Banking, Insurance, Life Insurance, Health Insurance and Superannuation (prudential standard) variation No. 1 of 2024
EXPLANATORY STATEMENT
Prepared by the Australian Prudential Regulation Authority (APRA)
Banking Act 1959, section 11AF
Insurance Act 1973, section 32
Life Insurance Act 1995, section 230A
Private Health Insurance (Prudential Supervision) Act 2015, section 92
Superannuation Industry (Supervision) Act 1993, section 34C
Under the above provisions, APRA may, in writing, determine, vary or revoke a prudential standard that applies to an APRA-regulated entity.
On 30 August 2024, APRA made Banking, Insurance, Life Insurance, Health Insurance and Superannuation (prudential standard) variation No. 1 of 2024 (the instrument) which varies Banking, Insurance, Life Insurance, Health Insurance and Superannuation (prudential standard) determination No.2 of 2023 to insert a new transition provision in Prudential Standard CPS 230 Operational Risk Management (CPS 230) and also to incorporate the definition of significant financial institution for this purpose.
The instrument commences on 1 July 2025.
- Background
APRA’s purpose is to ensure Australians’ financial interests are protected and that the financial system is stable, competitive and efficient.
To achieve this purpose, APRA sets legal requirements and guidance for the entities it regulates (the prudential framework).
The prudential framework comprises:
- legally binding prudential standards;
- legally binding reporting standards; and
- supporting guidance (such as prudential practice guides).
CPS 230 is a legally binding prudential standard that will come into effect on 1 July 2025. CPS 230 is designed to:
- strengthen the operational risk management of APRA-regulated entities;
- improve business continuity planning to ensure APRA-regulated entities can effectively respond to severe business disruptions and maintain critical operations and minimise material adverse impacts on depositors, policyholders, beneficiaries or other customers or an entity’s role in the financial system; and
- strengthen the management of third parties whom the regulated entity relies upon in providing critical operations.
- Purpose and operation of the instrument
The purpose of the instrument is to vary CPS 230 to insert an additional transition provision to allow APRA-regulated entities that are non-significant financial institutions (non-SFIs)[1] an additional period of 12 months to comply with certain aspects of the standard in relation to business continuity and scenario analysis.
Specifically, this update to CPS 230 is to insert a new paragraph 7 that sets out additional transitional arrangements that provide APRA-regulated entities that are non-SFIs an additional period to comply with requirements relating to business continuity and scenario analysis. An APRA-regulated entity that is a non-SFI will automatically receive the benefit of the additional transition and will continue to be subject to existing requirements in existing Prudential Standard CPS 232 Business Continuity Management and Prudential Standard SPS 232 Business Continuity Management. The new paragraph 7 also includes the definition of significant financial institution (SFI) and non-SFI in relation to APRA-regulated entities that are registrable superannuation entity licensees as those terms are not defined for these entities elsewhere in the prudential framework.
A more detailed explanation of the key requirements of CPS 230 is set out in Attachment A to this Explanatory Statement.
Exercise of discretion by APRA
CPS 230 provides for APRA to exercise various discretions. Decisions made by APRA in exercising those discretions are not subject to merits review. This is because these decisions are preliminary decisions that may facilitate or lead to substantive decisions which are subject to merits review.
Under the Banking Act 1959, Insurance Act 1973, Life Insurance Act 1995 and Private Health Insurance (Prudential Supervision) Act 2015, a breach of a prudential standard is a breach of the enabling legislation, as each enabling Act provides that regulated entities must comply with the standard. Under the Superannuation Industry (Supervision) Act 1993 (SIS Act), it is a condition on all RSE licences that the RSE licensee must comply with the RSE licensee law, which includes prudential standards. However, there are no penalties prescribed for breach of the prudential standards under any of these Acts. Instead, an entity’s breach of the enabling legislation or RSE licence condition is grounds for APRA to make further, substantive decisions under the relevant enabling legislation in relation to the entity. Those decisions may include the decision:
- to issue a direction to the regulated entity, including: a direction to comply with the whole or part of a prudential standard (section 11CA of the Banking Act, s.104 of the Insurance Act, section 230B of the Life Insurance Act, section 131D of the SIS Act); and a direction to comply with all, or specified obligations, which includes prudential standards (section 96 of the PHIPS Act); or
- to revoke: an authority to carry on banking business (section 9A of the Banking Act); a banking NOHC authorisation (section 11AB of the Banking Act); an authority to carry on insurance business (section 15 of the Insurance Act); an insurance NOHC authorisation (section 21 of the Insurance Act); registration of life insurance business (section 26 of the Life Insurance Act); a life NOHC authorisation (section 28C of the Life Insurance Act); or to revoke an authority to operate an APRA-regulated superannuation fund (section 29G of the SIS Act).
It is only at this stage that an entity is exposed to a penalty, loss of licence or imposition of a penalty if it breaches the direction (50 penalty units each day under section 11CG of the Banking Act, section 108 of the Insurance Act, and section 230F of the Life Insurance Act; 30 penalty units each day under section 104 of the PHIPS Act; and 100 penalty units each day under section 131DD of the SIS Act).[2] In nearly all cases,[3] the decisions are preceded by a full consultation with the regulated entity to raise any concerns they may have in relation to the decision.
The decisions of APRA to impose a direction are subject to merits review (section 11CA of the Banking Act, section 104 of the Insurance Act, section 236 of the Life Insurance Act, section 168 of the PHIPS Act and section 344 of the SIS Act), which is appropriately available at the point where an entity could be exposed to a penalty.
All decisions to revoke authorisations/registrations under the Banking Act, Insurance Act, Life Insurance Act and SIS Act are subject to merits review, unless specifically excluded by the enabling legislation.
Revocation of an authorisation to carry on banking business or a banking NOHC authorisation is subject to merits review unless either:
- APRA has determined that access to natural justice and merits review is contrary to the national interest or contrary to the interests of depositors with the body corporate; or
- (in the case of ADIs only) the authority is an authority that is to cease to have effect on a day specified in the authority (subsection 9A(8) of the Banking Act).
Revocation of an authorisation to carry on insurance business or an insurance NOHC authorisation is subject to merits review (ss 15 and 21 of the Insurance Act).
Revocation of registration as a life insurance company or a life NOHC authorisation is subject to merits review (section 236 of the Life Insurance Act). The situation in relation to cancellation of registration under the PHIPS Act is different to the other enabling legislation.
Adjust and exclude powers
CPS 230 gives APRA the discretion to adjust or exclude a provision of the prudential standard (paragraph 11). The power to create such a discretion is provided for under subsections:
- 11AF(2) of the Banking Act;
- 32(3D) of the Insurance Act;
- 230A(4) of the Life Insurance Act;
- 92(4) of the PHIPS Act; and
- 34C(5) of the SIS Act.
APRA may exercise this power when it is satisfied that the adjustment or exclusion of a specific requirement for one or more specified regulated entities will better support APRA in meeting its objectives. For example, the adjustment or exclusion may be necessary to obtain a better prudential outcome than would be the case if the prudential requirement were applied unaltered to a particular regulated entity. A tailored approach would give APRA comfort that the prudential requirements apply appropriately to protect the interests of depositors, policyholders and fund members. APRA will also take into account other considerations, such as efficiency, competition, contestability, competitive neutrality and regulatory burden, including comparisons with an entity’s peer group.
The exercise of APRA's powers is governed by a robust decision-making framework which is documented in APRA's internal policies. This framework supports APRA in fulfilling its mandate by limiting decision making to those senior APRA officers with the appropriate experience and skill to exercise prudent judgement. The framework also requires decision makers to seek advice from internal technical experts.
Documents incorporated by reference
Under section 14(1)(a) of the Legislation Act 2003, the standard incorporates by reference as in force from time to time:
- Acts of Parliament and associated delegated laws;
- Prudential Standards determined by APRA under:
- subsection 11AF(1) of the Banking Act;
- subsection 32(1) of the Insurance Act;
- subsection 230A(1) of the Life Insurance Act; and
- subsection 92(1) of the PHIPS Act.
Under section 14(1)(b) of the Legislation Act, where the standard incorporates by reference another Superannuation Prudential Standard determined by APRA under section 34C of the SIS Act, the Superannuation Prudential Standard referred to is the version that exists at the time the Instrument was determined.
All documents incorporated by reference in this standard are available on the Federal Register of Legislation at www.legislation.gov.au.
- Consultation
APRA undertook public consultation on the draft version of CPS 230 from July to October 2022. This included consultation engagements with a variety of stakeholders including regulated entities and industry associations. APRA received 62 submissions in response to the consultation.
In July 2023, APRA released a detailed response to material issues raised in submissions to the 2022 consultation, alongside the final version of CPS 230. APRA made a series of changes in finalising CPS 230 in response to issues and concerns raised during the consultation process. These included:
- deferring commencement from the original proposed date of 1 January 2024 to 1 July 2025;
- providing transitional relief in relation to existing contractual arrangements with service providers to allow sufficient time for entities to update such arrangements to ensure compliance with CPS 230;
- providing flexibility for a regulated entity to determine a prescribed critical operation should not be treated as a critical operation provided the entity is able to justify its decision; and
- providing flexibility for a regulated entity to determine that a prescribed material service provider is not a material service provider where the entity is able to justify its decision.
Along with the release of the final CPS 230 in 2023, APRA commenced consultation on guidance to support entities’ implementation of the new requirements. During this consultation, many, mostly smaller, entities raised material concerns about the resourcing and time needed to properly implement and meet the new standard.
APRA is responding to those concerns by allowing the additional transition period included in CPS 230 under this instrument.
- Regulation Impact Statement
The Office of Impact Analysis has advised that the change to CPS 230 to include additional transition for non-SFIs does not require additional analysis.
- Statement of compatibility prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011
A Statement of compatibility prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011 is provided at Attachment B to this Explanatory Statement.
ATTACHMENT A
Description of requirements in CPS 230
Paragraphs 12-15 set out overarching principles intended to guide APRA-regulated entities in the implementation of, and complying with, CPS 230. They are foundational principles on which CPS 230 is based.
Paragraphs 16-19 set out specific requirements for the management of operational risk in the context of an entity’s broader risk management framework requirements outlined in Prudential Standard CPS 220 Risk Management and Prudential Standard SPS 220 Risk Management.
Paragraphs 20-23 provide clarity to entities in setting out the responsibilities of the Board and of senior management for managing operational risk, business continuity of critical operations to minimise the possibility of disruptions and minimise the impacts on customers and to ensure the use of service providers is appropriately managed.
Paragraphs 24-33 set out specific matters that an APRA-regulated entity is required to address to ensure that it understands the operational risks that arise in the conduct of its business; that there are systems in place to monitor and manage operational risks; the regulated entity has identified and documented the resources needed to deliver critical operations; operational risks are appropriately mitigated; and operational risk incidents are identified and escalated in a timely manner, including reporting incidents with potential material financial impacts or material impacts on critical operations to APRA.
Paragraphs 34-46 deal with business continuity which is a fundamental aspect of CPS 230. These provisions require an APRA-regulated entity to identify its critical operations, being those which if disrupted beyond tolerance levels determined by the entity, would have a material adverse impact on customers or the entity’s role in the financial system. Essentially, this requires a regulated entity to consider the impact of disruptions on customers as the key determinant in their criticality. APRA-regulated entities are required to take actions to both minimise the likelihood of such disruptions as well as having plans in place to deal with disruptions should they occur and to return to pre-disruption operations as soon as is practical.
Paragraphs 47-60 set out matters an APRA-regulated entity is required to address in relation to the use of service providers. The regulated entity must have a service provider management policy and ensure that material arrangements meet certain requirements around due diligence, the need to have a legal agreement that covers specific matters. Material arrangements are those where an APRA-regulated entity is reliant on a service provider to undertake a critical operation or that expose the APRA-regulated entity to material operational risk. Such arrangements have the potential to adversely impact customers should the arrangement not be appropriately managed and monitored.
ATTACHMENT B
Statement of Compatibility with Human Rights
Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.
Banking, Insurance, Life Insurance, Health Insurance and Superannuation (prudential standard) determination No. 2 of 2023
The legislative instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011 (HRPS Act).
Overview of the Legislative Instrument
The purpose of the legislative instrument is to vary Prudential Standard CPS 230 Operational Risk Management (CPS 230) to provide APRA-regulated entities that are non-significant financial institutions additional time to comply with aspects of the standard.
CPS 230 sets out requirements to ensure that APRA-regulated entities are resilient to operational risks and disruptions and that risks arising from the use of service providers are managed appropriately.
CPS 230 seeks to ensure that APRA-regulated entities:
- identify and manage their operational risks;
- are able to continue to deliver critical operations to customers through severe disruptions; and
- have a comprehensive policy for managing risks from the use of service providers, and for the ongoing monitoring of such arrangements.
This variation provides an additional period of twelve months for APRA-regulated entities that are non-SFIs to comply with certain requirements in CPS 230.
Human rights implications
APRA has assessed the legislative instrument and is of the view that it does not engage any of the applicable rights or freedoms recognised or declared in the international instruments listed in section 3 of the HRPS Act. Accordingly, in APRA’s assessment, the legislative instrument is compatible with human rights.
Conclusion
The legislative instrument is compatible with human rights as it does not raise any human rights issues.
[1] A non-significant financial institution is defined in Prudential Standard APS 001 Definitions for authorised deposit-taking institutions; Prudential Standard GPS 001 Definitions for general insurers; Prudential Standard LPS 001 Definitions for life companies; Prudential Standard HPS 001 Definitions for private health insurers; and Prudential Standard CPS 230 Operational Risk Management for RSE licensees.
[2] The exception is section 54B of the SIS Act, which provides that breach of a covenant under sections 52 or 52A is a civil penalty provision. The covenants include a requirement to comply with prudential standards in relation to specified topics (conflicts, capital requirements for operational risk, MySuper and choice products). CPS 230 is not a standard in relation to any of these topics.
[3] The Banking Act, Insurance Act and Life Insurance Act specifically provide that APRA does not need to consult where APRA is satisfied that doing so could result in a delay in revocation that would be contrary to the national interest or the interests of depositors with the body corporate (subsection 9A(4) of the Banking Act), contrary to the national interest (subsection 15(4) of the Insurance Act), or contrary to the public interest (subsection 26(5) of the Life Insurance Act), respectively.