.png)
The Regulators Remain Hyper Active: APRA and ASIC Corporate Plan
Australia's financial services sector continues to face an increasingly broad and complex regulatory agenda, driven by evolving risks, changing stakeholder expectations and heightened regulatory scrutiny. With multiple regulators playing a role in shaping the industry landscape, organisations must navigate a growing range of prudential, conduct and governance obligations.
Against this backdrop, this article explores APRA and ASIC's latest corporate plans, highlighting the key priorities and regulatory focus areas expected to influence the sector in the year ahead.
ASIC 2026-2027 Corporate Plan: what this means for organisations
ASIC's priorities highlight a continued focus on customer outcomes, operational resilience, emerging technologies, and strong governance.
The ASIC 2026-2027 Corporate Plan can be found here: ASIC Corporate Plan 2026–27
Organisations should consider the following key areas:
Customer Outcomes and Service Standards
ASIC has identified insurance claims and services as a specific focus area as part of its broader objective of improving outcomes for consumers and small businesses. More broadly, regulators are placing increasing emphasis on fair treatment, service standards, complaints management, and ensuring organisations deliver good customer outcomes while minimising consumer harm.
Climate Risk and Resilience
The growing impact of natural disasters and climate-related risks continues to drive regulatory attention. Key areas of focus include organisational preparedness and response to major events, customer support during periods of disruption, risk management practices, affordability challenges, access to products and services, and the quality of climate-related disclosures.
Technology, Cyber and AI
Cyber resilience, operational risk management, third-party oversight, and business continuity remain priorities. Regulators are also paying closer attention to AI governance, particularly around transparency, accountability, fairness, and customer impacts.
Enforcement and Accountability
ASIC remains focused on addressing misconduct that results in consumer harm, systemic compliance weaknesses, and emerging risks. This signals continued scrutiny of governance arrangements, risk management practices, and control frameworks, with an expectation that organisations can demonstrate effective oversight, timely issue resolution, and accountability for customer outcomes.
Regulatory Expectations
At the same time, ASIC has indicated it wants to reduce unnecessary burden for organisations actively seeking to comply with their obligations. However, it will continue to take a strong regulatory and enforcement approach where significant breaches, poor conduct, or adverse customer outcomes are identified.
Key Actions for Organisations
Review customer feedback, complaints, and service metrics to identify potential consumer harms.
Test business continuity, crisis management, and incident response plans regularly.
Reassess climate, operational, and emerging risk frameworks.
Strengthen cyber security and oversight of critical third-party providers.
Implement robust AI governance, including accountability, monitoring, and fairness controls.
Focus compliance monitoring on high-risk areas and ensure issues are escalated and remediated promptly.
Enhance board and executive reporting to provide clear visibility of key risks and customer outcomes.
Maintain strong governance, documentation, and regulatory readiness.
Key Takeaway
The regulatory landscape continues to evolve, with a strong emphasis on customer outcomes, resilience, technology governance, and accountability. Organisations that proactively strengthen governance, risk management, and oversight frameworks will be best positioned to meet regulatory expectations and respond to emerging risks.
APRA 2026-2027 Corporate Plan: what this means for organisations
APRA's 2026-2027 Corporate Plan signals a continued supervisory focus on operational resilience, cyber security, technology concentration risk, governance, and accountability. The Plan is particularly relevant to insurers given APRA's intention to finalise strengthened governance requirements by 2028 and its increasing focus on AI, third-party risk, and geopolitical resilience. While APRA is pursuing additional prudential reforms, it has reaffirmed its commitment to reducing regulatory burden through simplification initiatives on its prudential requirements.
The APRA 2026-2027 Corporate Plan can be found here: 2026-27 Corporate Plan
Organisations should consider the following key areas:
Insurance Affordability, Climate Risk and Resilience
APRA acknowledges ongoing affordability and availability challenges in the insurance sector, driven by rising claims costs, natural disasters, and climate-related risks. These pressures are contributing to a widening protection gap and are expected to remain a supervisory focus. APRA also expects institutions to maintain resilience against severe stress events and disruptions.
Operational Resilience, CPS 230 and Critical Services
While CPS 230 commenced on 1 July 2025, implementation remains a key supervisory priority. APRA will continue to assess how entities manage operational risk, maintain critical business services, oversee material service providers, and respond to disruptions. The regulator has also flagged thematic reviews of operational and technology risk management during 2026-27, reinforcing the importance of effective resilience frameworks and control environments.
Cyber Risk, AI and Technology Governance
Cyber risk remains one of APRA's top concerns, particularly as AI-enabled cyber threats become increasingly sophisticated. APRA expects entities using AI to strengthen governance, risk management, operational resilience, and board oversight. Institutions should also expect more frequent and deeper supervisory engagement on cyber and AI-related risks.
Third-Party, Concentration and Systemic Risk
APRA is increasingly focused on risks arising from reliance on common technology platforms and material service providers. Concentration risks and shared dependencies can create system-wide disruption, making vendor governance, dependency mapping, and oversight of critical third parties an important area of regulatory attention.
Geopolitical Risk
Heightened geopolitical tensions, including trade disruptions, sanctions, cyber activity, and international conflicts, are viewed as growing threats to operational and financial resilience. APRA expects organisations to incorporate these risks into risk management frameworks, scenario analysis, stress testing, and resilience planning.
Supervision and Regulatory Expectations
APRA has made clear that it expects entities to move quickly to strengthen resilience and address weaknesses. The regulator has also signalled a strong appetite to increase supervisory intensity and take enforcement action where material risks are not appropriately managed or where cooperation is lacking. At the same time, APRA continues to pursue regulatory simplification through streamlined requirements, reduced duplication, and more efficient reporting obligations.
Key Actions for Organisations
Review CPS 230 implementation and confirm critical business services, controls, and resilience testing are operating effectively.
Strengthen cyber security, incident response, and technology risk management frameworks.
Establish robust AI governance, including clear accountability, risk management, and board oversight.
Assess critical third-party providers and identify concentration and dependency risks.
Incorporate geopolitical, climate, and emerging risks into risk assessments, stress testing, and resilience planning.
Review insurance affordability and climate-related impacts as part of strategic and risk management processes.
Ensure governance and reporting frameworks provide clear oversight of operational resilience and material risks.
Maintain readiness for increased supervisory engagement and demonstrate effective management of identified risks.
Key Takeaway
APRA's priorities reinforce a strong focus on operational resilience, cyber security, AI governance, third-party risk management, and preparedness for systemic and geopolitical shocks. Organisations that can demonstrate robust governance, effective risk management, and mature resilience capabilities will be best placed to meet APRA's evolving expectations.
Conclusion
While APRA and ASIC have distinct mandates, their corporate plans reflect common priorities around governance, resilience, risk management and maintaining confidence in the financial system. Together, they signal an increasingly proactive regulatory environment and clearly indicate the issues likely to attract regulatory attention.
For financial services organisations, staying ahead of these priorities will be critical to navigating ongoing regulatory change and meeting evolving expectations.
How we can help
Understanding regulatory priorities is only the first step. As APRA and ASIC continue to focus on the above, organisations should assess the adequacy of their frameworks, capabilities, and implementation plans.
Hall Advisory helps boards and executives assess regulatory impacts, identify gaps and implement practical, fit-for-purpose frameworks. Our support includes:
Regulatory readiness and gap assessments
Governance and accountability framework reviews
Risk and resilience capability uplift
Culture and conduct reviews
Regulatory engagement and response planning
Change implementation and delivery support
By combining regulatory insight with practical implementation experience, we help organisations respond to evolving expectations with confidence and clarity.
Comments