Civil Law

The Australian Prudential Regulation Authority (APRA) has released its 2025-26 Corporate Plan, which details APRA’s objectives and activities for the period 2025 to 2029. The Plan outlines APRA’s role in protecting the financial interests of Australians by promoting the safety and stability of the financial system.

A few of APRA’s top strategic priorities in the plan have been extracted by way of summary:

1. Strengthening cyber resilience across APRA’s regulated industries given the recent escalation of attacks. In 2025–26, APRA will prioritise targeted supervisory engagements to assess entities’ progress in uplifting cyber resilience. These engagements will focus on evaluating specific cyber control areas and identifying potential single points of failure within entity systems, processes and dependencies. Initial efforts will concentrate on superannuation trustees, insurers and smaller banks. In the superannuation sector, a key focus will be assessing funds’ responses to APRA’s concerns outlined in its June 2025 letter on Information Security Obligations and Critical Authentication Controls.

2. Assessing the degree to which regulated entities are complying with APRA’s new prudential standard CPS 230. On 1 July 2025, Prudential Standard CPS 230 Operational Resilience (CPS 230) came into effect, introducing enhanced requirements for operational risk management across all regulated entities. Given the growing reliance on third parties, rapid technological advancements and geopolitical uncertainty, effective implementation of CPS 230 is critical to maintaining financial safety and stability. Over 2025-26, APRA will engage with entities to ensure they are meeting their new obligations. APRA’s supervision program will initially focus on the largest entities (significant financial institutions), including through targeted prudential reviews of some entities.

3. Updating APRA’s prudential standards for governance. In the second half of 2025-26, APRA plans to consult on draft standards and guidance to update core governance requirements. These changes aim to address persistent poor practices and establish clear expectations for all regulated entities – almost 80 per cent of entities currently under heightened supervision by APRA exhibit underlying governance issues. To inform these revisions, APRA is continuing to engage extensively with stakeholders to gather diverse perspectives.

4. Publishing the results of APRA’s inaugural System Stress Test. In the second half of 2025-26, APRA will publish the results of its inaugural system stress test, designed to evaluate risks to financial stability arising from interconnectedness in the financial system. The test scenario assesses the impact and potential feedback loops between the banking and superannuation sectors from a significant financial market disruption alongside a major operational risk event. APRA will collaborate with industry and regulatory peers to address any vulnerabilities identified through this exercise.

5. Intensifying scrutiny of superannuation fund expenditure. Fund-level expenditure will remain a key focus to ensure superannuation trustees act in the best financial interests of their members. Over the next 12 months, APRA will undertake targeted assessments of expenditure data, and where deficiencies are identified, trustees will be required to make improvements.

6. Reviewing the investment governance and member outcomes of major platform providers. APRA is currently undertaking a review to assess the quality and soundness of trustees’ governance and oversight of investments offered via platforms. The review focuses on key areas including due diligence, onboarding, monitoring, and removal of investment options, as well as strategic planning and practices to promote member outcomes. APRA will assess current practices against relevant prudential standards. APRA’s findings will be shared with the superannuation industry, highlighting areas where enhancements are expected.

7. Releasing the results of APRA’s Climate Vulnerability Assessment for the general insurance sector. In the second half of 2025-26, APRA plans to release the results of its Climate Vulnerability Assessment for the general insurance sector. This assessment has involved Australia’s five largest general insurers and has included detailed analysis of granular, modelled premium data. The findings will provide governments, insurers, policyholders, and the broader community with a clearer understanding of how general insurance affordability may evolve over the medium term in response to the physical and transition risks associated with climate change.

A few other key takeaways from the Plan are that APRA:

• is carefully monitoring potential cyclical risk in the banking system as inflation and interest rates decline, which can give rise to faster rises in house prices, borrowers taking on more leverage, and lenders relaxing their lending standards;
• continues to position itself as a forward-looking regulator, primarily focused on preventing harm before it occurs;
• aims to “get the balance right” to ensure its regulation is efficient and proportionate and is working on nine initiatives to minimise regulatory burden and support productivity, but not at the cost of its safety and stability objectives; and
• is focused on new risks emerging in the system – including potential risks from geopolitical tensions, cyber-attacks, interconnections, an ageing population, and climate change.

LexBlog