APRA's 2025-26 Corporate Plan: Key implications for financial services

The Australian Prudential Regulation Authority’s 2025-26 Corporate Plan marks the first substantive recalibration of the prudential framework since the post-Royal Commission reform cycle. After a decade of intensive rule-making, APRA now pivots from policy construction to optimisation: focusing on maintaining resilience while explicitly considering productivity and competition. For financial services executives, the plan contains several developments that warrant immediate attention.

Regulatory recalibration: from “build” to “balance”

APRA has significantly reduced policy consultations and committed to various initiatives to minimise regulatory burden. John Lonsdale's foreword explicitly states APRA doesn't pursue "safety at all costs", acknowledging that effective prudential regulation must balance stability with efficiency and productivity.

This represents regulatory maturation rather than retreat. Having spent a decade building comprehensive frameworks post-GFC and Royal Commission, APRA is shifting from construction to calibration. The focus now is on making existing frameworks work more efficiently while maintaining the resilience gains achieved, effectively incorporating productivity, competition and efficiency into supervisory and policy decisions.

The plan maintains equal emphasis on both financial and operational resilience. CPS 230, which came into effect on 1 July 2025, elevates operational risk management to sit alongside traditional financial metrics. With APRA noting 80% of entities under heightened supervision exhibiting underlying governance issues, it sees operational resilience as fundamental to system stability. Noting the growing reliance on third parties, rapid technological advancements and geopolitical uncertainty, APRA flagged the possibility of using targeted prudential reviews to monitor the implementation of CPS 230.

Three-tier proportionality framework

One of the more notable announcements in APRA's strategy is the confirmation of consultation on a potential third prudential tier, supplementing the current Significant Financial Institution (SFI) / non-SFI split. This mirrors successful international models – the ECB's proportionality framework for smaller European banks and the Bank of England's "strong and simple" approach for challenger banks have both aimed to reduce regulatory burden, supporting new competitor entrants, while maintaining prudential objectives.

For Australian institutions, this means smaller banks can expect simplified capital requirements, streamlined reporting, and extended implementation timeframes. While initially focused on banking, APRA indicates the framework will extend to insurance and superannuation sectors. This, when combined with the proposed simplified bank license regime, should increase the flow of new entrants into the market.

Geopolitical and emerging risks

A formal geopolitical risk workplan appears formally on APRA's agenda for the first time, developed in coordination with the Council of Financial Regulators (CFR). Initially focusing on banks throughout 2025-26 before extending to other sectors, APRA expects institutions to assess vulnerabilities across multiple dimensions: technology supply chains, cross-border data flows, sanctions exposure, and potential cascade effects through interconnected financial systems.

Recent global events have demonstrated how quickly geopolitical tensions can disrupt financial markets. APRA will conduct targeted engagements and expects participation in CFR crisis simulation exercises. Boards should be asking concrete questions: What happens if key technology providers are sanctioned? How would restrictions on cross-border data flows affect operations? What's our exposure to counterparties in geopolitically sensitive regions?

Cyber, technology and third party risk

APRA's cyber resilience agenda spans all regulated sectors, with targeted supervisory engagements throughout 2025-26 focusing on specific control areas and identifying single points of failure within systems, processes and dependencies. Initial efforts concentrate on superannuation trustees, insurers and smaller banks. For superannuation, the 31 August 2025 deadline for CPS 234 authentication control self-assessments follows APRA's June 2025 letter expressing concerns about funds' information security obligations, particularly around multi-factor authentication for high-risk member activities.

The material service provider registers due 1 October 2025 serve a dual purpose: mapping individual entity dependencies while building APRA's system-wide view of concentration risks. Where multiple institutions rely on the same providers, a single compromise could cascade across the financial system.

APRA's collaboration with the CFR Cyber and Operational Resilience Working Group on simulation exercises and incident response protocols acknowledges that cyber threats don't respect institutional boundaries. With the risk environment potentially worsening amid geopolitical tensions, APRA is also assessing how entities are managing emerging risks from AI adoption, conducting targeted reviews with larger institutions to ensure governance and risk management keep pace with technological innovation.

Banking: refining resilience, liquidity, and competitive dynamics

APRA’s financial resilience agenda is centred on targeted refinements rather than wholesale change. The removal of Additional Tier 1 capital instruments from the prudential framework, effective 1 January 2027, reflects concerns about their effectiveness in absorbing losses during periods of stress. Banks are required to finalise transition strategies by mid-2026, with corresponding updates to reporting standards ARS 110.0, ARS 221.0, and ARS 222.0 to be completed in the first half of 2025-26.

A review of the bank liquidity framework will commence in the second half of 2025-26, aiming to modernise requirements in light of evolving risks and recent international bank failures, and to incorporate findings from the Council of Financial Regulators’ review of small and medium-sized banks.

Proposed simplification of the licensing regime, together with proportionality reforms, is intended to make it easier for new entrants to access the banking sector. Existing banks should consider the implications of a more competitive landscape, where new entrants face lower barriers and smaller institutions benefit from a reduced regulatory burden.

Superannuation: strengthening recovery, retirement outcomes, and expenditure oversight

Superannuation funds face a series of immediate regulatory requirements. Recovery and exit plans must be formally submitted to APRA for the first time in 2025-26. Unlike banks and insurers who've already been through this process, super funds will be navigating these requirements for the first time. APRA will review these plans and provide feedback, having identified several areas for improvement in previous reviews of banking and insurance sector plans.

The Government has also tasked APRA and ASIC with undertaking another Pulse Check report by the end of 2025, evaluating industry progress in implementing retirement income strategies. Previous reviews identified significant variability in how the covenant was adopted, with some entities demonstrating a lack of urgency in embracing its intent. APRA is also working with Treasury to develop a new retirement reporting framework, which will enable more robust monitoring of outcomes delivered to members in retirement. With almost five million superannuation accounts currently above preservation age and another 3.9 million expected to reach that milestone over the next decade, the industry’s shift from accumulation to decumulation represents a fundamental change in sector dynamics.

APRA’s oversight of fund-level expenditure continues to intensify. Throughout 2025-26, APRA will conduct targeted assessments of expenditure data, requiring trustees to address any identified deficiencies. The regulator is also undertaking a targeted review of platform products, assessing the governance and oversight of investments offered via platforms against relevant prudential standards to ensure member interests are protected.

Insurance: navigating affordability, reinsurance, and sector-specific challenges

The Climate Vulnerability Assessment for general insurance, scheduled for the second half of 2025-26, will provide a detailed analysis of premium affordability trends. Drawing on granular, modelled data from Australia’s five largest general insurers, the assessment will evaluate how physical and transition risks associated with climate change may impact insurance affordability over the medium term. These findings are expected to offer governments, insurers, policyholders, and the broader community valuable insights into the evolving affordability landscape.

In parallel, APRA’s reinsurance consultation in the first half of 2025-26 seeks to address rising global reinsurance costs while ensuring continued access to affordable and appropriate coverage. This initiative underscores APRA’s focus on balancing cost pressures with the need to maintain adequate risk retention across the sector.

For life insurers, APRA plans to finalise capital requirement reductions for annuity products in the first half of 2025-26. These changes aim to moderately lower costs and stimulate market growth, particularly as the sector grapples with challenges such as lapse rates outpacing new business and a rise in mental health-related claims.

The private health insurance sector continues to face pressures from an aging population, a relatively small base of younger members, and escalating health claims costs. APRA has previously outlined its ongoing supervisory focus for private health insurers remains on strengthening governance and operational risk management, as well as monitoring the sector’s risk profile and profitability. Insurers are expected to adapt their business models and risk frameworks to address these structural challenges and ensure long-term sustainability.

Technology transformation and supervision evolution

APRA’s $73.2 million technology investment is set to transform and modernise supervisory practices. A new cloud-based platform, scheduled to be operational by December 2025, will enable real-time analytics and significantly enhance APRA’s data and analytics infrastructure.

As part of this modernisation, APRA is also upgrading its mechanisms for collecting industry data. The transition to APRA Connect, expected to be completed by December 2027, provides institutions with a unique opportunity to redesign their regulatory reporting processes. This shift is anticipated to streamline data collection across the financial services industry, with APRA estimating $6 million in annual industry savings from reduced manual processing.

Additionally, APRA is enhancing its supervision management systems to support integrated analytics, streamlined reporting, and greater operational efficiency. The upgraded platform, scheduled to go live in November 2025, will equip supervisory teams with improved real-time monitoring capabilities, enabling more proactive and data-driven oversight.