Australian Prudential Regulation Authority (confidentiality) determination No. 2 of 2019

Three core legal concepts structure this determination.

First, the statutory basis for the instrument. The determination is made under paragraph 57(2)(b) of the Australian Prudential Regulation Authority Act 1998. The determination text reproduces the exercise of delegated authority: "I, Alison Bliss, a delegate of APRA, under paragraph 57(2)(b) of the Australian Prudential Regulation Authority Act 1998, DETERMINE..." The instrument also links to APRA's confidentiality and publication regime by reference to subsection 56(5C) of the APRA Act, noting that because the specified information is not confidential, it "may be published under subsection 56(5C)." The instrument therefore sits inside the APRA Act framework where APRA determines confidentiality status and then may publish non-confidential information.

Second, the scope concept. The determination does not declare entire reporting documents non-confidential; it specifies "parts of reporting documents" and then identifies those parts in the Schedule. The Schedule lists particular reporting forms and, for each, the specific aggregated items that are non-confidential. For example, for Reporting Standard ARS 720.0 the Schedule lists ARF 720.0A and ARF 720.0B and identifies items such as "Total currency and unallocated gold (Total)" and "Total funds on deposit at other financial institutions: Residents (Total)." For ARS 720.1 the Schedule lists ARF 720.1A and ARF 720.1B and items such as "Total loans and finance leases: Residents: Households: Housing loans: Owner-occupied (Total gross of provisions)." For ARS 720.2 and ARS 720.3 the Schedule sets out the deposits and intra-group asset/liability aggregates covered. The Schedule therefore operationalises the "part" concept as particular form-and-item combinations.

Third, the definitions and timing concept. The Interpretation clause defines key terms by reference to other statutes: APRA, ADI ("has the meaning given in section 5 of the Banking Act 1959") and reporting document ("within the meaning of section 13 of the Financial Sector (Collection of Data) Act 2001"). Timing is specified by the Schedule: the determination "only applies to information in the specified parts of reporting forms given to APRA by an ADI, under the following reporting standards, from the due date an ADI was required to provide the information specified in the relevant reporting standard to APRA." Thus the instrument ties the non-confidential status to data provided under ARS 720.x forms and to the statutory reporting calendar that triggers ADIs' obligations under the reporting standards.

Other operational points embedded in the document: the determination expressly covers both "Standard" and "Reduced" reporting forms where those exist (for example ARF 720.0A and ARF 720.0B; ARF 720.1A and ARF 720.1B; ARF 720.2A and ARF 720.2B). The Schedule contains line items that are predominantly high-level aggregates by counterparty type and residence status: totals for currency, securities held for trading and not held for trading, intra-group assets and liabilities, loans and finance leases broken down by resident counterparty type (households, financial institutions, general government, non-financial businesses), and deposit aggregates by resident counterparty type.

Primary affected parties are authorised deposit-taking institutions, and specifically those ADIs that submit the referenced ARS 720.x reporting forms to APRA. The instrument defines ADI by reference to section 5 of the Banking Act 1959, therefore the population affected includes entities within the statutory ADI definition under that Act; the determination itself does not expand or contract that statutory definition. The Schedule lists the exact reporting forms and items that fall within the non-confidential category. Practically, ADIs that complete ARF 720.0A/720.0B, ARF 720.A (as shown in the Schedule), ARF 720.1A/720.1B, ARF 720.2A/720.2B and ARF 720.3 will be affected in that specified parts of their submissions under those forms may be published by APRA.

Secondary affected parties include entities whose information appears within those aggregates. The Schedule shows many items reported by resident/non-resident, by counterparty type (for example, "Residents: Households: Housing loans: Owner-occupied") and by instrument class (for example, "Total securities held for trading: Debt securities (Total)"). Because the determination covers aggregates rather than line-by-line transactional data, the immediate effect is on the aggregate reporting lines rather than identifiable contractual counterparties. Nevertheless, any legal entity whose exposure or balances contribute materially to those aggregates will be represented indirectly in published aggregates.

APRA itself is affected in two ways. First, the determination increases APRA's publishing options under the APRA Act: the instrument makes particular data non-confidential so APRA "may" publish it under subsection 56(5C). Second, the determination delegates authorisation to an APRA official; it was signed by a delegate, Alison Bliss, General Manager Data Analytics and Insights, under paragraph 57(2)(b). The instrument therefore reflects internal APRA decision-making and delegation practices: a delegate has made a statutory determination about confidentiality.

Other regulators, data users and third parties who rely on APRA publications are indirectly affected. If APRA exercises its discretion to publish the specified aggregates, data users will obtain access to those published aggregates. The determination itself does not require publication; it permits it.

Note on timing. The Schedule conditions application on "the due date an ADI was required to provide the information specified in the relevant reporting standard to APRA." That timing condition affects which reporting periods' submissions are covered. The instrument otherwise contains no transitional provisions or grandfathering language beyond that timing statement. The determination commences on the date of registration on the Federal Register of Legislation.

This determination alters a particular right and creates a new legal status for the identified reporting items. It does not create affirmative duties on ADIs beyond duties that ADIs already have under the relevant reporting standards and the Financial Sector (Collection of Data) Act 2001 and the Banking Act 1959. Instead, it changes the confidentiality status of certain information that ADIs provide to APRA.

Rights created or clarified by the instrument:

• The determination declares that specified parts of reporting documents "does not contain confidential information." That is a legal determination of non-confidentiality within the APRA Act framework. The immediate legal consequence stated by the instrument is that "the non-confidential information may be published under subsection 56(5C) of the Australian Prudential Regulation Authority Act 1998." In short, APRA may, but is not required to, publish those items.
• APRA, through its delegate, has exercised its statutory power to remove confidentiality protection for the specified aggregated reporting items. The right to publish therefore vests with APRA, subject to the discretion in s56(5C).

Duties remaining with ADIs:

• ADIs continue to have reporting duties under the relevant Reporting Standards ARS 720.0 to 720.3 and the underlying statutory framework for reporting. The determination applies to "parts of reporting forms given to APRA by an ADI, under the following reporting standards," and applies "from the due date an ADI was required to provide the information." The instrument does not relieve an ADI of the duty to supply accurate and timely reporting information to APRA.
• Because the instrument does not create offences or sanctions itself, ADIs' compliance duties remain the existing statutory and regulatory obligations that require accurate submission of reporting documents under the Financial Sector (Collection of Data) Act and APRA's reporting standards.

APRA's duties and discretion:

• APRA has the discretion to publish the non-confidential information under subsection 56(5C) of the APRA Act; the instrument emphasises that effect. The determination does not itself mandate publication or set publication frequency, format, or timing. Those are left to APRA's exercise of discretion under the APRA Act and its internal policies.

Operational implications of the Schedule:

• The Schedule lists precise items that are non-confidential. For example, ARF 720.1A/B items include a detailed breakdown of loans and finance leases by resident sector and product type, including "Total loans and finance leases: Residents: Households: Personal loans and finance leases: Credit cards (Total gross of provisions)" and "Margin loans (Total gross of provisions)." ARF 720.2A/B items are deposit aggregates by resident sector. ARF 720.3 lists "Total intra-group assets: Loans and finance leases: Residents (Total)" and "Total intra-group liabilities: Deposits: Residents (Total)."
• ADIs that prepare those forms should be aware that the identified lines are categorised non-confidential by the determination, and APRA may publish them.

Limits and clarifications:

• The determination does not state that all information in the reporting documents is non-confidential. It is limited to specified parts of specified forms. Any part not listed remains subject to the APRA Act's confidentiality protections unless otherwise determined.
• The instrument does not itself define "publication" formats, nor does it alter the legal duties relating to how APRA may use the confidential data beyond the stated publication possibility under subsection 56(5C).

The determination text does not create new offences or specify penalties. It is a statutory determination of confidentiality status made under paragraph 57(2)(b) of the APRA Act; the instrument itself provides no enforcement provisions. The document's operation is to change legal status of certain reporting items from confidential to non-confidential, thereby enabling APRA to publish them under subsection 56(5C) of the APRA Act.

Immediate enforcement implications drawn from the instrument:

• There are no direct penalties or enforcement actions in the instrument. The determination does not state that any failure to report, or any misreporting, attracts a specific sanction under the determination itself.
• ADIs remain subject to their pre-existing legal and regulatory obligations under the Financial Sector (Collection of Data) Act 2001, the Banking Act 1959 and the APRA Act. Any penalties or enforcement mechanisms for inaccurate or late reporting would be found in those underlying statutes and reporting standards, not in this determination; the determination is silent on those points.

APRA's enforcement options related to publication:

• The instrument makes specific data eligible for publication under subsection 56(5C). Publication is an exercise of APRA's discretion rather than a sanction. The instrument does not indicate whether APRA intends to use publication as a supervisory tool or market discipline mechanism, nor does it specify that publication will be used punitively. It simply enables publication.

Operational compliance risk and indirect enforcement effects:

• Although the determination itself does not create new penalties, removal of confidentiality for specific aggregates can have indirect compliance consequences for ADIs. If APRA does publish aggregates that adversely affect an ADI's market reputation, that may create commercial pressure on the ADI to adjust behaviour. That is an indirect economic consequence rather than a statutory penalty. The instrument contains no mention of this, but the mechanics are clear: data APRA may publish will be non-confidential and thus accessible to market participants.

Delegation and internal APRA authority:

• The determination is signed by a delegate of APRA, Alison Bliss, exercising authority under paragraph 57(2)(b). The instrument therefore illustrates how APRA may use delegated powers to make confidentiality determinations. The determination does not state any external checks on that delegation within the text of the instrument.

In sum, the determination is not an enforcement instrument; it is a rule about confidentiality status that can enable APRA-led publication. Any penalties for breaches of reporting obligations must be sought in the primary statutes and reporting standards, not in this determination.

This determination expressly situates itself within a web of statutory provisions by reference. The instrument's operation depends on and interacts with at least three statutory sources named in the text.

1. The Australian Prudential Regulation Authority Act 1998

• The determination is made under paragraph 57(2)(b) of the APRA Act. The instrument repeatedly references the APRA Act and the confidentiality/publication mechanism in subsection 56(5C). The determination does not reproduce the text of those provisions, but it relies on them as the legal basis for making confidentiality determinations and for publishing non-confidential information. Therefore the instrument interacts directly with the APRA Act's confidentiality, publication, and delegation regime. APRA's ability to publish is conditioned by the APRA Act; the determination simply makes a subset of reporting items non-confidential so that subsection 56(5C) can be used.

2. The Banking Act 1959

• The Interpretation section defines authorised deposit-taking institution (ADI) "has the meaning given in section 5 of the Banking Act 1959." By adopting that statutory definition, the determination's population of affected entities is those captured by the Banking Act's ADI definition. The instrument therefore integrates with the Banking Act's institutional perimeter. The instrument itself does not modify the Banking Act or expand the ADI definition; it merely references it.

3. The Financial Sector (Collection of Data) Act 2001

• The reporting document concept is defined by reference to section 13 of the Financial Sector (Collection of Data) Act 2001. That Act provides the legal regime under which APRA imposes reporting obligations and collects data. The instrument applies only to "reporting documents" within that statutory meaning. The determination therefore presupposes the existence of statutory reporting obligations under that Act and the related APRA reporting standards.

4. APRA Reporting Standards (ARS 720.0, ARS 720.1, ARS 720.2, ARS 720.3)

• The Schedule identifies specific APRA Reporting Standards and their reporting forms and items. The determination does not change the content or mandatory nature of those Reporting Standards. Instead it specifies which parts of the forms under those Reporting Standards are non-confidential. The instrument therefore operates as a cross-cutting confidentiality decision linked to particular ARS 720.x obligations.

Interactions and limits:

• The determination creates a legal link between the content of ARS 720.x reporting forms and APRA's publication regime under the APRA Act. It does not modify the underlying reporting standards' content, nor the legal duties to report. It does not state that publication is required, only that it may occur under s56(5C).
• The determination refers to other laws only by reference. It does not purport to interpret or amend the Banking Act or the Financial Sector (Collection of Data) Act. It does not, within its text, cross-refer to other regimes such as the Privacy Act or Corporations Act. Any interactions with privacy law, secrecy obligations outside the APRA statutory framework, or contractual confidentiality between ADIs and third parties are not addressed in this instrument.

Practical coordination needed by ADIs:

• Because the instrument designates certain items non-confidential, ADIs must take account of that status when considering broader legal obligations that might otherwise impose confidentiality. The determination does not resolve potential conflicts between APRA's publication of non-confidential aggregates and other legal obligations beyond the APRA Act; the instrument is silent on such conflicts. Entities will need to consider any external legal duties (for example contractual confidentiality or privacy obligations) in light of APRA's statutory power to publish non-confidential reporting items.

In summary, the instrument is an administrative determination that changes the confidentiality status of specific data collected under the Financial Sector (Collection of Data) Act and APRA Reporting Standards, and it explicitly uses the APRA Act's mechanisms for determining confidentiality and publishing non-confidential information.

The determination text contains its making date and commencement statement but does not record any subsequent amendments. Key points from the instrument relating to history and duration:

• Date: The determination is dated 22 August 2019 and signed by Alison Bliss. The instrument states: "Dated: 22 August 2019" and includes the signature block for the delegate.
• Commencement: The instrument states: "This determination commences on the date of registration on the Federal Register of Legislation." The text therefore sets the commencement mechanism as registration, a standard administrative step for determinations and legislative instruments.
• No amendment clauses: The instrument contains no express amendment or repeal clauses within its text. It does not amend prior determinations. It does not state a sunset date or expiry date. The absence of such clauses in the text indicates that, as published, it remains in force until varied or revoked by APRA under the APRA Act or superseded by later determinations.
• No in‑instrument amendment history: The instrument does not include a notes section recording prior versions or earlier determinations that it replaces. The Schedule does not show earlier variants.

What the instrument does not say about amendment:

• It does not indicate whether APRA routinely reviews confidentiality determinations, or the frequency with which APRA will re-evaluate the status of these items. Any future amendment or revocation would presumably occur by further exercise of the statutory power in paragraph 57(2)(b) of the APRA Act, and would be recorded on the Federal Register of Legislation, but the instrument itself does not provide a framework for that process.

Practical consequence for users and practitioners:

• Because the instrument lacks an expiry clause, practitioners should treat the determination as an ongoing administrative determination in force from registration until active revocation or replacement. Users of the data and ADIs should monitor the Federal Register of Legislation and APRA communications for any amendments or replacement determinations that change the list of non-confidential items.
• For historical analysis or compliance work, the date and commencement rule supplied in the instrument provide the starting point for any reporting periods affected: the Schedule applies "from the due date an ADI was required to provide the information specified in the relevant reporting standard to APRA." Therefore, the timing of reporting obligations and the date of registration determine which reporting cycles are captured.

In summary, the determination as provided contains a single dated instrument (22 August 2019) without recorded amendments in the text. Any subsequent changes to the confidentiality status of the referenced items must be made by further APRA action and will need to be checked on the public register.

The determination text contains no references to litigation, court decisions, or judicial review. There is no litigation history recorded in the instrument. The document does not cite any cases, nor does it reference prior determinations that might have been the subject of legal challenge. The text is a stand-alone administrative determination.

Implications for practitioners:

• Because there is no litigation history contained in the instrument, there are no judicial interpretations of this specific determination set out in the material provided. Any legal challenges to an APRA confidentiality determination would arise under administrative law principles and the APRA Act, but the determination does not record any such proceedings.
• For legal research or risk assessment, the lack of litigation history in the instrument means that practitioners should not assume there is published judicial guidance on the particular legal effect of this determination. If a practitioner requires judicial interpretation or precedent about APRA confidentiality determinations generally, that material would need to be sought elsewhere; the instrument provides no such references.

Practical next steps for those concerned about legal risk:

• If an ADI or third party wishes to challenge the confidentiality determination or its consequences, the appropriate course would be to consider the administrative law remedies under the relevant jurisdiction and statutory framework. The instrument itself does not provide procedural detail about internal APRA review or appeal rights. The determination does not describe whether internal review procedures within APRA exist for confidentiality decisions. Those points are not included in the text and would need to be sourced from the APRA Act and APRA policy documents outside the instrument.

In sum, the instrument contains no litigation history and does not document prior legal contestation. Practitioners should treat it as an administrative exercise recorded on its date without accompanying judicial commentary.

This determination contains several practical nuances and potential traps for practitioners and ADIs that are evident from the text.

Limited scope: parts, not whole forms

• The instrument repeatedly emphasises that it applies to "specified parts of reporting documents" of a kind listed in the Schedule. That is not the same as declaring entire forms or entire reporting documents non-confidential. Practitioners must avoid the mistake of treating an entire ARS 720.x form as freely publishable. Only the line items and aggregates listed in the Schedule are determined to be non-confidential. Anything not listed remains subject to APRA's usual confidentiality protections unless and until APRA makes a separate determination.

Timing nuance: effective from due date

• The Schedule applies "from the due date an ADI was required to provide the information specified in the relevant reporting standard to APRA." This timing clause means the non-confidential status attaches to the data from the statutory due date for the reporting standard. A common error would be to assume retrospective effect to earlier reporting periods; the instrument ties coverage to reporting due dates. Practitioners must map the relevant reporting period(s) to the ARS 720.x due dates to know which submissions are covered.

Standard and Reduced forms included

• The Schedule includes both "Standard" and "Reduced" reporting forms where applicable (for example ARF 720.0A and ARF 720.0B; ARF 720.1A and ARF 720.1B). A potential trap is to assume that reduced forms are entirely excluded or treated differently. The instrument explicitly lists both, and the listed items in the reduced forms are included in the non-confidential determination where specified.

Level of aggregation matters

• The Schedule lists totals and aggregates by counterparty type and residence status. Aggregated reporting lines such as "Total loans and finance leases: Residents: Households: Housing loans: Owner-occupied (Total gross of provisions)" may still reveal material information about an ADI when coupled with other published data or if an ADI is small. The determination does not address de-identification thresholds or small-sample suppression, nor does it state whether APRA will apply statistical disclosure controls before publication. The instrument's text is silent on how aggregation interacts with re-identification risk.

Delegation and authority

• The determination is made by a delegate, and the instrument records that fact. If a third party wishes to challenge the decision on procedural grounds, they would need to consider the validity of the delegation under paragraph 57(2)(b) as applied. The instrument itself does not set out the delegation instrument or internal authorisation. Practitioners should not assume the delegate's signature in this instrument reflects all possible internal governance checks.

Publication is discretionary

• The instrument uses the permissive phrasing that the non-confidential information "may be published under subsection 56(5C)." "May" is permissive not mandatory. A mistake would be to assume APRA must publish the items once declared non-confidential. The determination removes confidentiality as a legal barrier, but publication remains an APRA discretion under the APRA Act.

No stated format, frequency, or context for publication

• The determination does not define how APRA will publish, at what frequency, or in what format. Practitioners should not assume that the items will appear in particular APRA releases, that they will be published in disaggregated form, or that APRA will provide context, commentary, or comparability adjustments. The instrument does not address these distributional choices.

Interaction with other legal obligations

• The instrument does not discuss whether APRA's publication of non-confidential aggregates could conflict with other legal duties such as contractually agreed confidentiality or privacy obligations. The determination is silent on reconciliation of competing legal regimes. ADIs should not presume publication authorised by APRA removes their need to consider third-party legal constraints outside the APRA Act framework.

Possible ambiguity in Schedule text

• The Schedule contains a line or item labelled "ARF 720.A" in one table. Practitioners should check APRA's reporting standards for precise form identifiers. The determination's Schedule is authoritative for the purpose of the instrument, but any typographical inconsistencies or ambiguous form identifiers could lead to confusion about coverage. The instrument contains only the text shown; it does not provide corrigenda.

No penalties or enforcement instructions

• The determination does not create enforcement mechanisms pertaining to publication or misuse of published data. Practitioners must not conflate the instrument's effect with new statutory enforcement tools; none are specified in the instrument.

In short, the key gotchas are the limited and specific scope of the non-confidential designation, the timing tied to statutory reporting due dates, the permissive nature of publication, the absence of procedural detail about publication method or frequency, and the need to reconcile APRA's publication power with other legal obligations that the instrument does not address.

For ADIs, the immediate compliance implications are practical rather than prescriptive. The determination does not change reporting obligations, create new offences, or alter the content of ARS 720.x. It does, however, change the confidentiality status of certain reported items. Below are concrete steps and checks that ADIs and their advisers should consider, grounded in the instrument's text.

1. Map reporting obligations to the Schedule

• Identify whether your institution is an ADI within the meaning of section 5 of the Banking Act 1959, as the instrument applies to ADIs so defined. Confirm which ARS 720.x reporting forms your institution files (for example ARF 720.0A/720.0B, ARF 720.1A/720.1B, ARF 720.2A/720.2B, ARF 720.3).
• Cross-check your internal reporting templates against the Schedule items. The Schedule lists specific items and aggregates, for example "Total securities held for trading: Debt securities (Total)" and detailed loan and deposit breakdowns. Ensure your data mapping produces the identical aggregates APRA expects so that what you submit aligns with the non-confidential items.

2. Review timing and reporting cycles

• The determination applies "from the due date an ADI was required to provide the information specified in the relevant reporting standard to APRA." Identify the due dates for ARS 720.x submissions and determine which reporting periods are covered. This is essential for understanding whether a particular submission falls within the scope of the determination.

3. Update internal confidentiality and disclosure assessments

• Where internal policies treat APRA submissions as confidential, update those policies to reflect that the listed aggregates are now legally non-confidential under the APRA Act due to the determination. That does not mean APRA will publish them, but the confidentiality status no longer legally restricts APRA from publishing those items.
• Review any contractual disclosure clauses with third parties and counterparties that reference APRA reporting to determine whether those contracts create obligations beyond the APRA confidentiality regime. The determination does not address such private law obligations.

4. Consider market disclosure and communications planning

• Because APRA "may" publish the aggregates, prepare communications plans for possible publication scenarios. Consider the potential reputational or market impacts should APRA publish certain aggregates. The determination contains no obligations to consult ADIs prior to publication. Adopting a proactive communications posture for identified aggregates reduces surprise if APRA publishes them.

5. Check data aggregation and re-identification risk

• Evaluate whether your institution's submission could, when combined with other public information, allow re-identification of sensitive exposures. The instrument designates aggregates as non-confidential; it does not mandate suppression protocols. If re-identification remains a concern, discuss with APRA through existing reporting or supervisory channels whether APRA will apply disclosure control methods to published aggregates.

6. Retain and version-control submitted data

• Maintain robust records of the specific versions of ARF forms and the line items submitted for each reporting cycle. The Schedule's specificity means that legal inquiries and supervisory questions may look to particular submitted aggregates. Clear version control ensures accurate responses to queries and a defensible audit trail.

7. Legal review and governance sign-off

• Ensure legal and compliance teams review the implications of the determination for contract confidentiality, privacy obligations, and group-level information flows. If your ADI is part of a group with intra-group reporting (ARF 720.3 is relevant), consider the group-level exposures and any internal confidentiality protocols that need adjustment.

8. Monitor APRA publications and the Federal Register

• Because publication is discretionary and further determinations may be made by APRA, monitor APRA's outputs and the Federal Register of Legislation for any subsequent determinations or notices that vary the list of non-confidential items. The instrument itself contains no amendment history or expiry clause; practitioners must track any future instruments.

9. Engage APRA where necessary

• If your institution has specific concerns about the non-confidential designation of particular items, raise them through APRA's reporting or supervisory contacts. The determination is an APRA decision under the APRA Act; APRA is the decision maker for publication. The instrument does not set out an internal review mechanism, so effective engagement through usual APRA channels is the practical route.

10. Prepare for data users and market queries

• If APRA publishes the designated aggregates, expect external stakeholders , analysts, journalists, auditors, counterparties , to use the data in comparative analyses. Have internal points of contact ready to respond to queries and to provide context for the published aggregates. The determination does not require APRA to publish explanatory notes; ADIs should be ready to explain their own position if needed.

Each of these steps flows from the instrument's core mechanics: a legal determination that specified parts of ARS 720.x reporting forms "does not contain confidential information" and may therefore be published under subsection 56(5C) of the APRA Act. The determination does not relieve ADIs of reporting duties, nor does it dictate publication mechanics. Compliance therefore focuses on mapping, governance, monitoring, and preparedness rather than on new statutory reporting duties.