Australian Prudential Regulation Authority (confidentiality) determination No. 2 of 2022

This instrument is a legislative determination made by a delegate of the Australian Prudential Regulation Authority (APRA) under section 57 of the Australian Prudential Regulation Authority Act 1998 (the APRA Act). It performs two mechanical acts. First, it revokes the earlier Australian Prudential Regulation Authority (confidentiality) determination No. 12 of 2015. Second, it determines that all or a specified part of the reporting documents listed in Part 1 or Part 2 of the Schedule do not contain confidential information. The effect of that latter determination is that APRA may publish the information under subsection 56(5C) of the APRA Act without needing to treat it as confidential. The determination commences upon registration on the Federal Register of Legislation. A critical timing condition appears in both Parts: the information becomes non‑confidential only after a period of at least 14 days has elapsed from the date the life insurer or friendly society was required to provide the information under the relevant reporting standard (in accordance with paragraph 5 of Reporting Standard LRS 001 Reporting Requirements). This means publication cannot occur immediately upon submission; there is a mandatory 14‑day buffer. The instrument therefore shifts a large category of prudential data from the confidential to the public domain, with a short grace period. The revocation of the 2015 determination suggests that the scope of what may be published has been updated, either expanded or narrowed, but the text makes no explicit statement of expansion or contraction; one must compare the schedules of both instruments to know, and that comparison is not provided. The practical effect is that life insurers and friendly societies must now anticipate that the specific data items and forms listed will become publicly available after the 14‑day window. This changes the incentives around what data is reported and how carefully it is prepared, because reputational and competitive consequences of disclosure attach. The instrument avoids any statement of purpose beyond the note that publication is permitted. There is no mention of why the earlier determination was revoked, nor any explanation of criteria used to decide which data is non‑confidential. That leaves regulated entities with some uncertainty about the rationale. The determination is a self‑executing legislative instrument; it does not require any further action by APRA to activate publication for each form, though APRA retains discretion whether to actually publish at any given time. In economic terms, this determination reduces the cost to third parties of obtaining prudential information, but imposes a compliance and competitive cost on reporting entities who lose control over the confidentiality of granular operational data.

The central concept is “confidential information” as understood under the APRA Act. Section 57 of that Act gives APRA the power to determine, by writing, that all or a specified part of a reporting document does not contain confidential information. The term “confidential information” is not defined in this determination; its meaning derives from the APRA Act and relevant case law, but the instrument does not engage with that definition. Instead, it simply declares that certain information is not confidential, thereby removing it from the statutory protection that would otherwise apply. The determination relies on the definition of “reporting document” in section 13 of the Financial Sector (Collection of Data) Act 2001. That Act governs the collection of data by APRA from financial sector entities. A reporting document is the form or return through which data is provided under a reporting standard. The determination distinguishes between two types of coverage. Part 1 covers “all of the information” in the reporting forms given under listed reporting standards. That is a blanket declaration: every data field in those forms becomes non‑confidential. Part 1 lists current reporting standards (e.g., LRS 112.0, LRS 114.2, LRS 300.0) and two sets of superseded reporting standards (effective 1 January 2008 to 30 September 2009 and 1 October 2009 to 31 December 2012). That means historical data reported under those older standards also loses confidentiality, potentially exposing years of past submissions to public view. Part 2 covers only specified parts of reporting forms. For example, under LRS 110.0 Prescribed Capital Amount, only certain sections of form LRF 110.1 are covered, such as “Section 1: Summary of prescribed capital amount” with specific data items like total amounts for various risk charges. The determination uses a table to identify precisely which data items are covered, often limiting disclosure to “total amount only” for some items (e.g., “Value of investment net of goodwill and other intangibles - total amount only” under LRF 112.3). This partial coverage suggests APRA intended to protect more granular or commercially sensitive sub‑items while still publishing aggregate figures. The timing condition is uniform: the 14‑day period runs from the date the entity was required to provide the information under paragraph 5 of LRS 001. That paragraph governs the lodgement date, so the clock starts on the statutory due date, not the actual date of submission. If an entity submits late, the 14‑day period still runs from the due date. If it submits early, the 14 days begin only on the due date. This creates a predictable, objective trigger. The determination does not grant any power to entities to request an extension of the 14‑day period or to argue that particular data should remain confidential. The decision about what is non‑confidential is made by APRA in the instrument itself. The concept of “revocation” is also important: the previous determination (No. 12 of 2015) ceases to have effect. Any information that was deemed non‑confidential under that earlier determination now falls back to the default position unless covered by this new determination. That could potentially cause a gap or a reversion to confidentiality for some forms, but the instrument’s text does not address transitional treatment of data previously published.

The determination directly affects all life insurers and friendly societies that are required to provide information under the listed reporting standards. That includes both current reporting obligations and historical obligations under superseded standards. The universe of entities is those subject to the Life Insurance Act 1995 and registered under that Act, as well as friendly societies regulated under the Friendly Societies Act 1999 (Commonwealth). The determination does not cover other APRA‑regulated entities such as banks, general insurers, or superannuation funds. Those entities are subject to separate confidentiality determinations. For life insurers and friendly societies, the effect is that data they have already submitted, or will submit, under the named forms is presumptively publishable after 14 days. This imposes a compliance cost: entities must review their data submission processes to ensure that no erroneous or commercially sensitive information beyond what is required is included, because it will become public. It also affects the competitive dynamics of the industry. Competitors, analysts, rating agencies, and the public can now access granular prudential data such as prescribed capital amounts, asset risk charges, insurance risk charges, policy liabilities, and revenue breakdowns. This transparency may benefit market discipline and allow more informed pricing of insurance products, but it also erodes first‑mover advantages and strategic opacity. Smaller friendly societies may be disproportionately affected because their data is not aggregated across large groups and may reveal specific business lines or investment strategies. The determination also affects APRA itself as the publisher. APRA gains the legal ability to release the data, but must manage the operational logistics of publication, including potential errors or misinterpretations. The 14‑day waiting period imposes a coordination cost. Third parties such as financial journalists, academics, and policyholders become indirect beneficiaries because they can access information that was previously unavailable. However, the determination does not compel APRA to publish; it merely permits publication. So the effect depends on APRA’s actual publication practices. If APRA publishes selectively or with delay, the de facto impact may differ. The revocation of the earlier determination also means that entities that relied on the confidentiality of certain data under the 2015 determination must reassess their exposure. The determination does not provide a grandfathering period. The instrument is a legislative instrument under the , which means it is publicly registered and legally binding. It does not require entity‑level consent or notification. Therefore, the affected entities have no right to opt out or seek an exemption from the publication of the listed data. The competitive and reputational consequences are borne entirely by the reporting entities.

The determination imposes no new positive duties on regulated entities. It does not require them to provide any additional information beyond what they already must supply under the financial sector reporting framework. However, it does alter the legal character of the information they are already obliged to provide. The primary duty relevant to this instrument is the duty to provide accurate and timely data under the reporting standards referenced in the Schedule. That duty remains unchanged. The key right created by the determination is the right of APRA to publish the information under subsection 56(5C) of the APRA Act. That subsection permits APRA to publish information that it has determined is not confidential. Without this determination, APRA would be restricted by the general confidentiality obligations in section 56 of the APRA Act, which prohibit disclosure of confidential information except in limited circumstances. The determination thus lifts that prohibition for the specified items. For regulated entities, the instrument creates a kind of negative right: they have no right to stop publication of the listed data after the 14‑day period. They also have no statutory right to be notified before publication, though in practice APRA may choose to inform them. The instrument does not provide any mechanism for entities to contest whether particular data falls within the description. For example, if an entity believes a particular data item in LRF 110.1 should not be covered because it contains non‑public strategy details, the determination gives no room for objection. The only potential avenue would be judicial review of the determination itself (for example, on the ground that APRA exceeded its power under section 57 by declaring information non‑confidential when it is in fact confidential under the Act’s definition). That is a high bar. The 14‑day period does not appear to be a right of review; it is simply a temporal condition that must pass before publication. Entities could use that window to make representations to APRA if they believe publication would cause exceptional harm, but the instrument does not require APRA to consider such representations. The instrument also implicitly affirms the right of the public to access information about the financial health of life insurers and friendly societies, at least to the extent of the listed data. This aligns with a broader policy trend toward transparency in prudential regulation. But it also means that entities lose control over the timing and context of disclosure. The duty to ensure the accuracy of the data becomes more critical: an error in a report that later becomes public could be more damaging than if it remained confidential. Entities may need to invest more in internal data validation and audit to avoid reputational harm. The determination does not address the treatment of corrections or resubmissions. If an entity amends a report after the 14‑day period, the amended data would also be non‑confidential under the same determination, but the original incorrect data may have already been published. That creates a potential liability for misleading information in the public domain.

This determination does not itself create any penalties. Penalties for regulatory breaches arise from the underlying Acts and reporting standards, not from this confidentiality instrument. The relevant enforcement mechanisms are located in the Australian Prudential Regulation Authority Act 1998 and the Financial Sector (Collection of Data) Act 2001. For example, section 15 of the Financial Sector (Collection of Data) Act 2001 makes it an offence to provide information that is false or misleading in a material particular. That offence carries a maximum penalty of 50 penalty units (currently $11,100) or imprisonment for 12 months, or both. That penalty applies regardless of whether the information is later deemed non‑confidential. The determination does not affect APRA’s enforcement powers for failure to report, late reporting, or incorrect reporting. APRA can still issue directions, impose civil penalties, or seek injunctions. The potential reputational harm from publication of inaccurate data could itself act as a powerful informal enforcement mechanism, but that is not a legal penalty. The instrument also does not provide any remedy for entities that believe APRA has published information that should have remained confidential. If APRA publishes data before the 14‑day period expires, or publishes data that falls outside the coverage of the Schedule, the entity’s recourse would be to seek judicial review or an injunction under administrative law, not under this determination. The instrument’s revocation of the prior determination also has no penalty implications; it is merely a legislative change. There is no penalty for an entity that fails to take account of the public availability of its data. For example, if an entity incorporates confidential assumptions into a published filed that are later shown to be flawed, the entity faces potential liability under the general law (e.g., misleading conduct) but not under this determination. APRA could also use the published data in its own enforcement activities: it can compare public data across entities to identify outliers or trends. That may increase the risk of regulatory scrutiny for entities whose published numbers diverge from industry norms. Enforcement of the determination itself is not necessary because it is self‑executing. The real enforcement risk lies in the data being wrong. Entities that previously treated the data as confidential and therefore paid less attention to presentation may need to upgrade their quality assurance. In summary, the determination creates no new penalty regime but amplifies the consequences of existing errors by making them visible to the market and the public.

The determination operates within a web of legislation. Its primary enabling law is the Australian Prudential Regulation Authority Act 1998, specifically section 57 (power to determine non‑confidential information) and section 56 (general confidentiality obligations and the publication power in subsection 56(5C)). The determination also interacts with the Financial Sector (Collection of Data) Act 2001 because the term “reporting document” is defined by reference to section 13 of that Act, and the reporting standards listed are made under that Act. The Acts Interpretation Act 1901 is relevant because subsection 33(3) of that Act is cited as the authority for the revocation. The Legislation Act 2003 governs the registration, tabling, and disallowance of legislative instruments. This determination is a legislative instrument and is subject to parliamentary scrutiny. It is possible that the Parliament could disallow it within 15 sitting days of tabling. That provides an indirect check, though disallowance is rare. The determination does not purport to override the Privacy Act 1988. The data covered is aggregated financial information, not personal information about individuals, so privacy law is unlikely to be engaged. However, if a reporting form contains any personal data (e.g., individual policyholder information embedded in a risk charge calculation), that could create a conflict. The determination does not carve out personal information, so technically such data would become publishable after 14 days. That is a potential interaction that appears unintended. The determination also interacts with the Freedom of Information Act 1982. Information that is determined to be non‑confidential under section 57 is effectively exempt from a FOI claim because it is already made publicly available or available for publication. Conversely, information that remains confidential under the default section 56 regime may be subject to FOI requests, though APRA may claim exemptions. The determination therefore clarifies the scope of FOI accessibility. The revocation of Determination No. 12 of 2015 means that any information that was earlier deemed non‑confidential but is now not listed in this determination reverts to the default confidential status. That could create a discontinuity in public access. Entities that relied on the earlier determination might have assumed their data was public, but now it may be confidential again. The Life Insurance Act 1995 and the Friendly Societies Act 1999 are the substantive prudential frameworks for the regulated entities. The reporting standards made under those Acts prescribe the data to be submitted. This determination does not amend those standards; it only addresses the confidentiality status of the data once submitted. There is no interaction with state or territory laws, as prudential regulation is a Commonwealth matter. The determination does not affect the or ASIC‑administered disclosure requirements, though the published data could be used in a prospectus or market announcement. Companies will need to reconcile their public disclosures with the APRA‑published data to avoid inconsistency.

The only amendment history disclosed in the instrument is the revocation of the earlier determination, the Australian Prudential Regulation Authority (confidentiality) determination No. 12 of 2015. That earlier determination was presumably made under the same provision (section 57) and covered a similar but not identical set of reporting documents. The instrument does not state the date of the 2015 determination or provide details of its coverage. One can infer that the 2015 determination was the operative instrument before this one, and that APRA considered it necessary to replace it, either to update the list of reporting standards (e.g., to add newly introduced standards like LRS 112.0, LRS 114.2) or to adjust the scope of data that may be published. The instrument makes no mention of any amendments between 2015 and 2022. There is no evidence of any other revocation or variation. The current determination has not been amended since its commencement on registration on the Federal Register of Legislation (dated 18 January 2022, registered presumably shortly thereafter). Because the instrument is a legislative instrument, any future amendments would need to be made by another determination. The revocation is effective immediately upon registration. There is no transitional provision that preserves the confidentiality of data reported under the 2015 determination but not covered by this determination. That means any data that was public under the 2015 determination but not listed here becomes confidential again, but any data that was confidential under the 2015 determination but is now listed becomes public. Entities with historical data should check the 2015 schedule against this one to determine which items have changed status. The instrument does not include a note about the date of application for historical data. For superseded reporting standards, the determination applies regardless of whether the data was submitted years ago. There is no sunset clause or periodic review in the instrument itself.

The instrument cites no litigation and no cases are referred to in its text. There is no recorded history of court challenges to the 2015 determination or to earlier confidentiality determinations. However, the broader context includes the possibility of judicial review of APRA’s decisions under section 57. A regulated entity could potentially seek review on the grounds that APRA’s determination that certain information is not confidential is unreasonable in a legal sense, or that APRA failed to take into account a relevant consideration (such as the commercial sensitivity of the data). No such challenge appears to have reached the courts in respect of this specific instrument. There have been cases concerning the definition of “confidential information” under section 56 of the APRA Act. For example, in APRA v Karia (2007) or similar matters, courts have considered the extent of APRA’s confidentiality obligations. Those cases are not binding on this determination but provide background on the strength of the presumption of confidentiality. Because this determination is a legislative instrument, it may be challenged within the statutory framework of the Administrative Decisions (Judicial Review) Act 1977 or the Legislation Act 2003 (for non‑compliance with the legislative instrument making process). The determination appears to have been properly made and registered, so procedural challenge is unlikely. There is also a theoretical possibility of a constitutional challenge if the determination were argued to effect an acquisition of property without just compensation, but that is far‑fetched given the regulatory context. In practice, the litigation risk is low, but entities contemplating litigation would need to show that the determination causes them special damage beyond that suffered by the industry generally. The absence of litigation history suggests that the industry has accepted APRA’s approach to publishing prudential data, or that the costs of challenging are too high relative to the benefit. The determination’s specificity (listing exact forms and data items) reduces ambiguity, which also reduces litigation risk.

Several features of this determination can catch unwary compliance officers. First, the 14‑day period runs from the due date, not the actual submission date. An entity that submits early must still wait until the due date before the clock starts. An entity that submits late has already missed the window; the 14 days began on the due date, so publication could occur shortly after the late submission is finally made. This can create a scenario where a late report becomes public almost immediately. Second, Part 1 covers “all of the information” in the listed forms. That means any free‑text notes, explanatory comments, or supplementary schedules appended to those forms are also publishable. Entities that include cautionary statements or draft annotations in their reports could find those made public. Third, the coverage of superseded standards means historical data from as far back as 2008 is now non‑confidential. Many entities may have assumed old data remained confidential under the 2015 determination. The new determination appears to apply retrospectively to data reported years ago, so long as it was under the listed superseded standards. Fourth, the distinction between Part 1 and Part 2 can cause confusion. For example, LRS 112.0 appears in Part 1 as a current standard (item 1 of Current Reporting Standards) and also appears indirectly in Part 2 via LRS 112.3. But Part 2 covers only specific parts of forms under LRS 110.0, LRS 112.3, etc. An entity might think that because LRS 112.0 is listed in Part 1, all forms under that standard are fully public. But Part 2 limits some forms to total amounts only. However, the instrument actually lists LRS 112.0 in Part 1 (item 1 of Current Reporting Standards) - that is the standard “LRS 112.0 Determination of Capital Base”. Part 2 covers forms under different standards like LRS 110.0 and LRS 112.3 (Related Party Exposures). The relationship is not cross‑referenced. An entity must check both Parts to see if a particular form is covered entirely (Part 1) or only partially (Part 2). Fifth, the determination does not define “life insurer” or “friendly society”. It leaves that to the underlying acts. A foreign life insurer operating in Australia through a branch may be covered. Sixth, there is no grandfathering for data that was confidential under the 2015 determination but is now public. Entities have no warning period; the determination is effective upon registration. Seventh, the 14‑day period applies to each reporting cycle. Older data that was reported under the superseded standards is not subject to a fresh 14‑day period because the trigger was the original due date. The instrument says “where a period of at least 14 days has elapsed from the date the life insurer or friendly society was required to provide the information”. For superseded standards, that due date is long past, so the 14 days have already elapsed. That means historical data is immediately publishable upon the determination’s commencement. Eighth, the . Entities could face continuous uncertainty if APRA publishes data sporadically. Ninth, . For example, a large operational risk charge could signal high operational complexity. The “total amount only” restriction in Part 2 for some items still reveals the aggregate, which may be enough for competitors to infer business models.

Compliance with this determination is largely passive: the information is made non‑confidential by operation of law, and the entity does not need to take any action to enable or prevent publication. However, prudent compliance involves proactive steps. First, entities should map their reporting obligations to the list of standards in the Schedule. Identify which forms and data items fall under Part 1 (full coverage) and which under Part 2 (partial coverage). This mapping should cover current, superseded, and historical submissions. Second, review data accuracy and consistency, because once published, errors can be damaging. Establish internal validation controls for all data items that will become public. This includes checking that total amounts in Part 2 items are correctly calculated and that no explanatory text in Part 1 forms contains misleading statements. Third, consider the timing of public disclosure. Even though the 14‑day period is mandatory, entities may wish to publish their own accompanying commentary or briefing at the same time to ensure the data is not misinterpreted. This is not required by law but can be a sensible way to manage reputation. Fourth, design internal reporting to flag any fields where the instrument says “total amount only” but where the entity might have included sub‑totals. Ensure that no more detail than permitted is included. Fifth, retain records of the original submissions and the due dates, so that the entity can calculate when the 14‑day period expires for each reporting cycle. This is particularly important for late submissions. Sixth, train staff who prepare regulatory returns on the fact that the data is now public after 14 days. Emphasise that free‑text sections may be published verbatim. Seventh, review historical data reported under the superseded standards. If that data contains any errors, now is the time to consider whether to correct them or to prepare a statement addressing them. APRA may publish the historical data at any time. Eighth, monitor APRA’s publication platform for actual release of the data. If data appears that the entity believes falls outside the Schedule, the entity should seek legal advice promptly, as the determination does not provide an internal objection process. Ninth, coordinate with any parent company or group treasury because the published data may reveal group‑level exposures. Finally, review insurance‑specific confidentiality agreements with policyholders or reinsurers. If the published data includes information that was subject to contractual confidentiality, the entity may need to reassess whether the determination overrides that obligation - it likely does because APRA’s statutory power does not depend on private agreements, but this could create a conflict. Legal advice should be sought if such agreements exist. Compliance is not limited to the legal duty; it extends to managing the commercial consequences of transparency.