The instrument sets out a small set of interlocking concepts that determine what the Level 3 Head must do and what APRA can require. Key concepts, as the Standard defines and uses them, are:

• Aggregate risk exposures (s 6). This is the central substantive concept. It covers exposures that, when aggregated, have the potential to produce material losses for the Level 3 group or an individual prudentially regulated institution in the group. The concept explicitly captures concentration risk by counterparty, related counterparty groups, groups with similar characteristics (for example sectors or geographies), and particular asset classes such as property holdings. Both on-balance-sheet and off-balance-sheet exposures are included. The Standard expressly prohibits unlimited exposures to any individual counterparty unless APRA agrees (s 6).

• Materiality. The Standard repeatedly conditions obligations on "material" aggregate risk exposures (ss 6, 9, 10, 13(b), 15). The text does not define "material" within this instrument; readers are signposted to defined-term usage in 3PS 001 (s 4). Practically, materiality gates which exposures must be captured, stress-tested and reported, and it therefore drives the breadth and depth of systems and costs.

• Group and conglomerate scope (s 7). When determining aggregate risk exposures the Level 3 Head must take into account exposures to the wider conglomerate group to which the Level 3 group belongs. This pulls in exposures beyond the immediate Level 3 group and requires aggregation across related entities.

• Exclusions (s 8). Exposures held, under written legal agreements, by the Level 3 group on behalf of external entities (for example custodial holdings), are excluded from aggregate risk exposures. The exclusion hinges on the existence of written legal agreements; the Standard is therefore specific about what custodial or agency arrangements do not count.

• Policy and governance architecture (ss 9-14). The Standard mandates an aggregate risk exposures policy and specifies minimum content, including limits (s 13(c)), procedures for identification and aggregation (s 13(d)), escalation and reporting procedures (s 13(d)(ii)-(iv)), independent review (s 13(a)), and timetable and board responsibilities (ss 12 and 13(d)(vi)). Limits must take into account a non-exhaustive list of exposure types and market/operational risks and be commensurate with the group’s risk appetite, capital and complexity (s 14).

• Management information and reporting (ss 15-16). Management information systems must incorporate reporting on aggregate exposures (s 15). Reports on material aggregate exposures must be supplied to APRA on request (s 16).

• APRA’s intervention powers (ss 5, 17, 20). APRA may in writing require limits or reductions in aggregate exposures and may prescribe calculation methods (s 17). APRA may adjust or exclude specific requirements in relation to a Level 3 Head (s 20). The Standard requires APRA to exercise powers or discretions in writing (s 5).

• Notification and timing obligations (ss 18-19). The Level 3 Head must notify APRA, as soon as practicable and no more than 10 business days after becoming aware, of breaches of the policy’s limits, significant deviations, or inadequacies in the policy and must advise remediation measures (s 18). The Level 3 Head must also submit a copy of its aggregate risk exposures policy to APRA within the same 10 business-day window following Board approval (s 19).

These concepts interact to create a governance and supervisory regime targeted at group-level concentration and aggregation risks, combining a mandatory internal policy framework with APRA’s supervisory and intervention powers.

The Standard applies specifically to each "Level 3 Head" (s 2). That term is used throughout and is defined in the referenced definitions standard 3PS 001 (s 4), so the Standard’s practical footprint depends on the entities captured by that external definition. Within the group, the following parties bear direct obligations or follow-on effects:

• The Level 3 Head entity. The primary obligations,creating and maintaining the aggregate risk exposures policy, conducting stress testing and scenario analysis, integrating management of aggregate exposures into the group risk framework, establishing reporting systems, and notifying and submitting documents to APRA,are vested in the Level 3 Head (ss 9-11, 15, 18-19).

• The Board of the Level 3 Head. The Board must approve the aggregate risk exposures policy, ensure adequate systems and controls, exercise oversight (which may be delegated to a board committee), receive regular reviews and review the policy at least annually (s 12). The Board therefore holds a formal governance obligation and is the authorised body to approve policy limits (s 13(d)(i)).

• Senior management functions. The policy must specify the responsibilities and compliance obligations of senior management in relation to identification, aggregation, monitoring and management of aggregate risk exposures (s 13(d)(i)). Senior management will in practice be responsible for implementing systems, conducting stress tests (s 10), maintaining management information systems (s 15) and executing escalation procedures (s 13(d)(ii)).

• Individual Level 3 institutions. The Standard addresses exposures that may result in material losses for either the Level 3 group or an individual prudentially regulated institution within the group (s 6). Those individual institutions will be indirectly affected by group-level limits, aggregation and reporting, and by any APRA-imposed group-level restrictions (s 17).

• External counterparties and related entities. The Standard requires aggregation across groups of related counterparties and similar-characteristic groups (s 6). This means exposures to the same borrower, corporate group or industry-sector may be aggregated, with practical effects on lending or investment decisions across the Level 3 group.

• Service providers and outsourced functions. The limits and policy must take account of operational risks such as service providers and outsourcing arrangements (s 14(b)). Providers may face increased contractual scrutiny, reporting requirements and continuity expectations.

• APRA. The regulator is both recipient of reporting and the decision-maker with powers to require limits or adjustments, to set calculation methodologies and to adjust or exclude requirements in writing (ss 5, 16-17, 20). APRA is a direct participant in enforcement and supervisory oversight under the Standard.

The Standard excludes exposures held for external entities under written legal agreements (s 8), which affects custodians and trustees by clarifying that bona fide custodial holdings are not to be included in the Level 3 group’s aggregate exposure calculations. The practical implication is that custodial or fiduciary holdings will generally not inflate a Level 3 group’s reported aggregate concentrations, but the exclusion is conditional on written legal agreements being in place (s 8).

Who pays. The compliance costs,systems, independent review, stress testing, Board time, management information systems and potential business changes to reduce exposures,fall on the Level 3 Head and, by extension, the Level 3 group. Where APRA requires limits or calculation changes, the Level 3 Head will bear the cost of implementation (s 17). APRA’s capacity to adjust requirements (s 20) allows for tailored relief or additional obligations in particular cases.

This Standard assigns a set of mandatory duties to the Level 3 Head, duties for the Board and obligations to maintain systems and reporting. It also confers rights and discretions to APRA. The main duties and rights, with their statutory references, are:

Duties on the Level 3 Head

• Policy duty: Maintain an aggregate risk exposures policy addressing all material exposures, with systems and procedures to identify, measure, monitor, evaluate, report and control or mitigate material risks (s 9). The policy content requirements are specified in s 13.

• Stress-testing and scenario analysis duty: Conduct forward-looking scenario analysis and stress testing for material aggregate exposures, assessing the impact on the group’s risk profile, capital strength and earnings (s 10).

• Integration duty: Ensure the management of aggregate risk exposures forms part of the group’s risk management framework (s 11).

• Reporting and information systems duty: Implement management information systems that incorporate reporting on aggregate exposures across the Level 3 group (s 15) and provide reports to APRA on request (s 16).

• Notification duty: Notify APRA as soon as practicable, and in any event no more than 10 business days after becoming aware, of (a) a breach of policy limits, (b) a significant breach or material deviation from the policy, or (c) that the policy did not adequately address a material risk, and advise remedial actions taken or planned (s 18).

• Policy submission duty: Submit a copy of the aggregate risk exposures policy to APRA as soon as practicable, and no more than 10 business days after Board approval (s 19).

Duties of the Board of the Level 3 Head

• Approval duty: Approve the aggregate risk exposures policy (s 12(a)).

• Oversight and control duty: Ensure systems and controls are in place to identify, measure, aggregate, manage, monitor and report on material risk exposures and that those systems are documented (s 12(b)).

• Oversight function: Engage in oversight (directly or via a committee) of the approach to identifying and managing aggregate risk exposures, receive regular reviews, and review the policy at least annually (ss 12(c)-(d)).

APRA rights and discretions

• Supervisory and intervention rights: APRA may require a Level 3 Head to limit or reduce aggregate risk exposures and may determine how a Level 3 Head must calculate an aggregate risk exposure (s 17). In exercising powers or discretions, APRA must do so in writing (s 5).

• Tailoring and waiver discretion: APRA may adjust or exclude a specific requirement in this Prudential Standard in relation to the Level 3 Head (s 20).

• Information right: APRA can request reports on material aggregate exposures and such reports must be provided (s 16).

Ancillary duties embedded in policy composition

• Limits duty: The policy must include limits on acceptable levels of aggregate risk exposures (s 13(c)), and those limits must take into account a broad list of exposure categories, market risks and operational risk exposures and be commensurate with the group’s risk appetite, capital strength, size, business mix and complexity (s 14).

• Procedural duty: The policy must describe procedures for identifying, aggregating, reviewing, controlling and reporting material exposures and include responsibilities, escalation procedures, authority for approving limit excesses and thresholds and procedures for reporting material changes to the Board (s 13(d)(i)-(iv)).

Rights of the Level 3 Head

• Right to APRA variation: While the Standard imposes duties, it also contemplates that APRA may, in writing, adjust or exclude requirements (s 20). That right can be invoked by the Level 3 Head to seek tailored treatment, and conversely it is a power APRA may use unilaterally.

• Exclusion for custodial holdings: Where exposures are held under written legal agreements on behalf of external entities, those exposures are excluded from the Level 3 group’s aggregate exposures (s 8). The Standard thereby grants a substantive exclusion right to groups that can demonstrate such arrangements.

Compliance timing constraints

• Prompt notification and policy submission timelines: The Standard requires notification or submission to APRA as soon as practicable and no more than 10 business days after the relevant triggering event (ss 18-19). That creates binding short-term deadlines for the Level 3 Head.

Practical legal effect

• APRA’s supervisory discretion, together with mandatory governance and reporting duties, reallocates responsibility for aggregate concentration management to Level 3 Heads and their Boards while preserving APRA’s capacity to intervene by written direction or requirement (ss 5, 17, 20). The duties impose quantifiable and qualitative obligations; the Standard leaves measurement choices and materiality judgements to the Level 3 Head subject to APRA’s ability to prescribe calculation methods (s 17).

The text of this Prudential Standard does not specify criminal sanctions, pecuniary penalties or a detailed enforcement regime within the instrument itself. Instead, enforcement mechanics operate through APRA’s supervisory powers and administrative discretions contained in the Standard and the parent Acts under which it is made. The provisions that bear on enforcement and compliance are:

• APRA’s written powers and direction (s 5 and s 17). The Standard requires APRA to exercise its powers or discretion in writing (s 5). Under s 17 APRA may require a Level 3 Head to limit or reduce levels of aggregate risk exposure and may prescribe calculation methods. Those written requirements are enforceable as administrative directions under APRA’s statutory regime.

• Reporting and information rights (s 16). Reports on material aggregate risk exposures must be provided to APRA on request. Failure to supply reports when requested would engage APRA’s supervisory mechanisms under the relevant Acts rather than the Standard itself.

• Notification obligations (s 18). The Level 3 Head must notify APRA within specific timeframes of breaches or deficiencies. Failure to comply with the notification requirement is a breach of the Standard and exposure to supervisory consequences.

• Policy submission duty (s 19). The duty to provide a copy of the Board-approved aggregate risk exposures policy within 10 business days is a discrete compliance obligation. Non-compliance would permit APRA to take supervisory or administrative measures under its statutory powers.

• APRA’s flexibility to tailor requirements (s 20). APRA may adjust or exclude specific requirements for a Level 3 Head. This discretion functions as an enforcement and compliance tool because APRA can dial obligations up or down depending on supervisory assessments.

The Standard itself does not state fines, criminal penalties or administrative sanctions. Enforcement therefore relies on the legal architecture and powers available to APRA under the Banking Act 1959, Insurance Act 1973 and Life Insurance Act 1995, which are the statutory bases noted in s 1 of the Standard. The Standard’s requirement that APRA exercise its powers in writing (s 5) means any enforceable directions or determinations under the Standard will be recorded and formal.

Consequences that are reasonably inferable from the Standard and its interaction with APRA’s supervisory toolkit include:

• Administrative orders or directions requiring remediation or the imposition of limits (s 17).

• Increased supervisory scrutiny, additional reporting requirements or tailored conditions on the Level 3 Head’s authorisations through APRA’s formal powers (ss 16-17, 20).

• Potential reputational consequences for the Level 3 Head and its Board where breaches or material deviations must be notified to APRA within tight timeframes (s 18).

• Operational and commercial consequences, such as forced reduction of exposures, restructuring of funding or asset holdings to meet APRA-imposed limits (s 17).

The Standard provides specific procedural obligations that create points of supervisory leverage rather than specifying in‑instrument monetary penalties. Any formal enforcement action that carries penalties would proceed under APRA’s statutory powers in the relevant Acts cited in s 1, rather than under the Standard’s text alone.

This Prudential Standard is enacted under APRA’s statutory powers and is therefore part of the regulatory regime that attaches to prudentially regulated groups. The instrument names the statutory sources for APRA’s authority and makes explicit connections to other prudential instruments. Key interaction points are:

• Statutory basis (s 1). The Standard is made under section 11AF of the Banking Act 1959, section 32 of the Insurance Act 1973 and section 230A of the Life Insurance Act 1995 (s 1). The Standard’s requirements therefore sit inside APRA’s broader statutory architecture and must be interpreted and enforced consistently with the powers, limits and procedures in those Acts.

• Definitions linkage (s 4). Terms defined in Prudential Standard 3PS 001 appear in bold the first time they are used. This makes the Standard lexically dependent on 3PS 001, so definitions in that standard (for example "Level 3 Head", "material", or other technical terms) will determine the Standard’s precise reach. Practically, compliance requires cross-referencing the definitions standard.

• Risk management integration (s 11). The Standard requires that the management of aggregate risk exposures be part of the Level 3 group’s risk management framework. That framework will typically be shaped by other prudential standards and regulatory expectations. The Standard does not replace those frameworks; rather it imposes an aggregation-specific overlay.

• Reporting and information regime (s 16). The obligation to provide reports to APRA on request operates alongside other statutory reporting duties available to APRA under the Banking, Insurance and Life Insurance Acts. The Standard does not specify its own separate enforcement channel; instead, it locates reporting obligations within the broader APRA supervisory regime.

• Exclusions tied to legal arrangements (s 8). The exclusion of exposures held on behalf of external entities under written legal agreements interacts with trust, fiduciary, custody and agency law concepts. The Standard requires written legal agreements as the condition for exclusion; therefore, legal documentation and its sufficiency will affect whether an exposure is included for prudential aggregation.

• APRA discretion and tailoring (ss 17, 20). APRA’s power to prescribe calculation methodologies (s 17) and to adjust or exclude requirements for particular Level 3 Heads (s 20) creates an administrative interaction where the Standard’s uniform text may be varied to account for circumstances determined by APRA. Those variations must be exercised in writing (s 5), and their legal effect will be governed by the parent Acts.

• Board governance duties (s 12) and other corporate law obligations. The Board’s duties under this Standard sit alongside statutory director duties under general corporate law and other prudential governance requirements. The Standard requires Board approval and oversight but does not displace directors’ general legal duties; compliance planning therefore must consider the interaction between this Standard and other applicable fiduciary, statutory and regulatory obligations.

• Materiality and external standards. The Standard’s repeated reliance on "material" exposures implies cross-references to other standards and expectations where materiality is defined or elaborated, notably 3PS 001. Practitioners must therefore map definitions and thresholds across multiple prudential instruments to ensure consistency.

In short, the Standard is an instrument that operates within APRA’s statutory ecosystem, depends on external definitional standards, dovetails with corporate governance obligations, and leaves practical interactions,such as how custodial arrangements are documented,to contractual and legal frameworks external to the Standard.

The instrument’s text provides only a single explicit historical marker: it commenced on 1 July 2017 (s 3). The Standard as supplied does not record any later amendments or versioning within the document. The only other textual mechanisms that affect the Standard’s functional variability are APRA’s administrative discretions:

• APRA’s power to adjust or exclude requirements (s 20). This provision permits APRA to tailor the Standard’s application to individual Level 3 Heads administratively, rather than through formal legislative amendment. Those adjustments or exclusions are explicitly permitted and may be expected to be recorded in writing given s 5 requires APRA to exercise powers in writing.

• APRA’s ability to determine calculation methods (s 17). APRA may specify how an aggregate risk exposure must be calculated, which functions as an administrative technical amendment to application in particular cases.

Because the Standard is made under the Banking Act, Insurance Act and Life Insurance Act (s 1), formal amendment of the Standard could occur either through APRA exercising its power to remake or revise prudential standards under those Acts or through legislative changes to the parent Acts. The instrument itself, however, contains no record of subsequent instrument amendments, savings provisions or transitional arrangements beyond its commencement date.

Practically, therefore, the amendment history as captured by this document is limited: the Standard came into force on 1 July 2017 and provides APRA with administrative levers to alter application at the Level 3 Head level. The Standard does not document any prior versions, consultation history, or later editions within its text. Users of the Standard must therefore check APRA’s public registers or instrument registers for any subsequent variations, written determinations or exclusions issued under s 20 or written requirements issued under s 17, as those instruments will be the primary source of later changes in application for specific Level 3 Heads.

The Prudential Standard text contains no litigation history, does not cite judicial decisions and does not summarise any contested applications or litigation outcomes. There are no cases, appeals, adjudications or administrative tribunal determinations recorded in the instrument itself.

Consequences of that absence for practitioners and compliance officers are:

• No internal guidance from precedent. With no litigation history included, the text gives no judicially articulated interpretation of key terms such as "material", "aggregate", or how APRA’s discretion to prescribe calculations and limits will be exercised in contested circumstances. That means interpretive uncertainty about borderline matters may remain until administrative practice or case law develops.

• Reliance on APRA’s written instruments. Because APRA must exercise powers in writing (s 5), the body of written directions, calculation methodologies and tailored exclusions that APRA issues will be the primary source of applied regulatory detail. Those APRA instruments and determinations, rather than the Standard itself, will often be the practical basis for compliance obligations that may later give rise to legal challenge.

• Channels for challenge are not specified here. The Standard does not set out procedural pathways for contesting APRA’s decisions. Any legal challenge would therefore proceed by reference to the statutory rights, remedies and procedural mechanisms available under the Banking Act, Insurance Act and Life Insurance Act,the Acts listed as the Standard’s authority (s 1). Those Acts will govern the availability and process of judicial review, merits review or other dispute resolution mechanisms, but this Standard does not summarise or modify those channels.

Practitioners should therefore treat this Standard as a regulatory-rule instrument that creates supervisory duties and administrative discretion, with the expectation that the finer points of application and legal contestation will occur through APRA’s written directions, individual determinations under ss 17 and 20, and any judicial consideration of those directions under the parent Acts. Because the instrument does not contain litigation history, monitoring APRA’s public determinations and any reported challenges will be necessary for an evolving understanding of legal exposure and interpretation.

The Standard contains a number of provisions where operational detail, timing or conditioning clauses create practical traps if not properly understood. Below are the specific items to watch for, each traced to the relevant provision:

• Broad concept of aggregate exposures (s 6). The Standard requires aggregation across counterparties, related groups, groups with similar characteristics and asset classes, including both on- and off-balance-sheet items. Entities that focus only on on-balance-sheet or single-entity exposures will undercount exposures. The Standard’s examples (geography, sector, property holdings) indicate a wide aggregation approach.

• Unlimited exposures not permitted unless APRA agrees (s 6). A Level 3 group that relies on guarantees or general arrangements that create effectively unlimited counterparty exposure must obtain APRA agreement or otherwise be outside compliance. That is a strict negative rule with an APRA consent carve-out.

• Exclusion conditions are documentation dependent (s 8). Custodial or fiduciary holdings are excluded only where held in accordance with written legal agreements. Where the custodial documentation is incomplete, vague or informal the exclusion may not apply and those holdings could inflate aggregate concentrations.

• Materiality is unlabeled in this instrument (s 6, s 9, s 13, s 15). The Standard repeatedly uses "material" but does not define it here; definitions are in 3PS 001 (s 4). Failure to align materiality thresholds across policies and systems can produce inconsistent reporting and unexpected APRA reactions.

• Tight notification and submission windows (ss 18-19). The Standard requires notifications and policy submissions "as soon as practicable, and no more than 10 business days" after becoming aware of a breach or after Board approval. That is a finite administrative deadline that requires rapid internal escalation and templated reporting processes to APRA.

• Board-level approvals and reviews (ss 12, 13(d)(vi)). The Board must approve the policy and review it at least annually. Boards that lack scheduled time or information to perform an informed annual review will breach the governance requirements.

• Independent review required but unspecified (s 13(a)). The policy must be subject to independent review, yet the instrument does not specify the nature, frequency, scope or independence criteria for that review. That ambiguity creates procurement and resourcing choices that bear compliance risk if APRA judges a review inadequate.

• APRA can dictate calculation methods (s 17). Even where a Level 3 Head believes its measurement approach is sound, APRA can require a different calculation method. Systems must therefore be flexible to implement alternative calculation approaches at APRA’s direction.

• APRA’s written discretion and tailoring (ss 5, 20). APRA’s capacity to adjust or exclude specific requirements can be an administrative benefit, but reliance on obtaining an exclusion is itself a compliance risk: until APRA grants an exclusion in writing, the Standard applies in full.

• Management information and reporting system scope (s 15). The MIS must incorporate reporting across the Level 3 group. Aggregating data from diverse legal entities, jurisdictions and legacy systems can be technically challenging and costly, and the Standard’s requirement that reports be available to APRA on request (s 16) means ad hoc retrieval capability is necessary.

• Interaction with wider conglomerate exposures (s 7). The Level 3 Head must take into account exposures to the wider conglomerate group. That can bring entities outside the immediate regulatory perimeter into prudential aggregation calculations, complicating data-gathering and legal authority to access information.

• Operational risk inclusions (s 14(b)). Limits must consider operational risks such as outsourcing and business continuity management. These are non-financial risks that may require qualitative assessments and contingency planning as part of the exposures policy.

These "gotchas" are concrete operational and governance risks embedded in the text. Addressing them requires clarity in documentation (especially custodial agreements), rapid escalation and reporting protocols, flexible measurement systems, Board scheduling and information flows, procurement of independent review services meeting APRA expectations, and readiness to implement APRA-directed calculation changes.

Compliance with the Standard requires a structured programme that aligns governance, systems, measurement, reporting and regulatory engagement. The following is a practical checklist of actions a Level 3 Head should take, mapped to the relevant provisions:

1. Confirm applicability and definitions (s 2; s 4)

   • Identify whether your entity is a Level 3 Head by consulting Prudential Standard 3PS 001. Ensure that all defined terms used in the Standard are cross-referenced and understood.

2. Draft and maintain an aggregate risk exposures policy (s 9; s 13)

   • Prepare a written policy that captures all material aggregate risk exposures, includes limits on acceptable aggregate exposures (s 13(c)), and documents systems and procedures to identify, measure, monitor, report and mitigate these exposures (s 9, s 13(d)).
   • Ensure the policy is conceptually sound, consistently implemented, transparent and subject to independent review (s 13(a)).

3. Board approval and governance arrangements (s 12; s 13(d)(i), (vi))

   • Schedule Board approval promptly. The Board must approve the policy (s 12(a)), ensure adequate systems and controls (s 12(b)) and engage in oversight, including receiving regular reviews and annual policy review (s 12(c)-(d)).
   • Document the respective responsibilities of the Board, its committees and senior management in the policy (s 13(d)(i)).

4. Implement limits and procedures (s 13(c)-(d); s 14)

   • Establish aggregate exposure limits appropriate to the group’s risk appetite, risk profile and capital strength, taking into account the categories listed in s 14.
   • Define escalation procedures for limit breaches, circumstances and authority for exceeding limits, thresholds for reporting material changes to the Board and a timetable for Board review of reports (s 13(d)(ii)-(vi)).

5. Develop measurement and stress-testing capability (s 10)

   • Implement forward-looking scenario analysis and stress testing that assesses the impact of market movements and key risk factors on aggregate exposures and on the group’s capital and earnings (s 10).

6. Build management information and reporting systems (s 15-16)

   • Ensure MIS can aggregate on- and off-balance-sheet exposures across entities in the Level 3 group and, where relevant, the wider conglomerate (s 6-7, s 15).
   • Put procedures in place to produce reports on material aggregate exposures for APRA on request (s 16).

7. Address exclusions documentation (s 8)

   • Where assets are held on behalf of external entities, ensure written legal agreements clearly evidence custodial or agency arrangements so those exposures can be excluded under s 8.

8. Implement independent review processes (s 13(a))

   • Commission independent reviews of the policy and related systems. Determine scope, frequency and independence criteria that would be persuasive to APRA, and document findings and remediation plans.

9. Establish notification and submission workflows (ss 18-19)

   • Create an escalation protocol to notify APRA "as soon as practicable, and no more than 10 business days" after becoming aware of breaches, significant deviations, or policy inadequacy (s 18). Record decision-making and remedial actions for the notification.
   • Prepare templated submissions so a copy of the Board-approved policy can be submitted to APRA within 10 business days following approval (s 19).

10. Prepare for APRA interventions and calculation changes (s 17)

    • Ensure systems and models are sufficiently flexible to incorporate any calculation methodologies APRA may require and to implement limits or reductions APRA may impose.
    • Retain robust documentation to demonstrate the group has been acting consistently with the aggregate risk exposures policy if APRA considers past conduct when imposing requirements (s 17(a)).

11. Liaise with legal and compliance to map interdependencies (s 4, s 7)

    • Coordinate legal, compliance and finance teams to ensure definitions, intragroup data access, trust/custody documentation, and cross-border information flows are aligned with policy requirements and APRA expectations.

12. Seek APRA clarity or tailored relief where appropriate (s 20)

    • If particular requirements present disproportionate compliance costs or are inapplicable because of the group’s structure, engage with APRA to request an adjustment or exclusion under s 20. All such arrangements should be sought and recorded in writing, noting s 5 requires APRA to exercise discretion in writing.

13. Ongoing monitoring and review

    • Operate a timetable for regular review of the policy and related reports; ensure the Board receives timely and accurate material on aggregate exposures at intervals consistent with the policy (s 13(d)(vi)).

Operational tips to reduce friction

• Pre-document custodial and agency relationships to secure exclusions under s 8. Contractual clarity here reduces inadvertent inclusion of client assets in aggregate exposure calculations.

• Build a rapid-reporting pack to satisfy the 10-business-day notification and submission deadlines (ss 18-19). Drill escalation and approval chains so notices to APRA can be issued promptly.

• Ensure data architecture can capture off-balance-sheet items, related-counterparty groupings and sectoral/geographic classifications identified in s 14.

• Keep a regulatory log of any written APRA directions, calculation methodologies and tailored adjustments, since APRA’s written instruments (ss 5, 17, 20) will define compliance scope for particular Level 3 Heads.

Following this checklist aligns internal controls and governance with the Standard’s text, places emphasis on documentary evidence and timely notification, and readies the Level 3 Head to respond to APRA’s written interventions.