Australian Prudential Regulatory Authority has just released their new supervisory strategy. APRA published its 2026-27 Corporate Plan this morning, covering the four years to 2029-30. It is built around three strategic objectives — maintaining financial safety and stability, getting the balance right, and improving organisational effectiveness — and is unusually specific about what it intends to do, when, and at what cost to industry. Ten things a supervisor elsewhere should note.
1. The framing: not “safety at all costs.” APRA opens by stating that it does not pursue a safety-at-all-costs agenda, and that its prudential framework is by design aimed at minimising undue costs of regulation. This is not a concession appended after the prudential priorities were set — regulatory balance is one of the three strategic objectives, with its own performance measures.
2. A net-neutral burden commitment. Under “Getting the balance right,” APRA states that its simplification measures are intended to offset the impact of new requirements, so that in aggregate the planned policy changes have a broadly net-neutral impact on regulatory burden. Very few supervisors have committed to an aggregate burden position rather than to individual simplification initiatives.
3. Proportionality expressed as a testable metric. The performance framework targets Tier 1 entities being subject, on average, to significantly more formal supervisory engagements than Tier 4 entities, and expects non-SFIs to face simpler requirements or transitional support where appropriate. Proportionality becomes something that can be evidenced — or missed — rather than asserted.
4. Duplication attacked at source. For all new and substantially revised data collections, APRA’s stated target is consultation with peer agencies on data sharing. It is also sequencing work with ASIC on small business lending, running a joint stress test with the Reserve Bank of New Zealand, and formalising its material service provider data collection partly to reduce the burden of CPS 230 compliance.
5. Burden reduction with numbers attached. Capital rule harmonisation with New Zealand is expected to cut around $175 million a year for banks operating in both jurisdictions; the APRA Connect transition is estimated at roughly $6 million a year in long-term industry savings; and licensing reforms should roughly halve the time to process new bank licence applications. Dollars and days are auditable in a way that “reducing red tape” is not.
6. Cyber, AI and quantum move to the centre. Following CPS 230’s commencement in July 2025 and an April 2026 letter setting out expectations for prudent AI risk management, entities should expect more frequent and deeper supervisory engagement on cyber and AI. APRA is also picking up the Australian Signals Directorate’s recommendation that organisations plan the transition to post-quantum cryptography by end-2026 and begin implementing by end-2028.
7. Geopolitical risk becomes a supervised risk. Having issued minimum prudential expectations in June 2026, APRA will require certain larger entities to conduct targeted readiness assessments — crisis preparedness in the first half of the year, political and personnel risk in the second. Boards of systemically important institutions committed to action plans in late 2025, and progress against those plans will be evaluated.
8. Stress testing moves to the system level. Building on its first system risk stress test in 2025-26, which explored interconnectedness between banks and superannuation trustees, APRA will launch a new system stress test in 2026-27. At entity level, the joint exercise with the RBNZ tests a severe downturn at both parent and subsidiary level, with thematic findings to be published.
9. Superannuation platforms are the enforcement frontier. The collapse of Shield and First Guardian Master Funds is named explicitly as evidence of harm from poor investment governance. Selected large trustees will be required to appoint independent parties to review valuation governance for unlisted assets; a platform reform package is planned; and trustees offering platforms should expect intensive oversight and further enforcement action where obligations are not met.
10. A new payments mandate and an AI-enabled supervisor. Government is proposing to give APRA prudential responsibility for large stored-value facility providers, including issuers of Australian dollar stablecoins, requiring a new framework and new capabilities. Internally, APRA is targeting becoming an AI-enabled regulator, developing supervisory dashboards and advanced analytics, and reviewing its Supervision and Risk Intensity model — all on a budget of $278 million, one per cent below the previous year.
The supervisory takeaway. The plan’s most transferable idea is not any single initiative but the pairing: APRA proposes deeper engagement on cyber, AI, geopolitical risk, lending standards and liquidity, and commits to offsetting new requirements with simplification. The implicit logic is that low-value supervisory friction consumes capacity that material risks require. The objective is not less supervision — it is less unnecessary supervision.
Source: Australian Prudential Regulation Authority, Corporate Plan 2026-27, August 2026.
Leave a Reply