Banking (prudential standard) determination No. 4 of 2023

Banking (prudential standard) determination No. 4 of 2023, made by APRA delegate Clare Gibney on 6 September 2023 under subsection 11AF(1) of the Banking Act 1959, revokes the 2013 version of Prudential Standard APS 910 Financial Claims Scheme and replaces it with a revised standard commencing 1 October 2023. The revocation instrument operates under subsection 11AF(3) of the Banking Act, and the new determination operates under subsection 11AF(1).

The mechanical effect is to impose a standing preparedness obligation on locally incorporated authorised deposit-taking institutions (ADIs). Every such ADI must, at all times, maintain the data systems, internal controls, testing regimes, audit arrangements, and communication infrastructure that would allow APRA to activate the Financial Claims Scheme (FCS) against that ADI at short notice. The FCS is a government deposit guarantee scheme under Part 2, Division 2AA of the Banking Act that pays depositors up to the FCS limit (set by the Banking Regulation 2016) from public funds if an ADI is declared by the Minister under section 16AD of the Banking Act.

The standard does not activate the FCS; it governs operational readiness for the scenario in which the FCS is activated. The core deliverable is the Single Customer View (SCV): a consolidated record of every protected account held by each unique account-holder, calculated at end-of-day, showing aggregate balances to the nearest cent. Within 48 hours of an FCS declaration (or an APRA test request), the ADI must produce that SCV. Within a further 24 hours, the ADI must generate and transmit payment instruction information to a paying agent, normally the Reserve Bank of Australia, in either EFT or cheque format. Reports must flow to APRA, account-holders, and the ATO within prescribed windows. The CEO must attest annually that all these capabilities are in place. External audit must provide limited assurance that the controls are designed correctly and operating effectively.

meta-content-style-type: text/css meta-content-type: application/xhtml+xml; charset=utf-8 meta-keywords: "[SEC=OFFICIAL]"

Commonwealth Coat of Arms

Banking (prudential standard) determination No. 4 of 2023

Prudential Standard APS 910 Financial Claims Scheme

Banking Act 1959

I, Clare Gibney, a delegate of APRA:

(a) under subsection 11AF(3) of the Banking Act 1959 (the Act) REVOKE Banking (prudential standard) determination No. 2 of 2013, including Prudential Standard APS 910 Financial Claims Scheme made under that determination; and

(b) under subsection 11AF(1) of the Act DETERMINE Prudential Standard APS 910 Financial Claims Scheme, in the form set out in the schedule, which applies to ADIs to the extent provided in paragraph 2 of the prudential standard.

This instrument commences on 1 October 2023.

Dated: 6 September 2023

Clare Gibney

Executive Director, Policy & Advice

APRA

Interpretation

In this instrument:

ADI has the meaning given in section 5 of the Act.

APRA means the Australian Prudential Regulation Authority.

Schedule

Prudential Standard APS 910 Financial Claims Scheme comprises the document commencing on the following page.

Commonwealth Coat of Arms

Prudential Standard APS 910

Financial Claims Scheme

Objective and key requirements of this Prudential Standard

This Prudential Standard sets out the minimum requirements that a locally incorporated authorised deposit-taking institution (ADI) must meet to ensure that it is adequately prepared, should it become a declared ADI for Financial Claims Scheme (FCS) purposes. The Board and senior management of an ADI are ultimately responsible for ensuring that appropriate policies and procedures are in place to ensure the integrity of the operations, internal controls and information required under this Prudential Standard.

The key requirements of this Prudential Standard are that an ADI must:

 identify each unique account-holder, to the extent practicable;

 develop and implement a Single Customer View;

 be able to generate and transmit payment instruction information for payment by electronic funds transfer and/or cheque in respect of each account-holder;

 facilitate the collection of an account-holder’s alternative ADI account data to which an EFT payment may be made for FCS purposes;

 generate and provide reports to APRA and to account-holders and other parties on APRA’s behalf;

 facilitate communications with account-holders and other relevant parties;

 comply with requirements specified from time to time by APRA for the purpose of testing the generation of Single Customer View data, the generation and transmission of payment and reporting information and communications arrangements;

 ensure that the systems and data required by this Prudential Standard are subject to external audit; and

 provide an attestation by the Chief Executive Officer.

Table of contents

Time for generating SCV data

Generation and transmission of payment instruction information

Payment methods

Capturing alternative ADI account data

Time for generating and transmitting payment instruction information

Reports

Time for generating and transmitting reports to APRA

Adjustments and exclusions

Previous exercise of discretion

Attachment A

Account-holder information

Account details

Account-holder aggregate details

Attachment B

Principles for account aggregation

Calculation of end-of-day deposit balances

Process for determining end-of-day position

Declaration of a direct participant

Accrued interest

Treatment of unsettled payments

Attachment C

Account-holder FCS balance and payment details

Account priority

Apportionment when the aggregate account-holder entitlement is above the FCS limit

ADI summary account-holder and payment data

Authority

This Prudential Standard is made under section 11AF of the Banking Act 1959 (Banking Act).

Application

2. This Prudential Standard applies to all authorised deposit-taking institutions (ADIs) except for foreign ADIs and purchased payment facility providers.

Commencement

3. This Prudential Standard commences on 1 October 2023.

Interpretation

4. In this Prudential Standard:

(a) terms that are defined in Prudential Standard APS 001 Definitions appear in bold the first time they are used in this Prudential Standard. Where this Prudential Standard requires a thing to be done, that requirement is to be read as excluding the operation of subsection 36(2) of the Acts Interpretation Act 1901;[1]

(b) where APRA may exercise a power or discretion, this power or discretion is to be exercised in writing; and

(c) unless the contrary intention appears, a reference to an Act, Regulations or Prudential Standard is a reference to the Act, Regulations or Prudential Standard as in force from time to time.

Definitions

5. In this Prudential Standard:

(a) ‘AEST’ means Australian Eastern Standard Time;

(b) ‘Alternative ADI account data’ refers to the BSB and account number details at an alternative ADI to which EFT payment may be made in the event that the ADI is a declared ADI;

(c) ‘Approved form’ means a form approved, in writing, by APRA and which APRA publishes on its website from time to time;

(d) ‘ATM’ refers to automatic teller machine;

(e) ‘ATO’ refers to the Australian Taxation Office;

(f) ‘declared ADI’ has the meaning in subsection 5(1) of the Banking Act;

(g) ‘electronic banking’ means all electronic delivery channels, such as internet banking, telephone banking and mobile phone banking, which are accessed using a unique customer identification and password;

(h) ‘EFT’ refers to electronic funds transfer;

(i) ‘EFTPOS’ refers to electronic funds transfer at point of sale;

(j) ‘end-of-day’ means 9.00 am AEST on the day following the date on which the Minister’s declaration is made under section 16AD of the Banking Act in relation to an ADI or, for testing purposes, 9.00 am AEST on the day following the date on which APRA requests that the information be generated by an ADI;

(k) ‘FCS’ refers to the Financial Claims Scheme for ADIs provided for under the Banking Act;

(l) ‘FCS limit’ means the limit on payments to an account-holder with a declared ADI, as set out in the Regulations;

(m) ‘FCS balance’ means the aggregate amount an account-holder is entitled to be paid by APRA in respect of protected accounts under Part 2, Division 2AA of the Banking Act, being not more than the FCS limit;

(n) ‘prescribed account’ is an account prescribed under subsection 16AH(5) of the Banking Act;

(o) ‘protected account’ has the meaning in section 5 of the Banking Act;

(p) ‘Regulations’ refers to the Banking Regulation 2016; and

(q) ‘SCV’ refers to Single Customer View.

Single Customer View

6. An ADI must identify each unique account-holder, to the extent practicable, for the purposes of being able to pay an account-holder who holds a protected account should the ADI be a declared ADI under section 16AD of the Banking Act.

7. An ADI must be able to generate the aggregate balance of all protected accounts held by an account-holder in the form of an SCV.

8. An ADI must maintain its SCV systems and the SCV data generated by those systems in Australia, unless otherwise approved by APRA.

9. An ADI must:

(a) include in its SCV the information set out in Attachment A; and

(b) comply with requirements concerning account aggregation and end-of-day positions set out in Attachment B.

Time for generating SCV data

10. An ADI must generate SCV data from its end-of-day deposit balances not later than 48 hours after the end-of-day on which:

(a) a declaration is made under section 16AD of the Banking Act; or

(b) APRA requests the ADI to generate the data.

Generation and transmission of payment instruction information

11. An ADI must be able, to the extent practicable, to identify payment instruction information for each account-holder according to principles set out in Attachment C.

12. To enable the payment to an account-holder who holds a protected account, an ADI must be able to generate and transmit payment instruction information to a person (paying agent) nominated by APRA, using any of the payment methods specified in this Prudential Standard.

Payment methods

13. The payment methods specified under this Prudential Standard are:

(a) electronic funds transfer (EFT) made by the Reserve Bank of Australia (RBA), or another paying agent nominated by APRA, to an account held by an account-holder at another ADI; and

(b) cheque drawn on the RBA.

14. For each specified payment method, the payment instruction information must contain the information specified in the approved forms.

Capturing alternative ADI account data

15. An ADI must be able to capture alternative ADI account data for an account-holder who is an existing electronic banking user. APRA may exempt an ADI from this requirement. APRA may approve an alternative data capture arrangement for an ADI that meets the requirements specified in paragraph 16 of this Prudential Standard.

16. An ADI must be able to capture alternative ADI account data in a way that:

(a) is secure;

(b) is able to identify an account-holder via electronic banking using a unique customer identifier and password, where such channels are maintained by the ADI;

(c) is able to receive and store an account-holder’s alternative ADI account data, including the BSB and account number, for the purposes of incorporating this information into the EFT payment information file sent to the RBA or another paying agent nominated by APRA for FCS purposes;

(d) records the account-holder’s consent for the alternative ADI account data to be provided to APRA and to the RBA or another paying agent nominated by APRA for FCS purposes; and

(e) allows the BSB and account number data to be merged with the account-holder’s SCV data to create information on an EFT payment or required report in relation to such payments.

17. An ADI must not use any alternative ADI account data for any purpose except as required in this Prudential Standard or by APRA.

Time for generating and transmitting payment instruction information

18. An ADI must be able to generate and transmit payment instruction information to a person (paying agent) nominated by APRA not later than 24 hours following the generation of SCV data.

Reports

19. An ADI must be able to identify reporting information in the form specified by APRA for each account-holder and at an aggregate ADI level.

20. An ADI must:

(a) be able to generate and transmit reports to APRA, and to any party nominated by APRA, in accordance with approved forms within the time periods specified in this Prudential Standard; and

(b) be able to generate reports on behalf of APRA in accordance with the approved forms, and be able to transmit those reports to APRA, and to any person nominated by APRA, in sufficient time to enable APRA to comply with its obligations to issue reports to account-holders and the Australian Taxation Office (ATO) under the Banking Act.

21. An ADI’s systems must be able to be updated to reflect account-holder balances, taking account of amounts that are paid for FCS purposes, to enable an account-holder to be provided with information on the balance in each protected account they hold, including transaction details related to FCS payments made.

Time for generating and transmitting reports to APRA

22. An ADI must be able to generate and transmit reports referred to in paragraph 20(a) of this Prudential Standard to APRA, or a person nominated by APRA, as follows:

(a) the SCV summary report - at the same time as the SCV;

(b) the EFT and cheque payments and summary reports - at the same time as the payment instruction information;

(d) the prescribed accounts and summary report - within 48 hours following the provision of the EFT and cheque payments reports; and

(e) any other report specified by APRA in an approved form - within the period specified by APRA.

Communications

23. An ADI must be able to communicate with account-holders and other customers in the event that it becomes a declared ADI by way of the communication channels maintained by the ADI including, where applicable, the ADI’s website, electronic banking facilities and call centre. Communications for this purpose include:

(a) conveying FCS-related information as specified by APRA;

(b) responding to FCS-related enquiries from account-holders and other customers; and

(c) recording information from an account-holder relevant to the preparation of the SCV and payment instruction information for FCS payments.

24. An ADI must maintain communication channels that are adequate to respond effectively, and in a timely manner, to the volumes of account-holder and other customer enquiries that may reasonably be expected in the event that the ADI becomes a declared ADI.[2] At a minimum, an ADI must maintain an existing website to convey FCS-related information specified by APRA from time to time, and must maintain the capability to respond to account-holder and customer queries by telephone and internet.

Testing

25. An ADI must regularly review and test[3] its ability to:

(a) generate SCV data as required by this Prudential Standard;

(b) capture alternative ADI account data for an existing electronic banking account-holder as required by this Prudential Standard;

(c) generate and transmit payment instruction information to the RBA, or another paying agent nominated by APRA, as required by this Prudential Standard, in a way that maintains the confidentiality of account-holder information;

(d) generate and transmit the reports as required by this Prudential Standard; and

(e) comply with the communications requirements in this Prudential Standard.

An ADI must test these requirements in accordance with a testing schedule that will be specified by APRA.

26. An ADI’s FCS-related systems and processes must be revised to address any shortcomings identified as a result of the review and testing required under paragraph 25 of this Prudential Standard.

Audit

27. In accordance with Prudential Standard APS 310 Audit and Related Matters (APS 310), the appointed auditor must provide limited assurance that:

(a) the ADI has controls that are designed to ensure that SCV data, to the extent practicable, and FCS payment and reporting information can be relied upon as being complete and accurate and in accordance with this Prudential Standard; and

(b) these controls operated effectively when tested.

28. An ADI must ensure that the appointed auditor provides the assurance required by paragraph 27 of this Prudential Standard at the same time as assurance is required by APS 310, unless otherwise agreed by APRA.

29. Notwithstanding the requirements in paragraph 27 of this Prudential Standard, APRA may require an ADI to engage an auditor to undertake a reasonable or limited assurance engagement[4] of SCV systems and data, and the systems used to generate and transmit FCS payment and reporting information.

Attestation

30. It is the responsibility of the Board and senior management of an ADI to ensure that appropriate policies and procedures are in place to ensure the integrity of the operations, internal controls and information required by this Prudential Standard.

31. An ADI must, within three months of its annual balance date, provide APRA with an attestation from its CEO.[5]

32. The CEO must attest, for the financial year to which the declaration relates, that:

(a) the ADI has taken all necessary steps to ensure that it is compliant with the requirements set out in this Prudential Standard;

(b) the ADI has systems and processes that allow it to identify, to the extent practicable, each unique account-holder who holds a protected account;

(c) the ADI is able to calculate an SCV for each unique account-holder identified and transmit those data to APRA, or to a person nominated by APRA, as required by this Prudential Standard;

(d) the ADI is able to generate and transmit payment instruction information for FCS purposes to the RBA, or another paying agent nominated by APRA, as required by this Prudential Standard;

(e) the ADI is able to generate and transmit reporting information to APRA, an account-holder, the ATO and any other party nominated by APRA, as required by this Prudential Standard;

(f) the ADI’s systems and associated controls are adequate for the purposes of ensuring that data generated by SCV systems are complete and accurate, to the extent practicable;

(g) the ADI’s systems and associated controls are adequate for the purposes of ensuring that the FCS payment and reporting information generated and transmitted by the ADI’s systems, including the ability to capture alternative ADI account data, are complete and accurate;

(h) the ADI is able to comply with the communications requirements set out in this Prudential Standard; and

(i) the ADI is able to comply with the testing requirements set out in this Prudential Standard.

33. If the CEO is unable to provide the attestation required by paragraph 31 of this Prudential Standard without qualification, the CEO must set out in the attestation the reasons why he or she is unable to make an unqualified attestation.

34. An ADI may provide the attestation required at paragraph 31 of this Prudential Standard at the same time and as part of the declarations required by APS 310.

Adjustments and exclusions

35. APRA may adjust or exclude a specific prudential requirement in this Prudential Standard in relation to one or more specified ADIs.[6]

Previous exercise of discretion

36. An ADI must contact APRA if it seeks to place reliance, for the purposes of complying with this Prudential Standard, on a previous exemption or other exercise of discretion by APRA under a previous version of this Prudential Standard.

Attachment A

This Attachment sets out the data that an ADI must include as part of each account-holder’s SCV (refer to Table 1 for data items to be included). The data are necessary to ensure the integrity of the SCV. The SCV will ensure the identification of protected accounts for each unique account-holder, thereby facilitating the timely and accurate payment of FCS balances to account-holders in the event that an ADI is declared by the Minister under section 16AD of the Banking Act.

Account-holder information

An ADI must identify each unique account-holder, to the extent practicable. For this purpose, an ADI will need to have some form of unique account-holder identifier that can be used to identify each account-holder and aggregate the balances in protected accounts for an account-holder into an SCV. The account-holder identifier will form the basis for the payment of balances held in protected accounts up to the FCS limit. The account-holder identifier must be limited to a maximum of 18 characters.
The account-holder status refers to the status an ADI normally uses for this purpose e.g. whether the account-holder is deceased, bankrupt, has no valid address or any other indicator the ADI may use to identify the status of the account-holder.
An ADI must capture the account-holder details in Table 1, including such matters as title, name, address (both street and mailing address), telephone numbers and email addresses to the extent that the ADI has these data in its source systems.

Account details

4. This is the information that an ADI must include for each protected account that is aggregated for each account-holder into an SCV.

Account-holder aggregate details

5. The aggregate details refer to the sum of all individual account balances for an account-holder.

Table 1

Account-holder SCV

1. Account-holder identifier
1.1 Account holder identifier
1.2 Account-holder status
1.3 Whether account-holder is an electronic banking customer
1. Account-holder details
2.1 Entity details
2.1.1 Entity type
2.2 Entity name
2.2.1 Title
2.2.2 Surname
2.2.3 Middle name or initial
2.2.4 First name or initial
2.2.5 Suffix
2.3 Date of birth
2.4 Street address details
2.4.1 Unit / Street Number
2.4.2 Street Name
2.4.3 City/Town/Suburb
2.4.4 State
2.4.5 Postcode
2.4.6 Country
2.5 Mailing address details
2.5.1 PO Box (if applicable)/ RMB etc
2.5.2 Unit / Street number
2.5.3 Street Name
2.5.4 City/Town/Suburb
2.5.5 State
2.5.6 Postcode
2.5.7 Country
2.6 Email address details
2.7 Telephone number details
2.7.1 Home telephone
2.7.2 Work telephone
2.7.3 Mobile telephone
1. Account details (for each protected account for each account-holder)
3.1 Account title
3.1.1 Account status
3.1.2 Account classification
3.2 BSB
3.3 Account number
3.4 Product type
3.4.1 Product name
3.5 Account entitlement
3.5.1 Account balance – cleared funds
3.5.2 Account balance – uncleared funds
3.5.3 Account balance – principal
3.5.4 Accrued interest
3.5.5 Fees, charges and duties payable
3.5.6 Withholding tax

1. Account-holder aggregate account details
4.1 Aggregate account-holder entitlement
4.1.1 Aggregate balance – cleared funds
4.1.2 Aggregate balance – uncleared funds
4.1.3 Aggregate balance – principal (sum of balances in all protected accounts)
4.1.4 Aggregate accrued interest (sum of accrued interest for all protected accounts)
4.1.5 Aggregate fees, charges and duties payable (sum of fees, charges and duties payable for all protected accounts)
4.1.6 Aggregate withholding tax (sum of withholding taxes for all protected accounts)
4.2 Estimate of account-holder’s aggregate FCS entitlement

6. An ADI must ensure that controls are in place in relation to its SCV data such that:

(a) data sourced from any product, customer or other ADI system for SCV purposes are complete and accurate, to the extent practicable;

(b) all fields are populated with data, or fields with no data are flagged as data ‘not available’ or blank filled as appropriate;

(c) calculation fields are accurate (for example, an account-holder’s aggregate account-holding is equal to the sum of its constituent parts);

(d) to the extent practicable, name and address fields are complete and valid;

(e) all records are referenced to their source;

(f) to the extent practicable, there are no duplicate records for an account-holder; and

(g) SCV account balances are reconciled to source systems.

Attachment B

This Attachment includes requirements concerning account aggregation and calculation of end-of-day positions.

Principles for account aggregation

The account aggregation principles are designed to assist an ADI with the treatment of balances in protected accounts. How an account is treated will depend on the entity type (as defined in sections 960-100 of the Income Tax Assessment Act 1997) and whether the account is held in a single name or in multiple names.
An ADI must apply the following rules when dealing with protected accounts:

(a) each protected account attributable to an account-holder must be aggregated under an SCV for the purpose of establishing an account-holder’s balance;

(b) account aggregation for SCV purposes must include aggregation of all protected accounts in an account-holder’s name including protected joint accounts, business accounts, prescribed accounts and all other protected accounts held by an account-holder, whether individually or jointly;

(d) joint accounts must be split on a proportionate basis between all account-holders named on that account (e.g. for a joint account with four named account-holders, each account-holder would have one quarter of the total account balance included as part of their aggregated protected account balance); and

(e) where a business account is held in an entity’s name, the balance must be treated as belonging to a single account-holder, being the person (including corporations, etc.) named as the account-holder. If the business account is held in multiple individual names the rules for joint accounts apply.

3. An ADI must separately identify and flag each pooled trust account held by an account-holder, to the extent practicable.

Calculation of end-of-day deposit balances

4. The amount repayable to an account-holder must be calculated from the sum of the deposit balances calculated at the end-of-day (i.e. ‘end-of-day deposit balances’) held in all protected accounts in an account-holder’s name on the day on which a declaration is made that the FCS applies in relation to an ADI (or if APRA requires the ADI to generate data for test purposes, the day on which APRA instructs the ADI to generate the data). As end-of-day deposit balances could include both cleared and uncleared funds, payments must only be made on the basis of deposit balances comprising cleared funds. Uncleared funds in protected accounts, on the day the FCS is declared, must clear before being eligible to be paid out.

5. The timing of the creation of the SCV allows for the finalisation of payments already exchanged and settled at the time of declaration e.g. the processing of dishonours, and returned direct credits and debits. The SCV identifies cleared and uncleared funds, with the latter used for informational purposes in case some items remain uncleared.

6. A declared ADI will be withdrawn from the payments system. It is therefore necessary to ensure the correct posting to accounts of all unsettled[7] payments exchanged between the declared ADI and other ADIs on the day of the declaration. These payments could include direct entry credits, cheques and EFTPOS transactions.

7. All balances must be adjusted for fees, charges and duties payable applicable to an account (i.e. the net credit balance as defined in section 5 of the Banking Act) and accrued interest and withholding tax.

8. Overdrafts and other forms of debt must not be set-off against balances in protected accounts.

Process for determining end-of-day position

9. An ADI must ensure consistency in the treatment of payments made between account-holders, where value passes between:

(a) two accounts at the same ADI[8]; and

(b) one account at the ADI and an account at another ADI.

An ADI must use the same general principles in the treatment of these transactions as set out in paragraphs 10-22 of this Attachment. The objective of the principles is to ensure, as far as practicable, that both sides of a transaction are treated the same. That is, either both stand or both are unwound.

Declaration of a direct participant

10. The Australian Payments Network Limited’s (AusPayNet’s) Australian Paper Clearing System (APCS) has been determined by the RBA to be a ‘recognised settlement system’ under the Cheques Act. The effect of this is that cheques, including Financial Institution Cheques, drawn on an ADI that becomes a ‘failed financial institution’ (within the meaning of subsection 70A(2) of the Cheques Act) after the cheque is lodged and before the cheque is settled are taken to be dishonoured.[9] Accordingly, for the purpose of calculating an end-of-day balance, any cheques debited to an account by a declared ADI in connection with unsettled cheques must be reversed. Similarly, credit entries made by other ADIs to an account arising from unsettled cheques drawn on the declared ADI must also be reversed.

11. Cheques drawn on an ADI, other than the declared ADI, and deposited into accounts at a declared ADI prior to the commencement of statutory management remain obligations due to the declared ADI by the ADI on whom the cheque is drawn. When calculating the end-of-day aggregate deposit balance, the declared ADI must ensure that credits associated with these cheques are posted to accounts as they normally would be. However, these deposits would remain subject to the standard APCS rules on cleared funds (i.e. cheques drawn on an ADI, and deposited at the declared ADI, could be dishonoured by an ADI if, for example, the drawer had insufficient funds in their account). As a result, end-of-day deposit balances must distinguish between ‘cleared’ and ‘uncleared’ funds. APRA will only make FCS payments to account-holders in respect of cleared funds.

12. Legislation similar to the Cheques Act does not exist in respect of other payments instruments. Treatment of accounts in respect of non-cheque payment instruments may be influenced by non-AusPayNet contractual requirements. To the extent that contractual requirements are either silent, or allow discretion to be exercised, ADIs must adopt uniform accounting treatments in dealing with a declared ADI.

13. The exchange of direct entry debit and credit items will cease from the time that an ADI is withdrawn from the payments system. Specifically, items that were exchanged, but not yet settled, prior to the ADI’s withdrawal must be treated as follows:

(a) direct entry credits received from a declared ADI would be returned to the declared ADI if they had not already been posted to accounts at another ADI. Unsettled direct entry credits that had been posted to accounts at another ADI would stand. To ensure consistent treatment between accounts at a declared ADI and all other ADIs, the declared ADI would need to explicitly identify which direct entry items had been posted by another ADI and which had not;

(b) direct entry debits received by a declared ADI would be treated as if they had not been exchanged (and any account postings would be reversed by the receiving ADI as well as the declared ADI); and

(c) all direct entry items exchanged on the day of declaration, which require settlement payment from another ADI to the declared ADI, are to be processed as normal. As a result, the declared ADI would need to post incoming direct entry credit payments from other ADIs and include these transactions in its end-of-day aggregate deposit balance. The same would apply to direct debits the declared ADI had exchanged with other ADIs.

14. The exchange of BPAY items will cease from the time at which an ADI is withdrawn from the payments system. Where items were exchanged prior to this time, then:

(a) unsettled BPAY credits received from the declared ADI would be returned to the declared ADI if they had not already been posted to accounts at another ADI. The declared ADI would reverse the related payer account postings; and

(b) unsettled BPAY credits that had been posted to accounts at another ADI would stand.

To ensure consistent treatment between accounts at a declared ADI and other ADIs, the declared ADI must be able to identify which BPAY payments had been processed by another ADI and which had not.

15. Real-time gross settlement (RTGS) payments are settled at the time they are exchanged. As a result, RTGS payments exchanged between a declared ADI and another ADI are irrevocable and these transactions must be included in the end-of-day balance. Account postings for RTGS payments that were initiated, but not settled, must be reversed by the declared ADI or other ADI, as applicable.

16. A declared ADI’s ATM network and EFTPOS channels must be closed from the time that the ADI is withdrawn from the payments system. Unsettled ATM and EFTPOS transactions must not be revoked because of the real-time nature of these transactions.

17. APRA would instruct the statutory manager, or request the liquidator, to close the payments functions associated with a declared ADI’s electronic banking facilities.

18. VISA and MasterCard debit card transactions must not be revoked due to the real-time nature of these transactions. The bank identifier numbers for cards issued by the declared ADI must be de-activated to ensure that no further transactions are able to take place following the withdrawal of the declared ADI from the payment system.

Accrued interest

19. An ADI must calculate accrued interest and pay interest at the relevant interest rate applicable to the account in question, rather than a break rate that might apply if an account-holder withdraws funds before a certain time or subject to other restrictions. An ADI must ensure that its accounting systems are able to apply interest at the contractual rate applicable to each account in the event of the ADI failing.

20. For the purpose of testing SCV data, it will not be necessary for an ADI, in calculating the end-of-day balance, to run an accrual to determine interest, fees and charges applicable to an account, unless the accrual is normally run on a daily basis or where the reporting date selected by APRA coincides with month-end. An end-of-day figure based on the principal amounts held in each protected account will be sufficient for the initial end-of-day balance for testing purposes.

Treatment of unsettled payments

21. The ADI would be suspended from the payments system immediately following a declaration. Failure-to-settle procedures would be applied in each payment system in which the ADI was a participant.

22. AusPayNet rules distinguish between direct participants and indirect participants. The former assume responsibility for settlement of payments obligations drawn on indirect participants as well as their own settlement obligations. In the event that an indirect participant fails, its representative direct participant remains responsible for settling the indirect participant’s obligations which have been exchanged with other direct participants. In these circumstances, credits posted (or to be posted) to accounts at a solvent ADI, and associated debits posted to accounts at the declared ADI, would stand even where the indirect participant had not settled for the resultant obligations with its representative direct participant (subject to the legitimate reversal of direct credits and the possibility of direct debits being dishonoured by the declared ADI). Since some ADIs are direct participants in one or more AusPayNet payment systems while participating indirectly in others, the treatment of customer accounts may vary by payment instrument.

Attachment C

This Attachment sets out the principles that an ADI must use in its calculations to meet its payment and reporting information requirements.

Account-holder FCS balance and payment details

An ADI must be able to calculate the FCS balance for each account-holder to the nearest cent.
An ADI must provide to the RBA, or APRA’s paying agent, information specified in the file specifications in the approved form. This will include calculations, alternative ADI account data, and information generated by ADI systems such as record codes and reference information, for example, the name of the declared ADI and unique reference numbers which are required to generate the payment instruction information.
EFT and cheque payment instruction information must have a date no later than the timeframes specified in paragraph 18 of this Prudential Standard, as calculated from the date of the generation of SCV.

Account priority

4. An ADI must be able to identify for every protected account:

(a) the account category as either non-prescribed or prescribed as defined under the Regulations; and

(b) the account status as either non-exception or exception, where an exception status indicates that a payment cannot be made at the time of generating and transmitting the payment instruction information specified in paragraph 18.

5. An ADI, must give priority for payment and reporting up to the FCS limit to each account-holder’s accounts in the following order:

(a) non-prescribed, non-exception accounts; then

(b) non-prescribed, exception accounts; then

(d) prescribed, exception accounts,

with any portion of the aggregated balance over the FCS limit to be identified. Within each category, accounts are to be treated equally.

Apportionment when the aggregate account-holder entitlement is above the FCS limit

6. When the account-holder’s aggregate entitlement is above the FCS limit, apportionment of the components is as follows:

(a) the account balance principal and accrued interest components are apportioned on a pro rata basis; and

(b) withholding tax calculated on the portion of the accrued interest below the FCS limit is deducted from the payment to the account-holder.

ADI summary account-holder and payment data

7. An ADI’s SCV and other systems must be able to generate summary account-holder entitlement and FCS balance and payment data aggregated by value and volume for use by APRA. An ADI may include any additional information it considers relevant for this purpose.

[1] Consequently, when a requirement falls due on a non-business day, it must be done by that day, not the next occurring business day.

[2] Refer to Prudential Standard CPS 232 Business Continuity Management (CPS 232).

[3] Refer to CPS 232.

[4] For the purposes of this Prudential Standard, reasonable assurance and limited assurance are defined in accordance with the Framework for Assurance Engagements issued by the Auditing and Assurance Standards Board (AUASB) as it exists from time to time.

[5] For non-disclosing entities, the relevant period is four months.

[6] Refer to subsection 11AF(2) of the Banking Act.

[7] Settlement refers to the extinguishment of obligations arising between payments system participants (including ADIs) using Exchange Settlement Accounts at the RBA.

[8] That is, in the treatment of ‘on-us’ items.

[9] Note, cheques drawn on an indirect participant deposited to an account at their representative direct participant are not settled via a ‘recognised settlement system’ therefore the Cheques Act deemed dishonour provisions do not apply to these cheques.

meta-content-style-type: text/css meta-content-type: application/xhtml+xml; charset=utf-8 meta-keywords: "[SEC=OFFICIAL]"

Banking (prudential standard) determination No. 4 of 2023

Prudential Standard APS 910 Financial Claims Scheme

Banking Act 1959

I, Clare Gibney, a delegate of APRA:

This instrument commences on 1 October 2023.

Dated: 6 September 2023

Clare Gibney

Executive Director, Policy & Advice

APRA

Interpretation

In this instrument:

ADI has the meaning given in section 5 of the Act.

APRA means the Australian Prudential Regulation Authority.

Schedule

Prudential Standard APS 910 Financial Claims Scheme comprises the document commencing on the following page.

Prudential Standard APS 910

Financial Claims Scheme

Objective and key requirements of this Prudential Standard

The key requirements of this Prudential Standard are that an ADI must:

 identify each unique account-holder, to the extent practicable;

 develop and implement a Single Customer View;

 be able to generate and transmit payment instruction information for payment by electronic funds transfer and/or cheque in respect of each account-holder;

Financial Claims Scheme (FCS). The FCS is the Australian government guarantee for depositors of a failed ADI. It is triggered when the Minister declares an ADI under section 16AD of the Banking Act. APRA then pays account-holders up to the FCS limit from public funds. This standard governs what the ADI must have built before that declaration occurs.

Single Customer View (SCV). The SCV is the data construct at the heart of the standard. It aggregates all protected accounts held by a unique account-holder into a single record (paragraph 7). The SCV must be generated from end-of-day deposit balances, must be maintained in Australia unless APRA approves otherwise (paragraph 8), and must include the data fields specified in Attachment A: account-holder identifiers (up to 18 characters), entity details, street and mailing addresses, contact details, individual account details (BSB, account number, product type, cleared and uncleared balances, accrued interest, fees, withholding tax), and aggregate totals.

End-of-day. Defined precisely in paragraph 5(j) as 9:00 am AEST on the day following the Minister's declaration. For testing purposes it is 9:00 am AEST on the day following APRA's request. This definition determines the snapshot from which SCV data are drawn.

Protected account. Has the meaning in section 5 of the Banking Act. Not all accounts qualify; the standard's obligations apply only to protected accounts.

Declared ADI. Has the meaning in subsection 5(1) of the Banking Act. Once declared, the ADI is withdrawn from the payments system and the FCS payment process begins.

FCS balance and FCS limit. The FCS balance is the aggregate entitlement of an account-holder across all protected accounts, capped at the FCS limit set by the Banking Regulation 2016 (paragraph 5(m) and (l)). Amounts above the limit are identified but not paid through the FCS.

Account aggregation principles (Attachment B). Joint accounts are split proportionately among named account-holders; a two-holder joint account contributes half of its balance to each holder's SCV. Business accounts held in an entity's name belong to one account-holder; those in multiple individual names follow joint account rules. Pooled trust accounts must be separately identified and flagged to the extent practicable (Attachment B, paragraph 3). Overdrafts and other debt are not set-off against protected account balances (Attachment B, paragraph 8).

Alternative ADI account data. The BSB and account number at another ADI to which an EFT payment can be directed (paragraph 5(b)). ADIs must be able to capture this data securely from existing electronic banking customers, record their consent, and merge it with SCV data for payment purposes (paragraphs 15-16). The data may not be used for any other purpose (paragraph 17).

Payment priority (Attachment C). Where an account-holder's aggregate balance exceeds the FCS limit, accounts are paid out in priority order: non-prescribed non-exception first, then non-prescribed exception, then prescribed non-exception, then prescribed exception. Above the limit, principal and interest are apportioned pro rata; withholding tax on the interest portion below the limit is deducted from the payment.

Prescribed accounts. Accounts prescribed under subsection 16AH(5) of the Banking Act receive lower payment priority than non-prescribed accounts but must still be included in the SCV and flagged accordingly.

The standard applies to all locally incorporated ADIs, which includes the major banks, regional banks, building societies, credit unions, and other entities holding an ADI authority under the Banking Act (paragraph 2). Foreign ADIs and purchased payment facility providers are expressly excluded.

In practical terms, every Australian-incorporated deposit-taking institution is subject to the full suite of requirements regardless of size. There is no small-ADI carve-out in the body of the standard, though APRA retains a discretion under paragraph 35 (backed by subsection 11AF(2) of the Banking Act) to adjust or exclude specific requirements for individual ADIs. An ADI seeking to rely on an earlier exemption granted under the 2013 version must contact APRA first (paragraph 36).

Account-holders of locally incorporated ADIs are the ultimate beneficiaries of the scheme. The standard is not addressed to them directly, but its operational requirements exist to ensure that if their ADI fails, APRA can identify them, calculate their entitlement, and pay them within a compressed timeframe. Electronic banking customers are specifically called out because they can provide alternative ADI account data to facilitate EFT payment.

The RBA acts as the default paying agent. AusPayNet (the Australian Payments Network Limited) rules govern how unsettled payments between the declared ADI and other ADIs are resolved. The ATO receives reporting information because interest paid under the FCS has tax implications.

CEOs of ADIs carry a personal accountability obligation: they must attest annually to APRA that the ADI's systems and controls satisfy every substantive requirement in the standard (paragraphs 31-33). A qualified attestation triggers an obligation to explain the qualification in writing. Board and senior management are also identified as bearing ultimate responsibility for the policies and procedures underlying the standard (paragraph 30).

Single Customer View (paragraphs 6-10). An ADI must identify each unique account-holder to the extent practicable, aggregate their protected account balances into an SCV, maintain SCV systems in Australia, include all Attachment A data fields, follow Attachment B aggregation rules, and generate the SCV within 48 hours of a declaration or APRA test request.

Payment instruction information (paragraphs 11-18). An ADI must be able to generate and transmit payment instruction information to APRA's nominated paying agent using either EFT (via the RBA or another nominated agent, to an account at another ADI) or cheque (drawn on the RBA). The payment file must contain the information specified in approved forms. It must be transmitted within 24 hours of generating the SCV.

Alternative ADI account data (paragraphs 15-17). An ADI must capture alternative ADI account data from existing electronic banking customers securely, using unique customer identifiers and passwords, recording consent, and merging the data into payment files. APRA may exempt an ADI from this requirement or approve an alternative capture arrangement. The data must not be used for any purpose other than as required by the standard or by APRA.

Reports (paragraphs 19-22). An ADI must generate and transmit: an SCV summary report at the same time as the SCV; EFT and cheque payment reports at the same time as the payment instruction information; exception and summary reports simultaneously with those payment reports; prescribed accounts and summary reports within 48 hours of the payment reports; and any further reports APRA specifies within the period APRA nominates. Reports must also flow to account-holders and the ATO in sufficient time for APRA to meet its statutory obligations under the Banking Act.

Systems updating (paragraph 21). After FCS payments are made, the ADI's systems must be updated to reflect revised account-holder balances, including transaction details related to FCS payments, so that account-holders can see their remaining position.

Communications (paragraphs 23-24). An ADI must maintain sufficient communication channels, including its website, electronic banking facilities, and call centre, to convey FCS information specified by APRA, respond to enquiries, and record alternative ADI account data. Channel capacity must be adequate for the volume of enquiries reasonably expected in a failure scenario. At minimum, an ADI must maintain a website, telephone, and internet response capability.

Testing (paragraphs 25-26). An ADI must regularly review and test all of the above capabilities in accordance with a testing schedule specified by APRA. Any shortcomings identified must be remedied. The testing obligation cross-references CPS 232 Business Continuity Management.

Audit (paragraphs 27-29). The appointed auditor under APS 310 must provide limited assurance that controls are designed to produce complete and accurate SCV, payment, and reporting information, and that those controls operated effectively when tested. APRA may separately require reasonable or limited assurance engagements on SCV systems. Audit must be synchronised with the APS 310 audit cycle unless APRA agrees otherwise.

Attestation (paragraphs 30-34). The CEO must provide a written attestation to APRA within three months of annual balance date (four months for non-disclosing entities), covering each of the substantive capabilities: customer identification, SCV generation and transmission, payment instruction generation and transmission, reporting, systems adequacy, alternative ADI account data capture, communications, and testing. A qualified attestation must explain the qualification.

APRA discretions. APRA may approve offshore hosting of SCV systems (paragraph 8), exempt an ADI from the alternative ADI account data capture requirement or approve alternatives (paragraph 15), specify additional report forms and periods (paragraph 22(e)), require additional audit engagements (paragraph 29), and adjust or exclude specific requirements for individual ADIs (paragraph 35). All APRA discretions must be exercised in writing (paragraph 4(b)).

Non-business day rule (footnote 1). Subsection 36(2) of the Acts Interpretation Act 1901, which allows obligations falling on non-business days to be met on the next business day, is expressly excluded. Deadlines must be met on the day they fall regardless.

The standard does not set out its own penalty regime. Enforcement follows the broader Banking Act framework: APRA has supervisory powers to require remediation, issue directions, and ultimately revoke an ADI's authority. Non-compliance with a prudential standard made under section 11AF is itself a basis for APRA action under the Banking Act's supervision architecture.

The CEO attestation requirement (paragraphs 31-33) creates a personal accountability mechanism. A CEO who provides a false or misleading attestation is exposed to potential liability under the general law and under any relevant executive accountability regime, including the Banking Executive Accountability Regime (BEAR) or its successor, the Financial Accountability Regime (FAR), which apply to ADIs covered by those frameworks. The standard does not recite those consequences, but they flow from the broader regulatory architecture in which the standard sits.

The audit requirement (paragraphs 27-29) provides an independent check. Where the auditor identifies deficiencies and the ADI fails to address them, APRA's supervisory response would ordinarily escalate. Paragraph 26 requires that any shortcomings identified in testing be remedied, but does not specify a timeframe; APRA presumably sets remediation periods through its supervisory relationship with the ADI.

The source document does not list specific civil penalty amounts, criminal offences, or infringement notice provisions within the standard itself.

Banking Act 1959. The standard is made under section 11AF of the Banking Act. The FCS it supports is established under Part 2, Division 2AA of the Banking Act. Declarations triggering the FCS are made under section 16AD. Prescribed accounts are defined under subsection 16AH(5). The FCS balance concept refers to Division 2AA entitlements. Protected accounts and declared ADI are defined in section 5. APRA's adjustment and exclusion discretion is grounded in subsection 11AF(2).

Banking Regulation 2016. The FCS limit is set by this Regulation (paragraph 5(l)). The account aggregation principles in Attachment B reference entity types defined in sections 960-100 of the Income Tax Assessment Act 1997 to determine how business accounts are treated.

Income Tax Assessment Act 1997. Entity type classifications from sections 960-100 govern how business and joint accounts are treated for aggregation purposes under Attachment B.

Acts Interpretation Act 1901. Subsection 36(2), which allows performance on the next business day when a deadline falls on a non-business day, is expressly excluded by footnote 1. Deadlines are absolute.

Cheques Act 1986. The Australian Paper Clearing System has been determined by the RBA to be a recognised settlement system under the Cheques Act. This means cheques drawn on a declared ADI after lodgement but before settlement are deemed dishonoured, which affects how the end-of-day balance is calculated and which credit entries must be reversed (Attachment B, paragraphs 10-11).

Prudential Standard APS 001 Definitions. Terms appearing in bold in the standard are defined in APS 001. This is the APRA-wide definitional framework.

Prudential Standard APS 310 Audit and Related Matters. The appointed auditor concept and the audit cycle for APS 910 are tied to APS 310. The APS 910 audit is co-ordinated with the APS 310 audit unless APRA agrees otherwise (paragraph 28). The CEO attestation may also be delivered as part of the APS 310 declarations (paragraph 34).

Prudential Standard CPS 232 Business Continuity Management. The testing and communications requirements cross-reference CPS 232 (footnotes 2 and 3). ADIs should read CPS 232 alongside this standard when designing their FCS testing schedules and assessing the adequacy of their communication channel capacity.

Auditing and Assurance Standards Board (AUASB) Framework for Assurance Engagements. The definitions of reasonable assurance and limited assurance in paragraph 29 are drawn from the AUASB Framework as it exists from time to time (footnote 4).

AusPayNet rules. The treatment of unsettled payments on declaration day, particularly for direct entry, BPAY, cheques, ATM, and EFTPOS transactions, is governed by AusPayNet rules in conjunction with the requirements of Attachment B. The distinction between direct and indirect participants in AusPayNet affects how settlement obligations are handled when an indirect participant is declared.

The source document records that this instrument revokes Banking (prudential standard) determination No. 2 of 2013, which included the previous version of Prudential Standard APS 910 Financial Claims Scheme. Beyond identifying that 2013 determination as the immediate predecessor, the source provides no further legislative history of prior versions of APS 910 or the amendments made between any earlier iterations. No chronology of changes between the 2013 and 2023 versions is recited within the instrument or its schedule.

The source document names no cases. No litigation history is recorded in or referenced by this instrument.

End-of-day is not midnight. End-of-day is defined as 9:00 am AEST on the day after the declaration (paragraph 5(j)), not midnight on the declaration day. This means the 48-hour clock for SCV generation starts from 9:00 am the morning after the Minister signs, not from the moment of declaration. ADIs modelling their timeframes against midnight will misread the deadline.

No business day extension. Footnote 1 expressly disapplies subsection 36(2) of the Acts Interpretation Act 1901. If the 48-hour SCV deadline or the 24-hour payment instruction deadline falls on a Saturday, the ADI must still meet it that day. Systems and staffing plans must account for weekend and public holiday scenarios.

Offshore SCV systems require APRA approval. Paragraph 8 requires SCV systems and data to be maintained in Australia unless APRA specifically approves an offshore arrangement. An ADI that has migrated core banking or data systems to offshore cloud infrastructure without obtaining that approval is in breach even if the data is functionally accessible.

Alternative ADI account data is single-purpose. Paragraph 17 prohibits any use of alternative ADI account data (the backup BSB and account number provided by a customer) except as required by the standard or by APRA. Using that data for customer re-engagement, marketing, or other product purposes would breach the standard regardless of any separate consent the ADI may believe it holds.

Previous APRA discretions do not automatically carry over. Paragraph 36 requires an ADI to contact APRA before relying on any exemption or discretion granted under the 2013 version. An ADI that assumed its 2013 exemption continued in force from 1 October 2023 without contacting APRA would be relying on a lapsed exercise of discretion.

Overdrafts cannot be set-off. Attachment B, paragraph 8 prohibits setting off overdrafts or other debt against protected account balances when calculating the FCS balance. An account-holder with a $50,000 credit balance in a savings account and a $30,000 overdraft receives the full $50,000 (subject to the FCS limit) through the FCS, not $20,000. The bank's claim for the overdraft becomes a creditor claim in the liquidation, separate from the FCS mechanism.

Uncleared funds are excluded from FCS payments. Attachment B, paragraph 4 provides that FCS payments are made only on cleared funds. Uncleared funds are recorded in the SCV for informational purposes but do not generate a payment entitlement at the time of declaration. Depositors with recently lodged cheques or direct credits not yet cleared will not be paid on those amounts through the FCS until clearing occurs.

Joint account splitting affects payment amounts. Under the proportionate splitting rule in Attachment B, paragraph 2(d), each named holder of a joint account receives only their proportionate share of that account toward their individual FCS cap. A customer with a joint account balance of $500,000 shared equally with one other person has only $250,000 allocated to their SCV. If their individual FCS limit is $250,000, they receive the full $250,000. If they also hold $100,000 in sole-name accounts, their total FCS-eligible position is $350,000, which exceeds the cap.

VISA and MasterCard debit transactions are irrevocable. Attachment B, paragraph 18 provides that VISA and MasterCard debit card transactions must not be revoked due to their real-time nature. The only action required is de-activating the bank identifier numbers for cards issued by the declared ADI. This means customers cannot recover amounts debited via card on the day of declaration, even if those amounts have not yet settled.

Attestation qualification must be explained in writing. Paragraph 33 requires that a CEO who cannot provide an unqualified attestation must set out the reasons in writing within the attestation itself. Silence or a generic qualifier is insufficient. A qualified attestation is effectively a self-reported breach disclosure to APRA.

Immediate architecture check. Confirm that SCV systems and all SCV data are hosted in Australia (paragraph 8). If any SCV data or the systems generating it sit offshore, apply to APRA for approval or bring them onshore before the standard's requirements bite.

Map your protected accounts and account-holders. Work through every product type the ADI offers and determine which accounts qualify as protected accounts under section 5 of the Banking Act. Build or validate the unique account-holder identification logic (paragraph 6). Ensure the identifier does not exceed 18 characters (Attachment A, paragraph 1).

Implement or validate Attachment A data fields. Audit source systems against Table 1 in Attachment A. Every required field, from entity type through to aggregate withholding tax, must be extractable, correctly calculated, and reconciled back to source systems (Attachment A, paragraph 6). Fields with no data must be flagged as not available or blank-filled; they may not simply be omitted.

Apply Attachment B aggregation rules rigorously. Programme joint account splitting on a proportionate basis. Identify and flag prescribed accounts separately. Identify and flag pooled trust accounts. Ensure overdraft balances are excluded from FCS balance calculations. Ensure accrued interest is calculated at the contractual rate, not a break rate (Attachment B, paragraph 19).

Build the payment instruction pipeline. The ADI must be able to generate both EFT files (in the format specified in APRA's approved forms for transmission to the RBA or a nominated paying agent) and cheque files (drawn on the RBA). The pipeline from SCV generation to payment file transmission must complete within 24 hours of SCV generation (paragraph 18).

Implement alternative ADI account data capture. Build or validate a secure mechanism that identifies existing electronic banking customers via unique credentials, records their alternative BSB and account number, records their consent, stores the data, and can merge it with SCV data for EFT payment files (paragraph 16). Ensure that data is segregated so it cannot be accessed or used for any non-FCS purpose (paragraph 17).

Build the full reporting stack. Configure systems to produce, within the prescribed windows, the SCV summary report, EFT and cheque payment reports, exception and summary reports, prescribed accounts reports, and any reports specified by APRA in approved forms (paragraph 22). Ensure ATO and account-holder reports can also be generated (paragraph 20(b)).

Implement systems balance updating. After FCS payments are processed, the ADI's systems must reflect the revised balances and transaction details so account-holders can see their position (paragraph 21).

Maintain communications capability. Verify that website, internet banking, and telephone channels can be scaled to handle the volume of enquiries expected in a failure scenario. Test the capability to publish APRA-specified FCS information and to take alternative ADI account data via electronic banking during a crisis (paragraphs 23-24). Cross-reference this work against CPS 232 Business Continuity Management.

Establish a testing schedule with APRA. Contact APRA to understand its testing schedule (paragraph 25). Conduct and document regular internal reviews and tests of all the above capabilities. Remediate any shortcomings identified (paragraph 26).

Engage the appointed auditor. Instruct the APS 310 appointed auditor to include FCS controls in their assurance engagement, providing limited assurance on design and operating effectiveness (paragraphs 27-28). Synchronise the timing with the APS 310 audit.

Prepare the CEO attestation process. Establish an internal sign-off process that culminates in the CEO attestation being delivered to APRA within three months of annual balance date (four months for non-disclosing entities). The attestation must address each element listed in paragraphs 32(a) through 32(i). Build a qualified attestation escalation protocol so that any gap identified before signing is either remediated or disclosed in writing in the attestation itself (paragraph 33). Consider delivering the attestation alongside APS 310 declarations (paragraph 34).

Check prior APRA discretions. If the ADI relied on any exemption or discretion granted under the 2013 determination, contact APRA before treating that discretion as continuing under the new standard (paragraph 36).

Deep Dive

What it does

Current sections