Introduction

A bank answers to the Australian Prudential Regulation Authority (‘APRA’) for its financial soundness, risk management and ability to meet obligations to depositors, while the Australian Securities and Investments Commission (‘ASIC’) oversees how it provides financial services and credit and treats customers. These obligations are often managed by separate treasury, risk, finance, legal, compliance, product and customer teams, creating a risk of duplicated controls, missed requirements or late breach identification.

This article maps the ongoing APRA prudential standards and ASIC conduct obligations that apply to a bank, credit union, mutual bank or digital bank according to its size, category, licences and activities. It also explains where the regimes overlap and how one compliance program can meet both regulators’ requirements without gaps.

Which Prudential & Conduct Obligations Apply to an Australian Bank Once It Is Operating?

APRA & Prudential Regulation

APRA supervises authorised deposit-taking institutions (‘ADIs’), including banks, credit unions and building societies, under the Banking Act 1959 (Cth) (‘Banking Act‘). Under Section 11AF of the Banking Act, APRA may determine prudential standards that applicable ADIs must comply with.

These standards address:

• Capital adequacy and loss-absorbing capacity;
• Liquidity and funding risk;
• Credit risk and counterparty concentrations;
• Governance, risk management and remuneration;
• Operational resilience, business continuity and information security; and
• Prudential reporting, audit and notifications.

Prudential standards are binding requirements. APRA Prudential Practice Guides explain supervisory expectations and possible implementation approaches but do not usually create separate legal obligations.

ASIC & Conduct Regulation

ASIC administers the main financial services and consumer credit conduct requirements applying to a bank. Under Section 911A of the Corporations Act 2001 (Cth) (‘Corporations Act‘), a bank carrying on a financial services business generally needs an Australian Financial Services Licence (‘AFSL’) covering the relevant services, unless an exemption applies.

Deposit-taking facilities and non-cash payment facilities may constitute financial products under Sections 763A, 763D and 764A(1)(i) of the Corporations Act. A bank conducting regulated consumer credit activities may also need an Australian Credit Licence (‘ACL’) under Section 29 of the National Consumer Credit Protection Act 2009 (Cth) (‘NCCP Act‘).

The Australian Securities and Investments Commission Act 2001 (Cth) separately prohibits misleading or deceptive conduct under Section 12DA and unconscionable conduct under Sections 12CA and 12CB.

Where AUSTRAC, AFCA & the Industry Codes Fit

A bank’s compliance responsibilities also include regimes administered by bodies other than APRA and ASIC. Banks providing designated services under Section 6 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) must meet applicable anti-money laundering and counter-terrorism financing requirements, including customer due diligence and transaction monitoring.

AFSL and ACL holders must maintain applicable dispute resolution arrangements, including Australian Financial Complaints Authority (‘AFCA’) membership where required under Section 912A(2) of the Corporations Act and Section 47 of the NCCP Act.

A subscriber may also have additional commitments under the Australian Banking Association’s Banking Code of Practice or the Customer Owned Banking Association’s Customer Owned Banking Code of Practice. Subscription, contractual arrangements and relevant statutory provisions determine whether those commitments apply.

How Obligations Change With ADI Size & Category

The prudential requirements applying to a bank depend on its size, complexity, business model and regulatory classification. APRA’s proportionality framework distinguishes significant financial institutions (‘SFIs’) from non-significant financial institutions (‘non-SFIs’), with SFI-specific governance and remuneration requirements and simplified requirements available to non-SFIs where provided.

Other ADI categories also affect the compliance assessment:

• Foreign ADI branches operate under Australian branch requirements and standards that address their particular structure.
• Restricted ADIs must comply with their restricted authorisation conditions and the prudential requirements applying to that status.
• Credit unions and mutual banks remain subject to the ADI prudential framework, with application determined by their classification and activities rather than mutual ownership alone.

A bank should assess its APRA classification, corporate structure, licence permissions, products and applicable regulatory determinations before deciding which obligations apply.

What Prudential Standards Must Australian Banks Meet Day to Day?

Capital Adequacy

Prudential Standard APS 110 Capital Adequacy (‘APS 110’) requires an ADI to maintain regulatory capital above its applicable prudential capital requirements. The baseline minimum ratios are:

• 4.5% Common Equity Tier 1 (‘CET1’) capital;
• 6.0% Tier 1 capital; and
• 8.0% Total Capital.

APRA may set higher institution-specific requirements. APS 110 also requires CET1 capital buffers above these minimums, being the capital conservation buffer and the countercyclical capital buffer, and an ADI whose capital falls into the buffer range is restricted in paying dividends and bonuses. From 1 January 2027, APRA’s removal of Additional Tier 1 capital from the framework means there will no longer be a separate Tier 1 minimum, and ADIs using the internal ratings-based approach to credit risk will move to minimums of 6.0% CET1 and 9.25% Total Capital.

APS 110 also requires relevant ADIs to maintain an Internal Capital Adequacy Assessment Process (‘ICAAP’). The ICAAP should:

• assess material risks;
• set capital targets and buffers against the bank’s risk appetite;
• forecast capital needs;
• test stress scenarios; and
• support contingency planning.

Capital forecasts should connect with the bank’s business plan and board-approved risk appetite rather than being monitored only as finance measures.

Liquidity

Prudential Standard APS 210 Liquidity (‘APS 210’) requires an ADI to manage liquidity and funding risk and maintain enough liquidity to meet obligations as they fall due. The applicable method depends on the ADI’s classification.

Locally incorporated Liquidity Coverage Ratio (‘LCR’) ADIs must generally maintain:

• an LCR of at least 100%; and
• a Net Stable Funding Ratio of at least 100%.

A Minimum Liquidity Holdings ADI must maintain eligible liquid assets equal to at least 9% of its liabilities, unless APRA requires a higher amount. APS 210 also requires liquidity stress testing, funding risk assessment and contingency planning.

Credit Risk & Large Exposures

Prudential Standard APS 220 Credit Risk Management (‘APS 220’) requires a credit risk management framework suited to the ADI’s size, business mix and complexity. The framework covers:

• credit assessment;
• approval limits;
• credit risk appetite;
• collateral;
• borrower monitoring;
• problem exposures;
• impairment;
• recovery; and
• independent review.

Prudential Standard APS 221 Large Exposures limits concentration risk by restricting exposures to an individual counterparty or connected group. A large exposure is generally one equal to or above 10% of the ADI’s Tier 1 Capital, while the general limit on the ADI’s aggregate exposures to a single counterparty or group of connected counterparties is 25% of Tier 1 Capital, subject to specified exceptions and APRA determinations. From 1 January 2027, these thresholds and limits will be measured against CET1 capital rather than Tier 1 Capital. The bank must monitor connected borrowers, guarantees, commitments and relevant off-balance-sheet arrangements.

Risk Management & Governance

Prudential Standard CPS 220 Risk Management (‘CPS 220’) requires an ADI to maintain risk management arrangements covering its material risks. The arrangements must support the identification, measurement, evaluation, monitoring, reporting and control of those risks, and include:

• a risk appetite statement;
• a risk management strategy; and
• a written business plan.

CPS 220 also requires an annual risk management declaration to APRA. Prudential Standard CPS 510 Governance addresses board responsibilities, composition, committees and oversight. Prudential Standard CPS 520 Fit and Proper requires assessments of responsible persons’ competence, character, integrity and experience. Prudential Standard CPS 511 Remuneration addresses incentives, risk culture and long-term soundness, with different requirements for SFIs and non-SFIs.

Operational Resilience & Information Security

Prudential Standard CPS 230 Operational Risk Management (‘CPS 230’) has operated in full for all ADIs since 1 July 2026, following the relevant transitional arrangements. It requires a bank to:

• identify critical operations;
• set tolerance levels for disruption;
• test business continuity arrangements; and
• manage risks arising from material service providers.

CPS 230 also covers operational risk incidents and related notifications. A material operational risk incident must be reported to APRA as soon as possible and no later than 72 hours after the applicable conditions are met. A disruption to a critical operation outside its tolerance level must be reported as soon as possible and no later than 24 hours. Prudential Standard CPS 234 Information Security (‘CPS 234’) requires information security capabilities, security controls, incident response and notification of relevant cyber incidents and material control weaknesses.

Prudential Reporting & Notifying APRA

Banks must provide regular prudential information to APRA under applicable reporting standards and the Financial Sector (Collection of Data) Act 2001 (Cth). Reporting may cover:

• capital;
• liquidity;
• credit exposures;
• financial performance;
• asset quality; and
• other prudential measures,

depending on the ADI’s category and activities.

A bank must also assess whether an event triggers notification to APRA. These events may include:

• a breach of a prudential standard;
• deterioration in financial condition;
• a material operational risk incident; or
• another circumstance identified by the relevant requirement.

The notification deadline depends on the applicable test. A bank should maintain records showing the trigger, responsible person, reporting channel and deadline for each type of notification.

What Conduct Obligations Apply to Australian Banks as AFSL & ACL Holders?

Section 912A Obligations & How They Apply to APRA-Regulated Banks

Section 912A(1)(a) of the Corporations Act requires an AFSL holder to provide financial services efficiently, honestly and fairly. Section 912A(1)(aa) requires adequate arrangements to manage conflicts of interest, while Section 912A(1)(c) requires the bank to comply with the financial services laws and Sections 912A(1)(ca) and (f) require it to take reasonable steps to ensure its representatives comply with those laws and are adequately trained and competent.

Under Sections 912A(4) and 912A(5) of the Corporations Act, Section 912A(1)(d), concerning financial, technological and human resources, and Section 912A(1)(h), concerning risk management systems, do not apply to a bank regulated by APRA, so those matters are addressed through APRA’s prudential standards instead. These provisions do not remove the bank’s obligations under other applicable provisions of the Corporations Act or APRA standards.

Responsible Lending & NCCP Obligations

A bank conducting regulated consumer credit activities must comply with the NCCP Act and Schedule 1 to that Act (‘National Credit Code‘). Section 47 of the NCCP Act sets general conduct obligations for ACL holders, including requirements concerning:

• efficient, honest and fair conduct;
• conflicts of interest;
• compliance arrangements; and
• representative conduct.

Chapter 3 of the NCCP Act contains responsible lending obligations. Sections 128 to 133 address assessments before entering into regulated credit contracts or increasing credit limits, while Sections 130 and 131 concern reasonable inquiries, verification and unsuitability. ASIC’s Regulatory Guide 209: Credit Licensing—Responsible Lending Conduct (‘RG 209’) provides regulatory guidance on these requirements.

Design & Distribution Obligations

Part 7.8A of the Corporations Act establishes design and distribution obligations for covered financial products, which may include deposit accounts, payment facilities, credit cards and home loans, depending on the product and applicable exclusions. Under Section 994B of the Corporations Act, an issuer must prepare a target market determination (‘TMD’) identifying the consumers for whom the product is likely to be appropriate.

Sections 994C, 994D and 994E of the Corporations Act address TMD reviews, distribution and reasonable steps. Section 994G of the Corporations Act requires notification of certain significant dealings outside a TMD as soon as practicable and within 10 business days after the issuer becomes aware of the dealing. ASIC’s Regulatory Guide 274: Product Design and Distribution Obligations (‘RG 274’) provides related guidance.

Complaints Handling & Financial Hardship

Section 912A(2) of the Corporations Act and Section 47 of the NCCP Act require the dispute resolution arrangements outlined above, including AFCA membership where required. ASIC’s Regulatory Guide 271: Internal Dispute Resolution (‘RG 271’) sets enforceable standards and guidance for receiving, investigating and resolving complaints.

Financial hardship obligations arise under Sections 72 to 75 of the National Credit Code. Under Section 72 of the National Credit Code, a debtor who considers they cannot meet, or will be unable to meet, obligations under a regulated credit contract may give the credit provider a hardship notice. Where sufficient information is available, the credit provider usually has 21 days to notify the debtor of its decision.

Breach Reporting to ASIC

AFSL holders and ACL holders must assess reportable situations under the Corporations Act and the NCCP Act. Sections 912D and 912DA of the Corporations Act apply to AFSL holders, while Sections 50A and 50B of the NCCP Act apply to credit licensees.

Reportable situations can include significant breaches or likely significant breaches, certain extended investigations, serious fraud, gross negligence and prescribed matters. A report is usually due within 30 calendar days after the licensee first knows, or is reckless as to whether, there are reasonable grounds to believe a reportable situation has arisen. ASIC’s Regulatory Guide 78: Breach Reporting by AFS Licensees and Credit Licensees (‘RG 78’) provides guidance on applying the reporting regime.

How Does the Financial Accountability Regime Affect Banking Executives?

Who Counts as an Accountable Person

Section 10 of the Financial Accountability Regime Act 2023 (Cth) (‘FAR Act‘) establishes the framework for identifying accountable persons. It covers directors and senior executives whose actual responsibilities meet the statutory definition, including prescribed responsibilities and functions set by the applicable Minister rules.

A bank should assess responsibilities rather than relying on job titles. Accountable functions may include:

• Overall management and control;
• Financial management, risk management and compliance;
• Internal audit, human resources and remuneration; and
• Information management, technology and other prescribed functions.

Section 23 of the FAR Act also requires accountable persons to collectively cover the bank’s operations and relevant group. Accountability statements and maps can help document how those responsibilities are allocated.

Accountability Obligations

Sections 20 and 21 of the FAR Act impose obligations on accountable entities and accountable persons. Under Section 21 of the FAR Act, an accountable person must act with honesty, integrity, due skill, care and diligence.

The accountable person must also:

• Deal with APRA and ASIC in an open, constructive and cooperative way;
• Take reasonable steps to prevent matters that could adversely affect the bank’s prudential standing or prudential reputation; and
• Take reasonable steps to prevent material contraventions of specified laws by the bank.

These duties do not create automatic personal liability whenever a failure occurs. The assessment depends on the person’s responsibilities, the circumstances and the steps reasonably required. Evidence may include committee papers, management reports, control testing, remediation decisions and escalation records.

Registration, Notification & Deferred Remuneration

Section 24 of the FAR Act restricts a bank from having an unregistered accountable person perform the relevant role, subject to applicable exceptions. Section 31 of the FAR Act establishes notification obligations, with notifications generally required within 30 days of a relevant notifiable event.

The enhanced notification threshold for ADIs is generally based on total assets of $20 billion under the relevant Minister rules. This threshold is separate from APRA’s SFI classification.

Part 4 of the FAR Act establishes deferred remuneration requirements. Subject to applicable thresholds, exceptions and modifications, a bank must generally defer at least 40% of an accountable person’s variable remuneration for at least four years. For ADIs, these requirements apply to remuneration decisions made in the first financial year beginning after 15 September 2024.

How APRA & ASIC Administer the FAR Together

APRA and ASIC jointly administer the FAR Act. APRA’s focus remains connected to prudential soundness and financial stability, while ASIC’s focus includes financial services and credit conduct.

A single failure may raise issues for both regulators. A widespread lending system failure, for example, may involve prudential controls, customer outcomes and the oversight exercised by executives responsible for lending, technology or customer operations.

Depending on the facts, consequences under the FAR Act may include regulatory investigation, directions, disqualification processes or other statutory enforcement measures. The regime provides civil penalties for specified accountable entity obligations, while individuals may face disqualification and other consequences under applicable provisions. Accountable persons are not exposed to civil penalties under the FAR Act for breaching their own accountability obligations, but a breach can lead to disqualification and a reduction of their variable remuneration.

How Can an ADI Run One Compliance Program That Satisfies Both APRA & ASIC?

Building a Single Obligations Register

A central obligations register can connect each applicable prudential, financial services, credit and accountability requirement to the bank’s operating arrangements, supported by financial services compliance and regulatory advice from AFSL House. Each entry should identify:

• the relevant Act, prudential standard or regulatory instrument;
• the activity or entity covered;
• the responsible person or function;
• the control; and
• the evidence showing that the control operates.

The register should also record reporting duties, deadlines, assurance arrangements, testing frequency, control weaknesses and remediation owners. FAR accountability may sit with a senior executive while day-to-day controls are performed by an operational manager, so the register should distinguish accountability from control ownership.

Aligning the Risk Management Framework With Conduct Risk

CPS 220 requires a bank to maintain a risk management framework covering its material risks. CPS 230 includes conduct risk and compliance risk within operational risk management, so conduct risk should be assessed within the bank’s broader risk arrangements rather than kept in a separate system.

The risk appetite statement may include indicators such as:

• recurring customer remediation;
• responsible lending breaches;
• products distributed outside their target market;
• complaints handling weaknesses; and
• delayed escalation of reportable situations.

A single product approval process can also assess capital, liquidity, credit risk, consumer suitability, design and distribution obligations, operational resilience, disclosure and FAR accountability.

Managing Breaches & Incidents Across Both Regulators

One incident may engage separate obligations to APRA and ASIC, each with its own legal test and reporting deadline, making coordinated advice from banking regulatory compliance lawyers important. A payment provider failure affecting customer access may raise issues under:

• CPS 230;
• CPS 234;
• Section 912A of the Corporations Act;
• the ASIC reportable situations regime; and
• the FAR Act.

A single incident workflow can record the facts, affected customers and services, classify the risks, assess each notification requirement, allocate responsibility and track remediation. The workflow must preserve separate assessments. Under CPS 230, some notifications are due within 72 hours or 24 hours, while ASIC reports are usually due within 30 calendar days when the statutory test is met.

Assurance & Independent Review

A bank should coordinate compliance monitoring, internal audit and other assurance work without treating different regulatory tests as interchangeable. One review of lending operations may test:

• APS 220;
• responsible lending requirements under the NCCP Act;
• design and distribution obligations under Part 7.8A of the Corporations Act;
• hardship responses; and
• breach escalation.

Paragraph 44 of CPS 220 requires the risk management framework’s compliance and effectiveness to be reviewed by internal and/or external audit at least annually. Paragraph 45 requires a comprehensive review by operationally independent and appropriately qualified persons at least every three years.

Common Gaps Between Prudential & Conduct Compliance

Gaps often arise when teams assess the same activity through separate systems without sharing relevant information. Common examples include:

• Product changes made without reviewing the TMD.
• Service provider failures treated only as technology incidents.
• Hardship and complaints data not reaching credit risk or the board.
• FAR accountability documents that do not reflect actual decisions.
• Duplicate testing that produces inconsistent findings.
• Incident assessments delayed until an internal investigation is complete.

A coordinated governance and reporting structure can reduce these gaps while preserving the separate evidence required for APRA prudential standards, ASIC conduct obligations and the FAR Act.

Conclusion

Australian banks need financial resilience and fair customer outcomes, with APRA prudential standards and ASIC conduct requirements applying throughout their operations. A coordinated compliance program can connect capital, liquidity, risk management, customer treatment, product governance and executive accountability without creating duplicated controls or missed obligations.

For banks, credit unions and mutual banks seeking help with these requirements, contact AFSL compliance and regulatory lawyers at AFSL House to review your prudential and conduct compliance arrangements. AFSL House assists banking businesses with financial services law, regulatory compliance frameworks and governance matters, helping teams clarify responsibilities and manage their obligations with greater confidence.

Frequently Asked Questions

Disclaimer: All information provided in this article is strictly general in nature and is not intended to be, nor should it be relied upon as, legal advice.