Australian Prudential Regulation Authority (confidentiality) determination No. 2 of 2023

This Determination, made by an APRA delegate under paragraph 57(2)(b) of the Australian Prudential Regulation Authority Act 1998 (the Act), declares that specified parts of particular reporting documents provided by authorised deposit-taking institutions (ADIs) do not contain confidential information (the Determination). The Determination is dated 29 May 2023 and is made by Michael Murphy, Acting Chief Data Officer, Technology and Data. It commences on registration on the Federal Register of Legislation, and it expressly notes that its effect is to permit publication of the non-confidential information under subsection 56(5C) of the Act.

Mechanically, the Determination does three things in the text supplied:

• Identifies the statutory power under which it is made: paragraph 57(2)(b) of the APRA Act. The instrument is thus an exercise of APRA’s confidentiality/determination powers delegated to an officer.
• Specifies the precise reporting forms, items and fields that are to be treated as non-confidential for the purpose of APRA’s publication power: a set of fields from Reporting Standard ARS 110.0 Capital Adequacy (ARF 110.0 1/2 and ARF 110.0) and from Reporting Standard ARS 210.0 Liquidity (ARF_210_1A, ARF_210_2, ARF_210_6). The Schedule lists individual section/item identifiers and internal codes (for example, Section A Item 2.22 Common Equity Tier 1 Capital (CS23805); Section B Item 1.4 Total RWA for credit risk (CS02055); ARF_210_1A item 34 Mean LCR (BSAO25666); ARF_210_2 item 18 Average MLH ratio (BSAO25564); ARF_210_6 item 56 Net stable funding ratio (CS26456)).
• Limits the timing and scope: the Determination applies to those items and "any information that can be derived from these items", and only 60 calendar days after the end of the reporting period to which the disclosure relates. The Determination applies to ARF 110.0 submissions from 1 January 2013 to 31 December 2022 for ARF 110.0 1/2, and ARF 110.0 from 1 January 2023, and to the ARS 210.0 forms as specified.

The legal effect available in the text is narrow and mechanical: by declaring specified parts of specified reporting documents non-confidential, APRA creates the precondition for APRA to publish those data under the Act (subsection 56(5C)). The Determination does not itself publish the data, does not amend the reporting standards, and does not state penalties or new obligations on ADIs beyond changing the confidentiality status of specified items. It is an administrative act that changes whether APRA can treat those specific data items as confidential, and therefore whether APRA may disclose them publicly under the identified statutory publication power.

Several statutory and practical concepts are central to this Determination and are expressly invoked in the text.

• Determination power and delegate: The instrument is explicitly made under paragraph 57(2)(b) of the APRA Act. That paragraph is the source of the delegate’s authority to determine confidentiality. The instrument identifies the maker as an APRA delegate, Michael Murphy, in his acting corporate role. This locates decision-making power within APRA’s internal delegation framework, rather than by primary legislation change.

• Reporting documents and reporting standards: The Determination applies to reporting documents as defined by section 13 of the Financial Sector (Collection of Data) Act 2001. It therefore targets documents created and delivered to APRA under APRA’s data-collection regime and the associated Reporting Standards (ARS 110.0 Capital Adequacy and ARS 210.0 Liquidity). The Schedule cross-references specific reporting forms and “items” within those forms (for example, ARF 110.0 Section A Item 4 Tier 1 Capital (CS02011)), by both human-readable labels and internal data field identifiers.

• Non-confidential information and publication: The instrument explicitly determines that the specified parts of the reporting documents “do not contain confidential information”. The note immediately under the determination clarifies the practical consequence: “The effect of this instrument is that the non-confidential information may be published under subsection 56(5C) of the Act.” That subsection is the statutory mechanism by which APRA may publish non-confidential material. The Determination is therefore a precursor step enabling potential public release.

• Temporal limitation: The Schedule imposes a timing rule. The Determination applies to the specified items and “any information that can be derived from these items” 60 calendar days after the end of the period to which the disclosure relates. That condition creates a delay between data submission and the point at which APRA may treat those items as non-confidential and publish them.

• Scope limitation to specified parts and derived information: The Determination is not a blanket de‑classification of entire reporting forms. It identifies discrete items and notes that “any information that can be derived from these items” is included. The “derived” clause broadens the practical information disclosure beyond the literal field values, because published fields may be used to calculate ratios or other metrics not explicitly listed.

The Determination directly and indirectly affects identifiable groups and institutional relationships described within the instrument.

• Authorised deposit-taking institutions (ADIs): The instrument applies to reporting forms “given to APRA by an ADI under the following reporting standards”. The definition of ADI is drawn from section 5 of the Banking Act 1959, and so the class of affected entities is the statutory ADI population that must submit ARS 110.0 and ARS 210.0 reports to APRA. For those ADIs, the specified items listed in the Schedule are declared non-confidential for the purposes described.

• APRA and its delegates: APRA (the regulator) and the delegate who made the Determination are the decision-makers. The Determination alters APRA’s internal handling of the specified information by removing the barrier to publication for those items after the 60-day delay. APRA staff, data teams, and legal/comms functions will be responsible for implementing the publication process if and when APRA exercises subsection 56(5C) to publish.

• Financial markets and market participants: Although the Determination does not itself publish data, it authorises publication, and so market participants,analysts, investors, lenders, counterparties,are potential indirect beneficiaries of increased transparency in the quantified capital and liquidity metrics specified (for example, Common Equity Tier 1, Tier 1 Capital, Total RWA, LCR mean, MLH average, NSFR). These participants may adjust valuations, credit assessments, or market pricing if APRA publishes the data.

• Depositors and customers of ADIs: The public availability of capital adequacy and liquidity metrics could inform depositor confidence or customer decision-making. The instrument itself names the items rather than those stakeholders, but the content (capital, RWAs, liquidity ratios) are typically the metrics used in assessing safety and soundness.

• Journalists, researchers and the public: The Determination creates a path for APRA to publish specified historic and prospective items (including derived metrics). If APRA chooses to publish, journalists and researchers will have access to consistent, regulator-sourced metrics for comparative work, reporting, and research.

• ADI compliance and risk teams, and external auditors: Those teams must account for the changed confidentiality status of specific fields when advising on internal disclosure policies, preparing public communications, and managing model documentation and data controls. External auditors and advisers may need to consider the changed risk around data leakage and public disclosure.

The Determination itself creates no new affirmative duties on ADIs in terms of data submission; ADIs remain subject to the underlying reporting obligations in the Financial Sector (Collection of Data) Act and the relevant Reporting Standards (ARS 110.0 and ARS 210.0). The instrument does change rights and administrative treatment with the following legal and operational effects:

• Right of APRA to publish: By determining that those specified parts “do not contain confidential information”, APRA acquires the administrative right to publish the specified items under subsection 56(5C) of the APRA Act. The instrument’s own note states this consequence.

• Temporal limitation on publication right: APRA’s declassification is subject to the timing provision in the Schedule: the Determination applies to the specified items and derived information 60 calendar days after the end of the reporting period to which the disclosure relates. That creates a fixed window after reporting for data to become potentially public. ADIs therefore have a predictable time horizon between submission and possible public disclosure of those fields.

• Scope limitation to enumerated items and derived information: The Determination applies only to the listed items (and derivable information). Items not listed in the Schedule remain subject to APRA’s confidentiality protections unless separately determined otherwise. The instrument therefore both limits and defines the regulator’s right to publish.

• No change to submission obligations: The instrument does not alter the obligation to lodge reporting documents with APRA. ADIs must continue to submit the same reporting forms pursuant to the applicable reporting standard determinations (which are cross-referenced in the footnotes). The Determination does not amend the reporting standards themselves.

• Right of APRA to rely on delegation: The maker is identified as an APRA delegate acting under paragraph 57(2)(b) of the Act. This locates the right to make such confidentiality determinations within APRA’s delegated functions, giving the agency an internal administrative mechanism to affect confidentiality treatment without legislative amendment.

• No new statutory penalties or enforcement provisions in this instrument: The Determination does not create new offences, penalties or enforcement mechanisms against ADIs. It changes the confidentiality status of specified data items; separate parts of the APRA Act and the Collection of Data Act (not stated in the Determination beyond references to section 13 and subsection 56(5C)) govern other compliance and enforcement matters.

The Determination does not itself create criminal or civil penalties, nor does it specify enforcement mechanisms or sanctions. It is an administrative determination about confidentiality status. The instrument should be read against the statutory framework it invokes, but the text only explicitly cites two statutory provisions: paragraph 57(2)(b), the source of the delegate’s authority to make the determination; and subsection 56(5C), the mechanism under which APRA may publish non‑confidential information. The Determination’s own text contains no enforcement language.

Practical consequences and enforcement landscape implied by the text:

• No new breach offence in the Determination: The instrument does not say that ADIs will be liable for penalty if APRA publishes or does not publish; it merely declares non‑confidentiality for the listed items. Any penalties connected to reporting accuracy, false statements, or other reporting offences would continue to be governed by the underlying reporting and prudential statutes and regulations, not by this instrument.

• APRA’s internal compliance and disclosure controls: While not addressed in the Determination, APRA will have internal procedures and governance around how it exercises subsection 56(5C) to publish. Those procedural controls are administrative rather than penal in character and are not set out here.

• Potential regulatory follow-on effects not specified: The Determination may have indirect enforcement implications for ADIs because public availability of specific capital and liquidity metrics could change market or supervisory responses. For example, if published data reveal weaknesses, market pressure or supervisory interventions could follow under other parts of the APRA Act or prudential standards. Those downstream enforcement possibilities are not created by the Determination itself and are not articulated in the instrument.

• Delegation and review rights: The instrument identifies a delegate as the decision-maker under paragraph 57(2)(b). The Determination does not specify appeal or merits review mechanisms in its text. Any review rights, judicial or administrative, would arise under the general administrative law framework or judicial review principles applicable to governmental decisions and statutory instruments, not from this instrument’s provisions.

In short, the Determination is administrative and enabling rather than punitive. It reclassifies particular reported items as non‑confidential (subject to the 60‑day rule), thereby enabling APRA to publish under subsection 56(5C), but it does not itself provide for penalties or an enforcement process relating to that reclassification. ADIs’ obligations and any penalties for false or late reporting remain governed by the underlying collection and banking statutes and reporting standards.

The Determination is explicitly framed to interact with a number of other statutory instruments and provisions. The text names the APRA Act as its source power, and it links the content to reporting standards made under the Financial Sector (Collection of Data) Act. The key interactions set out in the instrument are these:

• APRA Act (1998): The Determination is made under paragraph 57(2)(b) of the APRA Act. The instrument also refers to subsection 56(5C) as the enabling publication mechanism. Those references locate the Determination within the APRA Act’s confidentiality/publication framework. The text does not alter the APRA Act itself; it exercises a statutorily provided administrative power.

• Financial Sector (Collection of Data) Act 2001: The “reporting document” term is defined with reference to section 13 of that Act. The reporting forms specified (ARS 110.0, ARS 210.0) are output of reporting standards made under the Collection of Data Act. The footnotes in the Schedule cross-reference specific prior reporting standard determinations (for example, Financial Sector (Collection of Data) (reporting standard) determination No. 2 of 2020; No. 15 of 2017; No. 5 of 2012; and No. 48 of 2023 for ARF 110.0; and similar series references for ARS 210.0). The Determination thus depends on the reporting standards’ content and historical versions to define the scope of the affected fields.

• Banking Act 1959: The Determination invokes the term "authorised deposit-taking institution" and expressly relies on the Banking Act s 5 definition. This cross-reference establishes the class of entities whose reporting documents are in scope.

• Prior reporting standard determinations and technical instruments: The Schedule references earlier determinations that required submission of the specific forms. Those cross-references tie the Determination to the shape and time coverage of those prior standards. For example, the ARF 110.0 1/2 form applicable from 2013 to 2022 is linked to Financial Sector (Collection of Data) determinations No. 2 of 2020, No. 15 of 2017 and No. 5 of 2012, while the ARF 110.0 form from 1 January 2023 is linked to determination No. 48 of 2023 and any future instrument that revokes and replaces it.

• Publication and confidentiality regimes elsewhere: The Determination removes confidentiality status for the listed items, allowing publication under subsection 56(5C) of the APRA Act. It does not state how publication interacts with other secrecy or privacy statutes (for example, privacy law or other sectoral confidentiality obligations). The instrument is silent as to how publication under s56(5C) interacts with other statutes that might otherwise constrain release of confidential or personal information. Practitioners should therefore read the Determination alongside the APRA Act’s wider confidentiality, publication and privacy obligations, and with the content of the reporting standards that govern the data fields.

The instrument text supplied is a single Determination dated 29 May 2023. It records itself as “No. 2 of 2023” and names its maker. The Determination expressly ties into the history of reporting standard instruments by footnote references; those are the only explicit amendment or predecessor connections contained in the text.

Specifically:

• The Schedule treats ARF 110.0 1/2 and ARF 110.0 as covering different date ranges: ARF 110.0 1/2 is identified for 1 January 2013 to 31 December 2022, with a footnote indicating those submissions were required pursuant to Financial Sector (Collection of Data) (reporting standard) determination No. 2 of 2020, No. 15 of 2017, and No. 5 of 2012. ARF 110.0 from 1 January 2023 is linked to Financial Sector (Collection of Data) (reporting standard) determination No. 48 of 2023 and any future determination that revokes and replaces it. These footnote references situate the Determination relative to the reporting standard instruments that governed submission requirements over time. They show that the Determination contemplates both legacy reporting forms (2013-2022) and the post-2023 reporting form.

• For ARS 210.0 Liquidity, the Schedule footnotes list a series of prior reporting standard determinations relevant to liquidity reporting: No. 54 of 2023, No. 4 of 2022, No. 8 of 2021 and No. 19 of 2017. This indicates the Determination’s applicability is intended to align with the reporting standard sequence that required submission of ARF_210 forms.

• The Determination itself is a standalone instrument under the APRA Act; the text does not indicate this Determination supersedes, amends, or revokes prior confidentiality determinations. The text also does not specify subsequent amendments to itself. Any amendment, revocation or replacement would need to be effected by a later determination under the same statutory powers. The instrument expressly contemplates future reporting standard changes ("and any future determination that revokes and replaces this instrument" in the footnotes for ARF 110.0) but does not itself implement or record such future changes.

• Commencement detail: The Determination commences upon registration on the Federal Register of Legislation. There is no staggered commencement or sunset clause in the text; operation is immediate upon registration, subject to the Schedule’s timing rule that the declassification applies 60 calendar days after the reporting period ends.

• No in‑text record of prior versions or amendments: The instrument as supplied contains no explicit amendment history lines declaring earlier versions of this particular Determination, no revocation clause, and no record of being an amending instrument. The only historical linkage in the document relates to the reporting standard instruments that define the reporting forms and their relevant coverage periods.

The instrument does not mention any litigation, court decisions, or judicial review matters. It is an administrative determination and the text contains no list of legal challenges or judicial interpretations. The Determination therefore contains no internal litigation history.

What the Determination’s text allows us to state, based solely on the instrument supplied:

• The instrument is silent on litigation and does not record any legal proceedings either before or after its making. It does not indicate that it is the result of litigation or settlement, nor does it disclose any court decisions that led to this declassification.

• Because the Determination is an administrative instrument, any potential legal challenges (for example, to the delegate’s power or to the correctness of the determination) would proceed under general administrative law remedies, such as judicial review in the relevant courts, and under any statutory review rights if applicable. The instrument does not create or reference any special review route.

• The Determination’s effect,removing confidentiality for identified reporting items,could, in practice, give rise to disputes (for example, if an ADI considered the declaration unlawful or argued that particular items should remain confidential). The instrument does not record any such disputes.

For users requiring litigation information beyond the instrument, the Determination itself provides no litigation history; locating any judicial review or litigation would require an independent search of court records or subsequent APRA materials, which are not included in the instrument text before us. The safe textual point is that the instrument contains no litigation references.

Concrete operational and legal points where parties commonly misunderstand or where the Determination has potential unintended operational consequences are set out here, anchored to the instrument’s text:

• The Determination does not publish anything itself. It only determines that the listed items “do not contain confidential information” and therefore “may be published under subsection 56(5C) of the Act.” Do not conflate the Determination with an immediate data release; APRA retains discretion and administrative steps to publish.

• Time lag matters: the Schedule explicitly applies the declassification “60 calendar days after the end of the period to which the disclosure relates.” This is a fixed post-period delay. ADIs should not assume immediate public exposure at the point of lodgement. The Determination’s timing means there is a predictable delay in which ADI management can prepare for potential publication.

• Scope is field-specific and historical: The Determination applies only to specified items in specified forms. For ARF 110.0, it covers ARF 110.0 1/2 historical form submissions (1 January 2013 to 31 December 2022) and ARF 110.0 from 1 January 2023. For ARS 210.0 it lists three forms and specific items in each. Items not listed remain confidential absent other determinations. Practitioners must map the listed field identifiers (for example, CS23805, CS02011, BSAO25666) to internal reporting and data‑warehouse schemas to understand exactly what will be declassified.

• “Any information that can be derived” is broad: The Schedule includes not only the listed fields but “any information that can be derived from these items.” That increases the scope beyond a literal field list because derived calculations, ratios, or reconciliations based on the listed items may also be treated as non-confidential. ADIs need to inventory not only the fields but commonly derived metrics that third parties could compute.

• Historical range includes legacy forms and codes: Because the Determination covers ARF 110.0 1/2 going back to 2013, historical submissions and associated datasets are potentially declassifiable. ADIs who have legacy data management practices must be aware that older filings may be eligible for publication.

• The Determination is narrow in law but potentially broad in market effect: Legally it is a field-level administrative determination; economically and reputationally, the regulated entity bears the practical consequences of potential publication. The instrument does not mitigate market or reputational risk; it only affects legal confidentiality.

The Determination creates a predictable legal change: specified reporting items and derived information may be published by APRA 60 calendar days after the end of the reporting period. ADIs and their advisers should respond with concrete operational, legal and governance steps anchored to this legal effect.

Recommended compliance steps derived from the instrument’s content:

1. Map the affected fields to internal data systems and reports

   • Identify all internal data elements and reports that correspond to the Schedule’s exact items and field codes (for example, CS23805, CS02011, CS02034, CS02055, CS17743, CS17740, CS17741, CS17742, CS02056, CS02061, CS17744, CS26456, BSAO25666, BSAO25564).
   • Include historic archives relating to ARF 110.0 1/2 submissions (2013-2022) and post-2023 ARF 110.0 submissions.

2. Inventory derived metrics

   • Because the Schedule covers “any information that can be derived from these items”, document commonly produced derived metrics that could be computed from the listed fields (ratios, per‑exposure RWAs, per-jurisdiction splits).
   • Record where those derived metrics are published externally (analyst packs, investor presentations, public filings, internal dashboards).

3. Update confidentiality and access controls

   • Adjust internal data classification and access control policies to reflect that the listed items can become non-confidential after the 60-day window. Ensure that teams who prepare press releases, investor communications and public filings are aware of the timeline.
   • Limit early access within the organisation if necessary, but plan for post-60-day publication scenarios where the same information may be public.

4. Board and management reporting

   • Brief board and senior management on the Determination’s scope, timing and potential market consequences. Include scenario planning for different publication granularities (institution-specific publication, aggregated, anonymised).
   • Ensure investor relations and communications teams have approved messages if APRA publishes the data.

5. Legal review of contracts and confidentiality clauses

   • Review any contractual confidentiality obligations (for example, contracts with data vendors or group companies) that might be impacted by APRA’s publication of derived or raw items. Determine if publication under s56(5C) raises conflict issues and document legal advice.