life of relationship and seven years after cessation. - AUSTRAC supervisory activities cited: 2017 review of correspondent banking at 39 reporting entities; 2017 SMR campaign examining more than 1,500 SMRs from the top 37 high-volume reporters; planned review across the 18 largest reporting entities. - MoU between APRA and AUSTRAC entered in 2016. - Section 235 of AML/CTF Act provides statutory immunity as described. ### Policy recommendations and supervisor actions noted - AUSTRAC should increase use of rapid, formal legal requirements for corrective actions where firms’ compliance processes are not working as reported, and perform in-depth periodic assessments (AUSTRAC or external). - APRA should ensure AUSTRAC-identified AML/CTF weaknesses inform APRA’s assessments of banks and consider how to gain appropriate comfort about firms’ control practices beyond reliance on self-reporting. - Improve coordination and communication between APRA and AUSTRAC to better integrate AUSTRAC assessments of AML/CTF systems into APRA’s assessment of banks’ risk management. *Source: 1ausea2019006 - Section 16B of the Banking Act gives APRA the authority to require auditors to provide information, produce* ### 1. Responsibilities, objectives ### 1. Responsibilities, objectives and powers ### Responsibilities and mandate - APRA has broad powers and clear responsibilities underpinned mainly in the Banking Act and APRA Act. - APRA’s objective is promoting financial system stability, which must be balanced with other objectives: financial safety, efficiency, competition, contestability, and competitive neutrality. - APRA is focused on its financial stability objective while also promoting the other objectives, but clarifying the primary nature of APRA’s financial stability mandate and the subordinate nature of the other objectives could help APRA better achieve that balance. - Laws and regulations provide APRA with broad power to set and enforce prudential regulations; prudential standards can be disallowed by the Parliament (though this has not occurred in practice). - The parliamentary veto power and the Minister’s ability to issue directions to APRA (see BCP 2) could, in extreme situations, lead to failure to introduce or change key prudential standards, potentially limiting APRA’s ability to achieve primary objectives. ### Independence, accountability, resourcing, and legal protection for supervisors - The APRA Act provides APRA with broad operational powers; the Banking Act provides powers to license, regulate, and apply corrective actions. - The APRA Act grants the Minister power to give APRA a written direction about policies or priorities in performing any of its functions or powers; this power has never been exercised but is a potential concern for independence. - The APRA Act does not require public disclosure of the reasons for removal of an APRA Member if removal occurs in practice. - APRA is funded primarily by industry levies; the budget is set annually by the government after APRA funding requests are considered. - Constraints on funding include the need to submit new proposals for funding increases and the government-imposed “efficiency dividend”; these could limit APRA’s operational flexibility and medium-term budget visibility. - Since 2014 APRA’s employment framework has been subject to the APS Workplace Bargaining Policy, which: - sets many constraints on staff remuneration, - imposes an annual cap of 2 percent on remuneration increase, - subjects the staff employment framework to periodic approval every three years. - These employment constraints are increasingly limiting APRA’s ability to retain high quality staff and attract highly specialized skills (examples cited: cyber risk and advanced risk analytics). - Assessors conclude these matters cause significant concerns to APRA’s independence, budget autonomy, and staff employment and remuneration conditions. - Because the gap in BCP 1 is accounted for elsewhere, a compliant grade was given to BCP 1 to avoid double jeopardy; absent double jeopardy, BCP 1 would have been graded largely compliant. ### Cooperation and collaboration - APRA has cooperation agreements with various domestic and foreign supervisors and a good framework for exchanging and dealing with confidential information. - Cooperation with AUSTRAC has been improving but there is scope to significantly step it up. ### Permissible activities - The Banking Law defines “banking business” and activities that can be carried on as banking business. - The Banking Act reserves deposit-taking to licensed ADIs, though some exemptions can be granted; since the 2012 FSAP, operating conditions for exempted entities have been significantly tightened and their size has considerably decreased. ### Licensing criteria - APRA has a very thorough licensing framework and process; licensing criteria are overall consistent with ongoing supervision requirements. - The new restricted licensing regime increases market competition and eases entry for firms with new business models. - APRA has taken measures to limit potential financial stability issues associated with restricted ADIs. - APRA ensures proposed ADIs have the capacity to meet prudential capital requirements; initial capital of restricted ADI is taken as a minimum. - APRA is aware of risks associated with the law change allowing all ADIs to use the term “bank”. ### Transfer of significant ownership - APRA’s power to review, reject, and impose prudential conditions on proposals to transfer significant ownership or controlling interests in ADIs is very limited. - The FSSA gives the Treasurer power to approve changes in ownership of more than 15 percent based on “national interest” considerations. - The Treasurer has delegated the power to APRA for banks with assets of less than A$1 billion; this delegation can be withdrawn. - No definition of “national interest” is provided under the FSSA. - APRA does not receive regular reporting about major shareholders of banks to keep updated on actual and ultimate main shareholders. - Assessors conclude material non-compliance with this standard. ### Major acquisitions - Prudential Standard CPS 222 establishes clear provisions on acquisitions and investments that need prior supervisory approval or notification to APRA. - Regulations and prudential standards do not exactly define assessment criteria for individual proposals, but APRA’s internal guidelines provide a detailed list of criteria and considerations, including thorough prudential considerations. ### Supervisory approach - APRA has a strong supervisory approach identifying significant risks facing the industry and individual banks, with prudential standards covering governance, risk management and control practices across regulated banks and groups. - The supervisory program combines onsite and offsite reviews and analyses. - Input from risk specialists and offsite analysts (RDA Division) combined with frontline supervisors provides broad perspectives for supervisory direction and strategy. - APRA requires periodic reporting from firms on effectiveness of their processes; reliance on firms’ self-reporting requires strong supervisory validation. - More in-depth periodic reviews of key control processes can complement self-reporting. - A supervisory regime for assessment of resolvability is a work in progress; APRA is designing a supervisory regime for resolution planning and coordinating with other agencies on resolution processes for major banks. ### Supervisory techniques and tools - APRA has a good set of supervisory tools; staff are knowledgeable; frontline supervisors, risk specialists and offsite analysts support supervision planning well. - Written communications articulate issues; frequent engagement provides clarity to firms on issues and high-level expectations. - The PAIRS assessment regime covers the expected spectrum and is well supported by guidance. - IMF assessors observed that mechanically rolling underlying PAIRS assessment categories into one overarching rating may obscure the importance of underlying issues. - The relatively low weightings given to board and senior management inputs in the overall rating appear out of line with an approach emphasizing their roles. ### Supervisory reporting - APRA has appropriate authority to collect necessary supervisory data. - Prudential and statistical reporting provides extensive information on risk exposures, operating performance and financial condition. - APRA is refining data gathering and is working on a new system to support deeper supervisory analysis. - APRA’s strategy includes increasing use of quantitative analyses. - APRA makes considerable use of ad hoc data gathering, which can create issues with consistency and data quality from firms. ### Corrective and sanctioning powers of supervisors - APRA has a broad range of tools and authorities from supervisory requirements to revoke a banking license and resolve a bank. - APRA’s preferred approach is early identification of concerns and working with institutions to address them before breaches occur. - The supervision process provides for early intervention via referral to the watchlist of the EEC and increasing supervisory scrutiny and intensity. ### Consolidated supervision - APRA’s consolidated supervisory approach is well underpinned in practice. - Prudential standards and financial data are collected on a consolidated basis. - APRA reviews oversight of a bank’s foreign operations and ensures group risk management framework is applied on a consolidated basis. - APRA conducts prudential reviews and visits covering main cross-border activities of large Australian banking groups. ### Home-host relationships - APRA has developed a good cross-border supervisory framework based on MoUs and close working relationships with foreign supervisors, particularly the RBNZ. - APRA performs onsite reviews for operations of large Australian banks in New Zealand. - APRA has held supervisory colleges in the past, but no recent college was organized due to the importance of bilateral work and the focus of cross-border risks on New Zealand. - APRA has not established a recovery and resolution planning framework for its banks, including cross-border banks. ### Corporate governance - The Corporations Act, APRA’s prudential standards and supervisory approach articulate board and management responsibilities and emphasize the role of board and senior management. - Requirements for board and board committees are appropriate and comprehensive. - Partial reliance on firms’ self-reporting on governance practices should be supported by greater use of in-depth supervisory assessments of key control areas underlying firms’ RMFs. - PAIRS assessments of boards and management should explicitly incorporate their effectiveness over risk management. - Relevant findings from ASIC and AUSTRAC reviews are often not incorporated into governance assessments. - The BEAR ACT (effective July 1 for the major banks) will provide further clarity on responsibilities and accountability, sharpening focus of boards and management; APRA will need to engage firms to ensure strong understanding of expectations under the new regime. ### Risk management - APRA’s supervision of risk management strongly focuses on board responsibilities for effective processes. - Issuance of CPS 220 since the last FSAP (2012) has been positive; CPS 220 increased banks’ focus on financial risk management and internal controls. - APRA effectively risk-focuses supervision planning; more in-depth periodic supervisory assessments of risk management practices would enhance confidence in firms’ reporting. - APRA requires risk-management related stress testing and regular ICAAPs and reviews results; assessing key inputs, controls and governance around firm-wide stress testing and ICAAP needs more focus. - APRA has conducted several recovery planning exercises and thematic reviews for large ADIs; finalization of the recovery planning framework and requirements is still underway. ### Capital adequacy - APRA’s regulatory capital regime uses a conservative approach to the definition of capital and includes a conservative floor to the calculation of RWA for residential mortgages; reported regulatory capital ratios relative to other countries may be conservative as a result. - The imposition of the ‘unquestionably strong capital’ benchmark adds a further buffer and holds Australian banks to a high capital standard relative to Basel requirements. - APRA’s process for determining the prudential capital ratio (PCR) allows APRA to increase required regulatory capital at individual firms based on various analyses. - Currently the PCR and related practices are less of a focus than requiring firms to meet the ‘unquestionably strong threshold’; APRA’s focus on stress testing and ICAAP by firms to determine capital needs has not been an area of emphasis recently. ### Credit risk - APRA prudential framework and guidelines provide thorough requirements and expectations for credit risk management in ADIs. - Supervisors have recently undertaken thematic reviews of the four major banks targeting underwriting standards and serviceability assessments in residential loans as well as CRE lending. - As banks’ practices are addressed, APRA supervisors should keep a close watch to ensure banks effectively fix gaps and ensure proper board oversight of credit risk profiles. ### Problem assets, provisions, and reserves - APRA’s prudential standard is still largely based on incurred loss rules and includes some concepts not fully aligned with sound practices and Basel Guidelines on prudential treatment of problem assets. - Australian banks mainly apply accounting requirements for loan impairments and will apply IFRS 9 as it becomes effective for them. - APRA supervisors perform general reviews of adequacy of loan impairment; APRA risk teams perform some analysis on problem asset trends but these are still at a very general level and can be further enhanced. - Banks’ reporting to APRA on impaired loans could incorporate additional information such as asset impairments in specific categories and areas. ### Concentration risk and large exposure limits - The revised standard APS 221 on large exposures adopts the new Basel Framework on large exposure with one carveout related to retail exposures for economically interdependent counterparties. - Current and revised standards include thorough requirements on concentration risk. - Supervisors review specific concentration issues in their work, particularly in relation to real estate lending. *1ausea2019006 - 1. Responsibilities, objectives* ### 20. Transactions with related ### 20. Transactions with related parties ### Findings on related-party transactions - LC APS 222 sets requirements on associations with related entities. - Definition of related parties in APS 222 does not include all the parties identified in this principle, including individual parties and their direct and indirect interests. - The standard requires specific rules related to conflict of interest in related party transactions and exposures. - APRA supervisors monitor banks’ reporting on related parties and compliance with the rules. - Aggregate limits applied to related parties seem higher than the ones stipulated in the principle. - There is no requirement on board approval for related party-transactions and write-off of related party exposures. - APRA released on July 2, 2018, for consultation, revisions to its related party prudential and reporting standards that addresses many of the above-mentioned gaps. ### Other prudential and supervisory findings (selected topics 21–29) - Country and transfer risks (21) - Rating: C - APRA does not have an explicit prudential standard for country and transfer risks, but CPS 220 and standards for credit risk management and large exposures are sufficient for assessing firms’ practices. - The updated credit risk management standard (APS 221) includes enhancements related to transfer risk explicitly. - Market risk (22) - Rating: C - APRA has solid processes for managing market and trading related risks; supervisors have a strong understanding of key measurement and management issues. - Interest rate risk in the banking book (23) - Rating: C - APRA has solid practices and detailed guidance on interest rate risk management. - Banks are expected to capture interest rate risk in their ICAAP. - IRRBB is captured in capital as a Pillar 1 element for banks using advanced approaches. - Supervisors perform monitoring, analysis, in-depth reviews, and require extensive prudential reporting. - Liquidity risk (24) - Rating: C - Since the last FSAP, APRA has strengthened capacity, tools, and prudential framework for liquidity risk oversight. - APRA established a team of risk specialists dedicated to liquidity risk. - Implemented the LCR and the NSFR requirements and applied them for large more complex ADIs. - The October 2017 RCAP confirmed that Australia’s Basel III LCR is overall compliant with Basel requirements. - Prudential framework provides thorough requirements and guidance; frontline supervisors and liquidity specialists actively monitor banks’ liquidity risk management and conditions. - Operational risk (25) - Rating: C - CPS 220 and other prudential standards provide a good overall framework for operational risk management. - APRA IT and operational risk specialists assist frontline supervisors in reviews covering operational and IT risk issues. - Recent work addresses cyber security and systemic operational risks related to increased use of digital technology. - Internal control and audit (26) - Rating: LC - Prudential standards require boards and management to have appropriate internal controls given firm size, complexity, and risk profile. - Internal and external audit are expected to assess controls and report to the board and APRA (external audit). - No prudential standard comprehensively outlines internal control and internal audit requirements for ADIs. - Explicit in-depth supervisory reviews of internal audit effectiveness and the board’s role have not been a consistent area of focus. - Financial reporting and external audit (27) - Rating: C - Under the Corporations Act, ASIC regulates external audits. - Australian incorporated banks must issue audited financial reports annually and reviewed or audited half-year reports. - ASIC reviews external audits (including asset valuations) and conducts ongoing surveillance of financial reporting. - ASIC and APRA have regular interaction; ASIC is expected to inform APRA of concerns. - Prudential standards and financial reporting laws require external auditors to report to APRA when they believe a firm is not complying with prudential requirements. - Disclosure and transparency (28) - Rating: C - APRA prudential standards (APS 330) and the Corporations Act require significant disclosures by banks. - Banking statistics are made available to the public monthly and quarterly. - Abuse of financial services / AML/CTF (29) - Rating: LC - AUSTRAC has authorities, laws, rules, and processes to oversee AML/CTF requirements and serves as Australia’s financial intelligence agency. - AUSTRAC faces challenges in balancing supervisory and financial intelligence mandates, deployment of scarce human resources, and reliance on self-reporting by firms. - Banks are required to comply with laws, rules, and standards and to report to AUSTRAC that they have effective practices in place. - AUSTRAC uses risk-focused supervisory practices driven by intelligence gathering and analysis of firm-reported data. - Recent events show challenges with partial reliance on self-reporting: some firms’ compliance processes were not working as reported, leading to significant non-compliance with AML/CTF laws. ### Recommended actions (selected items from Table 3) - Principle 1 - Remove the legal provision that subjects APRA prudential standards to being disallowed by the parliament. - Clarify APRA’s primary financial stability mandate and subordinate nature of other objectives. - Principle 2 - Clarify Statement of Expectations objectives and make it advisory non-binding. - Remove Ministerial direction powers over APRA policies. - Mandate public disclosure of reasons for removal of an APRA member. - Provide APRA greater autonomy and flexibility in budget determination; remove efficiency dividend constraints. - Remove requirement to subject APRA staff employment and remuneration to the APS Workplace Bargaining Policy; periodically reassess staff recruitment and remuneration policies. - Principle 3 - Deepen collaboration with ASIC and explore joint activities. - Significantly increase cooperation with AUSTRAC via operational working groups to integrate ML/TF risks into APRA’s bank risk assessments. - Principle 5 - Undertake a prudent and gradual approach to licensing restricted ADIs to assess framework experience and avoid market disruptions. - Enhance supervisory resources and IT skills for oversight of restricted ADIs. - Principle 6 - Introduce legal changes to give APRA power to approve significant ownership changes, including ultimate beneficiary owners, and outline decision criteria. - Provide at least a broad definition of “national interest” and consult the Treasurer where relevant. - Issue the revised reporting standard (issued for consultation in July) requiring periodic reporting of significant shareholders and include all types of ultimate beneficiary owners. - Require ADIs to notify APRA of material information that may negatively impact suitability of a significant shareholder. - Principle 7 - APRA should outline internal criteria used to assess major acquisitions; include these in revisions to the prudential standard on related parties. - Principle 8 - Implement a formal program for assessment of resolvability at the largest firms supported by prudential standards and detailed guidance. - Carry out periodic in-depth reviews of the largest firms’ governance, risk management, and control functions on a regular cycle. - Principle 9 - Review the PAIRS process to ensure it is appropriate and calibrated for current supervision. - Expand use of thematic reviews across firms. - Enhance offsite analytics and ensure inputs from frontline teams and specialists inform supervisory strategy and SAPs. - Principle 10 - Assess potential data needs over the next five years and revise reporting requirements accordingly. - Periodically review validation tools and reliability checks; escalate validation for banks with consistent data integrity issues, possibly to a “reasonable assurance” standard. - Principle 11 - Enhance corrective action approach: be more proactive in escalating severity, including escalation from ‘recommendation’ to ‘requirement’ and more active use of formal corrective actions such as directions. - Principle 12 - Enhance assessment of how nonbanking activities in the group impact a bank’s risk profile and take proactive prudential measures. - Principle 13 - Consider regular supervisory colleges for large banks with material cross-border exposures. - Develop and test recovery and resolution planning framework and group-level resolution plans for large cross-border groups. - Principle 14 - More directly connect weaknesses in firms’ risk management practices to PAIRS assessments of board and management; revisit PAIRS rating framework. - Use coordination with AUSTRAC and ASIC to ensure identified weaknesses inform APRA’s assessments. - Principle 15 - Increase focus on ICAAP inputs, controls, and stress testing practices linked to internal capital assessments and capital decision making. - Continue implementation of recovery planning program and formalize program expectations for banks. - Principle 16 - Increase use of stress-testing analysis and assessments of firms’ internal use of stress testing. - Increase focus on risk identification, measurement, management, and controls in internal capital assessments. - Consider reducing the reference significance weight for access to new capital in PAIRS assessments and give more consideration to capital availability under stress. - Principle 17 - Continue scrutiny of banks’ underwriting practices, particularly retail loans (including residential mortgages) and CRE lending. - Consider periodic deep dives into banks’ credit risk management frameworks. - When revising APS 220, consider including guidelines and main takeaways related to residential mortgage and CRE lending. - Principle 18 - Revise APS 220 to incorporate expected loss rules and Basel guidelines on prudential treatment of problem assets. - Enhance APRA reporting on impaired assets to provide more granular data showing past due loans (by days past due) and distribution of loans by specific categories. - Deepen sectoral analysis of problem assets across loan categories and collateral types to identify systemic risks. - Principle 19 - Continue enhancing analysis of concentration risk, including real estate lending and real estate collateral, and act on systemic trends or bank-specific risks. - Principle 20 - Proceed with revisions initiated in July 2018 to prudential and reporting standards on related party transactions and exposures and ensure gaps identified are addressed. - Principle 25 - As technology-based entities enter the market, continue enhancing IT risk capacity and skills, particularly cyber risk and fintech risks. - Continue developing analytical capabilities on systemic operational risk and proceed with plans to develop a prudential standard focused on operational risk management. - Principle 26 - Include periodic in-depth assessment of internal audit in supervision cycles, focusing on stature, independence, resources, expertise, and board effectiveness. - Clarify internal control and internal audit requirements more comprehensively in APRA prudential standards. - Principle 29 (AUSTRAC) - Increase use of rapid, formal legal corrective actions when firms’ AML/CTF compliance processes are not working as reported. - Perform more in-depth periodic assessment of banks’ internal review processes to increase comfort about AML/CTF control practices and enable timely corrective actions. ### Authorities’ response - Paragraph 78: The Australian authorities thank the IMF and its assessment team for their assessment. - Australia is strongly committed to the FSAP process and acknowledges the importance of continual review and improvement of the regulatory framework and supervision practices. *Source: 1ausea2019006 - 20. Transactions with related* ### 79. The Australian 2018 FSAP has taken place in the midst of a significant reform agenda ### 1ausea2019006 - 79. The Australian 2018 FSAP has taken place in the midst of a significant reform agenda ### Context and reform agenda - The Australian 2018 FSAP took place against the backdrop of a Royal Commission into Misconduct into Banking, Superannuation and Financial Services Industry. - In 2014, the Australian Government commissioned the Financial System Inquiry to provide a ‘blueprint’ for future reform, producing recommendations focused on resilience, consumer outcomes, innovation and the regulatory framework. - Australian authorities have worked to implement these recommendations, including: - ensuring that banks have ‘unquestionably strong’ capital ratios; - improving the crisis management framework; - moving to industry funding for the Australian Securities and Investments Commission. ### Basel Core Principles (BCP) assessment and authorities' response - The Australian authorities agree Australia has a very high level of compliance against the Basel Core Principles for effective banking supervision. - The authorities express significant concerns with the IMF’s ‘materially non-compliant’ ratings for: - CP2 Independence, accountability, resourcing and legal protection; - CP6 Transfer of significant ownership. - The Australian authorities consider that the IMF’s assessment does not accurately reflect the operation and risks in Australia’s system. ### APRA independence and accountability mechanisms - The Australian authorities assert Australia’s framework does not pose material risks to APRA’s independence or its ability to effectively carry out its supervisory function. - The IMF noted APRA currently had a reasonable degree of independence but identified constraints that could limit APRA’s independence going forward. The Australian authorities agree on the need for an independent supervisor and state APRA maintains a high degree of independence. - There is no evidence, past or present, of Government or industry interference compromising APRA’s operational independence. Successive Governments have reiterated the importance of APRA’s independent role. - The IMF highlighted four aspects of Australia’s system rooted in parliamentary ‘checks and balances’ that it viewed as concerning; the Australian authorities respond as follows: - The Minister may issue a direction to APRA: - No direction has ever been issued to APRA. - The use of this power is subject to conditions to ensure full transparency to Parliament and the public. - The Minister must consult with APRA prior to issuing any direction. - Prudential standards issued by APRA are disallowable by the Parliament: - No prudential standard has ever been disallowed by Parliament. - APRA may establish prudential standards in respect of any prudential matter; these standards are legally binding and a breach is a breach of the law. - APRA exercises powers as a delegate of the Parliament; parliamentary oversight is considered fundamental. - The Government’s Statement of Expectations (SOE): - The SOE aims to provide guidance and clarity on the broader Government policy framework to support APRA in exercising its legislative functions. - Each previous SOE has reiterated the Government’s commitment to APRA’s independence and statutory objectives and are developed in consultation with APRA. - APRA may respond with a Statement of Intent indicating how and the extent to which they intend to meet the SOE. - APRA’s budget and staffing level are subject to approval of Government: - All non-corporate Commonwealth entities are subject to the Government’s budget process as an accountability mechanism. - The majority of APRA’s budget comes from a standing appropriation which is not subject to annual approval or scrutiny, providing a degree of medium-term certainty. - APRA can seek additional funding through the twice-yearly budget process and the Government reviews funding levels from time to time. - The Australian authorities do not consider these accountability mechanisms to impede APRA’s independence and see them as ‘checks and balances’ promoting confidence in the financial system. - This position is consistent with Australia’s stance in its 2012 FSAP. ### Transfer of significant ownership (CP6) - APRA’s prudential advice on issues including unsuitable influential person(s) and undue economic power is the most significant consideration in approving transfers of ownership. - While Treasurer approval is required by law for transfers of significant ownership, the majority of applications are handled by APRA through a standing delegation. - Where handled by the Treasurer, decisions are primarily informed by APRA’s prudential advice. - Treasurer approval is required for certain applications raising additional national interest test issues (for example, national security and competition). - The Australian authorities disagree with the IMF’s assessment that there are material shortcomings in Australia’s compliance with CP6. ### Consideration of IMF recommendations and domestic review processes - The Australian authorities welcome the IMF’s recommendations and will give them serious consideration alongside other domestic financial sector reviews. - The FSAP coincides with other review processes, including: - the Productivity Commission’s reports into Competition in the Australian Financial System and Assessing Efficiency and Competitiveness in the Superannuation System; - the Royal Commission into Misconduct in the Banking, Superannuation, and Financial Services Industry. - FSAP recommendations will need to be considered as part of broader reforms to the financial system (resilience, competition, and conduct) and prioritized accordingly. *Source: 1ausea2019006 - 79. The Australian 2018 FSAP has taken place in the midst of a significant reform agenda* --- _Source: https://www.imf.org/-/media/files/publications/cr/2019/1ausea2019006.pdf_