Introduction

Australian insurance businesses operate under distinct risk and compliance frameworks administered by the Australian Securities and Investments Commission (ASIC), the Australian Prudential Regulation Authority (APRA) and the Australian Transaction Reports and Analysis Centre (AUSTRAC). Requirements differ according to whether an entity is an Australian Financial Services Licence (AFSL) holder, insurer, insurance broker or other intermediary.

Getting these obligations right matters because each regulator applies its own rules, and insurers, brokers and other intermediaries can face very different requirements. This article explains the risk management, capital and AML/CTF requirements that apply to Australian insurance businesses, when AML/CTF obligations are triggered and how to keep compliance arrangements up to date.

Overview of Risk, Capital and AML/CTF Requirements for Australian Insurance Businesses

The main compliance requirements depend on the business’s regulatory status and the services it provides:

• AFSL holders: must maintain adequate risk management systems and, subject to limited exceptions, adequate financial resources under Section 912A of the Corporations Act 2001 (Cth) (‘Corporations Act‘).
• APRA-regulated insurers: must comply with prudential standards, including Prudential Standard CPS 220 Risk Management (‘CPS 220’), Prudential Standard CPS 230 Operational Risk Management (‘CPS 230’) and the capital adequacy standard for their industry.
• Reporting entities: businesses providing designated services, such as issuing life insurance policies or arranging them under an AFSL, must meet anti-money laundering and counter-terrorism financing (AML/CTF) obligations administered by AUSTRAC.

A single insurance business may be subject to all three frameworks. The sections below explain each in turn.

What Risk Management Frameworks Must Australian Insurance Businesses Maintain?

Section 912A of the Corporations Act

An AFSL holder must comply with the following obligations under the Corporations Act:

• maintain adequate risk management systems under Section 912A(1)(h); and
• do all things necessary to ensure that financial services covered by the AFSL are provided efficiently, honestly and fairly under Section 912A(1)(a).

The appropriate arrangements depend on the nature, scale and complexity of the financial services business.

Governance Structures and Internal Controls

An effective risk management framework requires governance arrangements that oversee operational risk. These arrangements are supported by:

• risk assessments;
• internal controls; and
• monitoring, reporting and escalation processes.

An APRA-regulated insurer must maintain an operational risk profile appropriate to its size, business mix and complexity.

The risk appetite must be defined through indicators, limits and tolerance levels. Internal controls must be designed, implemented, regularly monitored, reviewed and tested for operating effectiveness, with identified control gaps or material weaknesses addressed in a timely manner.

APRA Prudential Standards CPS 220 and CPS 230

APRA-regulated insurers must maintain risk management arrangements under CPS 220. Operational risk requirements are set out in CPS 230, which applies to the following entities within the APRA-regulated sector:

• general insurers;
• life companies; and
• private health insurers.

CPS 230 commenced on 1 July 2025. The amended version, released by APRA on 30 April 2026, is in force from 1 July 2026. It addresses:

• operational risks;
• critical operations;
• business continuity; and
• service provider arrangements.

What Capital and Financial Requirements Apply to Australian Insurance Businesses?

ASIC Financial Resource Requirements Under RG 166

Under Section 912A(1)(d) of the Corporations Act, an Australian Financial Services (AFS) licensee must have adequate financial resources to provide the financial services covered by its licence and carry out its supervisory arrangements. ASIC’s Regulatory Guide 166: AFS licensing: Financial requirements (‘RG 166’) explains how these obligations apply according to the nature, scale and complexity of the financial services business.

The financial resource framework may include:

• Base requirements: solvency, net assets, cash needs and audit requirements.
• Additional requirements: surplus liquid funds or adjusted surplus liquid funds, where applicable.

AFS licensees must monitor compliance with each applicable requirement on an ongoing basis under RG 166.

Distinguishing Brokers and Intermediaries From APRA Regulated Insurers

RG 166 applies to AFS licensees, including insurance brokers and other intermediaries, subject to the exclusions in RG 166.2.

Bodies regulated by APRA that are not required to comply with Section 912A(1)(d) of the Corporations Act are excluded from ASIC’s financial requirements under RG 166.4–166.5. A related body corporate that is not itself APRA-regulated may still remain subject to the AFS licensee obligations under RG 166.6.

APRA Capital Adequacy Requirements Under GPS 110, LPS 110 and HPS 110

APRA-regulated insurers are subject to prudential capital requirements rather than the financial resource framework that applies to many AFS licensees under RG 166. The relevant capital adequacy standards identified for the insurance industry are:

• GPS 110 for general insurers;
• LPS 110 for life companies.; and
• HPS 110 for private health insurers, made under Section 92(1) of the Private Health Insurance (Prudential Supervision) Act 2015 (Cth).

These standards form part of the prudential compliance framework for regulated insurers. HPS 110, for example, requires private health insurers to maintain an Internal Capital Adequacy Assessment Process and meet minimum capital requirements.

When Do AML/CTF Obligations Apply to Australian Insurance Businesses?

Which Insurance Services Are Designated Services Under the AML/CTF Act?

Under Section 6(2), table 1, items 37–39 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (‘AML/CTF Act‘), designated insurance services include:

• issuing, or undertaking liability as an insurer under, a life insurance or sinking fund policy (item 37);
• accepting premiums as the insurer under either type of policy (item 38); and
• making payments under either type of policy as the insurer (item 39).

General insurance is not a designated service under these items. Item 54 separately covers an AFSL holder that arranges for a person to receive a designated service, as explained below.

A business providing a designated service with a geographical link to Australia is a reporting entity. Its AML/CTF compliance framework must apply before the business starts providing that designated service. The program must be:

• documented;
• approved by a senior manager; and
• followed in daily operations.

When Do Insurance Brokers and Intermediaries Have AML/CTF Obligations?

Holding an AFSL does not, by itself, make an insurance business a reporting entity. Under item 54 of table 1 to Section 6 of the AML/CTF Act, an AFSL holder that makes arrangements for a person to receive a designated service, such as a life insurance policy, provides a designated service itself. A broker arranging life insurance for a client may therefore be a reporting entity, while a broker arranging only general insurance generally is not.

Where all of a reporting entity’s designated services are covered by item 54, Section 26T of the AML/CTF Act applies modified program requirements. Its AML/CTF policies need only deal with initial customer due diligence and be appropriate to the money laundering, terrorism financing and proliferation financing (ML/TF/PF) risks it may reasonably face. Several requirements do not apply, including the governance and independent evaluation requirements in Section 26F(4) and the governing body oversight duties in Section 26H.

What Should an Australian Insurance AML/CTF Framework Include?

ML/TF/PF Risk Assessments and Customer Due Diligence

For a reporting entity, the reformed framework in force from 31 March 2026 requires an AML/CTF program that identifies, assesses and manages ML/TF/PF risks.

Key controls include:

• Customer due diligence: Identify customers, assess customer risk and maintain relevant information.
• Transaction monitoring: Monitor customer activity for unusual transactions or behaviour.
• Suspicious matter reporting: Report suspicious matters where the reporting obligations apply.

The risk assessment should reflect the nature, size and complexity of the insurance business. Its findings should shape the AML/CTF policies, procedures, systems and controls used for insurance compliance.

AML/CTF Governance and Compliance Responsibilities

Unless the modified item 54 requirements apply, the reporting entity’s AML/CTF policies must deal with governance responsibilities. The reporting entity must:

• identify a governing body;
• appoint an AML/CTF compliance officer to oversee day-to-day compliance; and
• obtain senior manager approval for the AML/CTF program.

The policies must also provide for due diligence and training for personnel who perform functions relevant to the business’s AML/CTF obligations. Under Section 26H(1), the governing body must exercise appropriate ongoing oversight of the business’s ML/TF/PF risk assessment and its compliance with its AML/CTF policies, the AML/CTF Act and the AML/CTF Rules.

Independent Evaluations and AML/CTF Program Reviews

Under Section 26F(4)(f) of the AML/CTF Act, independent evaluations must be conducted at a frequency appropriate to the nature, size and complexity of the insurance business, and at least once every three years. This requirement does not apply to reporting entities whose only designated services fall under item 54, because Section 26T disapplies Section 26F(4).

The Anti-Money Laundering and Counter-Terrorism Financing Transitional Rules 2026 set different deadlines for the first independent evaluation, depending on the entity’s enrolment status, prior review history and AUSTRAC account number.

Under Section 26D of the AML/CTF Act, reporting entities must review their ML/TF/PF risk assessment when specified changes occur and at least once every three years, and their AML/CTF policies must provide for reviews and updates in those circumstances. This includes reviewing:

• the ML/TF/PF risk assessment;
• AML/CTF policies;
• internal controls; and
• compliance procedures.

How Should Australian Insurance Businesses Maintain Their Compliance Frameworks?

Regular Risk Assessments and Compliance Reporting

Australian insurance businesses should:

• conduct regular risk assessments;
• monitor capital requirements applicable to the business;
• review internal controls; and
• maintain compliance reporting.

Under CPS 230, controls must be tested at a frequency suited to the risks being controlled, with results reported to senior management. Material weaknesses must be included in the operational risk profile until remediation is complete.

Reviewing Frameworks Following Business or Regulatory Changes

A compliance framework should be reviewed when an insurer changes its products, services, business structure, technology or service provider arrangements. Under CPS 230, an APRA-regulated entity must assess how new products, services, geographies and technologies affect its operational risk profile.

Conclusion

Australian insurance businesses need a compliance framework that reflects their activities, structure and regulatory status. Requirements administered by ASIC, APRA and AUSTRAC apply differently to insurers, brokers, intermediaries and reporting entities.

For insurance businesses reviewing these obligations, contact AFSL House for risk, capital and AML/CTF compliance support for insurance businesses. To identify applicable compliance requirements, strengthen governance and support effective compliance management, contact AFSL House’s lawyers for AFSL compliance and regulatory support.

Frequently Asked Questions

Disclaimer: All information provided in this article is strictly general in nature and is not intended to be, nor should it be relied upon as, legal advice.