The reporting standard is built around a small set of recurring concepts that define scope, content and process.

• Advanced ADI and internal ratings-based approach: The standard applies only to ADIs approved to use the internal ratings-based approach to credit risk under APS 113 (paragraph 2). The document does not itself define the IRB approach; it references APS 113 for substantive capital and credit risk rules (paragraph 1).

• ARF 118.1 and attachments: The data specification is not contained in the body text but in Form ARF 118.1 Other Off-balance Sheet Exposures and its instructions, which are attached and form part of the standard (paragraph 1). APRA explicitly permits minor variations to those attached forms and instructions to correct technical or clarifying issues without changing substantive requirements (paragraph 13).

• Reporting Levels and group consolidation: The standard distinguishes Level 1 and Level 2 reporting, using the Level definitions in APS 110 (paragraphs 3-4, 16). Level 1 data are required from each reporting ADI; Level 2 data are required where the advanced ADI forms part of a Level 2 group unless the ADI is a subsidiary of an authorised NOHC, in which case the immediate parent NOHC must supply the Level 2-designated data and comply with the standard as if it were the ADI (paragraph 4).

• Electronic submission and authorisation: Submissions must be electronic via APRA’s D2A application (paragraph 5). An officer authorised by the ADI must digitally sign, authorise and encrypt submissions; APRA’s certificate authority issues the digital certificates for that purpose (paragraph 12).

• Timing and APRA discretion on frequency: The baseline reporting frequency is quarterly, aligned to the ADI’s financial year under the Corporations Act (paragraph 6). APRA may, by written notice, change the reporting periods for a particular ADI to require more or less frequent reporting, considering the ADI’s circumstances and the needs of APRA, the Reserve Bank of Australia or the Australian Bureau of Statistics (paragraph 7).

• Quality control and external audit involvement: With one exception, the information must be produced by processes and controls reviewed and tested by the ADI’s external auditor, consistent with AGS 1008 guidance (paragraph 10). All reported data must be subject to internal review and authorisation processes for which the board and senior management are responsible (paragraph 11). The exception is the information required of an ADI that is to be provided by an immediate parent NOHC under paragraph 4; that particular information is excluded from the external auditor review requirement (paragraph 10).

• Transitional and interpretative mechanisms: The standard contains a transitional rule requiring reporting under the old standard for certain reporting periods that ended before revocation of the old standard but remained due after revocation (paragraph 15). The interpretation section cross-references definitions in the Banking Act, APS 110 and the Corporations Act and provides APRA the power to treat an ADI as though it were a different class for purposes of the standard (paragraphs 16-17).

These concepts allocate reporting duty across solo ADIs, consolidated groups and NOHCs, specify how data are to be submitted and authorised, and embed auditor assurance and board responsibility into the reporting chain.

The reporting standard identifies a narrow but consequential population of reporting entities and a small set of third parties and internal stakeholders whose routines must change.

• Primary regulated entities: The standard applies to any authorised deposit-taking institution that has APRA approval to use the internal ratings-based approach to credit risk under APS 113. The phrase used throughout is advanced ADI (paragraph 2). An entity that does not have that approval is not within the standard’s scope as written.

• Group structures and NOHCs: Where an advanced ADI is part of a Level 2 group, the ADI must provide Level 2-designated data unless it is a subsidiary of an authorised non-operating holding company. If it is a subsidiary of an authorised NOHC, the immediate parent NOHC must provide the Level 2-designated information and comply with this reporting standard as if it were the ADI for those purposes (paragraph 4). The interpretation section defines immediate parent NOHC in reference to paragraph 10(b) of Prudential Standard APS 110 (paragraph 16).

• Internal governance: The board and senior management of each ADI carry responsibility to ensure systems of policies and procedures for internal review and authorisation of the data are in place (paragraph 11). The standard explicitly places internal control obligations on governance, not merely on operational units.

• External auditors: The external auditor of the ADI must review and test the processes and controls that produce the reported information (except where paragraph 4 applies) and must do so at least annually or more frequently where necessary for the auditor to form an opinion on accuracy and reliability (paragraph 10). AGS 1008 is cited as the guidance for scope and nature of that review.

• APRA and official users: APRA is the recipient and decision-maker for reporting frequency, authorisation requirements, form variations and transitions (paragraphs 5, 7, 9, 12-14). The Reserve Bank of Australia and the Australian Bureau of Statistics are named potential secondary users of the data for their own regulatory or official statistical purposes (paragraph 1).

• Officers authorised to submit: Officers of the ADI who have authority to transmit data must be issued digital certificates by APRA’s certificate authority and will be required to digitally sign and encrypt submissions (paragraph 12).

• Peripheral definitions: The interpretation section clarifies terms that affect classification and application, such as ADI (defined within the Banking Act 1959), business days, locally incorporated, Level 1 and Level 2 (as defined in APS 110), Australian-owned bank, authorised NOHC, reporting period and subsidiary (paragraph 16). APRA may treat an ADI as being of a different class for these purposes by written determination (paragraph 17), potentially bringing differently structured entities into scope or altering which entity reports.

Entities that fall into the advanced ADI category, those with group consolidation structures involving Level 2 reporting or authorised NOHCs, boards and senior management responsible for sign-off, and external auditors who must review reporting controls are the concretely affected parties named in the standard. APRA’s written notices and determinations can further change who must report or the frequency of reporting in specific cases (paragraphs 7 and 17).

The reporting standard sets out clear duties for reporting, control and submission. It also creates limited procedural rights and APRA discretions that carry operational consequences.

Key duties

• Submit ARF 118.1 Level 1 data for each reporting period: An ADI to which the standard applies must provide APRA with the information required by ARF 118.1 at Level 1 for each reporting period (paragraph 3).

• Provide Level 2 data where relevant or ensure the immediate parent NOHC does so: Where the advanced ADI is part of a Level 2 group, it must also provide the Level 2-designated information unless it is a subsidiary of an authorised NOHC. If a subsidiary of an authorised NOHC, the immediate parent NOHC must provide the Level 2-designated data and comply with the standard (other than paragraphs 3 and 10) as if it were the ADI (paragraph 4).

• Electronic submission through D2A: All information must be given to APRA in electronic form, using one of the electronic submission mechanisms provided by the Direct to APRA application (paragraph 5).

• Time-bound reporting: Baseline timing is quarterly based on the ADI’s financial year, and reports must be provided within 30 business days after the end of the reporting period, unless APRA grants an extension in writing (paragraphs 6 and 8-9).

• Maintain reviewed and tested processes and controls: With limited exception, reported information must be the product of processes and controls that have been reviewed and tested by the external auditor on at least an annual basis or more frequently if necessary for the auditor to form an opinion (paragraph 10). Internal processes and controls for review and authorisation must be developed and maintained by the ADI; the board and senior management are responsible for ensuring appropriate policies and procedures are in place (paragraph 11).

• Authorise and digitally sign submissions: An authorised officer must digitally sign, authorise and encrypt the relevant data when submitting via the D2A software; APRA will issue digital certificates for that purpose (paragraph 12).

Key APRA discretions and ADI rights in the instrument

• APRA may change reporting periods and frequency: APRA may, by written notice, require a particular ADI to provide information more or less frequently, having regard to the ADI’s circumstances and the supervision needs of APRA and other agencies (paragraph 7). This is a one-way discretion to tailor frequency.

• APRA may grant extensions: APRA can grant an extension of a due date in writing, and the new due date is that on the notice of extension (paragraph 9). This is the explicit relief mechanism in the standard.

• APRA may make minor variations to forms and instructions: APRA may make non-substantive corrections or clarifications to attached forms and their instructions without changing substantive requirements, but must notify affected ADIs in writing (paragraphs 13-14).

• APRA may treat ADIs as different classes: APRA may, by written determination, treat an individual ADI of one class as though it were of another class for the purposes of the reporting standard (paragraph 17). That determination can alter an ADI’s obligations under this standard.

• Use of data by other agencies: The standard identifies that APRA may provide the collected data to the Reserve Bank of Australia and the Australian Bureau of Statistics (paragraph 1). The standard does not set out limits or processes for sharing beyond the stated use cases but makes the sharing explicit as a purpose of collection.

Duties are specified with procedural detail that assigns responsibilities to specific actors: ADIs for reporting, boards and senior management for internal authorisation, external auditors for independent review (subject to the paragraph 4 exception), and APRA for issuance of digital certificates and written notifications about frequency and form variations.

The reporting standard itself does not set out express penalty provisions or specify enforcement sanctions. The document confines itself to procedural duties, quality control requirements and APRA’s powers to vary reporting arrangements and issue determinations; it does not describe financial penalties, civil sanctions or criminal offences within its text.

Available enforcement and compliance levers within the standard

• Reporting obligations and timeframes: The standard makes clear that reports must be submitted within set timelines and by electronic submission mechanisms (paragraphs 5, 6 and 8). Compliance is thus monitored by APRA through receipt or non-receipt of the prescribed electronic submissions. The standard also contains a mechanism for ADIs to request extensions, which APRA may grant in writing (paragraph 9).

• Audit and internal control obligations: The requirement that reported information be the product of processes and controls reviewed by the external auditor (except for information covered by paragraph 4) places a formal audit assurance requirement on reporting (paragraph 10). The standard references AGS 1008 for guidance on the scope and nature of the auditor’s review, embedding a monitoring mechanism through the external audit process.

• Governance responsibility: The board and senior management are explicitly made responsible for ensuring appropriate internal policies and procedures for authorisation of data submitted to APRA (paragraph 11). That governance allocation establishes a record of responsibility that APRA may use in supervisory engagement.

• APRA’s procedural powers: APRA may vary reporting frequency by written notice (paragraph 7), make minor non-substantive variations to forms and instructions and must notify ADIs when it does so (paragraphs 13-14), and may issue written determinations treating an ADI as a different class for purposes of the standard (paragraph 17). These powers let APRA tailor reporting and make administrative corrections.

Not stated in the standard

• The reporting standard does not itself prescribe sanctions, penalties or enforcement processes such as civil pecuniary penalties, injunctions, licensing actions or criminal penalties. It also does not specify dispute resolution mechanisms or appeal procedures against APRA determinations, frequency changes or notices.

• Because the standard is made under section 13 of the Financial Sector (Collection of Data) Act 2001 (paragraph 1), enforcement measures relevant to non-compliance may be located in that parent Act or in other prudential legislation, but the standard text does not reproduce or specify any such provisions. Any reader seeking the sanctioning regime would need to consult the enabling legislation outside this document.

In short, this reporting standard sets out mandatory reporting, assurance and governance routines, and delegates administrative discretions to APRA, but it does not itself include penalty clauses or enforcement steps within its operative text.

This reporting standard is explicitly cross-referenced to and dependent on multiple other legal and regulatory instruments. It is not self-contained for substantive definitions or capital requirements.

• Enabling legislation: The reporting standard is made under section 13 of the Financial Sector (Collection of Data) Act 2001 (stated in the objective paragraph and paragraph 1). That Act is the statutory basis for APRA’s collection of prudential data. The standard does not reproduce obligations from the enabling Act; it frames its requirements under that power.

• Prudential Standards: The standard must be read in conjunction with Prudential Standard APS 113 Capital Adequacy: Internal Ratings-based Approach to Credit Risk and Prudential Standard APS 112 Capital Adequacy: Standardised Approach to Credit Risk (paragraph 1). The substantive approach to off-balance-sheet exposures, and eligibility for internal ratings-based treatment, is therefore defined in APS 113 and APS 112 rather than in this reporting standard.

• APS 110 and reporting levels: Level 1 and Level 2 reporting concepts and the definition of immediate parent NOHC are drawn from Prudential Standard APS 110 Capital Adequacy, as the interpretation section directs (paragraph 16). Whether an ADI is a Level 1 or Level 2 reporting entity and the treatment of NOHCs is governed by APS 110 definitions.

• Corporations Act: The reporting period is defined as each quarter based on the financial year within the meaning of the Corporations Act 2001, thereby tying reporting calendars to a corporate law concept of financial year (paragraph 6 and paragraph 16).

• Banking Act definitions: The interpretation defines ADI and authorised NOHC by reference to the Banking Act 1959 (paragraph 16). The reporting standard therefore relies on the Banking Act for who is an ADI and for the statutory definition of authorised NOHC.

• Auditing Standards and guidance: The standard references AGS 1008 ‘Audit Implications of Prudential Reporting Requirements for Authorised Deposit-taking Institutions’ issued by the Auditing and Assurance Standards Board as the source of guidance for the scope and nature of auditor review and testing of processes and controls that underpin reporting (paragraph 10). AGS 1008 sits outside the reporting standard and the practitioner must consult that guidance for auditor obligations.

• Inter-agency sharing and statistical use: Paragraph 1 records that APRA may use the data for prudential supervision and that the data may also be used by the Reserve Bank of Australia and the Australian Bureau of Statistics. The reporting standard therefore functions as a point of data collection that serves multiple official bodies.

• Transitional interaction with prior reporting standards: The standard creates transitional reporting obligations where an old reporting standard is revoked, stating that ADIs must report under the old standard for specified transitional reporting periods (paragraph 15). The interplay between the new and old standards is governed by this transitional provision.

• Administrative powers: APRA’s power to make determinations treating an ADI as a different class for the purposes of this reporting standard (paragraph 17) links the instrument to APRA’s broader administrative powers under prudential legislation.

The reporting standard therefore operates as an instrument that prescribes data collection methods and governance while relying on and referencing external statutory definitions, prudential standards for substance, auditing guidance for assurance and the Corporations and Banking Acts for structural definitions. Any practitioner working with this standard must consult those cross-referenced instruments to determine substantive eligibility, capital treatment and underlying legal definitions.

The reporting standard itself describes a built-in mechanism for limited administrative amendment and a transitional rule for moving from a prior reporting standard to this standard. The text does not include a dated legislative history or an amendment chronology; it only describes the processes APRA may use to change forms and to manage transition.

Mechanisms for amendment or variation contained in the standard

• Minor variations to forms and instructions: APRA may make minor variations to any form that is part of the reporting standard and the instructions to such a form to correct technical, programming or logical errors, inconsistencies or anomalies, or to clarify instructions (paragraph 13). The standard specifies that such variations must not change any substantive requirement in the form or instructions.

• Notification requirement for variations: If APRA makes a variation under paragraph 13, it must notify in writing each ADI that is required to report under the reporting standard (paragraph 14). The notification obligation creates a traceable administrative record of any non-substantive changes.

• Transitional reporting obligations: The standard requires ADIs to report under the old reporting standard in respect of a transitional reporting period defined by two conditions: the period ended before revocation of the old reporting standard and the ADI was required under the old standard to report by a date on or after the date of revocation (paragraph 15). The standard clarifies that overdue reporting documents due before revocation remain required to be provided under the old standard (paragraph 15 note). This transitional clause manages timing mismatches when a revocation occurs mid-reporting cycle.

• APRA determinations altering entity class: APRA may make a determination in writing that an individual ADI of one class is to be treated, for the purposes of the reporting standard, as though it were an ADI of another class (paragraph 17). That power lets APRA vary which reporting rules apply to particular ADIs administratively.

What the text does not provide

• No dated amendment log or version history is given within the text provided. The instrument does not record earlier dates, revocation dates, or prior version identifiers in the body of the standard supplied here.

• No mechanism is provided for stakeholders to challenge minor variations or APRA determinations under this standard; the standard requires notification but does not set out consultation or appeal procedures.

Operational consequences of the amendment provisions

• The ability to make minor non-substantive corrections is practical for electronic forms and instructions that may contain technical errors or require clarifications. APRA is required to notify ADIs in writing of such changes, which creates an obligation to monitor APRA communications.

• The transitional clause requires ADIs to track the interaction between old and new standards and to continue to submit overdue documents under the old regime where applicable.

• APRA’s authority to treat an ADI as of another class for the purposes of the standard is an administrative lever that can be used to alter reporting obligations in particular cases without a broader rule change.

In sum, the reporting standard provides only limited internal amendment mechanisms and transitional provisions; it does not include a published amendment history within the document provided and contemplates APRA-administered, notice-based adjustments rather than statutory revisions described in the text.

The text of this reporting standard contains no citations of judicial decisions, no references to litigation, and no description of past enforcement proceedings. The standard does not name any court cases, rulings or tribunal outcomes. It establishes procedural requirements, audit obligations and APRA discretions, but it is silent as to any judicial interpretation or challenge history.

Potential loci for disputes implied by the standard

• APRA determinations and notices: Paragraphs 7 and 17 give APRA administrative powers to change reporting frequency for a particular ADI and to treat an ADI as though it were of another class for purposes of the standard. Such discretionary administrative acts are common subjects of dispute in other contexts, but the standard itself does not record any litigation outcomes about the exercise of these particular discretions.

• Transitional obligations and interpretations: Paragraph 15 addresses transitional reporting under an old reporting standard. Parties may in practice dispute whether a particular reporting period falls within the transitional definition, but the standard contains no litigation examples or case law citations addressing such disputes.

• Auditor review scope: Paragraph 10 requires external auditors to review and test the processes and controls that produce the reported information, pointing to AGS 1008 for guidance. Disagreements could arise over the scope or sufficiency of auditor testing, but again the standard does not reference any disputes or judicial consideration of AGS 1008 in this context.

• Board and senior management responsibilities: Paragraph 11 places responsibility on the board and senior management to ensure appropriate policies for authorisation of data. The standard does not discuss litigation concerning governance failures in relation to this reporting obligation.

Absence of litigation references means the instrument does not provide precedential guidance on how courts or tribunals may interpret its provisions. Practitioners seeking to understand how disputes have been resolved, or how courts treat APRA administrative discretion under these clauses, will need to consult case law and other sources outside this document. The standard itself does not supply a litigation history.

This reporting standard contains several specific operational and interpretative traps that can lead to reporting errors or governance failures if overlooked. The following points surface concrete pitfalls that flow directly from the text.

• Scope is limited to advanced ADIs: The standard applies only to ADIs approved to use the IRB approach under APS 113 (paragraph 2). An entity that is an ADI but lacks that APRA approval is not within scope. Treating the standard as applying more broadly would be an error.

• Level 2 reporting may be reallocated to an NOHC: If an ADI is a subsidiary of an authorised NOHC, the requirement to provide Level 2-designated data falls on the immediate parent NOHC, not on the subsidiary ADI. The NOHC must comply with this reporting standard other than paragraphs 3 and 10 as if it were the ADI (paragraph 4). Practitioners must not assume that all group reporting flows up or down without checking NOHC status.

• Auditor review exception for paragraph 4 reporting: The external auditor review and testing requirement explicitly excludes the information required under paragraph 4 (paragraph 10). That means that where Level 2 data are provided by an immediate parent NOHC under paragraph 4, the external auditor review requirement mentioned in paragraph 10 does not apply to that particular information. ADIs and NOHCs must be aware which parts of the dataset are captured by the audit requirement.

• Reporting period tied to financial year under the Corporations Act: The baseline reporting cadence is quarterly based on the ADI’s financial year within the meaning of the Corporations Act 2001 (paragraph 6 and paragraph 16). If a group entity uses a different reporting year or has differing balance date conventions, mapping to the ADI’s financial year is required and can create timing mismatches.

• APRA may change frequency and timing: APRA may require a particular ADI to report more or less frequently by written notice, taking into account several factors including the ADI’s circumstances and needs of APRA, the Reserve Bank of Australia or ABS (paragraph 7). ADIs must therefore monitor APRA notices and be prepared to modify reporting cadence at short notice.

• Electronic-only submissions and digital certificates: All submissions must be electronic via the D2A application (paragraph 5). Submissions must be digitally signed and encrypted by an authorised officer with an APRA-issued digital certificate (paragraph 12). Failure to obtain the appropriate digital certificates and set up D2A access will prevent lawful submission.

• 30 business day deadline and limited extension mechanism: The prescribed deadline is 30 business days after the reporting period (paragraph 8). APRA may grant an extension in writing (paragraph 9). Late submissions without an APRA extension are not contemplated in the standard and are therefore procedural risk events.

• Minor form variations can occur without substantive change: APRA can make minor variations to forms or instructions to correct technical, programming or logical errors or to clarify application without changing substantive requirements (paragraph 13). APRA must notify ADIs of such changes (paragraph 14), but ADIs relying on static templates must be prepared for such updates. Automated submission processes may break if formats change and programmes are not kept in sync.

• Transitional reporting and overdue documents: If a reporting period under the old reporting standard ended before revocation of the old standard but the ADI was required to report under the old standard by a date on or after revocation, the ADI must report under the old standard for that period (paragraph 15). Overdue documents that were due before revocation remain required under the old standard. This temporal interaction can cause confusion about which form applies and which set of instructions to use.

• APRA may reclassify ADIs by written determination: Paragraph 17 allows APRA to treat an individual ADI of one class as though it were of another class for the purposes of the reporting standard. Such a reclassification can shift reporting obligations; entities should monitor for written determinations affecting their class.

• Board and senior management responsibility: The standard places responsibility for policies and procedures for authorisation of submitted data on board and senior management (paragraph 11). Operational teams may treat reporting as a data exercise; the standard requires governance ownership and sign-off procedures.

• Cross-referenced rules and definitions are elsewhere: Level 1 and Level 2 meanings, authorised NOHC definitions and some substantive thresholds are defined in APS 110, APS 112 and APS 113, and the Banking Act and Corporations Act supply other definitions (paragraphs 1 and 16). Misreading this standard in isolation risks misclassification and non-compliance.

Practical consequence: entities should map obligations to legal status, ensure D2A and digital certificate readiness, establish annual external auditor review cycles aligned to AGS 1008, document governance sign-off procedures, and maintain a timetable that accommodates APRA notices and transitional interactions with prior reporting standards.

The reporting standard lays out a concise compliance pathway. The following is a source-grounded, stepwise checklist that an advanced ADI, or the NOHC where applicable, should follow to comply with the standard.

1. Confirm applicability

   • Verify APRA approval to use the internal ratings-based approach under APS 113. The reporting standard applies only to advanced ADIs (paragraph 2).
   • If the ADI is part of a Level 2 group, determine whether it is a subsidiary of an authorised NOHC. If so, notify and coordinate with the immediate parent NOHC, because the NOHC must provide Level 2-designated data in that case (paragraph 4).

2. Identify required data and forms

   • Obtain Form ARF 118.1 Other Off-balance Sheet Exposures and its instructions, which are attached and form part of the reporting standard (paragraph 1). Treat the form and instructions as the authoritative specification of required fields.

3. Map reporting levels and group responsibilities

   • Apply Level 1 data requirements to the ADI for each reporting period (paragraph 3).
   • Determine whether Level 2-designated data are required and whether those must be submitted by the ADI or the immediate parent NOHC (paragraph 4). Consult APS 110 for Level 1 and Level 2 definitions (paragraph 16).

4. Establish electronic submission capability

   • Acquire and configure APRA’s Direct to APRA (D2A) application and any required submission mechanisms (paragraph 5).
   • Arrange for APRA-issued digital certificates for officers authorised to transmit data. Ensure the authorised officer can digitally sign, authorise and encrypt submissions (paragraph 12).

5. Set the reporting calendar and deadlines

   • Base the quarterly reporting calendar on the ADI’s financial year within the meaning of the Corporations Act 2001 (paragraph 6).
   • Build operational lead times to meet the 30 business day deadline after each reporting period (paragraph 8).
   • If particular circumstances require different timing, apply to APRA or monitor for APRA’s written notice changing reporting frequency (paragraphs 7 and 9).

6. Implement internal processes, controls and governance

   • Develop and document processes and controls that produce the required data and ensure they are subject to internal review and authorisation. The board and senior management are responsible for ensuring appropriate policies and procedures are in place (paragraph 11).
   • Identify and document the authorised officers who will hold APRA digital certificates and the internal approval workflow for submissions, including sign-off authorities.

7. Arrange external auditor review

   • Ensure the external auditor will review and test the processes and controls that produce the reported data, in accordance with AGS 1008 guidance, at least annually or more frequently if necessary (paragraph 10). Note that the paragraph 4 exception may exclude certain NOHC-provided Level 2 information from the external auditor review requirement.

8. Test end-to-end submission processes

   • Conduct test submissions through D2A where possible and ensure that encryption, digital signing and the authorised officer processes operate correctly. Account for minor variations in forms that APRA may make (paragraph 13).

9. Monitor APRA communications and variations

   • Actively monitor for APRA written notices changing reporting frequency or for determinations treating the ADI as another class (paragraphs 7 and 17).
   • Monitor for APRA notifications of minor variations to forms or instructions. Update automated submission scripts or data mappings promptly when APRA notifies affected ADIs (paragraphs 13-14).

10. Manage transitional reporting

    • If transitioning from an old reporting standard, identify any transitional reporting periods that fall under paragraph 15 and ensure those reports continue to be submitted under the old standard where required (paragraph 15).

11. Recordkeeping and audit trail

    • Maintain contemporaneous records of the internal review and authorisation, external auditor review and testing outcomes, APRA communications including extension approvals and determination notices, and copies of submissions and digital certificates to demonstrate compliance.

12. Engage with group and NOHC stakeholders

    • Where the NOHC provides Level 2 information, establish written protocols for data collection, verification and submission to APRA, consistent with paragraph 4. Ensure the NOHC’s compliance with the standard (other than paragraphs 3 and 10) as if it were the ADI.

13. Prepare for supervisory queries

    • Given the use of the data by APRA, the RBA and ABS (paragraph 1), be ready to respond to supervisory requests for clarification on reported off-balance sheet exposures, with source documentation, audit testing results and governance sign-off records.

By following these steps and mapping each task to the relevant paragraph or provision in the reporting standard, an advanced ADI or an immediate parent NOHC can establish a compliant reporting regime that addresses electronic submission, auditor assurance and corporate governance requirements set out in the standard.