Introduction

Australian banking businesses must maintain customer-facing disclosure documents, prudential governance and risk records, accountability materials, and financial crime compliance documents. The required set depends on the products offered, the institution’s size and classification, and whether it operates as a locally incorporated authorised deposit-taking institution (‘ADI’), digital bank, mutual bank or foreign ADI branch.

Keeping those documents complete and consistent matters for compliance, board oversight and regulatory engagement. This guide sets out the documents a bank or banking business may need, explains which requirements apply to different products and business models, and identifies the review and ownership practices used to keep the document set current.

What Disclosure & Governance Documents Does an Australian Banking Business Need?

Customer-Facing Disclosure Documents

A banking business may need customer-facing documents covering financial services, financial products, consumer credit, complaints and privacy. The Australian Securities and Investments Commission (‘ASIC’) regulates the financial services and consumer credit frameworks, while privacy obligations are principally administered by the Office of the Australian Information Commissioner.

The document set may include:

• Financial Services Guides (‘FSGs’)
• Product Disclosure Statements (‘PDSs’), where required
• Product terms and conditions
• Fee schedules and interest rate information
• Target Market Determinations (‘TMDs’)
• Credit guides, credit contracts and pre-contractual disclosures
• Key facts sheets for applicable home loans and credit cards
• Complaints and external dispute resolution information
• Privacy policies and collection notices

The applicable documents depend on the products offered, the services provided and any available statutory relief.

Board Governance & Risk Documents

ADIs regulated by the Australian Prudential Regulation Authority (‘APRA’) maintain governance and risk documentation under applicable prudential standards made pursuant to Section 11AF of the Banking Act 1959 (Cth) (‘Banking Act‘). These documents show how the board and management oversee the institution’s financial and non-financial risks.

The document suite may include:

• Board and committee charters, renewal policies and performance assessment records under CPS 510 Governance (‘CPS 510’)
• A board-approved Fit and Proper Policy and assessment records under CPS 520 Fit and Proper (‘CPS 520’)
• A remuneration framework and policy under CPS 511 Remuneration (‘CPS 511’)
• A risk appetite statement, risk management strategy and business plan under CPS 220 Risk Management (‘CPS 220’)
• An Internal Capital Adequacy Assessment Process (‘ICAAP’) under APS 110 Capital Adequacy (‘APS 110’)
• Liquidity risk, funding and contingency funding documents under APS 210 Liquidity (‘APS 210’)
• Operational risk, business continuity and service provider documents under CPS 230 Operational Risk Management (‘CPS 230’)
• Information security policies, testing records and incident response plans under CPS 234 Information Security (‘CPS 234’)
• A recovery and exit plan under CPS 190 Recovery and Exit Planning (‘CPS 190’)

Approval, implementation and review requirements differ between documents and between ADIs, including significant financial institutions (‘SFIs’), non-SFIs and foreign ADI branches.

Accountability, Public Disclosure & Financial Crime Documents

A banking business may also need records supporting accountability, public reporting and financial crime compliance. Some requirements apply only to larger institutions or entities meeting specific classification tests.

Relevant documents may include:

• Accountable person registration and accountability allocation records under the Financial Accountability Regime (‘FAR’)
• Accountability statements and accountability maps for enhanced accountable entities
• A board-approved prudential disclosure policy, disclosure templates under APS 330 Public Disclosure (‘APS 330’), verification records and attestations for applicable locally incorporated SFI ADIs
• Money laundering, terrorism financing and proliferation financing risk assessments and anti-money laundering and counter-terrorism financing (‘AML/CTF’) policies under Sections 26C–26F of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (‘AML/CTF Act‘)
• Customer due diligence procedures, transaction monitoring controls and supporting records
• Sanctions screening procedures, escalation protocols and reporting records

The FAR, APS 330 and the AML/CTF Act use different application tests, so meeting one set of requirements does not establish compliance with the others.

Which Disclosure Documents Do Your ADI & Banking Products Need?

Do Deposit Accounts Need a Product Disclosure Statement?

Not every deposit account requires a PDS for retail customers. Under Sections 1012A–1012C of the Corporations Act 2001 (Cth) (‘Corporations Act‘), a PDS may be required when a regulated person recommends, issues or sells a financial product to a retail client.

Regulation 7.9.07FA of the Corporations Regulations 2001 (Cth) (‘Corporations Regulations‘) modifies Section 1012D by inserting Section 1012D(7A). This provides conditional PDS relief for specified products, including basic deposit products. A basic deposit product is defined in Section 761A of the Corporations Act, with the definition referring to requirements in Section 6BA of the Banking Act concerning repayment and returns.

The relief is conditional. Regulation 7.9.07FA of the Corporations Regulations requires information about product costs and whether amounts may become payable after acquisition, alongside the other conditions in the modified provision.

However, a savings account, transaction account or term deposit does not qualify automatically. A term deposit that requires up to 31 days’ notice for early withdrawal can still be treated as a basic deposit product under ASIC Corporations (31-day Notice Term Deposits) Instrument 2025/172 (Cth), but only if the bank meets that instrument’s conditions, including its offer information and rollover notice requirements. If the product does not meet the statutory definition and exemption conditions, the ordinary Part 7.9 requirements of the Corporations Act must be assessed.

FSG obligations must be assessed separately. Under Sections 941A and 941B of the Corporations Act, an Australian financial services licensee or authorised representative will generally need to provide an FSG when providing a financial service to a retail client, subject to applicable exceptions or modified requirements.

What Customers Receive When No PDS Is Required

A bank relying on basic deposit product PDS relief still needs clear contractual and customer information. The documents commonly provided include:

• Account terms and conditions covering access to funds, interest, fees, restrictions and termination.
• Fee schedules identifying account fees, transaction charges and other costs.
• Interest rate information, including variable-rate arrangements.
• Payment facility information, transaction limits and account access details.
• Complaints and dispute resolution information.

Customer communications must remain accurate and consistent. The Australian Securities and Investments Commission Act 2001 (Cth) (‘ASIC Act‘), including Sections 12DA and 12DB, prohibits misleading or deceptive conduct and specified false or misleading representations in relation to financial services. Section 12BF and related provisions of the ASIC Act establish an unfair contract terms regime for applicable consumer and small business financial product and services contracts.

In addition, subscribing institutions must check their documents against the applicable industry code. The relevant codes are:

• The Australian Banking Association’s Banking Code of Practice, which applies to subscribing banks; and
• The Customer Owned Banking Code of Practice, which applies to subscribing customer-owned banking institutions.

These codes address matters such as customer information, transparency, accessibility and complaint handling.

Payment Facilities & Cards

Debit cards and other payment arrangements may be non-cash payment facilities under Section 763D of the Corporations Act. Regulation 7.9.07FA of the Corporations Regulations provides conditional PDS relief for a non-cash payment facility related to a basic deposit product.

The relief must be assessed for the particular facility. A debit card attached to an eligible basic deposit account may qualify, while a standalone stored-value or payment facility may require separate analysis.

A banking business should maintain documents covering:

• Payment authorisation, transaction processing and liability.
• Fees, transaction limits, cash withdrawals and foreign exchange charges.
• Reporting unauthorised transactions, lost cards and mistaken internet payments.
• Complaint handling and investigation arrangements.

In addition, the ePayments Code is administered by ASIC and applies to subscribing entities. It contains requirements concerning electronic payment terms and conditions, transaction information, unauthorised transactions and mistaken internet payments. The ePayments Code is not universally mandatory for every payment provider, but subscribing banks should align their documents and procedures with their commitments.

Home Loans, Credit Cards & Personal Lending

Consumer lending products are usually regulated under the National Consumer Credit Protection Act 2009 (Cth) (‘NCCP Act‘) and Schedule 1 to that Act (‘National Credit Code‘), rather than the PDS regime for many financial products. The documents required depend on the credit product, the entity’s role and any applicable exemption.

Key documents may include:

• A credit guide under Section 126 of the NCCP Act where the bank is the credit provider, or under Section 113 where it provides credit assistance.
• A pre-contractual statement under Section 16 of the National Credit Code.
• A credit contract containing prescribed information under Sections 14–17 of the National Credit Code.
• A home loan key facts sheet where Section 133AC of the NCCP Act and applicable regulations apply.
• A credit card key facts sheet under Section 133BC of the NCCP Act and relevant regulations.
• Mortgage documentation for applicable secured lending arrangements.

A bank should first determine whether the arrangement is regulated consumer credit under Sections 5 and 6 of the National Credit Code and whether an exemption applies. Commercial lending is not automatically subject to the National Credit Code merely because the lender is a bank.

Why Target Market Determinations Apply Even Without a PDS

PDS relief does not necessarily remove the need for a TMD. Part 7.8A of the Corporations Act, including Sections 994B–994F, establishes design and distribution obligations. Regulation 7.8A.05 of the Corporations Regulations extends the regime to prescribed financial products, including specified basic banking products.

For covered products, a TMD must generally identify:

• The retail consumers comprising the target market.
• Conditions and restrictions on distribution.
• Events or circumstances that trigger review.
• The maximum period between periodic reviews.
• Information distributors must report to the issuer.

Section 994B of the Corporations Act sets out the principal TMD requirements, while Section 994C addresses review obligations. Section 994E requires regulated persons engaging in relevant retail product distribution conduct to take reasonable steps directed at consistency with the TMD, subject to the statutory framework and exceptions.

A bank should maintain distribution and review records under Sections 994F and 994G of the Corporations Act and applicable regulations. A change to product eligibility criteria or fees may require the bank to reassess whether the existing TMD remains appropriate.

Which Governance & Risk Documents Does APRA Expect Australian Banks to Hold?

Board & Governance Policies Under CPS 510, CPS 520 & CPS 511

An ADI’s board governance documents should record how committees operate, how board renewal is managed and how performance is assessed. Under CPS 510, these documents include:

• the Board Audit Committee charter;
• the Board Risk Committee charter;
• the board renewal policy;
• performance assessment procedures; and
• relevant board and committee minutes.

The board renewal policy and director performance assessment procedures must be maintained for locally incorporated ADIs, with performance assessed at least annually.

CPS 520 requires a board-approved Fit and Proper Policy. It must explain:

• assessment responsibilities;
• information considered;
• decision-making steps;
• responses to unsuitable appointments; and
• the timing of initial and later assessments.

CPS 511 requires a documented remuneration policy within the remuneration framework, with annual compliance review and a comprehensive operationally independent effectiveness review at least every three years.

Risk Appetite Statement, Risk Management Strategy & Business Plan Under CPS 220

Under CPS 220:

• The board-approved risk appetite statement must identify the risks the bank is prepared to accept and set suitable tolerances and limits.
• The risk management strategy must explain how material risks are managed, including the responsibilities of the risk function, board committees and senior management.
• The written business plan must cover the whole institution, extend across a rolling period of at least three years, receive board approval and be reviewed at least annually.

These documents must be consistent. A business plan proposing rapid growth in higher-risk lending should correspond with the risk appetite statement’s limits and with the risk management strategy’s monitoring and escalation processes.

CPS 220 also requires:

• an annual audit review of the risk management framework;
• a comprehensive independent review at least every three years; and
• an annual risk management declaration to APRA signed by the board chair and Board Risk Committee chair.

Capital & Liquidity Documents Under APS 110 & APS 210

Under APS 110, an ADI must maintain a documented ICAAP, approved by the board initially and when significant changes are made. The ICAAP should connect:

• capital requirements;
• material risks;
• internal targets and buffers;
• stress-testing assumptions;
• strategic objectives; and
• management actions.

An annual ICAAP report must be provided to APRA no later than three months after the end of the period covered, and the ICAAP must undergo an independent review at least every three years.

APS 210 requires documented liquidity arrangements covering:

• the liquidity risk tolerance statement;
• the liquidity management strategy and policy;
• the funding strategy;
• the contingency funding plan; and
• monitoring records.

The board must approve the liquidity risk tolerance, liquidity management strategy and policy, and funding strategy. These documents must be reviewed at least annually, with the funding strategy and contingency funding plan also receiving the specified annual board review and approval.

Operational Resilience & Information Security Documents Under CPS 230 & CPS 234

CPS 230 requires:

• an operational risk management framework;
• a business continuity plan;
• a service provider management policy;
• a material service provider register;
• relevant agreements; and
• testing records.

The board must approve the business continuity plan, disruption tolerance levels for critical operations and service provider management policy. The business continuity plan must be tested through an annual exercise and updated annually as needed. The material service provider register must be submitted to APRA annually and kept consistent with actual arrangements.

CPS 234 requires an information security policy framework covering policies, standards, procedures, controls, information assets and responsibilities. It also requires information security response plans for plausible incidents. Those plans must be reviewed and tested annually, while the sufficiency of the information security testing program must be reviewed at least annually or after material changes to information assets or the business environment.

Recovery & Exit Plans Under CPS 190

CPS 190 requires an applicable ADI to maintain a board-approved recovery and exit plan suited to its size, business mix and complexity. The plan should identify:

• threats to financial viability;
• warning indicators;
• recovery actions;
• possible exit actions;
• governance arrangements;
• required capabilities; and
• communication arrangements.

An SFI must review and update its plan at least annually unless APRA determines otherwise. A non-SFI must do so at least every three years.

An earlier review is required after a significant change to the ADI’s legal or organisational structure, business mix, strategy or risk profile. After each review, the plan must be provided to APRA within three months after board approval.

What Extra Documents Apply Based on Your ADI Size & Business Model?

Do All Banks Need FAR Accountability Statements & Maps?

All ADIs covered by the Financial Accountability Regime Act 2023 (Cth) (‘FAR Act‘) must register accountable persons, record accountability arrangements and meet applicable notification obligations. Under Section 31 of the FAR Act, relevant notifications are usually required within 30 days, subject to the requirements and exceptions applying to the particular event.

Formal accountability statements and accountability maps apply to enhanced accountable entities, not every core accountable entity. In particular:

• Under Section 33 of the FAR Act, an accountability statement describes an accountable person’s areas of management or control.
• Under Section 34 of the FAR Act, an accountability map records how accountability is allocated across the entity and its accountable persons.

The Financial Accountability Regime (Minister) Rules 2024 (Cth) (‘FAR Minister Rules‘) set the enhanced notification threshold for ADIs at $20 billion in total assets, subject to relevant group arrangements. Enhanced entities must provide their accountability statements and accountability maps to the regulators in accordance with Section 31 of the FAR Act.

Who Must Publish Prudential Disclosures Under APS 330?

The version of APS 330 in force during 2026 applies to locally incorporated ADIs classified as SFIs. Foreign ADIs, non-SFIs and purchased payment facility providers are excluded unless APRA applies the requirements to a particular institution.

An SFI subject to APS 330 must maintain:

• A board-approved prudential disclosure policy.
• Controls and procedures for preparing, verifying and reviewing disclosures.
• Required disclosure templates and supporting data.
• Written attestations from an accountable person.
• Publication and archiving records.

The replacement APS 330 commences on 1 January 2027. It continues to focus on locally incorporated SFI ADIs and retains requirements for a board-approved disclosure policy, internal controls, verification and attestation. An affected bank should review its disclosure process and update it before the revised standard commences.

Credit Unions & Mutual Banks

Credit unions and mutual banks authorised as ADIs remain subject to applicable prudential standards and financial services legislation. Their customer-owned structure does not create a general exemption from APRA’s governance and risk requirements.

Proportionality may affect the size and complexity of the documents required. A smaller mutual bank classified as a non-SFI and core accountable entity may not usually need:

• FAR accountability statements and accountability maps.
• APS 330 requirements.
• SFI-specific remuneration requirements under CPS 511.

CPS 190 permits a non-SFI to review its recovery and exit plan at least every three years, unless APRA determines otherwise or an earlier review is triggered. A subscribing institution should also reflect the Customer Owned Banking Code of Practice in relevant customer communications, service arrangements and complaint procedures.

New Entrants & Digital Banks

A new banking entrant should have the documents required for its proposed activities operating at the point of licensing, rather than existing only as drafts. The document suite may include:

• a business plan.
• governance policies.
• risk appetite statement.
• risk management strategy.
• capital and liquidity frameworks.
• operational risk documents.
• information security plans.
• service provider arrangements.
• recovery and exit planning.
• AML/CTF documents.
• customer disclosures.

The level of implementation depends on the proposed business and any licence conditions or restrictions. APRA’s assessment may consider whether the bank has the personnel, systems, testing and operational arrangements needed to support its policies. This is especially relevant to digital banks that rely on external providers for core banking technology, cloud services, payment processing or customer onboarding.

Foreign ADI Branches & Significant Financial Institutions

A foreign ADI branch is not subject to exactly the same prudential requirements as a locally incorporated ADI. In particular:

• APS 110 generally excludes foreign ADIs;
• CPS 510 modifies some governance requirements; and
• APS 330 generally excludes foreign ADIs unless APRA determines otherwise.

Each standard’s application provisions must be checked separately, including whether overseas group documents satisfy Australian requirements.

An ADI is generally classified as an SFI when its total assets exceed $30 billion or APRA determines that the classification applies. APRA raised this threshold from $20 billion on 1 July 2026 and generally allows 12 months to transition when an ADI moves into a higher tier. SFI status can affect:

• APS 330;
• remuneration requirements under CPS 511; and
• review periods for recovery and exit plans under CPS 190.

SFI status and enhanced status under the FAR Act are separate classifications and must be assessed under their own rules.

How Should Australian Banks Keep Their Documents Complete & Current?

Document Ownership, Board Approval & Recordkeeping

A banking business should maintain a master document register covering customer disclosures, prudential policies, accountability records and financial crime documents, with financial services compliance and regulatory documentation lawyers available to provide guidance. The register should record each document’s title, regulatory basis, applicable products or entities, owner, approval authority, latest approval date, review cycle, next review date and status.

Each document should have a clearly assigned owner responsible for keeping it accurate. The bank should also retain evidence of required approvals and implementation, such as board minutes, committee records, signed policies, review reports, testing results, management attestations and records submitted to regulators.

The register should distinguish mandatory approval requirements from internal governance preferences. For example, CPS 220 requires board approval of the risk appetite statement and business plan, while CPS 230 requires board approval of the business continuity plan and service provider management policy.

Minimum Review Cycles

A bank should not apply one annual review rule to every document. The required timing differs between prudential standards, product governance requirements and financial crime obligations.

Key minimum cycles include:

• CPS 510: board and individual director performance assessments at least annually.
• CPS 511: annual compliance review and a comprehensive independent effectiveness review at least every three years.
• CPS 220: annual audit review of the risk management framework and a comprehensive independent review at least every three years.
• APS 110: independent ICAAP review at least every three years and an annual ICAAP report.
• APS 210: annual review of the liquidity framework, funding strategy and contingency funding plan.
• CPS 230: an annual business continuity exercise and annual updates to the business continuity plan as needed.
• CPS 234: annual review and testing of information security response plans.
• CPS 190: annual review for SFIs and at least every three years for non-SFIs, unless an earlier review is required.

TMDs and AML/CTF policies have separate review requirements under the Corporations Act and the AML/CTF Act.

Events That Should Trigger a Review

Scheduled dates are only one part of document maintenance. A bank should also review affected documents when its products, structure, services or regulatory classification changes.

Review triggers may include:

• Launching or materially changing a deposit, payment or credit product.
• Changing fees, interest arrangements, eligibility criteria or contractual terms.
• Crossing the $30 billion SFI threshold or the $20 billion FAR enhanced notification threshold, including through relevant group arrangements.
• Engaging or materially changing a material service provider.
• Changing board composition, senior management responsibilities, reporting lines or legal entity structures.
• Regulatory amendments, such as the replacement APS 330 commencing on 1 January 2027.

A product change may affect terms and conditions, a TMD, customer disclosures, liquidity assumptions, operational risk documents and financial crime controls. A management restructure may require updates to fit and proper records, FAR accountability documents and board committee materials.

Common Documentation Gaps

Documentation gaps often arise where related documents are reviewed separately. Common examples include:

• Product terms and conditions changing while the relevant TMD continues to describe the former eligibility criteria or fees.
• A business plan forecasting growth that exceeds the limits in the risk appetite statement or is not reflected in the Risk Management Strategy and ICAAP.
• A CPS 230 material service provider register that omits a new technology, cloud or payment provider.
• An enhanced ADI changing management responsibilities without updating its accountability statements or accountability map under Sections 33 and 34 of the FAR Act.
• A board-approved policy that has not been tested, implemented or supported by operational records.

A gap assessment should separate missing documents, inadequate documents, overdue reviews and approved policies that are not operating as recorded. Each category may require a different remediation response.

Conclusion

Australian banks, credit unions and mutual banks may need customer disclosure, prudential governance, accountability and financial crime documents. The documents that apply depend on the products offered, the institution’s size and classification, its business model, and whether the records remain consistent with its operations as those factors change.

With these requirements in mind, contact AFSL House through its banking services to request assistance with drafting, reviewing and gap-checking your documents. You can speak with our banking compliance and regulatory lawyers at AFSL House to assess your bank’s obligations and keep its records accurate, approved and supported by evidence of implementation.

Frequently Asked Questions

Disclaimer: All information provided in this article is strictly general in nature and is not intended to be, nor should it be relied upon as, legal advice.