This Reporting Standard (GRF 800.3) requires insurers to supply facility-level data about public liability, product liability and professional indemnity insurance to the Australian Prudential Regulation Authority (APRA) and specifies the form, frequency, formats, fields and authorisation arrangements for that information. The Standard is made under section 13 of the Financial Sector (Collection of Data) Act 2001 (para 1) and states that the information collected will be used by APRA for prudential supervision and publication, including the National Claims and Policies Database (NCPD) (para 2). The Standard applies to insurers (defined as general insurers, see para 16) and is said to apply for reporting periods ending on or after 31 December 2021 (para 4).

Mechanically the instrument does the following.

• Identifies the population required to report: insurers (para 3; definition of insurer at para 16).
• Defines the subject matter: facility business that is closed by bordereau and for which the insurer does not receive individual policy or claims data from a facility manager, including business undertaken through underwriting pools or joint ventures (definition of facility business, para 16).
• Defines reportable facility business and sets materiality thresholds for separate facility reporting (para 16 and Record Layouts: facility identifier and threshold discussion).
• Specifies required data items, record layout and field types (Facility Business Data Specifications and Field Definitions; items 1-11).
• Prescribes reporting frequency by default as each calendar half-year (periods ending 30 June and 31 December), with APRA able to vary frequency for particular insurers or classes (paras 6-7).
• Sets due dates: half-yearly data must be provided no later than four months after the end of the reporting period; APRA may set different times in writing (para 8). It also clarifies that the insurer must ensure receipt by the recipient by the due date (para 17).
• Prescribes submission method and format: CSV format, submitted electronically via the NCPD web site using a customer identification number and password supplied by Fujitsu Australia as agent of APRA (para 9 and para 12). APRA may determine alternative IT requirements or alternative delivery addresses in writing (para 10).
• Places corporate responsibility for data quality on board and senior management, requiring processes and controls for internal review and authorisation (para 11).
• Sets authorisation and access arrangements including the role of Fujitsu Australia as agent, password assignment to the insurer’s Chief Financial Officer, and APRA’s power to specify alternative authorised signatories (paras 12-13).
• Provides APRA express discretion to make minor alterations to the reporting form, occupation codes and specifications either generally, for classes of insurers or for particular insurers, and requires written notice to affected insurers (paras 14-15).
• Establishes validation and reasonability checks at submission, described in Appendix B (data validation checks and reasonability comparisons).

The instrument therefore operationalises a half-yearly, CSV‑based, facility-level reporting regime for public/product liability and professional indemnity facility business, with APRA retention and publication of that data in the NCPD. The Standard contains definitions, field-by-field instructions (including numeric formats, date format DDMMYYYY, treatment of GST and statutory charges, threshold rules for the “Other” facility identifier and rounding/decimal rules) and validation rules intended to ensure data consistency (Facility Business Record Data Field Definitions; Appendices A and B).

The Standard’s core concepts are facility business, reportable facility business, the GRF 800.3 record layout, reporting periods and due dates, submission mechanics, authorisation and quality control, APRA discretion to alter form/specifications, and validation checks.

Facility business. Facility business is defined as business that is closed by bordereau and for which the insurer does not receive individual policy or claims data from the facility manager, and it explicitly includes business undertaken through underwriting pools or joint ventures (para 16, definition of facility business). That definition locates the reporting obligation at the facility-aggregate level rather than at the individual policy or claim level where such granular data is not received by the insurer.

Reportable facility business. The Standard sets out what is reportable: facility business underwritten by an insurer on or after 1 January 2003 that relates to product liability, professional indemnity or public liability, with specific exclusions for reinsurance/retrocession, marine insurance, domestic householder/owner’s insurance or tenant’s liability sold with a building/contents policy, and events that could neither occur in Australia nor in relation to an insured resident of Australia (para 16, definition of reportable facility business). This narrows the universe to in-scope liability lines and to risks with an Australia nexus.

Materiality threshold and “Other”. The Record Layout requires a unique Facility Identifier for each facility where an insurer has received more than $100,000 in premium or made gross payments in excess of $100,000 for the six-month period. Facilities below that threshold are to be aggregated into a single “Other” record (Facility Identifier definition). If a facility drops below the threshold after previously being reported separately it may be moved into “Other”.

Field definitions and formats. Eleven data items are prescribed for each facility record (Insurer Code; Date of reporting period end; Facility Identifier; Industry/Occupation Code; Class of Business; Runoff Indicator; Insurer’s Percentage of Facility; Number of Policies; Premium Received; Number of Claims; Gross Payments Made). The instructions specify field types and limits, date format DDMMYYYY, how to treat premiums (exclude statutory charges such as FSL, GST and stamp duty but include commissions) and how to report payments (net of GST, whole dollars, no decimals). Insurer percentage must be to two decimal places; the “Other” record must leave insurer-percentage blank (Record Layout and Field Definitions).

Industry/occupation coding. For public and products liability APRA requires the principal ANZSIC code at the 4-digit level (ANZSIC catalogue 1292.0), with reporting aggregated to two-digit level for publications; for professional risks APRA uses its Appendix A occupation codes (Facility Business Data Field Definitions, Appendix A). A multi-occupation code “OMULTI” and “0000” for ANZSIC exist but are restricted to certain circumstances.

Primary obligated parties. The Reporting Standard applies to insurers; the term insurer is defined to mean general insurer with the same meaning as in the Insurance Act 1973 (para 3; definitions at para 16). Therefore the primary direct cost-bearers are entities operating as general insurers writing public/product liability or professional indemnity business that fall within the defined reportable facility business.

Indirectly affected parties. Facility managers are indirectly affected because the definition of facility business is tied to whether an insurer receives individual policy and claims data from the facility manager (definition of facility business, para 16). Where insurers do not receive individual data from facility managers, the insurer must construct the aggregated facility records and submit them to APRA. Underwriting pools and joint venture arrangements are specifically within scope for facility business (para 16).

APRA agents and IT providers. Fujitsu Australia is named as APRA’s agent for customer identification and for receiving data through the NCPD web site, and Fujitsu’s role is embedded in the submission and authentication process (paras 9 and 12). When Fujitsu acts as agent it will supply each insurer a customer identification number and provide the password to the insurer’s Chief Financial Officer (para 12). APRA may, however, determine alternative recipients or IT requirements in writing (para 10).

State and Territory Government insurers. The Instruction Guide explicitly records that State and Territory Government insurers will also contribute to the NCPD where possible (Instruction Guide footnote). That suggests the Standard contemplates public insurers participating, while recognising practical constraints.

Who decides and who may change obligations. APRA is the decision-maker for determinations about reporting periods, frequency, deadlines, alternate submission methods, and minor variations to the form, occupation codes and specifications (paras 7, 8, 10, 14). APRA must exercise these powers in writing (para 19) and must notify affected insurers when it makes variations (para 15). The Standard therefore centralises discretionary supervisory tailoring in APRA.

Who pays in practice. The direct financial and operational costs fall to insurers. Those costs include establishing and maintaining data extraction, aggregation and validation processes, meeting the CSV and field-format requirements, implementing board-level controls and authorisation processes to comply with para 11, and handling the security/authentication arrangements via Fujitsu or any alternate APRA-determined arrangements. Insurers that participate in underwriting pools or that manage facility business where they do not receive individual policy/claim records will particularly bear the cost of producing aggregated facility records.

Duties imposed on insurers. The Standard imposes several explicit duties on insurers.

• Supply required information for each reporting period and each reportable facility business where the insurer is on risk (para 5). That duty is unconditional in form and applies to every reporting period.
• Provide the information in respect of calendar half-years (periods ending 30 June and 31 December) unless APRA decides otherwise for a particular insurer (paras 6-7).
• Ensure receipt by APRA or APRA’s agent by the due date (para 17). Practically this means insurers must manage submission timing so the data are received by the recipient no later than the deadline.
• Submit data in CSV format in accordance with GRF 800.3 instructions, via the NCPD web site using the customer identification number and password supplied by Fujitsu Australia, unless APRA determines an alternative method in writing (paras 9-10, 12).
• Ensure that the information provided is the product of processes and controls developed for internal review and authorisation; board and senior management are responsible for ensuring these policies are in place (para 11). That is framed as a corporate governance duty rather than a technical filing instruction.
• Observe the field-level definitions and formats in the Record Layouts and Field Specifications: date format, numeric formatting, inclusion/exclusion rules for premiums and payments, the threshold rule for facility identifiers and the use of “Other” where appropriate (Facility Business Record Data Field Definitions).
• Comply with APRA’s data validation and reasonability checks (Appendix B), which will be carried out at each submission and may prompt follow-up.

Authorisation arrangements and APRA discretion over authorised persons. Fujitsu will supply the customer identification number and the insurer must apply for the password via the web page; Fujitsu will advise the insurer’s Chief Financial Officer of that password (para 12). APRA may, in writing, determine that specific persons, holders of specified positions (not necessarily the CEO or CFO), or persons authorised by the insurer must or may authorise information provided under this Standard (para 13). This creates a duty to maintain clarity about who is authorised to sign-off on submissions, and APRA may require different authorisers in writing.

APRA rights and discretions. APRA has a number of rights under the Standard.

• To substitute reporting periods and change reporting frequency for particular insurers (para 7).

The Reporting Standard as provided does not contain express penalty or sanction clauses within its text. It prescribes reporting obligations, validation checks and APRA discretions but does not itself set out civil penalties, administrative fines or criminal offences for non-compliance. The Standard is made under section 13 of the Financial Sector (Collection of Data) Act 2001 and identifies APRA as the collecting authority (para 1); any enforcement powers, sanctions or compliance processes available to APRA will be found in the Financial Sector (Collection of Data) Act 2001 or other relevant statutes, not in this document. The Standard also requires APRA to act in writing when exercising its discretions (para 19) and to notify affected insurers when it makes variations to the instructions, codes or specifications (para 15), which provides some administrative procedure but does not itself identify penalties.

What the text does contain relevant to enforcement.

• Validation and reasonability checks. Appendix B sets out unit-record validation and overall reasonability checks that APRA will perform at each half-yearly submission, and APRA may carry out other ad hoc reasonability checks. Those validation results can be expected to trigger follow-up requests for clarification or correction from APRA, or further supervisory engagement; the Standard itself does not specify the follow-up steps (Appendix B).
• Written determinations and notifications. APRA must notify affected insurers in writing of variations (para 15) and APRA’s exercise of power or discretion is to be exercised in writing (para 19). These written instruments create an administrative record that can be relied upon as the basis for subsequent supervisory action under broader legislative powers.
• Authorisation and board responsibility. The Standard places responsibility on the insurer’s board and senior management to have appropriate policies and procedures for authorising data provided to APRA (para 11). Failure to have such processes could be relevant to APRA’s broader prudential supervision and governance assessments, but the Standard does not itself specify targeted sanctions.

Practical reading for enforcement risk. Because the Standard refers to the Financial Sector (Collection of Data) Act 2001 as its authority (para 1) and to APRA’s supervisory use of the data (para 2), insurers should assume APRA has supervisory tools outside the Standard that it can use if data quality, timeliness or completeness is deficient. The Standard’s validation framework and written-determination procedure will produce audit trails and evidence that APRA can use in supervisory engagement, but readers should consult the Financial Sector (Collection of Data) Act 2001 and APRA’s general supervisory framework for the precise range of enforcement powers and sanctions that can be brought to bear for non-compliance.

Statutory basis and cross-references. The Standard is made under s 13 of the Financial Sector (Collection of Data) Act 2001 (para 1), so its legal force and the available enforcement mechanisms will be governed by that Act. The definition of agent of APRA refers to s 47 of the Australian Prudential Regulation Authority Act 1998 (para 16, definition of agent of APRA), which integrates the Standard with APRA’s statutory architecture for using agents to receive data. The term general insurer is given the same meaning as in the Insurance Act 1973 (para 16), tying the identity of obliged entities to the definitions set out in insurance legislation. The Standard also specifies that any reference to Acts, Regulations, Prudential Standards, Reporting Standards, Australian Accounting Standards or Auditing Standards is to those instruments as in force from time to time (para 18), thereby incorporating evolving external instruments by reference.

Publication and other regulatory regimes. The Standard expressly states APRA will use collected information for prudential supervision and publication, including publication in the National Claims and Policies Database (NCPD) (para 2). That ties the Standard to APRA’s public reporting activities. The Standard does not itself address how publication interacts with privacy, confidentiality, or secrecy obligations under other statutes. The question of whether particular data elements intersect with the Privacy Act 1988, secrecy obligations under the APRA Act or publicly disclosable information under freedom of information regimes is not resolved by the Standard itself; the Standard is silent on those interactions and only states APRA will publish data in the NCPD (para 2).

Accounting and auditing standards. Paragraph 18 states that references to Australian Accounting Standards and Auditing Standards are to instruments as in force, which signals that insurers must map their reporting to accounting constructs as those standards evolve. The Standard also requires insurers to implement internal processes and controls for authorising data provided to APRA and makes the board and senior management responsible for those policies (para 11). That governance requirement sits alongside the financial reporting and audit frameworks insurers already must follow.

Agent and third-party arrangements. The Standard expects data to be supplied via the NCPD website operated with Fujitsu Australia as APRA’s agent (paras 9 and 12). The agent relationship is underpinned by APRA’s statutory ability to appoint agents (agent definition linked to APRA Act s47, para 16). Use of an external IT provider for submission and authentication means insurers’ compliance will intersect with third-party service management and contractual arrangements, but the Standard does not specify contractual terms; those arise from separate agreements with APRA’s agent and APRA’s determinations where relevant.

The text provided does not include a change log or a sequence of historic amendments to the Reporting Standard. What the source does state about timing and variability is as follows.

• The Standard is made under section 13 of the Financial Sector (Collection of Data) Act 2001 (para 1); no date of making or legislative instrument number is provided in the text excerpt.
• The Standard applies for reporting periods ending on or after 31 December 2021 (para 4). That provides a commencement anchor for when the reporting obligations began to apply to reporting periods.
• The Standard expressly foresees that APRA may make minor variations to GRF 800.3 and to occupation codes or table specifications either generally, for classes of insurers or in relation to particular insurers to correct technical, programming or logical errors or where APRA considers a code/specification inappropriate, and mandates written notification to affected insurers if such variations are made (paras 14-15). Those provisions create a built-in mechanism for APRA to alter the instrument administratively in the future, and so the Standard is not static.

What is not present. The document does not list previous versions, amendment dates, or the statutory instrument history within this text. There is no schedule of past changes, no consolidated amendment list and no indication of whether the Standard consolidates earlier versions. Consequently a reader seeking a complete amendment history must consult APRA’s instrument registry, the Federal Register of Legislation, or the Financial Sector (Collection of Data) Act 2001’s legislative instruments registers for formal amendment records.

Practical implication. Because the Standard authorises APRA to vary codes and specifications and requires APRA to notify affected insurers in writing (para 15), insured entities must monitor APRA communications and the formal legislative instrument registers for any changes. The absence of a documented amendment history in this text means practitioners should not rely on the excerpt alone to determine past iterations or to infer the stability of particular fields or codes.

In short, the document sets a commencement date for the reporting obligation (periods ending on or after 31 December 2021) and embeds a mechanism for future minor variations, but it does not itself contain a chronology of amendments.

The provided Reporting Standard and accompanying instructions do not contain, cite or reference any litigation history. The text contains no judicial decisions, no references to court challenges to the Standard, and no description of disputes about interpretation or enforcement arising from the Standard. The Instructions and Appendices focus exclusively on field specifications, submission mechanics, validation checks and APRA discretion to make variations.

Practical consequence. Because no litigation history is included, there is no source-grounded precedent available in this document about how courts have treated obligations arising from this Standard, the act of data publication in the NCPD, or disputes about APRA’s exercise of its discretions under the Standard. Users seeking to understand how obligations under APRA reporting instruments have been litigated must consult court records and judgments separately and check whether there have been challenges to APRA reporting standards or to the use of data in the NCPD outside this text.

Note on available materials. The Instruction Guide refers to State and Territory Government insurers contributing where possible (Instruction Guide footnote), and Appendix B outlines validation checks APRA will perform, which may generate follow-up supervisory engagement. None of those operational processes are described as having produced litigation in the document.

In short, there is no litigation history recorded in this Reporting Standard excerpt. Where litigation questions arise,such as enforcement actions under the Financial Sector (Collection of Data) Act 2001, disputes over APRA determinations, privacy or publication challenges,those must be researched in external legal databases and court archives; the Standard itself is silent on that history.

This Standard contains a number of concrete technical, procedural and governance features that often catch practitioners and operational teams unprepared. The following are specific, source-grounded “gotchas” to watch for.

1. Deadline semantics and receipt requirement. The Standard requires insurers to ensure that the information is received by APRA or APRA’s agent no later than the specified date (para 17). That is not the same as ensuring transmission by the insurer by that date. Operationally an insurer must account for transmission, agent processing time, possible rejections by automated validation and re-submission cycles so that the recipient actually receives the data by the deadline (paras 8 and 17).

2. CSV format and strict field formats. The required CSV format must match the GRF 800.3 instructions exactly, including date format DDMMYYYY with no delimiters, numeric field widths and the absence of decimals in some fields (Record Layouts and Field Definitions). Small formatting mistakes (wrong date delimiter, decimal points in payments) can trigger validation failures per Appendix B.

3. Threshold and “Other” aggregation logic. Facilities are reported separately only where premium received or gross payments exceed $100,000 for the six-month period; otherwise they must be aggregated into an “Other” facility identifier (Facility Identifier definition). This threshold can change how internal systems must map exposures to facility identifiers each period. If a facility was previously reported separately but now falls below $100,000 it must be reported as part of “Other”, and accordingly the insurer must manage identifiers across reporting cycles.

4. Insurer percentage blank on “Other”. For “Other” facilities the Insurer’s Percentage of Facility must be left blank (Field 7). Failure to leave it blank will likely trigger validation checks. Conversely, for named facilities the percentage must be to two decimal places (Field 7).

5. Treatment of premium and payments. Premium must exclude statutory charges (FSL, GST and SD) but include commissions (Field 9). Payments must be reported net of GST in whole dollars with no decimal points and should include claimant payments plus third-party service providers attributed to the claim (Field 11). Misinterpreting “exclude statutory charges” or including GST in payment figures will distort reported metrics and fail validation checks.

6. Industry/occupation coding. For PL/Products the principal ANZSIC 4-digit code is required; professional risks use APRA’s Appendix A occupation codes (Field 4 and Appendix A). Using “OMULTI” or “0000” is permissible only where a facility genuinely covers multiple occupations and no principal code applies. Overuse of “Other” or “OMULTI” is a specific reasonability check in Appendix B.

Practical, stepwise compliance actions mapped to the Standard’s text.

1. Governance and policies (para 11)

   • Board and senior management must adopt and document policies and procedures for data authorisation and internal review. Create an approval matrix that records the positions and persons authorised to approve submissions, and record the control environment (reconciliation processes, owner roles, escalation paths).
   • Maintain an audit trail of approvals and record who authorised each submission and on what basis.

2. Acquisition of authentication credentials (paras 9 and 12)

   • Apply for the insurer’s customer identification number if not already provided by Fujitsu/APRA.
   • Follow the web page instructions to apply for the password and ensure secure receipt and custody of the password. Record the process by which the CFO is informed and how password change and rotation will be handled.
   • Build procedures for secure credential handling, including incident response where credentials are compromised.

3. Data mapping and extraction

   • Map internal ledgers, bordereau submissions and aggregate facility accounts to the GRF 800.3 record fields. Document the source systems, reconciliation points and mappings for each field (items 1-11).
   • Implement logic to identify facilities above the $100,000 premium or payment threshold for separate reporting and to aggregate below-threshold facilities into the “Other” record per Facility Identifier instructions.
   • Ensure Insurer’s Percentage of Facility is blank for “Other”, and two-decimal precision is used for percentages on named facilities (Field 7).

4. Field-level formatting and calculations (Field Definitions and Record Layout)

   • Enforce date format DDMMYYYY with no delimiters.
   • For premiums, exclude FSL, GST and stamp duty but include commission calculations (Field 9). Have clear sub-ledgers to isolate statutory charges.
   • For gross payments, report amounts net of GST, in whole dollars, without decimals, and include payments to claimants and third‑party service providers attributable to claims (Field 11).
   • Ensure number-of-policies and number-of-claims fields are either populated where available or left blank per instructions (Fields 8 and 10).