Application

2. This Prudential Standard applies to all ‘APRA-regulated entities’ defined as:

(a) authorised deposit-taking institutions (ADIs), including foreign ADIs, and non-operating holding companies authorised under the Banking Act (authorised banking NOHCs);

(b) general insurers, including Category C insurers, non-operating holding companies authorised under the Insurance Act (authorised insurance NOHCs), and parent entities of Level 2 insurance groups;

(c) life companies, including friendly societies, eligible foreign life insurance companies (EFLICs) and non-operating holding companies registered under the Life Insurance Act (registered life NOHCs);

(d) private health insurers registered under the PHIPS Act; and

(e) RSE licensees under the SIS Act in respect of their business operations.[1]

3. The obligations imposed by this Prudential Standard on, or in relation to, a foreign ADI, a Category C insurer or an EFLIC apply only in relation to the Australian branch operations of that entity.

4. Where an APRA-regulated entity is the ‘Head of a group’,[2] it must comply with a requirement of this Prudential Standard:

(a) in its capacity as an APRA-regulated entity;

(b) by ensuring that the requirement is applied appropriately throughout the group, including in relation to entities that are not APRA-regulated; and

(c) on a group basis.

In applying the requirements of this Prudential Standard on a group basis, references in paragraphs 13 to 36 to an ‘APRA-regulated entity’ are to be read as ‘Head of a group’ and references to ‘entity’ are to be read as ‘group’.

5. This Prudential Standard commences on 1 July 2019, subject to paragraph 6.

6. Where an APRA-regulated entity’s information assets are managed by a third party, the requirements in this Prudential Standard will apply in relation to those information assets from the earlier of the next renewal date of the contract with the third party or 1 July 2020.