EXPLANATORY STATEMENT

Issued by authority of the Assistant Treasurer and Minister for Financial Services

Reserve Bank Act 1959

Reserve Bank Regulations 2026

Section 89 of the Reserve Bank Act 1959 (the Act) provides that the Governor‑General may make regulations prescribing matters required or permitted by the Act to be prescribed, or necessary or convenient to be prescribed for carrying out or giving effect to the Act.

The Act provides for, among other things, declarations of secrecy by each member of a Reserve Bank of Australia (RBA) board as well as the disclosure of protected information and production of protected documents by ‘officers’ as defined in the Act (RBA officers).

Paragraphs 25AJ(1)(b), 25E(1)(b) and 25NJ(1)(b) of the Act oblige each member of the RBA’s Monetary Policy Board, Payments System Board and Governance Board to make a declaration of secrecy. Paragraphs 25AJ(3)(a), 25E(3)(a) and 25NJ(3)(a) respectively confer power for regulations to prescribe the form of the declarations.

Paragraph 79A(4)(c) of the Act allows RBA officers to disclose protected information and produce protected documents to persons or bodies prescribed by regulations, provided that disclosure or production assists the person or body to perform its functions or exercise its powers.

The Reserve Bank Regulations 2026 (the Regulations) prescribe:

•                 the form for a declaration of secrecy by a member of the Monetary Policy Board, Payments System Board or Governance Board; and

•                 the bodies to which RBA officers may disclose protected information or produce protected documents without written approval by the Governor or written agreement by the person to whose affairs the information or document relates, to assist the body to perform its functions or exercise its powers.

The Legislation Act 2003 provides that all legislative instruments, other than exempt instruments, are automatically repealed (‘sunset’) according to the progressive timetable set out in section 50 of that Act. Legislative instruments generally cease to have effect after a specific date unless further legislative action is taken to extend their operation, such as remaking the instrument.

The purpose of the Regulations is to remake and improve the existing Reserve Bank Regulation 2016 (the 2016 Regulation), which will otherwise sunset on 1 October 2026.

The 2016 Regulation is still required to support the operation of the Act, subject to drafting improvements and the addition of prescribed entities to which RBA officers may disclose protected information and produce protected documents.

Improvements to the 2016 Regulation are made in the Regulations through minor drafting changes and the prescription of the following three additional bodies under paragraph 79A(4)(c) of the Act:

•                 the Department administered by the Minister who administers the Security of Critical Infrastructure Act 2018 – presently the Department of Home Affairs (Home Affairs);

•                 the Australian Office of Financial Management (AOFM); and

•                 the Australian Signals Directorate (ASD).

The RBA’s mandate includes contributing to the stability of the Australian financial system. The risks posed by the increasing sophistication of cyber‑attacks, including at financial institutions, mean that information sharing has become a more important part of the RBA’s performance of its functions. Home Affairs and ASD both play an essential role in responding to major cyber security incidents in Australia, so it is appropriate for the RBA to be able to share protected information and documents with them through a more streamlined process.

The AOFM plays a key role in the Australian financial system through its role as Australia’s sovereign debt issuer. The market for Australian government securities is a critical part of Australia’s financial system. The RBA’s market operations to implement monetary policy, contribute to the stability of Australia’s financial system and provide banking services to the Commonwealth can have important implications for the functioning of that market, particularly at times of severe economic disruption. Collaboration with the AOFM is therefore an important part of the RBA’s work.

The protected information and documents collected by the RBA are generally institutional in nature, particularly given the RBA’s focus on financial system stability. It is extremely unlikely that the RBA will use its powers to disclose personal information to the newly prescribed bodies.

The Act does not specify any condition that needs to be met before the power to make the Regulations may be exercised.

The Regulations were subject to public consultation during the period 13 May 2026 to 27 May 2026. Two submissions were received from members of the public. The RBA was also consulted during the preparation of the Regulations. Following public consultation, one change was made to the Regulations to identify Home Affairs by reference to the Security of Critical Infrastructure Act 2018, instead of the Australian Border Force Act 2015. This better reflects the policy purpose for allowing disclosure to Home Affairs.

The Regulations are a legislative instrument for the purposes of the Legislation Act 2003.

The Regulations commenced on 1 October 2026. They are subject to disallowance and will sunset on 1 October 2036 subject to any extensions.

Details of the Regulations are set out in Attachment A.

A Statement of Compatibility with Human Rights is at Attachment B.

ATTACHMENT A

Details of the Reserve Bank Regulations 2026

This Attachment sets out further details of the Reserve Bank Regulations 2026 (the Regulations). All references are to the Regulations unless otherwise stated.

The Regulations improve the Reserve Bank Regulation 2016 (the 2016 Regulation) by adding three prescribed entities to which Reserve Bank of Australia (RBA) officers may disclose protected information and produce protected documents.

Section 1 – Name

This section provides that the name of the regulations is the Reserve Bank Regulations 2026.

Section 2 – Commencement

The Regulations commenced on 1 October 2026.

Section 3 – Authority

The Regulations are made under the Reserve Bank Act 1959.

Section 4 – Schedules

This section provides that each instrument that is specified in the Schedules to the Regulations are amended or repealed as set out in the applicable items in the Schedules, and any other item in the Schedules to the Regulations has effect according to its terms.

Section 5 – Definitions

This section provides the definition of Act to mean the Reserve Bank Act 1959 (the Act).

Section 6 – Declarations of secrecy

This section provides that the form for declarations of secrecy by members of the Monetary Policy Board, Payments System Board and Governance Board is prescribed in Schedule 1 to the Regulations. This is for the purpose of paragraphs 25AJ(3)(a), 25E(3)(a) and 25NJ(3)(a) of the Act.

Section 7 – Prescribed bodies—disclosure of protected information or production of protected documents

This section prescribes the bodies to which RBA officers can disclose protected information and produce protected documents if satisfied that the disclosure of the information, or the production of the document, will assist the body to perform its functions or exercise its powers. The RBA’s relationship with each of these entities is summarised below, including the reasons for the need to share protected information and documents with each.

•                 Department of the Treasury: It is noted that the expression ‘Department’ is to be interpreted according to item 1 of subsection 19A(1) of the Acts Interpretation Act 1901, which states that it designates the Department that is administered by the Minister administering the provision, i.e. the Department of the Treasury. The RBA and the Department of the Treasury staff meet regularly to discuss policy issues and possible responses. For example, both entities are members of the Council of Financial Regulators (CFR), which is the coordinating body for Australia’s main financial regulatory agencies. Among other things, the CFR is a forum for the regular exchange of information and views on financial regulations, and for coordination across members when the exercise of regulatory powers by one agency affects others. Prescribing the Department of the Treasury allows information and documents to be exchanged that are helpful in analysing policy issues and related responses. Furthermore, the CFR Memorandum of Understanding on Crisis Management sets out expectations that members will share information giving rise to concerns about emerging stress in the financial system. The ability to share protected information and documents with the Department of the Treasury is critical in the event of a crisis in the financial sector.

•                 Department of Home Affairs (Home Affairs): It is noted that the reference to ‘Department administered by the Minister who administers the Security of Critical Infrastructure Act 2018’ (SOCI Act) is to be interpreted according to item 2(b) of subsection 19(1) of the Acts Interpretation Act 1901, which designates the reference to the Department that is administered by the Minister administering the abovenamed law, i.e. Home Affairs. The RBA and Home Affairs have a Memorandum of Understanding (MoU) which assists each agency with the performance of their regulatory responsibilities under the SOCI Act.[1] The MoU builds resilience against hazards of assets used in connection with the operation of payment systems that are prescribed as critical to the security and reliability of the financial services and markets sectors (Critical Payment System Assets). Such hazards include but are not limited to cyber security incidents. The RBA and Home Affairs consult one another on significant issues with respect to these Critical Payment System Assets, hazards to them (e.g. cyber security incidents), and their responsible entities that may have an impact on or relevance to the regulatory responsibilities of the other agency.[2] The ability for the RBA to share protected information and documents with Home Affairs will greatly assist with crisis prevention and management, particularly with respect to these Critical Payment System Assets.

•                 Australian Bureau of Statistics (ABS): The RBA regularly communicates with the ABS on data collection issues, including with respect to specific financial sector entities. Sharing of protected information and documents is essential for the RBA to collaborate with the ABS in a meaningful manner.

•                 Australian Competition and Consumer Commission (ACCC): The RBA and the ACCC share responsibility for competition and access in payment systems. The RBA holds a substantial amount of information relating to payment systems, including payments data collected from financial institutions. The ability to disclose such information to the ACCC is helpful for the discussion of current issues and possible policy responses.

•                 Australian Office of Financial Management (AOFM): The AOFM is responsible for financing the operations of the Australian Government, including by issuing debt securities. The market for Australian Government securities plays a critical role in the Australian financial system. Information obtained in connection with the RBA’s market operations can help to understand the functioning of that market, particularly at times of severe economic disruption. The ability for the RBA to disclose protected information and produce protected documents to the AOFM will greatly assist each agency to cooperate in performance of their functions and exercise of their powers.

•                 Australian Signals Directorate (ASD): The ASD is the Australian Government’s technical authority on cyber security and works with the RBA on cyber-security crisis prevention and management. The RBA draws on advice from the ASD, along with its engagement with peer central banks, the Australian Government, and industry participants, to contribute to national and international financial systems cyber-resilience. The ability of the RBA to disclose protected information and produce protected documents to the ASD will greatly assist in achieving such resilience.

•                 Bank for International Settlements (BIS): The BIS is the international organisation representing the world’s central banks (the RBA is a member of the BIS). The BIS’ mission is to serve central banks in their pursuit of monetary and financial stability, to foster international cooperation in those areas and to act as a bank for central banks. The BIS is a central player in the formulation of the international regulatory framework applying to the financial sector, especially with respect to banks and other critical financial institutions such as systemically important payment systems, securities settlement facilities and central counterparties. If the RBA were unable to share protected information and documents, this could constrain the RBA’s ability to fully participate in the BIS’ work. This may limit the influence the RBA is able to exert with regard to the matters debated and decided within the BIS, and may prevent the RBA from comprehensively arguing and supporting positions that are important for Australia. Furthermore, much of the day-to-day work of the BIS is done through a number of important committees. In order to clarify beyond doubt that the RBA is allowed to disclose protected information and produce protected documents in the course of its work in these committees, including in any working or other groups formed under the committees, they are separately prescribed as follows:

–               the Basel Committee on Banking Supervision;

–               the Committee on the Global Financial System;

–               the Committee on Payments and Market Infrastructures; and

–               the Markets Committee.

•                 Financial Stability Board (FSB): The FSB is the international organisation endorsed by the Group of Twenty (G20) to assume the key role in promoting the reform of international financial regulation in the wake of the Global Financial Crisis. Australia is represented by the RBA and the Department of the Treasury. The FSB was originally tasked by G20 leaders to develop reforms in four key areas: building resilience of financial institutions; ending the problem of banks that are too-big-to-fail; transforming shadow banking into transparent and resilient market-based financing; and making derivatives markets safer. The FSB has also expanded its scope to cover a number of related topics. FSB projects generally culminate in the promulgation of international standards which directly impact on the regulation of the financial sector and its constituent institutions in Australia. As in the case of the BIS, prescribing the FSB allows the RBA to fully participate in its work and enables the RBA to better represent Australian interests and positions in developing the reforms promoted by the FSB. As in the case of the BIS, most of the FSB’s day-to-day work is done through a number of committees, working groups and consultative groups. As these may be subject to change depending on the particular focus of the FSB’s work, any such committees or groups operating under the FSB’s charter are prescribed in addition to the FSB itself.

•                 International Monetary Fund (IMF): The RBA regularly meets with IMF staff as part of the annual Article IV consultations during which an IMF team of economists visits Australia to assess economic and financial developments and discuss the country’s economic and financial policies with government and central bank officials. The IMF’s monitoring work is intended to identify weaknesses that are causing or could lead to financial or economic instability. The IMF also conducts Financial System Stability Assessments of the Australian banking and financial system on a regular basis, as well as ad hoc surveys on various topics. The IMF reports setting out its assessments, conclusions and recommendations are public documents, and are very influential in forming global public opinion on the state of the Australian economy, the stability of the financial system and the quality and adequacy of the financial regulatory architecture. It is in the national interest to ensure that the IMF is given all the information and documents it requires to make a full and balanced assessment of these matters. Prescribing the IMF allows the RBA to provide comprehensive responses to its requests for information and documents, assisting the IMF in better understanding the Australian economy, financial system and related regulatory architecture, and contributing to more accurate assessments and recommendations in its reports.

•                 New Zealand Treasury: Entities owned by Australian banks are a significant feature of the New Zealand banking market, and in turn represent significant exposures for Australia’s major banks. Staff of the RBA therefore regularly meet with the New Zealand Treasury staff, as both entities are members of the Trans-Tasman Council on Banking Supervision, to discuss matters of concern and policy issues in the Australian and New Zealand financial and banking markets. Both entities are parties to the Memorandum of Cooperation on Trans-Tasman Bank Distress Management. As with the Australian Treasury, the ability to share protected information and documents with the New Zealand Treasury greatly assists with policy analysis and formulation, and is critical in the event of a crisis in the financial sector in Australia or New Zealand.

A minor drafting amendment is made to the heading of the provision in the Regulations to better reflect the terms of the empowering provision in the Act.

Section 8 – Application—disclosure of protected information or production of protected documents

This section provides that information disclosed or obtained, or documents given or produced before, on or after the commencement of the Regulations (i.e. 1 October 2026) can be shared with the three newly prescribed bodies. The effect of this is that the RBA can disclose information or produce documents to the AOFM, Home Affairs and ASD even if the information or documents came into existence before 1 October 2026. This includes information disclosed to or obtained by the RBA and documents given or produced to the RBA before 1 October 2026. This section is merely declaratory of the law, and does not invoke any retrospective commencement of the amendments.

Schedule 1 – Form for declaration of secrecy by Board members

Schedule 1 prescribes the form to be used by a member of an RBA board to make the declaration of secrecy referred to in section 6 of the Regulations. The form itself is the same as that set out in the 2016 Regulation.

Schedule 2 – Repeals

Schedule 2 repeals the whole of the 2016 Regulation, which are replaced and superseded by the Regulations.

ATTACHMENT B

Statement of Compatibility with Human Rights

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011

Reserve Bank Regulations 2026

This Legislative Instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Overview of the Legislative Instrument

Amendments made through the Reserve Bank Regulations 2026 (the Regulations) will assist the Reserve Bank of Australia (RBA) in performing its functions by allowing officers to disclose protected information and produce protected documents to three additional important government agencies. The Regulations also remake the existing Reserve Bank Regulation 2016, which would otherwise ‘sunset’ on 1 October 2026.

Human rights implications

This Legislative Instrument engages the right to privacy under Article 17 of the International Covenant on Civil and Political Rights (ICCPR), in relation to disclosing personal information.

Article 17 of the ICCPR protects the right to privacy, prohibiting arbitrary or unlawful interference with an individual’s privacy, family, home, or correspondence, and attacks on reputation. It requires states to provide legal protection against such interference, including regulating data, surveillance and searches.

The Human Rights Committee has interpreted the term ‘unlawful’ to mean that interferences cannot take place except in cases envisaged by law, which itself must comply with the provisions, aims and objectives of the ICCPR. The Human Rights Committee has also indicated that an interference will not be considered ‘arbitrary’ if it is provided for by law, is in accordance with the provisions, aims and objectives of the ICCPR, and is reasonable in the particular circumstances.[3]

The Regulations engage the right to privacy by allowing RBA officers to disclose protected information and produce protected documents to certain government bodies which may interfere with the right to privacy, if the disclosure includes personal information.

The RBA collects limited ‘protected information’ and ‘protected documents’ which is or which contain ‘personal information’ as defined in section 6 of the Privacy Act 1988. The main source of such information is the ‘large exposure’ data for financial institutions which the RBA receives from the Australian Prudential Regulation Authority (APRA). There are instances each quarter in which smaller deposit taking institutions report large exposures to natural persons.

The bodies that are prescribed in the Regulations are concerned with the stability and/or security of the financial system, or with financial sector data or competition in and efficiency of payment systems. The information that the RBA may need to share with these bodies for the purposes of assessment of financial stability, crisis prevention, crisis management, co-operative oversight and effective collaboration and development of policy responses is aggregated information about the system as a whole or segments of the system, or information about specific institutions. The nature of the respective mandates of the RBA and the prescribed bodies, and the purposes for which information sharing with them would occur, means that the sharing of information about natural persons is extremely unlikely. The RBA does not contemplate that any personal information will need to be, or will be, shared with the bodies prescribed in the Regulations.

Subsection 79A(4) of the Reserve Bank Act 1959, for which section 7 of the Regulations is made, has been drafted narrowly enough to ensure that protected information is not disclosed and protected documents are not produced unless the RBA is satisfied that disclosure or production will assist a prescribed body to perform its functions or exercise its powers. That qualifier means that the disclosure of personal information is, in practice, extremely unlikely to occur and, if it did occur, it would be justified by legitimate reasons and only to the extent required by those reasons, and the recipient would be using the information for the exercise of its functions or powers.

Conclusion

This Legislative Instrument is compatible with human rights as the RBA does not contemplate that any personal information will need to be, or will be, shared with the bodies prescribed in the Regulations and, even if it were, it would be limited information disclosed in circumstances that would be justified by legitimate reasons and only to the extent required by those reasons.

[1] In accordance with the SOCI Act and the Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023, the relevant Commonwealth regulator for a Critical Payment System Asset is the RBA.

[2] See RBA website at https://www.rba.gov.au/payments-and-infrastructure/payments-system-regulation/mou/dha-and-rba/.

[3] General comment No. 16: Article 17 (Right to privacy), Thirty second session (1988) at [3]-[4].