Australian Prudential Regulation Authority outlines faster bank licensing and new proportionality tiers for smaller banks while maintaining cyber standards

In opening remarks to FINSIA’s The Regulators, Australian Prudential Regulation Authority Executive Board Member Therese McCarthy Hockey set out how APRA’s latest Corporate Plan seeks to balance its prudential mandate with productivity and proportionality, including further steps to reduce regulatory burden where it is safe to do so. The remarks highlighted recent burden-reduction measures, including cutting policy consultations by more than half in 2024, ceasing multiple data collections, streamlining reporting requirements and modernising the prudential architecture. On cyber security, McCarthy Hockey pointed to the binding requirements in Prudential Standard CPS 234 Information Security (in place since 2019 for banks, insurers and super trustees) and argued that lowering cyber expectations for smaller banks would create unacceptable prudential risks, with APRA stepping up its cyber focus in the Corporate Plan. As part of commitments linked to the Council of Financial Regulators review of small and medium-sized banks (undertaken with the Australian Competition and Consumer Commission), APRA plans to simplify the bank licensing regime with an aim of halving licensing timeframes, provide greater clarity on supervisory expectations for capital requirements tied to specific risks and what banks can do to lower them, and introduce a third proportionality tier for banks, with a potential fourth tier for the very smallest banks contingent on APRA being granted stronger resolution powers for that cohort.