Banking, Insurance and Life Insurance (prudential standards) determination No. 2 of 2011 - Prudential Standard CPS 232 - Business Continuity Management

Administered by Department of the Treasury

Legislation au F2011L01921 Not in force Legislative Instrument

Legislation content

Banking, Insurance and Life Insurance (prudential standards) determination No. 2 of 2011

EXPLANATORY STATEMENT

Prepared by the Australian Prudential Regulation Authority

Banking Act 1959, section 11AF

Insurance Act 1973, section 32

Life Insurance Act 1995, section 230A

APRA may, in writing, revoke a prudential standard that applies to an APRA-regulated institution under:

  • subsection 11AF(3) of the Banking Act 1959 (Banking Act), in relation to authorised deposit-taking institutions (ADIs) and authorised non-operating holding companies (authorised banking NOHCs);
  • subsection 32(4) of the Insurance Act 1973 (Insurance Act), in relation to general insurers and authorised non-operating holding companies (authorised insurance NOHCs); and
  • subsection 230A(5) of the Life Insurance Act 1995 (Life Insurance Act), in relation to life companies (including friendly societies) and registered non-operating holding companies (registered life NOHCs).

APRA may, in writing, determine a prudential standard that applies to an APRA-regulated institution under:

  • subsection 11AF(1) of the Banking Act, in relation to ADIs and authorised banking NOHCs;
  • subsection 32(1) of the Insurance Act, in relation to general insurers and authorised insurance NOHCs; and
  • subsection 230A(1) of the Life Insurance Act, in relation to life companies (including friendly societies) and registered life NOHCs.  
  1.    Background

APRA has powers under the Banking Act, Insurance Act and Life Act to determine prudential standards that apply to ADIs and authorised banking NOHCs, general insurers and authorised insurance NOHCs and life companies and registered life NOHCs.

APRA's policy is to issue prudential standards that apply across the banking, general insurance and life insurance industries that are broadly consistent in their requirements. Specifically, APRA views the risks arising from outsourcing, the management of business continuity, governance and the fitness and propriety of responsible persons is similar regardless of the industry within which the regulated institution operates.

To date, APRA has issued three individual prudential standards covering business continuity management requirements in relation to each APRA-regulated industry. The content of these standards is nearly identical and requires a regulated institution to implement a whole-of-business approach to business continuity management (BCM), appropriate to the nature and scale of its operations. The prudential standards are as follows:

  • Prudential Standard APS 232 Business Continuity Management (APS 232) applying to ADIs;
  • Prudential Standard GPS 222 Business Continuity Management (GPS 222) applying to general insurers; and
  • Prudential Standard LPS 232 Business Continuity Management (LPS 232) applying to life companies.

In line with its publicly stated desire to supervise regulated institutions operating in different industries consistently, APRA is consolidating the requirements contained in these three industry-specific prudential standards into a single prudential standard with cross-industry application. The requirements currently contained in APS 232, GPS 222 and LPS 232 are consolidated into a new prudential standard, Prudential Standard CPS 232 Business Continuity Management (CPS 232).

2.      Purpose of the instrument

This instrument revokes APS 232, GPS 222 and LPS 232 and replaces them with a new prudential standard, CPS 232. CPS 232 must be complied with by ADIs and authorised banking NOHCs, general insurers and authorised insurance NOHCs and life companies (including friendly societies) and registered life NOHCs.

CPS 232 aims to ensure that each APRA-regulated institution and Level 2 group implements a whole-of-business approach to BCM, appropriate to the nature and scale of its operations and to that of the group (where applicable). BCM increases resilience to business disruption arising from internal and external events and may reduce the impact on the regulated institution’s or group’s business operations, reputation and profitability, and on its depositors, policyholders and other stakeholders.

3. Operation of the instrument

The key differences between CPS 232 and the industry-specific prudential standards it replaces include that CPS 232:

  • applies to all regulated institutions in the banking, general insurance and life insurance industries, rather than operating via separate, although nearly identical, standards applying to different regulated institutions in individual industries;
  • clarifies the role and obligations of the Board (or equivalent) in complying with the standard;
  • includes a requirement for the Board of the Head of the Level 2 banking group to ensure that all group members have in place BCM policies, that BCM is applied for each part of the group and that the business continuity policy is internally and externally reviewed at least annually;
  • extends application of the standard to include registered life NOHCs;
  • clarifies the application of the standard to foreign branches;
  • extends to life companies the requirement, currently applying to ADIs and general insurers, to conduct periodic review of the Business Continuity Plan by the internal auditor (or an external expert);
  • extends to ADIs and general insurers APRA’s ability, under LPS 232, to request the external auditor (or an external expert) to undertake an assessment of BCM arrangements; and
  • transfers requirements for Level 2 insurance groups to comply with BCM requirements from Prudential Standard GPS 221 Risk Management: Level 2 Insurance Groups (GPS 221);
  • contains a number of minor amendments to clarify or harmonise the existing obligations. These minor amendments do not alter the substance of those obligations.

4. Consultation

In December 2010, APRA publicly consulted on CPS 232 as part of a broader consultation package on its initiative to harmonise certain prudential standards across APRA-regulated industries. APRA received a small number of submissions that were generally supportive of the approach and APRA has implemented specific feedback received, where appropriate, in CPS 232.

5.  Regulation Impact Statement

A Regulation Impact Statement for the changes described in this Explanatory Statement was not required. 

 

Overview

The Banking, Insurance and Life Insurance (Prudential Standards) Determination No. 2 of 2011 was enacted by the Australian Prudential Regulation Authority (APRA) under sections 11AF(3) of the Banking Act 1959, 32(4) of the Insurance Act 1973, and 230A(5) of the Life Insurance Act 1995. This determination addresses the need for harmonisation and consistency in prudential standards across the banking, general insurance, and life insurance industries. APRA aimed to consolidate the existing business continuity management (BCM) requirements into a single, cross-industry prudential standard. Previously, separate standards applied to each industry, leading to similar requirements being replicated across different sectors. The new Prudential Standard CPS 232 Business Continuity Management aims to ensure that all APRA-regulated institutions implement a whole-of-business approach to BCM, appropriate to the nature and scale of their operations, thereby increasing resilience and potentially reducing the impact of disruptions on business operations, reputation, and profitability.

Scope and Application

The Banking, Insurance and Life Insurance (prudential standards) determination No. 2 of 2011 applies to authorised deposit-taking institutions (ADIs) and authorised non-operating holding companies (authorised banking NOHCs) under the Banking Act 1959, general insurers and authorised non-operating holding companies (authorised insurance NOHCs) under the Insurance Act 1973, and life companies (including friendly societies) and registered non-operating holding companies (registered life NOHCs) under the Life Insurance Act 1995. This determination consolidates existing industry-specific prudential standards into a single cross-industry standard, Prudential Standard CPS 232 Business Continuity Management (CPS 232), which applies to all regulated institutions in the banking, general insurance, and life insurance industries. The standard aims to ensure that regulated institutions implement a whole-of-business approach to business continuity management (BCM), appropriate to the nature and scale of their operations. The Australian Prudential Regulation Authority (APRA) has the authority to determine and revoke prudential standards that apply to these institutions under the respective Acts. The new standard CPS 232 replaces Prudential Standard APS 232 Business Continuity Management, Prudential Standard GPS 222 Business Continuity Management, and Prudential Standard LPS 232 Business Continuity Management, and it extends to include registered life NOHCs, clarifying the role and obligations of the Board in complying with the standard. The standard also includes minor amendments to harmonise existing obligations without altering their substance.

Key Provisions

The Banking, Insurance and Life Insurance (Prudential Standards) Determination No. 2 of 2011 (the "Determination") consolidates existing prudential standards for business continuity management (BCM) into a single standard applicable across the banking, insurance, and life insurance sectors. This consolidation is achieved through the revocation of Prudential Standard APS 232 (APS 232) for authorised deposit-taking institutions (ADIs), Prudential Standard GPS 222 (GPS 222) for general insurers, and Prudential Standard LPS 232 (LPS 232) for life companies, and their replacement with the new Prudential Standard CPS 232 (CPS 232). CPS 232 mandates that all APRA-regulated institutions, including authorised non-operating holding companies (authorised banking NOHCs and authorised insurance NOHCs), registered life NOHCs, and life companies (including friendly societies), adopt a comprehensive approach to business continuity management tailored to the nature and scale of their operations (section 2). The Determination imposes specific obligations on the regulated institutions, requiring them to implement a whole-of-business approach to BCM. This includes ensuring that the Board (or equivalent) takes responsibility for compliance with the standard, and for overseeing the implementation of BCM policies across the institution and its group members, where applicable (section 3). The Board must also ensure that business continuity policies are reviewed annually, either internally or by an external expert. Additionally, the Determination extends certain requirements, such as periodic review of the Business Continuity Plan by the internal auditor, to life companies, and permits APRA to request external assessments of BCM arrangements from ADIs and general insurers (section 3). Breach of the requirements set out in CPS 232 may result in enforcement actions by APRA. While the Determination does not explicitly state penalties for non-compliance, APRA has the authority to take action under the Banking Act 1959, the Insurance Act 1973, and the Life Insurance Act 1995, which may include fines, public reprimands, or more severe regulatory actions such as revoking licenses. The precise penalties would depend on the nature and severity of the breach, as well as the specific provisions of the underlying Acts (sections 11AF(3), 32(4), and 230A(5)).

Legal classification tags

Area of Law
Banking & Finance
Insurance Law
Instrument
Regulation
Concepts
Definitions & Interpretation
Regulatory Standards
Compliance Obligations
Enforcement Powers

Interactions

Authorises

All Versions

Sourced from the Federal Register of Legislation at 26 August 2026. For the latest information on Australian Government law please go to https://www.legislation.gov.au.