APRA Strategy for Banking Businesses: Choosing the Right ADI Structure11 min read

Introduction

Obtaining an Australian Prudential Regulation Authority (APRA) authorised deposit-taking institution (ADI) licence is not simply a matter of demonstrating that a business can accept deposits. A prospective Australian bank needs a regulatory structure, funding model and governance framework capable of supporting prudent banking from authorisation onwards.

This article explains how to determine whether ADI authorisation is required and how to choose a structure that meets APRA’s licensing and prudential expectations.

Does Your Australian Banking Business Need APRA Authorisation

What Is Banking Business

“Banking business” is a statutory concept under Section 5(1) of the Banking Act 1959 (Cth) (‘Banking Act‘), not simply a commercial label used by businesses that call themselves banks. For a constitutional corporation, the definition includes carrying on a business that involves both:

• taking money on deposit, other than as part-payment for identified goods or services; and
• making advances of money.

The definition may also include prescribed financial activities, and an advance includes a loan.

Sections 7 and 8 of the Banking Act restrict who may carry on banking business in Australia. Under Section 8 of the Banking Act, a body corporate generally cannot conduct banking business in Australia unless it is the Reserve Bank of Australia or an ADI.

Lending Without Taking Deposits

A business that only provides finance does not necessarily require ADI authorisation. APRA states that a business proposing to provide finance without taking deposits does not require an ADI licence from APRA, although other regulatory requirements may apply.

The funding model is central to this assessment. The following funding sources may support a lending business without customer deposits:

• wholesale funding;
• warehouse facilities;
• securitisation;
• institutional funding; and
• shareholder capital.

A business should assess whether it accepts customer money, how those funds are characterised and whether it also makes advances before deciding that it needs an ADI structure.

Locally Incorporated ADIs

A business intending to conduct banking business for Australian customers through an Australian company will generally consider a locally incorporated ADI structure. Under Section 9 of the Banking Act, a body corporate may apply to APRA for authority to conduct banking business in Australia, and APRA may grant that authority.

The existing APRA framework includes a direct pathway and a Restricted ADI pathway. The direct pathway is intended for applicants with the resources and capabilities needed to operate as a full ADI. Under Sections 9D–9F of the Banking Act, a Restricted ADI may conduct limited banking business while developing those capabilities. APRA has decided to discontinue this pathway under its proposed framework, but the final replacement framework has not been published.

Foreign Banks

An overseas bank may seek authority to operate through an Australian branch as a foreign ADI or establish a separate Australian subsidiary. Section 5(1) of the Banking Act defines a foreign ADI as a foreign corporation authorised to conduct banking business in another country and granted authority to conduct banking business in Australia.

A foreign ADI branch may serve wholesale clients in Australia, but APRA’s licensing conditions restrict retail deposit-taking, including deposits and other funds below $250,000 from individuals and non-corporate institutions, subject to stated exceptions. An overseas bank wishing to accept retail deposits will generally need an Australian subsidiary with its own authority under Section 9 of the Banking Act.

How Should APRA-Regulated Banking Business be Structured

Local ADI Structure

A locally incorporated ADI is an Australian body corporate that holds authority under Section 9 of the Banking Act to conduct banking business. It becomes the prudential centre of the banking operation, so its arrangements must support the proposed banking activities, including:

• capital;
• liquidity;
• governance;
• risk management; and
• operational arrangements.

Related entities and service providers remain relevant to APRA’s assessment. A technology company, overseas parent or outsourced provider may support critical functions, but corporate separation does not remove the ADI’s responsibility to manage those risks under CPS 230 — Operational Risk Management (‘CPS 230‘) and CPS 234 — Information Security (‘CPS 234‘).

Foreign ADI Branch vs Australian Subsidiary

A foreign ADI branch forms part of the overseas bank and may suit a foreign bank serving wholesale clients in Australia. Foreign ADIs are not subject to the Australian capital requirements applying to locally incorporated ADIs, although other Australian prudential and regulatory requirements continue to apply.

An Australian subsidiary is a separate Australian body corporate with its own ADI authority, local capital requirements and governance arrangements. Retail deposit-taking generally requires this structure for two reasons: foreign ADI branches are subject to conditions restricting retail deposits, and deposits held with foreign ADI branches are not covered by the Financial Claims Scheme.

Banking Groups and NOHCs

A banking group may include an authorised non-operating holding company (NOHC) above one or more ADIs. Under Section 11AA of the Banking Act, APRA may authorise a body corporate to operate as a NOHC of subsidiary ADIs.

The NOHC structure gives APRA a prudentially recognised head of the banking group. In addition, Section 9 of the Banking Act allows APRA to refuse an ADI application or impose an authority condition where the parent-company structure does not include an appropriate NOHC authorisation.

Ownership and Shareholding Approvals

ADI licensing and ownership approval are separate issues. Under Section 10 of the Financial Sector (Shareholdings) Act 1998 (Cth) (‘Financial Sector (Shareholdings) Act‘), an unacceptable shareholding situation generally arises when a person holds more than 20% in a financial sector company, unless a higher percentage has been approved.

The ownership structure should be assessed before investors finalise their rights and percentages. An ADI authority does not itself permit a shareholder to exceed the applicable limit, so a capital raising may require separate approval under the Financial Sector (Shareholdings) Act.

What Prudential Capability Should Prospective Banks Build Before Applying

Capital & Liquidity

Capital planning should reflect the proposed balance sheet, expected growth, credit losses, operating costs and stressed conditions. Two key prudential standards address capital and liquidity:

• APS 110 Capital Adequacy (‘APS 110‘) requires a locally incorporated ADI to maintain adequate regulatory capital and an Internal Capital Adequacy Assessment Process (ICAAP).
• APS 210 Liquidity (‘APS 210‘) requires an ADI to maintain a liquidity-risk management framework and sufficient liquidity to meet obligations across a range of conditions, including severe stress.

A prospective bank should model both capital resilience and funding resilience rather than focus only on the amount needed at authorisation.

Governance & Fit & Proper Requirements

Two key prudential standards address governance and fit and proper requirements:

• CPS 510 Governance (‘CPS 510‘) requires an ADI to maintain a sound and prudent governance framework supported by a competent board. The board and senior management should have suitable banking, finance, risk, operational and regulatory experience for the proposed business.
• CPS 520 Fit and Proper (‘CPS 520‘) requires an ADI to maintain a Fit and Proper Policy and assess responsible persons before appointment and at least annually. The assessment considers competence, character, diligence, honesty, integrity, and judgement.

Under Section 9 of the Financial Accountability Regime Act 2023 (Cth) (‘Financial Accountability Regime Act‘), covered ADIs and authorised banking NOHCs are accountable entities.

Risk & Credit Management

Two prudential standards address risk and credit management:

• CPS 220 Risk Management (‘CPS 220‘) requires an ADI to maintain a risk management framework suited to its size, business mix and complexity. The framework must include a board-approved risk appetite statement, risk management strategy, business plan, management information systems, scenario analysis and stress testing.
• APS 220 Credit Risk Management (‘APS 220‘) addresses the full credit life cycle. A prospective lender should be able to show how credit is originated, assessed, approved, priced, monitored and managed after origination. The framework should also address arrears, problem exposures, credit concentrations, exceptions, portfolio reporting and the relationship between credit risk and capital.

Operational Resilience & Recovery Planning

Operational risk and information security are addressed by two standards:

• CPS 230 requires an ADI to manage operational risks, maintain critical operations during disruption and manage service-provider risks.
• CPS 234 requires suitable information-security and cyber resilience capability, controls, testing, assurance, incident response and notification processes.

Recovery and exit planning are addressed by CPS 190 Recovery and Exit Planning (‘CPS 190’), which requires covered entities to maintain credible plans for responding to financial stress and, where recovery fails, facilitating an orderly exit. The plans should include stress indicators, governance arrangements and links to capital, liquidity, and risk frameworks. CPS 900 Resolution Planning (‘CPS 900‘) may also apply to significant financial institutions and entities providing critical functions.

How Should FinTechs & Prospective Banks Approach the APRA Licensing Process

Engage With APRA Before Applying

APRA encourages prospective applicants to make contact before lodging a formal licence application. Early discussions can identify whether the proposed business actually requires an ADI licence and whether its corporate structure, funding model or regulatory approach needs adjustment.

This step is especially useful for unusual FinTech models involving:

• outsourced technology;
• multiple group entities;
• novel deposit arrangements; or
• offshore functions.

Resolving these questions before the application process begins can reduce the risk of committing resources to an unsuitable licensing pathway.

Develop a Credible Banking Business Plan

A banking business plan should connect the proposed products and target customers with the deposit, lending and funding strategy. It should also explain the financial forecasts, expected growth and assumptions supporting the proposed banking operation.

Revenue forecasts should be supported by realistic estimates of:

• customer acquisition;
• deposit growth;
• loan growth;
• margins;
• credit performance;
• funding costs; and
• operating expenses.

The plan should also show how the following will support the proposed business as it grows:

• capital;
• liquidity;
• staffing;
• technology; and
• risk controls.

Demonstrate Operational Readiness

Under APRA’s current direct pathway, an applicant is expected to have the resources and capabilities needed to establish an ADI and begin its intended banking business when authorised.

Operational readiness includes:

• functioning systems;
• suitable people;
• board and management oversight;
• capital;
• risk controls;
• financial reporting;
• IT resilience;
• incident management; and
• business continuity arrangements.

APRA’s licensing process may involve meetings, document reviews and assessments of whether policies and systems operate effectively rather than exist only in draft form.

Account for APRA’s 2026 Licensing Reforms

APRA’s May 2026 draft framework proposes legally effective licensing criteria for locally incorporated ADIs. The criteria would address:

• effective supervision;
• financial and non-financial resources;
• skills and experience;
• risk management; and
• plans for responding to threats to viability.

The draft framework would give applicants 12 months to demonstrate compliance, with APRA proposing a 90-day decision period once an application is complete enough for assessment. APRA also intends to discontinue the Restricted ADI pathway. The final licensing criteria and guidelines have not been published, so the existing licensing framework remains relevant.

When Should a Growing Bank Review Its APRA Strategy

Changes in Size & Prudential Classification

APRA’s three-tier banking framework applies different prudential expectations as an ADI grows. From 1 July 2026, the framework includes:

• Most Significant Financial Institutions (MSFIs);
• Significant Financial Institutions (SFIs); and
• non-SFIs.

APRA introduced the MSFI category for ADIs with total assets above $300 billion and increased the asset threshold for SFI classification from $20 billion to $30 billion. A growing bank should assess whether changes in its assets, governance expectations, risk profile or resolution obligations require an updated APRA strategy.

Changes to Ownership or Group Structure

A change in shareholdings may require review under the Financial Sector (Shareholdings) Act. Acquisitions, capital raisings and changes to ownership percentages can affect the approvals needed for the banking group.

A new holding-company structure may also require consideration of a NOHC authority under the Banking Act. Corporate transactions involving an ADI should be assessed for their effects on:

• Ownership approvals;
• NOHC arrangements;
• Group supervision; and
• The structure and timing of the transaction.

New Products or Material Business Changes

A bank should review its APRA strategy before introducing products or activities that may materially alter its risk profile. Relevant changes may involve:

• a new lending market;
• a different deposit product;
• a new wholesale funding method;
• substantial outsourcing;
• cross-border expansion; or
• major technology changes.

CPS 220 requires the risk management framework and business planning process to address material risks associated with strategic objectives and changes in the business. The bank should also assess whether the change remains within its authority and conditions and whether it affects its resources, prudential obligations or engagement with APRA.

Recovery & Resolution Planning

CPS 190 requires a covered entity to maintain a recovery and exit plan suited to its size, business mix and complexity. A plan prepared for a small, single-product bank may need revision when the ADI gains significant deposit funding, adds business lines or develops more complex service-provider arrangements.

CPS 900 may apply to SFIs and non-SFIs that provide critical functions in the circumstances specified by the standard. Relevant entities may need to support APRA’s resolution planning through measures such as:

• resolvability assessments;
• steps to remove barriers to resolution; and
• capabilities supporting an orderly resolution.

Conclusion

An effective APRA strategy starts by identifying whether the proposed activities amount to banking business under the Banking Act, then selecting the right ADI, branch, subsidiary, NOHC and ownership structure. The business must also build suitable capital, liquidity, governance, risk, operational resilience, recovery and resolution capabilities while tracking APRA’s proposed 2026 licensing reforms.

For a clear assessment of your proposed banking structure and licensing readiness, contact AFSL House’s banking lawyers for licensing and regulatory advice. Our team can help you assess the regulatory framework, funding model and prudential requirements so you can plan your Australian banking operation with greater certainty.

Frequently Asked Questions