{"id":"F2016L01429","name":"Banking, Insurance and Life Insurance (prudential standard) determination No. 2 of 2016","slug":"banking-insurance-and-life-insurance-prudential-standard-determination-no-2-of-2016","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"in_force","isInForce":true,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":95041,"registerId":"commonwealth-F2016L01429-current","compilationNumber":null,"startDate":"2026-04-02","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"Authority","sectionType":"part","heading":"Authority","content":"# Authority\n\n1.  This Prudential Standard is made under:\n\n(a) section 11AF of the Banking Act 1959 (Banking Act);\n\n(b) section 32 of the Insurance Act 1973 (Insurance Act); and\n\n(c) section 230A of the Life Insurance Act 1995 (Life Insurance Act).","sortOrder":0},{"sectionNumber":"Application","sectionType":"part","heading":"Application","content":"# Application\n\n2. This Prudential Standard applies to each Level 3 Head.\n\n3. This Prudential Standard commences on 1 July 2017.","sortOrder":1},{"sectionNumber":"Interpretation","sectionType":"part","heading":"Interpretation","content":"# Interpretation\n\n4. Terms that are defined in Prudential Standard 3PS 001 Definitions appear in bold the first time they are used in this Prudential Standard.\n\n5. Where this Prudential Standard provides for APRA to exercise a power or discretion, this power or discretion is to be exercised in writing.","sortOrder":2},{"sectionNumber":"Aggregate risk exposures","sectionType":"part","heading":"Aggregate risk exposures","content":"# Aggregate risk exposures\n\n6. For the purposes of this Prudential Standard, aggregate risk exposures arise from exposures to individual counterparties, a group of related individual counterparties, a group of counterparties with similar characteristics (e.g. in specific geographical locations or industry sectors) or to particular asset classes (e.g. property holdings or other investments) where the exposures have the potential to result in material losses for the Level 3 group or an individual prudentially regulated institution in the group. Aggregate risk exposures include both on- and off-balance sheet exposures. Unlimited exposures to any individual counterparty (e.g. a general guarantee of the obligations of a counterparty) are not permitted unless agreed with APRA.\n\n7. For the purposes of this Prudential Standard, when determining aggregate risk exposures the Level 3 Head must ensure that exposures to the wider conglomerate group to which the Level 3 group belongs are taken into account.\n\n8. For the purposes of this Prudential Standard, aggregate risk exposures exclude any exposures held, in accordance with written legal agreements, by the Level 3 group on behalf of entities external to the Level 3 group (e.g. custodian arrangements), even if the assets are held in the name of a Level 3 institution in the group.\n\n9. A Level 3 Head must have an ‘aggregate risk exposures policy’ that addresses all material risk exposures associated with the operations undertaken by Level 3 institutions in the Level 3 group. The policy must include systems and procedures to identify, measure, monitor, evaluate, report and control or mitigate all material risks arising from aggregate risk exposures.\n\n10. A Level 3 Head must conduct forward-looking scenario analysis and stress testing of the Level 3 group’s material aggregate risk exposures. The analysis must assess the impact of changes in market conditions and key risk factors on these aggregate risk exposures, and how these changes impact on the group’s risk profile, capital strength and earnings.\n\n11. The management of aggregate risk exposures must be a part of the Level 3 group’s risk management framework.[\\[1\\]](#_ftn1)","sortOrder":3},{"sectionNumber":"The role of the Board of a Level 3 Head","sectionType":"part","heading":"The role of the Board of a Level 3 Head","content":"# The role of the Board of a Level 3 Head\n\n12. The Board of a Level 3 Head must:\n\n(a) approve the aggregate risk exposures policy for the Level 3 group;\n\n(b) ensure that adequate systems and controls are in place to identify, measure, aggregate, manage, monitor and report on material risk exposures in the Level 3 group in a timely manner and that those systems and controls are documented;\n\n(c) engage in oversight, which may be via a board committee, of the approach to the identification, measurement, management and monitoring of aggregate risk exposures and compliance with the aggregate risk exposures policy, which includes receiving regular reviews of material aggregate risk exposures of the Level 3 group; and\n\n(d) review the aggregate risk exposures policy at least annually to ensure that this policy remains adequate and appropriate for identifying, measuring, aggregating, managing and monitoring the Level 3 group’s risk exposures.","sortOrder":4},{"sectionNumber":"The aggregate risk exposures policy","sectionType":"part","heading":"The aggregate risk exposures policy","content":"# The aggregate risk exposures policy\n\n13. The aggregate risk exposures policy for a Level 3 group must:\n\n(a) be conceptually sound, consistently implemented, transparent and be subject to independent review;\n\n(b) capture all material aggregate risk exposures;\n\n(c) include limits on acceptable levels of aggregate risk exposures for the Level 3 group;\n\n(d) include a description of the procedures for identifying, aggregating, reviewing, controlling and reporting material risk exposures within the Level 3 group. This must include:\n\n(i) a clear statement of the respective responsibilities and compliance obligations of the Board of the Level 3 Head, its board committees and senior management of the Level 3 group in relation to the monitoring and management of aggregate risk exposures;\n\n(ii) escalation procedures for aggregate risk exposures that facilitate responses to identified policy breaches between formal reporting cycles;\n\n(iii) the circumstances in which aggregate risk exposure limits may be exceeded and the authority required for approving such excesses;\n\n(iv) thresholds and procedures for reporting material changes to the Board of the Level 3 Head, in both formal reporting cycles and outside formal reporting cycles;\n\n(v) consideration of the impact of material changes in macroeconomic conditions, including foreign exchange rates, interest rates and inflation; and\n\n(vi) a timetable for a regular review of the reports by the Board of the Level 3 Head.\n\n14. The aggregate risk exposure limits identified under paragraph 13(c) must take into account, where appropriate, matters such as:\n\n(a) on- and off-balance sheet exposures to:\n\n(i) various types of counterparties;\n\n(ii) an individual counterparty or group of related counterparties;\n\n(iii) individual industry sectors;\n\n(iv) geographical locations;\n\n(v) financial products, including risk transfer products;\n\n(vi) specific funding sources;\n\n(vii) various asset classes such as equities, property holdings and other investments;\n\n(viii) various market risks such as interest rate, foreign exchange and commodities; and\n\n(ix) any other material risks,\n\nthat cover asset and liability exposures and that are commensurate with the Level 3 group’s risk appetite, risk profile and capital strength, and the size, business mix and complexity of the group; and\n\n(b) operational risk exposures to:\n\n(i) service providers;\n\n(ii) outsourcing;\n\n(iii) business continuity management; and\n\n(iv) any other operational risks.","sortOrder":5},{"sectionNumber":"Internal reporting systems","sectionType":"part","heading":"Internal reporting systems","content":"# Internal reporting systems\n\n15. A Level 3 Head’s management information systems must incorporate reporting systems in relation to aggregate risk exposures across the Level 3 group.[\\[2\\]](#_ftn2)\n\n16. Reports on material aggregate risk exposures must be provided to APRA on request.","sortOrder":6},{"sectionNumber":"Limits and approvals","sectionType":"part","heading":"Limits and approvals","content":"# Limits and approvals\n\n17. Where, in APRA’s view, the Level 3 group is exposed to a significant level of aggregate risk exposure in specific risks, APRA may require a Level 3 Head to limit or reduce the Level 3 group’s level of aggregate risk exposure. APRA may also determine how a Level 3 Head must calculate an aggregate risk exposure. In determining any requirement to limit or reduce the Level 3 group’s level of aggregate risk exposure, or how a Level 3 Head must calculate an aggregate risk exposure, APRA may take account of the following factors:\n\n(a) whether the Level 3 group has been acting in a manner that is consistent with the aggregate risk exposures policy;\n\n(b) the characteristics of aggregate risk exposures, including their number, size and nature;\n\n(c) the characteristics of the Level 3 group, including the nature of its business and the experience of its management; and\n\n(d) other relevant factors to be considered on a case-by-case basis.","sortOrder":7},{"sectionNumber":"Notification requirements","sectionType":"part","heading":"Notification requirements","content":"# Notification requirements\n\n18. A Level 3 Head must notify APRA as soon as practicable, and no more than 10 business days, after it becomes aware:\n\n(a) of a breach of the limits in the aggregate risk exposures policy;\n\n(b) of any significant breach of, or material deviation from, the aggregate risk exposures policy; or\n\n(c) that the aggregate risk exposures policy did not adequately address a material risk,\n\nand advise of remedial actions taken, or planned to be taken, to deal with the issue.\n\n19. A Level 3 Head must submit to APRA a copy of its aggregate risk exposures policy as soon as practicable, and no more than 10 business days, after Board approval.","sortOrder":8},{"sectionNumber":"Adjustments and exclusions","sectionType":"part","heading":"Adjustments and exclusions","content":"# Adjustments and exclusions\n\n20. APRA may adjust or exclude a specific requirement in this Prudential Standard in relation to the Level 3 Head.[\\[3\\]](#_ftn3)","sortOrder":9}],"analysis":{"flash_summary":{"complexity_score":6,"scope_assessment":{"changed":false,"description":"The Standard applies specifically to Level 3 Heads and mandates group‑level aggregation, governance, stress testing, reporting and APRA oversight. It does not expand the class of regulated entities beyond Level 3 Heads but clarifies and codifies group‑wide prudential obligations and APRA’s powers; commencement is set as 1 July 2017."},"complexity_factors":["Group‑wide aggregation across on‑ and off‑balance sheet exposures and related external conglomerate exposures creates measurement complexity (paras 6–8)","Requirement for Board‑approved policy, documented systems and documented responsibilities increases governance and compliance burden (paras 9, 12, 13)","Forward‑looking scenario analysis and stress testing require modelling capability and assumptions that affect capital and earnings projections (para 10)","Detailed policy content requirements — limits, escalation, exceedance authorities, reporting thresholds and review timetables — create operational rules to implement (paras 13–14)","APRA’s discretionary powers to require limits, set calculation methods, request reports and adjust/exclude requirements create regulatory uncertainty and case‑by‑case variation (paras 17, 20)","Notification and submission timeframes (breach notification and policy submission within 10 business days) impose tight reporting deadlines (paras 18–19)","Reliance on external definitions (Prudential Standard 3PS 001) and written exercise of APRA discretions adds cross‑reference and procedural layers (para 4; para 5)"],"plain_english_summary":"This Prudential Standard requires each Level 3 Head (the top entity of a regulated financial group) to maintain a Board‑approved policy, systems and reporting to identify, measure, monitor and limit group‑wide aggregate risk exposures and to perform forward‑looking scenario analysis and stress testing. Unlimited guarantees of counterparties require APRA approval.\n\nThe Level 3 group bears compliance costs; the Board must approve and oversee controls; APRA may set or vary limits, require specific calculations, request reports and must be notified of breaches (including a 10 business‑day notification deadline)."},"flash_summary_failed":{"failed":true,"reason":"Unauthenticated. Configure AI_GATEWAY_API_KEY or use a provider module. Learn more: https://ai-sdk.dev/unauthenticated-ai-gateway","source":"analysis-cron"},"kimi_summary":{"content_quality":"ok","complexity_score":4,"scope_assessment":{"changed":false,"description":"The legislation appears consistent with its original intent. It establishes prudential standards for aggregate risk management by Level 3 financial groups, which aligns with the title and enabling provisions. No significant scope creep is evident — the provisions address risk concentration management, board governance, and regulatory oversight as expected for this type of prudential standard."},"complexity_factors":["Moderate cross-referencing: references to external Prudential Standard 3PS 001 Definitions for defined terms, plus three separate enabling Acts (Banking Act 1959, Insurance Act 1973, Life Insurance Act 1995)","Conditional logic in notification requirements: three distinct triggering events in section 18 with overlapping but distinct thresholds ('breach of limits', 'significant breach or material deviation', 'did not adequately address material risk')","Nested scope considerations: aggregate risk exposures must account for both the Level 3 group itself AND the wider conglomerate group to which it belongs (section 7), while excluding certain custodian arrangements (section 8)","APRA discretion provisions: multiple sections (5, 17, 20) grant APRA written discretionary powers to adjust requirements, determine calculation methods, or mandate risk reductions on a case-by-case basis","Detailed policy requirements: section 13 contains six sub-paragraphs with multiple nested sub-sub-paragraphs (i-vi) specifying mandatory policy contents","Length: approximately 20 operative sections covering policy content, board responsibilities, reporting systems, limits, notifications, and APRA adjustments"],"plain_english_summary":"This law requires large financial group holding companies (\"Level 3 Heads\") to have board‑approved, annually reviewed policies and systems for managing aggregate risk exposures across their group, including forward‑looking stress testing and internal reporting. It also mandates APRA notification when limits are breached. \n\nIt affects boards, senior management, and APRA oversight, aiming to limit concentration risk and strengthen the stability of Australia’s financial system."}},"importantCases":[],"_links":{"self":"/api/acts/banking-insurance-and-life-insurance-prudential-standard-determination-no-2-of-2016","history":"/api/acts/banking-insurance-and-life-insurance-prudential-standard-determination-no-2-of-2016/history","analysis":"/api/acts/banking-insurance-and-life-insurance-prudential-standard-determination-no-2-of-2016/analysis","conflicts":"/api/acts/banking-insurance-and-life-insurance-prudential-standard-determination-no-2-of-2016/conflicts","importantCases":"/api/acts/banking-insurance-and-life-insurance-prudential-standard-determination-no-2-of-2016/important-cases","documents":"/api/acts/banking-insurance-and-life-insurance-prudential-standard-determination-no-2-of-2016/documents"}}