The Standard centres on three principal concepts: scope (who reports and what), form and delivery (how information is provided), and quality control (assurance and governance over the data). Each is shaped by linked definitions in the Standard and other Prudential Standards.

Scope and classification

• The ADI classes to which the Standard applies are listed in paragraph 3 and the initial table. It explicitly includes banks (advanced/applicant advanced and standardised), branches of foreign banks, building societies, credit unions, and "other ADI", but excludes providers of purchased payment facilities (paragraph 3 table). A caveat applies for Cairns Penny Savings and Loans Limited in the definition of "credit union" and "other ADI" (paragraph 17).
• Level 1 and Level 2 reporting: the Standard requires Level 1 reporting for applicable ADIs (paragraph 5). If the ADI is part of a Level 2 group, it must also provide Level 2 reporting (paragraph 6), unless it is a subsidiary of an authorised NOHC, in which case the immediate parent NOHC must provide the Level 2 form (paragraph 6). The meaning of Level 1 and Level 2 is taken from APS 001 (paragraph 17 definitions).

Forms and delivery

• Reporting Form ARF 118.0 is the operative instrument for content. The Standard states that ARF 118.0 and its instructions are attached and form part of the Standard (paragraph 1). APRA may make minor variations to the forms or instructions to fix technical or clarification issues without changing substantive requirements (paragraphs 15-16).
• Electronic submission is mandatory using the Direct to APRA (D2A) application or any other method APRA notifies in writing beforehand (paragraph 7). The D2A application is also referred to by its acronym (note in paragraph 7).
• Digital authorisation: an officer must digitally sign the submission using an APRA-acceptable digital certificate (paragraph 14).

Quality control and assurance

• External auditor review: except for the information required under paragraph 6 (i.e. where Level 2 parent NOHC reporting applies), all information must be produced by systems, processes and controls that have been reviewed and tested by the ADI’s external auditor in accordance with Prudential Standards APS 310 Audit and Related Matters (paragraph 12). The review and testing must occur at least annually or more frequently if required for the auditor to form an opinion on accuracy and reliability (paragraph 12).
• Internal review: all reported information must be subject to ADI-developed processes and controls for internal review and authorisation to assure completeness and reliability (paragraph 13).

Timing and APRA discretion

• Reporting frequency is quarterly as default (paragraph 8). APRA may change reporting periods (increase or reduce frequency) for particular ADIs by written notice, taking into account the ADI’s circumstances and requirements of the RBA or ABS (paragraph 9).
• Deadlines differ by ADI class, set out in the table at paragraph 10. APRA may grant written extensions to due dates (paragraph 11).

Cross-references and interpretative rules

• The Standard must be read alongside APS 112 or APS 113, as appropriate, and ARF 118.0 instructions (paragraph 1).
• Definitions and cross-references are provided in paragraph 17. The Standard treats references to Acts, Prudential Standards and Australian Accounting or Auditing Standards as references to those instruments as in force from time to time (paragraph 18).
• APRA can treat an individual ADI as though it were of another class for these purposes by written determination (paragraph 19).

These main concepts frame the compliance, governance and operational requirements ADIs must meet when reporting off-balance sheet business.

The Standard applies directly to ADIs as defined in the Banking Act 1959 (paragraph 17). The initial scope table in paragraph 3 identifies classes and whether the Standard applies to them. Those in scope include:

• Bank - Advanced or Applicant Advanced (Yes) , advanced internal ratings-based approach or advanced measurement approach applicants (paragraph 17 definitions; paragraph 3 table).
• Bank - Standardised (Yes) (paragraph 3 table).
• Branches of foreign banks (Yes) , required to report for the Australian branch only (paragraph 5).
• Building societies (Yes) (paragraph 3 table).
• Credit unions (Yes) , explicitly includes Cairns Penny Savings and Loans Limited in the definition of credit union for the purposes of this Standard (paragraph 17).
• Other ADI (Yes) , definition excludes Cairns Penny Savings and Loans Limited for the purposes of the Standard (paragraph 17).
• Providers of purchased payment facilities are listed but not applicable under this Standard (paragraph 3 table and paragraph 10 where not applicable).

Group structures and NOHCs

• Where an ADI is part of a Level 2 group, the ADI must provide Level 2 reporting as well (paragraph 6). However, if the ADI is a subsidiary of an authorised NOHC, the immediate parent NOHC must provide the Level 2 form; in providing that form the immediate parent NOHC must comply with the Reporting Standard, other than paragraphs 5 and 12, as if it were the ADI (paragraph 6). In short, parent NOHCs may bear the Level 2 reporting obligation for subsidiaries that are NOHC subsidiaries.

Users of the data

• APRA is the primary recipient and user of the data for prudential supervision and assessing compliance with APS 112 or APS 113 (paragraph 2). The Standard also permits use by the Reserve Bank of Australia and the Australian Bureau of Statistics (paragraph 2), so those agencies will receive and potentially rely upon the data.

Particular institutional distinctions

• Foreign ADIs are required to report only the Australian branch (paragraph 5); locally incorporated entities report for the whole ADI subject to Level classification rules (see definitions in paragraph 17).
• The Standard gives APRA express power to treat an ADI as another class for reporting purposes (paragraph 19), which can change who is affected on a case-by-case basis.
• The Standard does not state criminal or civil penalties for non-compliance in its text. Consequently, if a reader is seeking who will be sanctioned for non-compliance, that must be determined by reference to APRA’s enforcement powers under the enabling legislation and other prudential rules; the Standard itself prescribes reporting duties and processes (paragraphs 1-19).

Operational personnel and functions within ADIs affected include: data and finance teams (to prepare ARF 118.0), compliance and prudential reporting teams (to ensure adherence to APS 112/113 cross-references), IT and systems teams (to transmit via D2A), legal for governance and interpretation, and external auditors (for the required reviews under paragraph 12). Senior officers must also be capable of digitally signing submissions using an acceptable digital certificate (paragraph 14), which affects executive authorisation processes.

Duties imposed on ADIs

• Provide the information required by the version of ARF 118.0 designated for an ADI at Level 1 for each reporting period, where applicable (paragraph 5). Branches of foreign banks report only in relation to the Australian branch (paragraph 5).
• Where the ADI is part of a Level 2 group, it must also provide the Level 2 ARF 118.0 for each reporting period, unless it is a subsidiary of an authorised NOHC (paragraph 6).
• Where an ADI is a subsidiary of an authorised NOHC, the immediate parent NOHC must provide the Level 2 form and comply with the Reporting Standard (other than paragraphs 5 and 12) as if it were the ADI (paragraph 6).
• Submit the information electronically using D2A or another method APRA notifies in writing prior to submission (paragraph 7).
• Provide the information on a quarterly basis based on the ADI’s financial year, subject to any APRA notice altering reporting periods (paragraphs 8-9).
• Meet the submission deadlines set out in the paragraph 10 table (number of business days after the reporting period), unless APRA grants an extension in writing (paragraphs 10-11).
• Ensure that reported information (other than where paragraph 6 applies) is the product of systems, processes and controls reviewed and tested by the ADI’s external auditor in accordance with APS 310 (paragraph 12). The external auditor’s review and testing must be at least annual, or more frequently if necessary for the auditor to form an opinion on the information’s accuracy and reliability (paragraph 12).
• Maintain internal processes and controls for review and authorisation to assure completeness and reliability of the information (paragraph 13).
• Ensure that an officer digitally signs any submission using a digital certificate acceptable to APRA (paragraph 14).

Rights and APRA discretions that affect ADIs

• APRA may change reporting periods for a particular ADI by written notice, increasing or reducing frequency, having regard to the ADI’s circumstances and the RBA/ABS requirements (paragraph 9). This is a power that can impose a change in reporting burden by administrative direction.
• APRA may grant extensions to submission due dates in writing (paragraph 11). ADIs have the procedural right to apply for and receive such extensions.
• APRA may make minor variations to forms or instructions to correct technical or programming errors or clarify instructions without changing substantive requirements, and must notify affected ADIs of such variations in writing (paragraphs 15-16). The right to be notified is provided.
• APRA may determine in writing that an individual ADI of one class be treated as though it were an ADI of another class for the Standard’s purposes (paragraph 19). This changes reporting obligations on APRA’s determination.
• The Standard explicitly excludes the external auditor review requirement where paragraph 6 applies (i.e. when an immediate parent NOHC reports Level 2), meaning subsidiaries in that situation are relieved of that specific auditor-review duty (paragraph 12 exception).

Practical duty allocation and authorising roles

• The Standard requires an officer’s digital signature for submission (paragraph 14), which imposes a duty on senior staff or authorised officers to validate data and accept legal responsibility for the submission process. The Standard does not specify which officer level is required; that is left to ADI governance and APRA’s digital certificate regime.

Cross-referenced obligations

• The duty to ensure external-auditor review is qualified by reference to APS 310 (paragraph 12), so compliance requires coordination between prudential reporting, external audit arrangements, and APS 310 obligations; obligations under APS 112 or APS 113 are relevant because the collected data will be used to assess compliance with those Prudential Standards (paragraphs 1-2).

In short, the core duty is to produce, assure, and submit, on APRA’s forms and timetable, accurate off-balance sheet data; APRA retains discretion to change frequency, make minor form changes, grant extensions, and reclassify ADIs.

The Reporting Standard itself sets prescriptive requirements for reporting and assurance but does not enumerate specific penalties, fines, or enforcement actions within its text. The instrument makes clear its statutory source (made under section 13 of the Financial Sector (Collection of Data) Act 2001, paragraph 1), and the data are collected for prudential supervision (paragraph 2). However, the Standard does not include express sanctioning provisions such as monetary penalties or licence revocation powers within paragraphs 1-19.

What the Standard does provide that bears on enforcement and control:

• APRA has procedural powers to change reporting periods (paragraph 9), grant extensions (paragraph 11), make minor variations to forms and instructions (paragraphs 15-16), and determine that an ADI be treated as a different class for these purposes (paragraph 19). These are powers that influence reporting burden, compliance timelines and applicable forms.
• Quality control requirements are mandatory: information (except where paragraph 6 applies) must be produced by systems, processes and controls subjected to external auditor review and testing under APS 310 (paragraph 12). Non-compliance with this duty could be material to APRA’s prudential assessment, but the Standard does not itself state consequences.
• The Standard requires digital authorisation of submissions using APRA-acceptable certificates (paragraph 14). Failure to use proper authorisation could result in a submission being invalid or questioned by APRA; the Standard requires the method but not the sanction for non-use.

How to locate enforcement measures

• Because the Standard does not specify enforcement mechanisms, a reader seeking the concrete consequences of non-compliance must look to:
  • The enabling legislation, Financial Sector (Collection of Data) Act 2001, and other legislative instruments (the Standard is made under that Act, paragraph 1). The Act will set out APRA’s statutory powers regarding data collection and possible penalties.
  • APRA’s broader prudential framework and enforcement policies, and any relevant provisions in the Banking Act 1959 or Corporations Act defining regulatory breaches and associated remedies.
  • Related Prudential Standards (for example, APS 310) which may set expectations and interactions with audit obligations; breaches of those standards can attract regulatory consequences under other instruments or regulatory practice.

Summary statement

• The Standard prescribes duties and sets administrative mechanisms for reporting and assurance but leaves punitive measures outside its text. The Standard’s enforcement and penalties, if any, are governed by the enabling legislation and APRA’s broader regulatory powers; the Standard records APRA’s capacities to vary reporting requirements and to require particular submission processes and assurance arrangements (paragraphs 9, 11, 12, 14, 15 and 19). Users should consult the Financial Sector (Collection of Data) Act 2001 and APRA’s enforcement guidance for the specific consequences of non-compliance.

ARS 118.0 is explicitly framed as part of a network of prudential standards and statutory definitions. The Standard cross-references, relies upon and delegates to a number of external instruments and statutory concepts:

Prudential Standards and reporting forms

• The Standard must be read in conjunction with Reporting Form ARF 118.0 (Level 1 and Level 2) and instructions which are attached and form part of the Standard (paragraph 1). The form content defines the data items required.
• The Standard is linked to capital adequacy prudential instruments: APS 112 (Standardised Approach to Credit Risk) and APS 113 (Internal Ratings-based Approach to Credit Risk), which APRA will use ARF 118.0 data to assess compliance with (paragraphs 1-2). That places ARF 118.0 as a reporting input into capital adequacy assessment regimes.

Audit and assurance standards

• External-auditor review and testing must be carried out in accordance with Prudential Standard APS 310 Audit and Related Matters (paragraph 12). The Standard also references Auditing and Assurance Standards Board guidance on scope and nature of auditor review (paragraph 12). So an ADI’s obligations under ARS 118.0 are operationalised through APS 310 and established auditing standards.

Statutory definitions and other Acts

• The Standard imports several statutory definitions and references:
  • AASB definition via section 9 of the Corporations Act 2001 (paragraph 17).
  • ADI definition via the Banking Act 1959 (paragraph 17).
  • The definition of foreign ADI and branch of a foreign bank references section 5 of the Banking Act 1959 (paragraph 17).
  • The meaning of “subsidiary” from section 9 of the Corporations Act 2001 (paragraph 17).
  • The “stake” measure is to be determined under the Financial Sector Shareholdings Act 1998 with a specified modification (paragraph 17).
• Paragraph 18 provides a general interpretative rule that references to Acts, Prudential Standards, Reporting Standards, Australian Accounting or Auditing Standards are to be read as references to those instruments as in force from time to time, which imposes dynamic incorporation of updates in those instruments.

Group and NOHC interaction

• The Standard interacts with APS 110 Capital Adequacy by referencing paragraph 21(b) of APS 110 for the definition of “immediate parent NOHC” (paragraph 17). This establishes reporting responsibilities across holding-company structures and links ARF 118.0 obligations with APS 110’s group capital adequacy architecture.

Operational systems and APRA systems

• The Standard mandates electronic submission using APRA’s Direct to APRA (D2A) system or another method APRA notifies in writing (paragraph 7). That creates an interface between ADIs’ internal data systems and APRA’s submission infrastructure.

Regulatory coordination with other agencies

• APRA may provide ARF 118.0 data to the Reserve Bank of Australia and the Australian Bureau of Statistics (paragraph 2), which creates inter-agency information flows and potentially subjects the data to other agencies’ confidentiality and data-handling rules.

Administrative discretions

• APRA may change reporting periods (paragraph 9), grant extensions (paragraph 11), make minor variations to forms and instructions (paragraphs 15-16), and determine that an ADI be treated as another class (paragraph 19). These administrative powers interact with statutory duties because they alter operational obligations without legislation.

Net effect

• The Standard does not operate in isolation. Compliance requires coordination with APS 112/113, APS 310, APS 110 and APS 001, and adherence to definitions from the Corporations Act, Banking Act and Financial Sector Shareholdings Act (paragraphs 1-2, 12, 17-18). ADIs should treat ARS 118.0 as an instrument that draws on and feeds into the broader prudential and statutory architecture, rather than a standalone rule. Where ARS 118.0 refers to other instruments, the current versions of those instruments prevail (paragraph 18).

This Reporting Standard contains limited explicit amendment history within its text. The instrument records a clear commencement and statutory basis, and grants APRA certain administrative powers to make technical changes without a formal amendment process. The following items are explicit in the Standard:

• Statutory authority and commencement: The Standard is made under section 13 of the Financial Sector (Collection of Data) Act 2001 (paragraph 1). It commenced on 1 April 2018 (paragraph 4). The instrument does not include any later amendment dates or versions in the provided text.

• Attached forms: The Standard states that the versions of Reporting Form ARF 118.0 and associated instructions are attached and form part of the Reporting Standard (paragraph 1). Any substantive change to the mandated data items would normally be reflected by issuing an updated ARF 118.0 form and instructions.

• Minor variations process: APRA is empowered to make "minor variations" to a form and its instructions to correct technical, programming or logical errors, inconsistencies or anomalies, or to clarify application, without changing any substantive requirement (paragraph 15). If APRA makes such a variation it must notify each ADI required to report under the Standard (paragraph 16). These paragraphs create an administrative pathway for small, non-substantive amendments without a formal legislative amendment.

• Interpretative dynamism: Paragraph 18 provides that references to Acts, Prudential Standards and Accounting or Auditing Standards are to be read "as in force from time to time." That means when those instruments are amended, the Standard operates with the amended versions unless a contrary intention appears, effectively absorbing changes in related instruments without formal amendment to ARS 118.0 itself.

• APRA reclassification power: Paragraph 19 allows APRA to determine in writing that an ADI of one class be treated as though it were of another class for the purposes of the Standard, which functionally changes obligations in a targeted way without an amendment.

What is not recorded

• The provided text does not show a sequence of formal amendments, version numbers, or dates beyond the commencement date. It contains no express amendment history table or record of prior revisions. Any changes to substantive content would be expected to be visible via updated ARF 118.0 forms or replacement of the Standard, or via the explanatory APRA notices that paragraph 16 requires APRA to send to ADIs when making minor variations.

Practical consequence for readers

• Users must monitor APRA notices regarding ARF 118.0 forms and instructions, and watch for changes to associated Prudential Standards (APS 112, APS 113, APS 310, APS 110 and APS 001) because the Standard explicitly incorporates those instruments and treats references as dynamic (paragraphs 1-2, 12, 17-18). The Standard’s administrative clauses (paragraphs 15-16 and 19) mean that certain operational changes can occur without formal legislative amendment; ADIs need procedures to track APRA notifications.

The Reporting Standard as provided contains no references to judicial or tribunal decisions, does not cite any cases, and does not include a litigation history section. The text does not record disputes, appeals to courts or administrative tribunal outcomes concerning the Standard. Paragraphs 1-19 set out the Standard’s requirements and APRA’s administrative discretions but make no mention of enforcement litigation, court rulings, or prior legal challenges.

Implication for practitioners

• Because the Standard itself does not document litigation or judicial interpretation, if practitioners require precedent or judicial interpretation on points such as the scope of APRA’s data-collection powers, the legal effect of APRA determinations under paragraph 19, or the consequences of non-compliance, they must look to:
  • Case law and decisions concerning the Financial Sector (Collection of Data) Act 2001 and APRA’s powers more broadly.
  • Administrative decisions or tribunal outcomes relating to APRA’s enforcement actions under the Banking Act or other prudential instruments.
  • Any jurisprudence interpreting cross-referenced Prudential Standards (APS 112/113/310/110/001) where relevant facts overlap.

Absent recorded litigation in the Standard, the text should be treated as a regulatory instrument setting obligations; questions about legal enforceability, statutory interpretation, or constitutional limits would require reference to external case law and the enabling Act. The Standard’s silence on litigation history is a factual statement about this instrument, not evidence that disputes have not occurred elsewhere in the APRA framework.

The Standard contains a number of features that can cause operational surprises if not anticipated. These are drawn directly from the text and should be noted by reporting officers and compliance teams.

Differing timelines by ADI class

• Submission deadlines vary by class (paragraph 10 table). Building societies and credit unions have shorter timeframes (15 business days) compared with banks - advanced (30 business days). That means smaller mutuals may have tighter operational windows to compile and assure data.

Scope exclusions and odd inclusions

• Providers of purchased payment facilities are explicitly excluded from application of the Standard (paragraph 3 table and paragraph 10 where "Not applicable" appears). Make sure to check whether an ADI’s authority includes a condition limiting it to purchased payment facilities, as that affects applicability (paragraph 17 definition).
• Cairns Penny Savings and Loans Limited is treated as a credit union for the purposes of the Standard, and the Standard excludes it from the "other ADI" category (paragraph 17). This bespoke treatment can generate confusion if assumed to be a generic rule.

Group reporting and the auditor-exemption trap

• Paragraph 6 creates a split in auditor-review duties: where an ADI is a subsidiary of an authorised NOHC, the immediate parent NOHC must provide the Level 2 form and must comply with the Reporting Standard (other than paragraphs 5 and 12) as if it were the ADI. Paragraph 12 exempts the paragraph 6 information from the external-auditor review requirement. A potential gotcha is misunderstanding whether a subsidiary still needs to produce auditor-reviewed systems for its Level 1 reporting; paragraph 12’s exception applies only to information required under paragraph 6, not paragraph 5. Practically, subsidiaries should confirm which obligations remain theirs and which flow to the NOHC.

Electronic submission and digital certificates

• The Standard mandates electronic submission via D2A or another APRA-notified method (paragraph 7). Submissions must be digitally signed using a digital certificate acceptable to APRA (paragraph 14). ADIs must ensure the chosen officers have valid certificates, and IT systems can apply the certificate correctly; failures here could delay or invalidate submissions.

Minor variations and silent substantive changes

• APRA may make "minor variations" to forms and instructions without changing substantive requirements (paragraph 15), but what APRA considers "minor" could still have operational impact (for example, correction of programming errors affecting reporting templates). APRA must notify ADIs of such variations (paragraph 16), but ADIs need processes to ingest and apply those notifications quickly.

APRA reclassification power

• APRA may determine that an individual ADI is to be treated as though it were an ADI of another class for the Standard’s purposes (paragraph 19). Such a determination can change reporting timelines, form versions or Level 2 responsibilities. ADIs need to track APRA determinations affecting their class.

Dynamic cross-references

• Paragraph 18 makes references to Acts and Prudential Standards dynamic ("as in force from time to time"). That means that changes to APS 112, APS 113, APS 310, APS 110 or APS 001 can change the operational content or assumptions behind ARF 118.0 reporting without a change in this Standard itself.

Ambiguities left to APRA

• The Standard specifies that APRA can change reporting periods or frequency for particular ADIs (paragraph 9), having regard to specified factors. The Standard leaves considerable discretion to APRA; ADIs must be ready to scale up or down reporting frequency on relatively short notice.

No penalties specified in the text

• The Standard does not set out sanctions for non-compliance (see "Penalties and enforcement" section above). Practitioners commonly misread the absence of penal clauses as meaning there are no consequences. The real-world risk is that APRA’s broader powers and other instruments may address breaches; practitioners need to check the enabling Act and APRA’s enforcement policies.

Form dependency

• The Standard relies on attached ARF 118.0 forms and instructions to define the actual data items (paragraph 1). Those forms are the operative specification of what must be reported. Updating forms or failing to use the current attached version can lead to incomplete or incorrect submissions.

Practical note

• Establish an internal change-control process that monitors APRA communications, Prudential Standards updates, and form revisions. Ensure your submission authorisers have valid digital certificates and that your external audit timetable aligns with the Standard’s annual review requirement (paragraph 12). Finally, clarify responsibilities between ADI subsidiaries and NOHC parents early to avoid duplicated or missing Level 2 submissions under paragraph 6.

This section provides a practical, step-by-step compliance roadmap tied to the Standard’s paragraphs. The guidance below must be read alongside the actual ARF 118.0 forms and APS cross-references.

1. Determine applicability and class

   • Confirm whether your entity is an ADI within the meaning of the Banking Act 1959 (paragraph 17). Check whether the ADI falls into one of the classes listed in paragraph 3. If the ADI is a provider of purchased payment facilities, the Standard does not apply (paragraph 3).
   • If part of a Level 2 group, identify whether the ADI or the immediate parent NOHC has responsibility for Level 2 reporting under paragraph 6, and confirm the immediate parent NOHC’s obligations.

2. Identify required form version and instructions

   • Obtain the current ARF 118.0 Level 1 and (if applicable) Level 2 forms and instructions that are attached to the Standard (paragraph 1). Use the form designated for your ADI class and Level. Confirm there have been no minor variations issued by APRA (paragraphs 15-16).

3. Establish reporting timetable and deadlines

   • Adopt quarterly reporting aligned with your ADI’s financial year (paragraph 8) unless APRA has issued a written notice changing reporting periods for your ADI (paragraph 9).
   • Map the submission due dates according to the table in paragraph 10 (e.g. 15, 20 or 30 business days after period end depending on class). Build internal cut-offs sufficiently ahead of those deadlines to allow for internal review and digital authorisation.

4. Prepare systems, processes and controls

   • Ensure your data pipelines, accounting records and risk systems capture the off-balance sheet exposures required by ARF 118.0. The required data fields are those in the attached ARF 118.0 form and instructions (paragraph 1).
   • Implement internal controls for data completeness and reliability, including reconciliations and sign-off procedures (paragraph 13).

5. External audit coordination

   • For all information other than that required under paragraph 6, plan for external-auditor review and testing of the systems, processes and controls producing the reported information, in accordance with APS 310 (paragraph 12).
   • Schedule the auditor’s review annually at a minimum, and more frequently if necessary for the auditor to form an opinion on accuracy and reliability (paragraph 12). Maintain working papers and evidence to demonstrate the auditor’s scope and findings.

6. Parent NOHC and group reporting arrangements

   • Where the ADI is a subsidiary of an authorised NOHC, coordinate with the immediate parent NOHC to confirm that the parent will submit the Level 2 ARF 118.0 (paragraph 6). Ensure roles and responsibilities are documented, particularly since the paragraph 12 auditor-review requirement does not apply to the paragraph 6 information (paragraph 12).

7. Submission platform and authorisation

   • Register for and configure APRA’s D2A application (Direct to APRA) or ensure readiness to use an alternate method APRA notifies in writing (paragraph 7). Confirm your IT security and file-format compliance.
   • Ensure at least one officer has an APRA-acceptable digital certificate and is authorised to digitally sign submissions (paragraph 14). Maintain a delegation list for who can sign.

8. Monitoring APRA notices and variations

   • Establish a process for monitoring APRA notices about changes to ARF 118.0 forms or instructions (paragraphs 15-16), APRA determinations about ADI class (paragraph 19), and any written notices altering reporting frequency (paragraph 9). Ensure quick turnaround to implement minor variations and to apply for extensions if required.

9. Extension and communications

   • If you cannot meet a due date, apply to APRA for a written extension (paragraph 11). Keep documentary evidence of all communications and approvals.

10. Record-keeping and audit trail

    • Retain records that evidence the operational processes, internal reviews, reconciliation procedures, and the external-auditor’s review scope and findings (paragraphs 12-13). Maintain a log of the officers who digitally signed each submission and the certificate details (paragraph 14).

11. Cross-reference prudential capital requirements

    • Ensure the ARF 118.0 submissions are consistent with reporting used for APS 112 or APS 113 compliance, because APRA uses ARF 118.0 data in assessing compliance with those Prudential Standards (paragraphs 1-2). Coordinate with capital adequacy teams to align methodologies and assumptions.

12. Contingency: APRA reclassification and frequency changes

    • Prepare to scale reporting frequency up or down if APRA issues a written notice changing reporting periods for your ADI (paragraph 9). Develop templates and processes that can be quickly adapted to increased frequency.

13. Special items checklist

    • Confirm whether your entity is the Australian branch of a foreign bank (if so, report the Australian branch only,paragraph 5).
    • Verify whether your organisation falls into the special placements involving Cairns Penny Savings and Loans Limited in the Standard’s definitions (paragraph 17).
    • Confirm whether your ADI is a provider of purchased payment facilities; if so, the Standard does not apply (paragraph 3).

14. Governance and board reporting

    • Establish board-level oversight for prudential reporting, ensuring the board is informed of ARF 118.0 submissions, auditor findings (APS 310), and any APRA communications altering obligations.

15. Testing and dry runs

    • Conduct trial runs of D2A submissions, including the digital signature step, well ahead of first reporting deadlines, to avoid last-minute technical problems (paragraph 7 and paragraph 14).

By following the steps above and tying operational tasks directly to the relevant paragraphs (noted in parentheses), an ADI can operationalise compliance with ARS 118.0. The critical pieces are: using the correct form, meeting class-specific timelines, securing external auditor review where required, and ensuring authorised digital sign-off on every submission.