The central concept is the recovery and exit plan, a single document that must contain six minimum components: a concise standalone summary; a trigger framework for early identification of stress, including early warning indicators relevant to the entity’s operating environment and risk profile; governance arrangements for monitoring triggers and timely activation, with clear senior executive roles; credible recovery actions to stabilise and restore financial resilience; credible exit actions to effect an orderly and solvent exit from regulated activity; and a communication strategy (para 19). The plan is not a static document; it must be integrated into the entity’s risk management framework, capital and liquidity management (or for RSE licensees, the business plan and performance review) and updated on a cycle (paras 15, 28). A key conceptual distinction is between recovery capacity and exit capability. Recovery capacity is relevant only to SFIs and is defined as the aggregate impact of plausible recovery actions under each scenario, measured quantitatively by calculating the amount of capital and liquidity that can be rebuilt during or following stress (para 20(b)). This is a forward-looking metric the Board must assess for sufficiency (para 18). Exit capability is an implicit requirement for all entities: the plan must demonstrate how the entity could enable orderly solvent exit, and the entity must maintain sufficient financial resources to support exit actions (paras 13(b), 26). The concept of credibility runs through both sets of actions: each action must include a timeline, analysis of barriers and execution risks, preparatory measures, and where relevant an estimate of capital and liquidity impact based on credible assumptions (para 21). For SFIs, credibility is further tested through scenario analysis that measures effectiveness and impact of actions (para 20(a)). The instrument introduces the concept of no assumption of extraordinary public sector support (para 16). This is a binding prohibition: the plan must assume no taxpayer backstop or government bailout. This forces entities to plan for genuinely private solutions. The concept of group-wide application is also important: when an entity is the Head of a group, it must comply both in its own capacity and by ensuring the requirement is applied throughout the group, including to non-APRA-regulated entities, and on a group basis (paras 6, 7). This extends the planning obligation beyond the regulated legal entity to the entire economic group. APRA’s discretion is a pervasive concept: it can adjust or exclude specific requirements for any entity (para 12), mandate inclusion or exclusion of actions (para 22(a)), prescribe scenarios or assumptions (para 22(b), (c)), and adjust capital and liquidity requirements for entities other than RSE licensees where it sees material weaknesses (para 23). This means the instrument’s requirements are not fully fixed; they are subject to APRA’s individualised modifications.

The instrument applies to all APRA-regulated entities as defined in paragraph 2. This includes five categories. First, authorised deposit-taking institutions (ADIs) and authorised banking non-operating holding companies, but excluding purchased payment facility providers. Second, general insurers (including Category C insurers), authorised insurance NOHCs, and parent entities of Level 2 insurance groups. Third, life companies including friendly societies and eligible foreign life insurance companies (EFLICs), and registered NOHCs. Fourth, private health insurers. Fifth, RSE licensees under the SIS Act in respect of their business operations. Foreign ADIs are excluded unless APRA determines that all or part of the standard applies to their Australian branch operations (para 3). Category C insurers and EFLICs are subject only in relation to their Australian branch operations (para 3). Within each category, entities are further divided into SFIs and non-SFIs based on size or APRA determination. For RSE licensees, the threshold is total assets in excess of AUD $30 billion for a single RSE, or combined total assets of all RSEs operated by the licensee exceeding that amount; APRA may also determine an RSE licensee to be an SFI based on complexity of operations or group membership (para 5). For other entity types, the instrument does not specify the SFI threshold; it likely relies on APRA’s general determination powers referenced in para 5(b) style language, though the standard does not define SFI for non-RSE entities. The practical effect is that larger and more complex entities face substantially higher compliance costs: annual plan updates, scenario analysis, quantified recovery capacity, comprehensive independent review every three years, operational testing, and Board assessment of recovery capacity sufficiency. Non-SFIs have a lighter regime: triennial review, no mandatory scenario analysis, no quantified recovery capacity, no comprehensive independent review, and no mandatory operational testing. The instrument also affects groups where a regulated entity is the Head of a group: compliance must flow through to all group entities including non-APRA-regulated ones (para 6). This means unregulated holding companies, non-regulated subsidiaries, and foreign affiliates within the group may be indirectly subject to the planning and information requirements. The board and senior management of each entity are directly affected: the Board must approve the plan, oversee reviews and execution, and for SFIs assess recovery capacity sufficiency (paras 17, 18). Senior executives must have clear roles for preparation, maintenance and execution (para 19(c)). The effect on business operations is significant: the plan must be integrated into the risk management framework, capital and liquidity management, and business plan, meaning it shapes strategic decisions on capital allocation, liquidity buffers, and business continuity planning. Compliance will require dedicated resources, external consultants for independent reviews, and ongoing monitoring of triggers.

The core duty is to develop and maintain a recovery and exit plan that meets the content requirements of paragraphs 13 through 21. Every APRA-regulated entity must do this. For SFIs, additional duties include conducting scenario analysis (at least two severe scenarios, one systemic and one idiosyncratic) and assessing recovery capacity in quantitative capital and liquidity terms (para 20). The entity must ensure its plan is integrated into its risk management framework, capital and liquidity management frameworks (or for RSE licensees, the business plan and business performance review) (para 15). The entity must not assume extraordinary public sector support in its planning (para 16). The Board has specific duties: approve the plan, oversee reviews and ensure management addresses findings, and oversee execution of recovery and exit actions (para 17). For SFI boards, there is an additional duty to form a view on the sufficiency of recovery capacity to restore financial resilience in stress; if the Board views capacity as insufficient, the entity must improve its plan or take other actions to improve financial resilience (para 18). The entity must maintain capabilities to execute the plan and take reasonable preparatory steps considering legal, financial, operational and structural requirements (paras 24, 25). It must maintain access to sufficient financial resources to support implementation of recovery and exit actions (para 26). It must regularly monitor stress indicators (para 27). Review and update duties are periodic: SFIs at least annually, non-SFIs at least every three years, and additionally in response to significant changes in structure, business mix, strategy or risk profile (paras 28, 29). SFIs must also undertake a comprehensive review every three years of the plan’s effectiveness and readiness, conducted by operationally independent, appropriately experienced and competent persons (para 30). As part of that review, SFIs must conduct operational testing simulating plan use, covering governance, communication, operational elements of key actions, and internal reporting (para 31). The entity must provide a copy of the plan to APRA within three months of Board approval following each review (para 32). It must notify APRA if the plan is activated (para 33). APRA has corresponding rights: it may adjust or exclude any specific requirement for a particular entity (para 12); it may require inclusion or exclusion of particular recovery or exit actions (para 22(a)); it may require inclusion of APRA-determined scenarios (para 22(b)); it may require use of particular assumptions when assessing recovery capacity (para 22(c)); and for entities other than RSE licensees, it may adjust prudential requirements for capital and liquidity where it assesses material weaknesses in the plan (para 23). APRA’s powers are to be exercised in writing (para 11). The entity has no express right to appeal APRA’s decisions under this standard, though general administrative review rights under the underlying Acts would apply.

The instrument itself does not create civil or criminal penalties. Its enforcement arises through the underlying Acts under which it is made (para 1) and through APRA’s general supervisory powers. The most specific enforcement mechanism provided in the standard is APRA’s power to adjust prudential requirements for capital and liquidity for entities (other than RSE licensees) where it assesses material weaknesses in the recovery and exit plan (para 23). This is a significant regulatory sanction: it can increase capital or liquidity requirements beyond the baseline prudential standards, imposing direct costs on the entity and potentially constraining its business activities. For RSE licensees, no equivalent capital/liquidity adjustment is specified, but APRA could rely on its powers under the SIS Act. APRA also has the power to require inclusion or exclusion of particular actions or scenarios (para 22), which effectively allows APRA to dictate the substance of the plan. Non-compliance with notification duties (paras 32, 33) could be treated as a breach of a prudential standard, attracting the enforcement tools in the underlying Acts: directions, licence conditions, licence suspension or cancellation, and in some cases civil penalties. For ADIs, the Banking Act provides for directions by APRA under s 11CA (breach of prudential requirement), civil penalties under s 11CB, and criminal offences for providing false or misleading information. Similar provisions exist in the Insurance Act (s 51A), Life Insurance Act (s 230B), PHIPS Act (s 91), and SIS Act (ss 34B, 34C, 34D). The standard’s requirement that the plan must be integrated into the risk management framework (para 15) means a failure in the plan may also constitute a breach of other prudential standards on risk management, creating multiple compliance risks. The requirement that the plan not assume extraordinary public support (para 16) is a binding prohibition; if an entity were to plan assuming a government backstop, it would be in breach, and APRA could take enforcement action. The entity’s duty to maintain capabilities and take preparatory steps (paras 24, 25) is ongoing and not limited to plan review dates; a failure to maintain resources could be detected during APRA supervision and lead to directions. The requirement for SFIs to have an independent comprehensive review every three years (para 30) is a structural control; if the review is not conducted by genuinely independent persons, or if findings are not addressed (para 17(b) - Board must ensure findings addressed), the entity would be non-compliant. APRA’s power to adjust or exclude specific requirements (para 12) can be used to relax requirements for some entities or to impose additional conditions on others, giving APRA flexibility to calibrate enforcement.

This Prudential Standard is made under five Acts and sits within the broader APRA prudential framework. It references definitions from sector-specific definitional standards (3PS 001, APS 001, GPS 001, LPS 001, HPS 001) (para 9), meaning those standards define key terms used in this instrument. The standard must be read consistently with those definitional standards and with the underlying Acts. For example, terms like “Board”, “capital”, “liquidity”, “risk management framework” take their meaning from the sectoral definition standards. The standard requires integration of the recovery and exit plan into the entity’s risk management framework (para 15(a)), capital management and liquidity management frameworks (para 15(b)), and for RSE licensees into the business plan and business performance review (para 15(c)). This means the plan must be consistent with requirements in other prudential standards, such as CPS 220 (Risk Management), APS 110 (Capital Adequacy), APS 210 (Liquidity), GPS 110 (Capital Adequacy), GPS 112 (Liquidity), SPS 220 (Risk Management) and similar. A weakness in the recovery and exit plan can trigger APRA adjusting capital and liquidity requirements under this standard for non-RSE entities (para 23), which directly interacts with the sectoral capital adequacy and liquidity standards. The standard also interacts with the Financial Account Standards (AASB) and accounting concepts indirectly, since “total assets” for the RSE licensee SFI threshold (para 5(a)) would be measured according to accounting standards. The prohibition on assuming extraordinary public sector support (para 16) interacts with resolution and crisis management frameworks, including the Financial System Stability Act and the Australian Prudential Regulation Authority (Financial Claims Scheme) orders for ADIs. The recovery and exit plan is intended to be a private sector solution, complementing APRA’s resolution powers under the Banking Act Part II (for ADIs) and similar provisions for insurers. The standard does not replace the obligation to maintain a resolution plan under other regulatory frameworks (e.g., for global systemically important banks), but it overlaps with those requirements. The group-level application (paras 6, 7) means the standard interacts with foreign laws for groups with international operations: the Head of a group must ensure the requirement is applied throughout the group, including to non-APRA-regulated entities, which may require compliance with this Australian standard in jurisdictions where local law conflicts. The standard also interacts with director and officer duties under corporations legislation: the Board’s duty to approve the plan and oversee execution is likely to be considered part of directors’ duty of care and diligence under s 180 of the Corporations Act. For RSE licensees, the standard interacts with the SIS Act covenants and trustee duties.

The source document does not include any amendment history, nor does it reference predecessor standards or transitional provisions beyond the application dates (para 8). The standard appears to be a new instrument applied from 1 January 2024 for most entities and 1 January 2025 for RSE licensees. There is no indication of which instrument number or title this is (e.g., CPS 900), nor any reference to earlier versions. It is likely that this standard replaced or supplemented earlier recovery planning guidance, but the source does not say so. The prudential standards regime is generally revised and reissued periodically. Given the source text is presented without a heading identifying its full title (e.g., “Prudential Standard CPS 900 Recovery and Exit Planning”), the amendment history cannot be traced from this source alone. The user should consult APRA’s website for the instrument’s history, including any predecessor standards, consultation papers, and amending instruments. The application dates are staggered, suggesting phased implementation: non-RSE entities had to comply by January 2024; RSE licensees have an additional year. The source does not indicate any transitional relief or grandfathering. The instrument was likely made in 2023, given the 2024 effective date. No amendment history is provided in the source text.

The source document does not refer to any litigation, and no case names are given. As a prudential standard made under multiple Acts, challenges to its validity or application would be possible under administrative law principles, but the source provides no evidence of any court proceedings. There is no mention of any interpretive disputes, appeals of APRA decisions under the standard, or challenges to APRA’s exercise of powers such as adjusting capital requirements or requiring inclusion of particular scenarios. The relative newness of the instrument (effective 2024/2025) means there may have been insufficient time for litigation to arise. However, the instrument’s content - particularly the discretion given to APRA to adjust prudential requirements (para 23) and to require inclusion or exclusion of actions (para 22) - could be fertile ground for future litigation on grounds such as jurisdictional error, unreasonableness, or failure to consider relevant matters. The absence of litigation to date does not mean the instrument is immune from challenge; it simply means no cases are recorded in the source. Users should monitor APRA decisions and any appeals to the Administrative Appeals Tribunal or the Federal Court.

Several provisions in the standard carry hidden traps for the unwary. First, the prohibition on assuming extraordinary public sector support (para 16) is absolute and may conflict with assumptions or plans that implicitly rely on government guarantees such as the Financial Claims Scheme for ADIs or the insurance protection schemes. The plan must be demonstrably built on private resources only. Second, the integration requirement (para 15) means the recovery and exit plan cannot be a standalone document; it must be embedded in the risk management framework, capital and liquidity frameworks (or business plan for RSE licensees). This imposes a legal duty to actually link the plan to these other frameworks, not just mention them. Third, for groups where the regulated entity is Head of a group, compliance must be ensured throughout the group including unregulated entities (paras 6, 7). This can extend the planning obligation to offshore subsidiaries, joint ventures, and non-regulated holding companies. If a non-regulated entity refuses to cooperate, the Head entity may still be in breach. Fourth, APRA’s power to adjust capital and liquidity requirements for material weaknesses (para 23) is a direct financial penalty that does not require a formal enforcement process; APRA can simply write to the entity and impose higher requirements. This gives APRA strong leverage. Fifth, the definition of SFI for non-RSE entities is not specified in this standard; it likely relies on APRA’s general determination powers, meaning an entity may be classified as SFI without a clear size threshold, leading to uncertainty. Sixth, the requirement for SFIs to form a view on sufficiency of recovery capacity (para 18) is a mandatory Board judgment; if the Board concludes capacity is insufficient, the entity must improve the plan or take other actions. This could force capital raising, asset sales, or other structural changes at an unwelcome time. Seventh, the timeline for notification - within three months of Board approval following each review (para 32) - means the plan must be approved by the Board after each review; the three-month clock runs from that approval, not from the review completion. Eighth, the trigger framework (para 19(b)) must be relevant to the operating environment and risk profile, and must include a range of early warning indicators. This is an ongoing monitoring duty, not a one-off design. If indicators are not monitored regularly (para 27), the entity may be unable to activate the plan in time. Ninth, the comprehensive review for SFIs must be by operationally independent persons (para 30). Using internal audit or first-line management may not satisfy independence. External consultants or independent internal audit may be required, adding cost. Tenth, the operational testing requirement (para 31) for SFIs involves simulating plan use; this is a live test that can disrupt business operations. It must test governance, communication, operational elements, and internal reporting - a broad scope.

Compliance requires a structured, documented and ongoing program. First, determine whether the entity is an SFI or non-SFI based on the definitions in para 5 (for RSE licensees: total assets over AUD $30 billion or APRA determination) or APRA’s general SFI classification for other entities. If uncertain, seek APRA confirmation. Second, develop a recovery and exit plan that meets all content requirements of paras 13 and 19: a standalone summary, trigger framework with early warning indicators, governance arrangements with senior executive roles and responsibilities, credible recovery actions, credible exit actions, and a communication strategy. For SFIs, additionally include scenario analysis (at least two severe scenarios, systemic and idiosyncratic) that assesses effectiveness of triggers and actions, and a quantification of recovery capacity in capital and liquidity terms (para 20). For each recovery and exit action in the plan (if an SFI), include a timeline, barriers analysis, preparatory measures summary, and capital/liquidity impact estimates (para 21). The plan must not assume any extraordinary public sector support (para 16). Third, integrate the plan into the risk management framework, capital and liquidity management frameworks (for non-RSE entities) or business plan and business performance review (for RSE licensees) (para 15). This requires ensuring that the plan is referenced in those documents and that there are alignment controls. Fourth, obtain Board approval of the plan (para 17(a)). For SFI boards, also form a documented view on sufficiency of recovery capacity; if considered insufficient, take actions to improve the plan or financial resilience (para 18). Fifth, maintain capabilities and take preparatory steps to support timely execution (paras 24, 25). This may involve legal reviews of exit options (e.g., portfolio transfers, wind-down), establishing ring-fenced financial resources, and setting up trigger monitoring systems. Sixth, monitor stress indicators regularly (para 27). Seventh, review and update the plan at least annually for SFIs or every three years for non-SFIs (para 28), and additionally upon significant changes in structure, business, strategy or risk profile (para 29). For SFIs, conduct a comprehensive review every three years by operationally independent, experienced and competent persons (para 30) that includes operational testing of governance, communication, operational elements and internal reporting (para 31). Eighth, within three months of each Board approval following a review, provide a copy of the plan to APRA (para 32). Ninth, notify APRA if the plan is activated (para 33). Tenth, respond promptly to any APRA requests for inclusion or exclusion of actions, scenarios, or assumptions (para 22). If APRA adjusts capital or liquidity requirements due to plan weaknesses, engage with APRA to remediate and seek relaxation. Maintain a compliance checklist covering all paragraphs. Retain records of Board approvals, review reports, testing results, and communications with APRA. Consider engaging external specialists for scenario analysis and independent reviews. Ensure that group-level compliance (para 6) is documented through group governance policies and evidence that requirements have been cascaded to all relevant subsidiaries. Regularly test the trigger framework against real data. Update the plan if any barrier to exit emerges.