Banking, Insurance and Life Insurance (prudential standards) determination No. 2 of 2011

EXPLANATORY STATEMENT

Prepared by the Australian Prudential Regulation Authority

Banking Act 1959, section 11AF

Insurance Act 1973, section 32

Life Insurance Act 1995, section 230A

APRA may, in writing, revoke a prudential standard that applies to an APRA-regulated institution under:

• subsection 11AF(3) of the Banking Act 1959 (Banking Act), in relation to authorised deposit-taking institutions (ADIs) and authorised non-operating holding companies (authorised banking NOHCs);
• subsection 32(4) of the Insurance Act 1973 (Insurance Act), in relation to general insurers and authorised non-operating holding companies (authorised insurance NOHCs); and
• subsection 230A(5) of the Life Insurance Act 1995 (Life Insurance Act), in relation to life companies (including friendly societies) and registered non-operating holding companies (registered life NOHCs).

APRA may, in writing, determine a prudential standard that applies to an APRA-regulated institution under:

• subsection 11AF(1) of the Banking Act, in relation to ADIs and authorised banking NOHCs;
• subsection 32(1) of the Insurance Act, in relation to general insurers and authorised insurance NOHCs; and
• subsection 230A(1) of the Life Insurance Act, in relation to life companies (including friendly societies) and registered life NOHCs.  

1.    Background

APRA has powers under the Banking Act, Insurance Act and Life Act to determine prudential standards that apply to ADIs and authorised banking NOHCs, general insurers and authorised insurance NOHCs and life companies and registered life NOHCs.

APRA's policy is to issue prudential standards that apply across the banking, general insurance and life insurance industries that are broadly consistent in their requirements. Specifically, APRA views the risks arising from outsourcing, the management of business continuity, governance and the fitness and propriety of responsible persons is similar regardless of the industry within which the regulated institution operates.

To date, APRA has issued three individual prudential standards covering business continuity management requirements in relation to each APRA-regulated industry. The content of these standards is nearly identical and requires a regulated institution to implement a whole-of-business approach to business continuity management (BCM), appropriate to the nature and scale of its operations. The prudential standards are as follows:

• Prudential Standard APS 232 Business Continuity Management (APS 232) applying to ADIs;
• Prudential Standard GPS 222 Business Continuity Management (GPS 222) applying to general insurers; and
• Prudential Standard LPS 232 Business Continuity Management (LPS 232) applying to life companies.

In line with its publicly stated desire to supervise regulated institutions operating in different industries consistently, APRA is consolidating the requirements contained in these three industry-specific prudential standards into a single prudential standard with cross-industry application. The requirements currently contained in APS 232, GPS 222 and LPS 232 are consolidated into a new prudential standard, Prudential Standard CPS 232 Business Continuity Management (CPS 232).

2.      Purpose of the instrument

This instrument revokes APS 232, GPS 222 and LPS 232 and replaces them with a new prudential standard, CPS 232. CPS 232 must be complied with by ADIs and authorised banking NOHCs, general insurers and authorised insurance NOHCs and life companies (including friendly societies) and registered life NOHCs.

CPS 232 aims to ensure that each APRA-regulated institution and Level 2 group implements a whole-of-business approach to BCM, appropriate to the nature and scale of its operations and to that of the group (where applicable). BCM increases resilience to business disruption arising from internal and external events and may reduce the impact on the regulated institution’s or group’s business operations, reputation and profitability, and on its depositors, policyholders and other stakeholders.

3. Operation of the instrument

The key differences between CPS 232 and the industry-specific prudential standards it replaces include that CPS 232:

• applies to all regulated institutions in the banking, general insurance and life insurance industries, rather than operating via separate, although nearly identical, standards applying to different regulated institutions in individual industries;
• clarifies the role and obligations of the Board (or equivalent) in complying with the standard;
• includes a requirement for the Board of the Head of the Level 2 banking group to ensure that all group members have in place BCM policies, that BCM is applied for each part of the group and that the business continuity policy is internally and externally reviewed at least annually;
• extends application of the standard to include registered life NOHCs;
• clarifies the application of the standard to foreign branches;
• extends to life companies the requirement, currently applying to ADIs and general insurers, to conduct periodic review of the Business Continuity Plan by the internal auditor (or an external expert);
• extends to ADIs and general insurers APRA’s ability, under LPS 232, to request the external auditor (or an external expert) to undertake an assessment of BCM arrangements; and
• transfers requirements for Level 2 insurance groups to comply with BCM requirements from Prudential Standard GPS 221 Risk Management: Level 2 Insurance Groups (GPS 221);
• contains a number of minor amendments to clarify or harmonise the existing obligations. These minor amendments do not alter the substance of those obligations.

4. Consultation

In December 2010, APRA publicly consulted on CPS 232 as part of a broader consultation package on its initiative to harmonise certain prudential standards across APRA-regulated industries. APRA received a small number of submissions that were generally supportive of the approach and APRA has implemented specific feedback received, where appropriate, in CPS 232.

5.  Regulation Impact Statement

A Regulation Impact Statement for the changes described in this Explanatory Statement was not required.