The standard revolves around a small set of legal and operational concepts defined and elaborated in the text.

• Fit and Proper Policy: A documented policy that sets out how an RSE licence-holder will determine fitness and propriety of responsible persons. It must be board-approved, form part of the risk management framework, be communicated to relevant persons and prescribe processes for assessment, disclosure and record-keeping (paras 7-11, 26-35).

• Responsible person and responsible person position: A responsible person is defined to include directors, secretaries, senior managers, individual or lead RSE auditors, appointed RSE actuaries, and persons performing activities for a connected entity that could materially affect the RSE licence-holder’s operations or financial position (para 12). APRA can add or subtract persons from that category by written determination (paras 14-15). “Responsible person position” means the responsibilities or activities that give rise to the person being a responsible person under para 12 (para 16).

• Senior manager: A defined sub-category of responsible person that covers senior executives who make, or participate in making, decisions affecting the whole or a substantial part of the licence-holder’s business; who have capacity to affect the licence-holder’s business operations or financial standing; who enforce board-approved policies or are responsible for systems and risk frameworks; or who are executive officers (para 17).

• Fit and proper criteria: For general responsible persons, the criteria require that it would be prudent to conclude the person possesses competence, character, diligence, experience, honesty, integrity and judgement, as well as education or technical qualifications relevant to the role; is not disqualified under the SIS Act; and has no conflict of interest or, if a conflict exists, the conflict does not create a material risk of failing to perform duties (para 19(c) and (d); paras 18-19).

• Additional criteria for RSE auditors and RSE actuaries: The standard sets out enumerated additional requirements for individual RSE auditors and lead auditors (para 21) and RSE actuaries (para 24), such as registration under the Corporations Act for auditors, minimum five years’ relevant experience, membership of relevant professional bodies, not being the CEO or director of the licence-holder or connected entity, and ordinary residence in Australia. Each category has provision for exceptions if APRA is notified promptly and issues no-objection (paras 21-22 and 24-25).

• Assessment process and documentation: The Fit and Proper Policy must set out who conducts assessments, what information will be obtained, what matters will be considered and the decision-making process; must require a pre-appointment assessment (subject to limited interim appointment rules), annual reassessments, reasonable enquiries including sensitive information where relevant, retention of documentation and whistleblower procedures (paras 26-35, 29-31).

• APRA interaction and discretion: APRA plays multiple roles: it receives notifications and information (paras 43-46), determines who is a responsible person or not (paras 14-15), must be notified and may object to exceptions in auditor/actuary appointments (paras 21-22, 24-25), may adjust or exclude prudential requirements for particular licence-holders (para 49), and may request information (para 47). APRA’s exercise of its power or discretion is to be in writing (para 6).

These concepts create a framework in which the board holds ultimate responsibility for the Fit and Proper Policy (para 8), the licence-holder operationalises assessments and record-keeping, and APRA retains administrative oversight and discretion.

The instrument directly binds all RSE licence-holders under the SIS Act (paras 2-3). The text identifies specific groups of persons whose appointment, tenure or activities are captured and therefore who are affected by the obligations the licence-holder must discharge.

• Internal officers and executives: Directors of the RSE licence-holder (explicitly named), company secretaries and senior managers are captured as responsible persons (para 12(a)-(c)). Senior managers are further defined by the substantive impact of their decisions on business operations and financial standing (para 17). Those roles will therefore be subject to pre-appointment assessments, annual reassessments and the competence/character/conflict criteria (paras 26, 29, 31, 18-19).

• External service providers and non-employees: The definition extends to individuals who are not employees, for example consultants, contractors or employees of other entities, where their activities materially affect the licence-holder (paras 13, 12(f)). That expands the compliance perimeter to outsourced service providers whose functions directly or indirectly impact the RSE licence-holder’s operations or finances.

• Auditors and actuaries: Individual RSE auditors, lead auditors and RSE actuaries appointed under RSE licence-holder law are responsible persons and subject to both the core criteria and the additional, role-specific criteria enumerated in paras 20-25. Specific constraints apply, such as not being the CEO or director of the licence-holder or a connected entity (paras 21(b), 24(b)), membership of professional bodies, and minimum experience and residency requirements (paras 21(c)-(g), 24(a), (d)-(f)).

• Connected entities and their personnel: The standard captures persons performing activities for connected entities if those activities could materially affect the RSE licence-holder’s business operations or financial standing (para 12(f)). The Fit and Proper Policy must cover connected entities’ consent to disclosures and whistleblowing releases (paras 34, 36-41).

• Boards and the RSE licence-holder as entities: Boards decide and approve the Fit and Proper Policy and bear ultimate responsibility for ensuring fitness and propriety of responsible persons (paras 7-9). RSE licence-holders as legal entities must implement, document and test procedures, conduct assessments, report to APRA and keep records (paras 26-35, 43-48).

• APRA: The Australian Prudential Regulation Authority is an affected decision-maker; it receives notifications, may determine who is a responsible person, may issue no-objection or objections to exceptions, may adjust or exclude requirements in relation to particular licence-holders and exercises any power or discretion in writing (paras 6, 14-16, 21-25, 49).

Practically, the burden of compliance sits with the RSE licence-holder and its Board, and through them the responsible persons and candidate appointees. The standard also affects recruitment and contracting decisions because persons who do not meet the set criteria or for whom APRA objects may not be suitable to hold responsible person positions without an approved exemption process.

The Prudential Standard imposes explicit duties on RSE licence-holders and places specific expectations on responsible persons, while also creating certain rights and procedures.

Duties placed on RSE licence-holders:

• Adopt and maintain a Fit and Proper Policy that meets the standard’s requirements, have Board approval for that Policy, and incorporate it into the licence-holder’s risk management framework (paras 7-11). The Board holds ultimate responsibility for ensuring fitness and propriety (opening statements, para 8).

• Define and document required competencies for each responsible person position (para 18), and set out assessment processes including who will conduct assessments, what information will be sought, matters to be considered, and decision-making processes (para 26).

• Conduct fit and proper assessments before appointment, subject to limited interim appointment periods, and re-assess at least annually (paras 29-31). Interim appointments may last up to 90 days unless APRA agrees in writing to longer (para 30).

• Make all reasonable enquiries and, where relevant, collect sensitive information as defined in the Privacy Act when conducting assessments and when new information arises that may change a previous assessment (paras 32-33). The Fit and Proper Policy must include processes for obtaining consents required for collection and use of information by the licence-holder and APRA (para 34(c)).

• Retain sufficient documentation of each assessment to demonstrate fitness and propriety of current and recently past responsible persons (para 35).

• Implement whistleblowing provisions that permit and encourage disclosure of relevant information to the persons conducting assessments or APRA, and ensure that contractual clauses or policies do not constrain such disclosures (paras 36-41).

• Notify APRA with specified information about each responsible person (paras 43-44), promptly notify APRA if a person remains in a position despite an assessment of not fit and proper (para 45), and comply with APRA’s information requests (paras 46-47).

• Take all reasonable steps to ensure that persons assessed as not fit and proper are not appointed to, or do not continue to hold, responsible person positions (para 42).

Duties and constraints on particular roles:

• RSE auditors and actuaries must meet the additional enumerated criteria (paras 21, 24) or follow the exception notification/no-objection route (paras 22, 25).

Rights and procedural protections:

• The Fit and Proper Policy must require that people being assessed are given a copy of the Policy before assessment and that candidates for directorship receive the Policy on nomination (para 28). The Policy must include procedures to enable disclosure to APRA and for obtaining necessary consents for information sharing (paras 34(b)-(c)).

• APRA must act in writing when exercising powers or discretions under the Standard (para 6). Where RSE licence-holders wish to rely on a previous APRA discretion under an earlier version of the Standard, paragraph 50 requires contact with APRA to confirm reliance.

• The text notes that, other than for section 120 disqualification checks, APRA will not require disclosure of spent convictions where precluded under Part VIIC of the Crimes Act 1914 (para 48). This limits the scope of required disclosures in that particular area.

Who decides

• The Board approves the Fit and Proper Policy and is ultimately responsible for fitness and propriety (paras 7-9). The licence-holder decides on assessments and must document “who will conduct” them (para 26(a)). APRA decides whether a person is a responsible person or not (paras 14-15), and whether it will object to exceptions for auditors and actuaries (paras 22, 25). APRA also controls administrative flexibility through adjustments and exclusions (para 49). The standard requires that APRA’s exercises of power be in writing (para 6).

Overall, the duties require proactive governance, documented processes, routine monitoring and an administrative relationship with APRA that includes prompt notifications and responsiveness to information requests.

The Prudential Standard sets out administrative compliance and reporting obligations; it does not itself specify civil penalties, criminal sanctions or quantified fines within the text. Enforcement mechanics specified or implied in the instrument are administrative and supervisory, and operate through APRA’s statutory powers under the SIS Act.

Enumerated enforcement and supervisory mechanisms in the text:

• APRA determinations as to who is, or is not, a responsible person (paras 14-15). Those determinations alter coverage and therefore the obligations the RSE licence-holder must meet in relation to the specified person.

• APRA’s power to require information and documentation from the RSE licence-holder, by requesting documents or the licence-holder’s Fit and Proper Policy (paras 46-47). The licence-holder must take reasonable steps to obtain and provide information requested by APRA (para 47).

• Notification and no-objection processes for exceptions to auditor and actuary criteria, whereby APRA may notify a licence-holder that it has no objection to a person holding a position if the licence-holder promptly informs APRA of exceptional circumstances (paras 21-22, 24-25). APRA’s objection or no-objection is an administrative lever affecting appointment viability.

• APRA’s ability to adjust or exclude specific prudential requirements in relation to a particular licence-holder or specified licence-holders (para 49). This creates a pathway for APRA to vary supervisory intensity in individual cases.

• The requirement that APRA exercises its powers or discretions in writing (para 6). This operates procedurally, making APRA’s positions formally documented and recordable.

• Duty to notify APRA where a person assessed as not fit and proper remains in post and the requirement to report reasons and actions taken (para 45). That obligation creates a trigger for APRA engagement.

The Standard does not describe enforcement outcomes such as licence revocation, directions, enforceable undertakings, civil pecuniary penalties, or criminal prosecution. Those outcomes, if pursued, would derive from APRA’s powers under the SIS Act rather than the Standard’s text. The Standard does, however, create multiple administrative interaction points with APRA that can be used in supervisory or enforcement processes: notification of responsible persons (paras 43-46), provision of requested information (para 47), APRA determinations naming persons as responsible (para 14), and APRA’s adjustments or exclusions to prudential requirements (para 49).

Practical compliance risk: Non-compliance with the Standard’s reporting and assessment obligations leaves licence-holders exposed to APRA scrutiny, administrative action under the SIS Act and the downstream effects of adverse supervisory determinations. The Standard’s requirements to retain documentation (para 35) and to ensure whistleblower disclosures are not impeded (paras 36-41) make it easier for APRA to investigate potential breaches where records or disclosures reveal deficiencies.

The Prudential Standard explicitly references and interfaces with multiple statutory instruments and legal concepts. The text itself locates its authority under section 34C of the SIS Act (para 1) and specifies where its criteria operate for purposes of the SIS Act (para 4). Key interactions set out in the text include:

• SIS Act: The Standard is made under s 34C of the SIS Act and is intended to set fitness and propriety criteria for the purposes of certain SIS Act provisions (paras 1, 4). It also cross-references “disqualified person” under section 120 of the SIS Act as a criterion that must be checked (para 19(c), 48).

• Privacy Act 1988: The Standard contemplates the collection of sensitive information as defined in the Privacy Act when making fit and proper assessments (paras 32-33). It requires that Fit and Proper Policies include provisions for obtaining any consents necessary for collection and use of information by the licence-holder and by APRA (para 34(c)). The Standard also notes that, other than for the specific disqualification check, APRA will not require disclosure of spent convictions where precluded by Part VIIC of the Crimes Act (para 48).

• Corporations Act 2001: For RSE auditors the Standard requires registration as an auditor under the Corporations Act or being the Auditor-General (para 21(a)). This ties auditor eligibility to Corporations Act regulatory requirements.

• Professional bodies and standards: The Standard references membership of recognised professional bodies for auditors (para 21(f)) and the Institute of Actuaries of Australia for actuaries (para 24(e)). It therefore aligns eligibility with professional accreditation frameworks.

• Crimes Act 1914: The Standard observes a limit on APRA’s information requirements with respect to spent convictions under Part VIIC of the Crimes Act 1914, other than for the section 120 disqualification check (para 48).

• APRA’s administrative procedures and website: The Standard mandates that certain notifications be provided in such form and by such procedures as APRA publishes on its website from time to time, operationally connecting compliance with APRA’s procedural instruments (para 46).

Operational interactions implied by the Standard:

• Recruitment, employment contracts and confidentiality arrangements. The Standard requires that licence-holders and connected entities consent to disclosures to APRA and prohibits measures that constrain persons from providing information to APRA (paras 34(b), 36-39). This will interact with contract law and employment agreements, requiring licences and clauses allowing disclosure to APRA and limiting confidentiality provisions.

• Outsourcing and third-party arrangements. Because responsible person status can attach to individuals employed by connected entities or contractors (paras 12, 13), the Standard intersects with outsourcing obligations and the governance of service providers. Licence-holders must ensure controllers of outsourced functions are captured by their Fit and Proper Policy when activities could materially affect operations.

• Evidence and privacy regimes. The requirement to collect and retain sufficient documentation to demonstrate fitness and propriety (para 35) must be reconciled with privacy obligations and data security requirements under the Privacy Act and other applicable data protection laws (paras 32-34).

The Standard therefore functions as a prudential overlay that draws on, and interacts with, corporate governance, privacy, employment, criminal disclosure limitations and professional accreditation regimes.

The text supplied contains limited explicit amendment history. What is stated in the instrument itself is:

• Authority and commencement: The Prudential Standard is made under section 34C of the SIS Act and commences on 30 June 2024 (paras 1, 5).

• Continuity with previous APRA discretions: Paragraph 50 requires licence-holders to contact APRA if they wish to rely, for compliance with this Standard, on any exercise of discretion previously made by APRA under a prior version of the Fit and Proper Standard. That implies there was at least one prior version and that prior APRA discretions are not automatically binding under the new instrument; explicit contact with APRA is required to establish continuing reliance (para 50).

• APRA’s adjustment and exclusion power: The Standard expressly formulates a mechanism by which APRA may adjust or exclude particular prudential requirements in relation to particular licence-holders or specified licence-holders (para 49). This clause itself is a forward-looking amendment mechanism that allows APRA to vary application on a case-by-case basis without text amendments.

The instrument does not provide a history of prior amendments, versions, dates of earlier standards or transitional arrangements except for the commencement date and the instruction in paragraph 50 about prior discretions. The absence of a full amendment chronology within the text means that practitioners wishing to understand changes from an earlier standard must consult APRA’s published materials, prior versions of the Fit and Proper Standard and any transitional guidance APRA has issued.

Recommended practical approach for tracking amendments (procedural, grounded in the text):

• Treat the commencement date as the operative effective date when assessing duties (para 5).

• Where a licence-holder seeks to rely on past APRA discretionary determinations under previous versions, contact APRA as paragraph 50 requires.

• Monitor APRA’s website for the form and procedural requirements for notifications and for any APRA guidance on interpretation, because paragraph 46 ties some procedural compliance to what APRA publishes.

• Note that APRA may make written determinations or no-objections in individual cases (paras 6, 21-25, 49); retain those written instruments as the operative documentary record for any exception or adjustment.

Because the supplied text contains only the current instrument and not a legislative amendment log, practitioners should use the instrument’s internal references to APRA discretion and the commencement date as the starting point for mapping changes, and rely on APRA’s published material for an external amendment record.

The Prudential Standard itself, as supplied, contains no litigation history or references to judicial decisions. It does not cite any case law, nor does it record previous judicial interpretation of its provisions. Paragraph 50’s requirement to contact APRA about reliance on prior discretionary exercises refers to administrative practice rather than judicial outcomes.

Consequences of the absence of litigation history in the text:

• There is no precedent within the instrument to guide interpretation of ambiguous phrases such as “materially affect”, “reasonable steps”, or the thresholds for conflicts of interest. Absent judicial interpretation cited in the text, those concepts must be operationally defined by licence-holders in their Fit and Proper Policies and may ultimately be tested in administrative or judicial fora if contested.

• APRA’s written exercise of powers (para 6) will be an important evidentiary record in any future dispute. Where APRA issues written determinations, objections, no-objections or adjustments (paras 6, 21-25, 49), those documents will likely be the first source of interpretive weight in any administrative review or litigation.

• The Standard’s requirements that licence-holders retain sufficient documentation (para 35) creates a contemporaneous evidentiary trail that would be used in administrative reviews or litigation but does not itself create case law.

Practitioner implications:

• Expect early disputes to arise over scope issues such as when a person employed by a connected entity becomes a responsible person (para 12(f)) and over the sufficiency of “reasonable steps” or “reasonable enquiries” in making assessments (paras 32, 42). Those disputes may produce case law over time but the instrument does not supply that jurisprudence.

• Because APRA’s role is central and its determinations must be in writing (para 6), practitioners seeking to challenge an APRA determination should preserve APRA communications and consider administrative review remedies under the SIS Act and relevant administrative law frameworks, though specific legal strategies are beyond the instrument’s text.

In short, the supplied instrument is silent on litigation history. Interpreting and defending compliance will rely on APRA guidance, administrative records and any future case law that develops after commencement.

The Standard contains several practical traps and implementation risks that a compliance or legal team should explicitly identify and address. These are drawn from the instrument’s specific wording.

1. Broad and potentially surprising coverage of “responsible person”: APRA may designate additional people as responsible persons beyond the enumerated categories if it is satisfied they play a significant role or could materially impact beneficiaries or financial position (para 14). Conversely APRA may determine a person is not a responsible person (para 15). Licence-holders should not assume responsibility coverage is limited to directors and senior managers without checking APRA’s determinations.

2. Outsourced personnel and contractors can be responsible persons: The definition explicitly includes persons who are not employees if their activities for a connected entity could materially affect operations or finances (paras 12(f) and 13). Contracts and supplier governance must therefore anticipate fit and proper checks, consents for information collection and disclosure clauses aligned with paras 34 and 36-41.

3. Sensitive information collection and consent obligations: The Standard requires reasonable enquiries and permits collection of sensitive information as defined in the Privacy Act (paras 32-33). The Fit and Proper Policy must include provisions for obtaining consents for collection and use of that information by the licence-holder and APRA (para 34(c)). Failure to obtain appropriate consents risks breaching privacy obligations.

4. Confidentiality clauses cannot impede disclosures to APRA: The Standard requires that licence-holders and connected entities must not constrain or discourage persons from disclosing information or providing documents to APRA, including via confidentiality clauses (paras 36-41). Existing confidentiality or settlement clauses may therefore be incompatible with this Standard and require contract remediation.

5. Interim appointment limit and timing risk: An interim appointment without full assessment is limited to 90 days, including prior interim periods, unless APRA agrees in writing to extend (para 30). Recruitments that rely on long interim periods risk regulatory non-compliance.

6. Record retention but no specified retention period: The Standard requires retention of sufficient documentation to demonstrate fitness and propriety of current and recently past responsible persons (para 35) but does not specify retention periods. Licence-holders must set and justify retention periods aligned with other legal obligations and risk assessments.

7. Auditor and actuary incompatibilities: Additional criteria bar certain dual-role or related-party relationships, for example an auditor cannot be the RSE actuary or a partner of the RSE actuary (para 21(e)), and similar prohibitions apply for actuaries (para 24(c)). Cross-appointments or tight commercial relationships common in small markets may therefore be prohibited or require a formal exception process with APRA (paras 21-22, 24-25).

8. APRA no-objection process is time-sensitive: Where an RSE licence-holder believes exceptional circumstances justify departure from an auditor or actuary criterion, the licence-holder must promptly notify APRA and obtain APRA’s no-objection (paras 22, 25). “Promptly” is not defined and may invite scrutiny.

9. Notification and procedural forms set by APRA: The Standard refers to forms and procedures that APRA publishes on its website for giving notifications (para 46). Compliance requires monitoring and alignment with APRA’s operational guidance; failing to use the specified forms or procedures could render notifications ineffective.

10. Disqualification checks and spent convictions carve-out: Licence-holders must satisfy themselves that a person is not a disqualified person under s 120 of the SIS Act and must ensure the person has never been convicted of an offence of dishonesty in any jurisdiction (para 48). However, apart from this purpose APRA will not require disclosure of spent convictions where precluded by Part VIIC of the Crimes Act 1914 (para 48). Practitioners must reconcile these two obligations and design screening processes that are lawful under criminal record legislation.

11. Board and governance responsibility: The Board must approve the Fit and Proper Policy and has ultimate responsibility for fitness and propriety (paras 8 and opening). Boards cannot delegate away ultimate accountability even where operational tasks are delegated, so governance frameworks and Board reporting must be robust.

12. Reliance on prior APRA discretions requires reconfirmation: If a licence-holder wants to rely on a prior APRA discretion under an earlier standard, paragraph 50 requires contact with APRA. Do not assume grandfathering without written confirmation.

These “gotchas” are concrete operational and legal frictions arising directly from the Standard’s text. Addressing them requires concrete policy drafting, contractual amendments, documented consent protocols and active liaison with APRA.

This section converts the Standard’s requirements into an actionable compliance roadmap for RSE licence-holders. Each task is anchored to the relevant paragraph references.

1. Draft and adopt a Fit and Proper Policy (paras 7-11)

   • Prepare a written Fit and Proper Policy that complies with all specified elements: board approval (para 8), communication to responsible persons (para 9), and inclusion in the licence-holder’s risk management framework (para 10).
   • Where a group policy is used, ensure the RSE licence-holder’s Board explicitly approves it (para 11).

2. Define roles and competencies (paras 12, 17-18)

   • Map all positions in and connected to the RSE licence-holder that may fall within the responsible person definition, including contractors and connected entity personnel (paras 12-13, 17).
   • Document role-specific competencies for every responsible person position (para 18), including technical qualifications, experience levels, and behavioural attributes.

3. Establish assessment processes and decision-making (para 26)

   • Document who will conduct assessments (internal HR/legal/compliance or external advisors), what information will be collected, how it will be collected, the matters considered, and the decision-making authority and escalation paths (para 26(a)-(d)).
   • Ensure the decision-making process is auditable and that the Board has oversight and receives regular reports.

4. Pre-appointment checks, interim appointments and annual reassessments (paras 29-31)

   • Implement pre-appointment checks for all responsible person candidates. For interim appointments, put in place a documented reasonable-step check as specified by the Policy and do not exceed 90 days unless APRA agrees in writing (para 30).
   • Schedule annual re-assessments for each responsible person and operate close-to-annual reviews where annual timing is impracticable (para 31).

5. Information collection, consents and privacy (paras 32-34)

   • Design consent forms and information collection processes that permit lawful collection of sensitive information where necessary, and which allow sharing with APRA where required by the Policy (paras 32-34(c)).
   • Ensure privacy notices explain the purpose of collection and the recipients, and update privacy policies to reflect APRA disclosure obligations.

6. Whistleblowing and non-impediment provisions (paras 36-41)

   • Include in the Policy explicit whistleblowing provisions that allow disclosure to the person responsible for fit and proper assessments and to APRA (paras 36-37).
   • Audit contractual confidentiality clauses across the group and ensure they do not constrain disclosures to APRA; add consent language permitting former responsible persons to disclose reasons for resignation to APRA (para 38) and protect whistleblowers from detriment (para 41).

7. Special criteria for auditors and actuaries (paras 20-25)

   • Verify that proposed or appointed RSE auditors and actuaries meet the additional specific criteria (paras 21, 24).
   • If any criterion cannot be met, promptly notify APRA of exceptional circumstances and obtain written no-objection before formalising the appointment (paras 22, 25). Retain APRA’s written response as the compliance record.

8. Record-keeping and evidence (para 35)

   • Retain sufficient documentation to demonstrate fitness and propriety of current and recently past responsible persons. Define and document retention periods that align with corporate record-retention policies and legal requirements, and ensure secure storage.

9. Notifications to APRA and information requests (paras 43-48)

   • Establish operational processes to notify APRA with the required particulars for each responsible person (title, name, date of birth, position and responsibilities, statement as to assessment) and to keep that information updated (paras 43-44).
   • Build a process to promptly notify APRA where a person remains in a role despite being assessed not fit and proper (para 45).
   • Monitor APRA’s website for prescribed notification forms and procedural requirements and use the published forms (para 46). Prepare for APRA information requests and ensure you can produce the Fit and Proper Policy and supporting documents (para 47).

10. Board governance and reporting (paras 7-9)

    • Board must approve the Fit and Proper Policy and be provided with regular reports on assessment outcomes, whistleblower disclosures, outstanding APRA notifications and any instances where a person remains in office despite being assessed not fit and proper.

11. Remediation and action where not fit (paras 27, 33, 42)

    • Define actions to be taken where a person is assessed as not fit and proper, including restrictions on duties, removal procedures, remediation plans and timing. The Policy must articulate these actions (para 27).
    • Where new information arises that might change an earlier fit finding, take all reasonable steps to collect information and conduct a full reassessment if there is a concern (para 33). Where assessed as not fit, take all reasonable steps to prevent ongoing appointment (para 42).

12. Interaction with contracts and service arrangements (paras 11, 13, 34, 39)

    • Update employment and contractor agreements to allow disclosure to APRA where required and to ensure consents for information collection. For group policies used across connected entities, ensure Board approval and clear allocation of responsibilities (para 11).

13. Audit and oversight testing

    • Incorporate periodic internal or external audit testing of compliance with the Fit and Proper Policy, including sampling personnel files, reviewing whistleblowing incident handling, verifying APRA notifications and validating the documentation trail required by para 35.

14. Engage APRA proactively

    • Where in doubt about whether APRA would treat a person as a responsible person, or where exceptions to criteria are contemplated, contact APRA early and seek written confirmation; APRA discretion must be in writing (para 6) and prior discretions require reconfirmation (para 50).

This compliance checklist translates the Standard’s textual requirements into operational steps. Each action should be evidenced, retained and made available for APRA review in line with paras 35 and 47.