Lead signal
Two penalties, $55m of offset remediation and two live standards lead a long list. HSBC's $35m and the offset findings were systems failures before they were compliance failures, CPS 230 makes that kind of weakness enforceable now, APRA's old lodgement route closes on 30 September, and seven capital, exposure and disclosure standards commence 1 January 2027. Privacy determinations, breach reporting and DDO precedents round out the list.
Show radar
Regulatory radar overview
Angle shows the regulatory category, distance from the centre shows when it bites, and size and colour show severity. Select a numbered signal to read its detail.
On a small screen, scroll the radar horizontally to see the full graphic.
Regulatory changes on the radar
$35 million for slow scam handling
- Who it affects
- banks and deposit takers running scam detection and disputes across multiple payment rails
- What it can disrupt
- case management queues, loss allocation logic and controls applied to some rails but not others
- Why it matters now
- penalty ordered on admissions, including 144 day average investigations. Timelines are licence obligations now.
$55m for unlinked accounts
- Who it affects
- banks and lenders offering offset accounts on home loans
- What it can disrupt
- origination and linking processes with nothing downstream watching whether the link held
- Why it matters now
- review of eight banks published 29 July. ASIC says all banks should check. Further compensation expected
Operational risk rules now bind
- Who it affects
- every APRA regulated bank and deposit taker, and the service providers running their critical operations
- What it can disrupt
- operational risk registers, continuity plans and service provider monitoring still living in spreadsheets
- Why it matters now
- commenced 1 July 2026. Binding and enforceable now, across every APRA regulated industry.
The old reporting route is closing
- Who it affects
- banks, deposit takers and registered financial corporations lodging APRA returns
- What it can disrupt
- reporting workflows and third-party lodgement tooling still built for the alternate path
- Why it matters now
- liquidity returns cut over 31 July. EFS from 31 August. Everything else by 30 September
IRB model governance is binding
- Who it affects
- APRA approved IRB banks running internal credit risk models
- What it can disrupt
- rating system registers, change logs and validation workflows that live in documents, not systems
- Why it matters now
- commenced 30 June 2026. Annual backtesting and audit trails expected.
Capital adequacy reset lands 2027
- Who it affects
- all locally incorporated banks and deposit takers
- What it can disrupt
- capital ratio engines, buffer tracking and ICAAP reporting due to APRA within three months of period end
- Why it matters now
- commences 1 January 2027. About four months to be calculating correctly.
Capital instrument rules tighten
- Who it affects
- banks issuing or holding regulatory capital instruments
- What it can disrupt
- eligibility classification, transitional AT1 treatment and fair value controls in capital systems
- Why it matters now
- commences 1 January 2027, with transition rules for AT1 issued before then.
Rate risk models need approval
- Who it affects
- banks holding banking book interest rate risk under an internal model
- What it can disrupt
- model change management, data flow documentation and the three month notification clock to APRA
- Why it matters now
- commences 1 January 2027. Material model changes need APRA approval first.
Large exposures get hard limits
- Who it affects
- banks and deposit takers with concentrated counterparty exposures
- What it can disrupt
- systems that cannot identify connected counterparties or calculate exposures the prescribed way
- Why it matters now
- commences 1 January 2027 with Board approved policies expected.
Related entities, real limits
- Who it affects
- banks with related entity structures, group funding or underwriting arrangements
- What it can disrupt
- exposure monitoring, capital deductions past the 20 per cent underwriting threshold, and ELE consolidation logic
- Why it matters now
- commences 1 January 2027. Contagion and step-in risk become measurable obligations.
Prudential numbers go public
- Who it affects
- significant locally incorporated banks
- What it can disrupt
- disclosure production that cannot generate Basel aligned templates from governed data, on schedule
- Why it matters now
- commences 1 January 2027 with a Board approved disclosure policy required.
Insider access just got expensive
- Who it affects
- banks whose frontline and back office staff can open any customer record
- What it can disrupt
- role based access controls and audit logging that cannot prove who viewed which account, and when
- Why it matters now
- determination made: compensation, apology, technical access controls and account level logging all ordered.
260,000 misreported trades, $2m
- Who it affects
- banks and reporting entities under the ASIC derivative transaction reporting rules
- What it can disrupt
- trade reporting pipelines where one mandatory field is silently wrong at scale
- Why it matters now
- infringement notice paid. One bad field across 208 business days was enough.
Every defined term just moved
- Who it affects
- banks and insurers whose systems embed prudential definitions in calculations and reports
- What it can disrupt
- capital calculations, classifications and reporting logic keyed to superseded definitions
- Why it matters now
- commenced 1 July 2026. One standard now governs interpretation across the frameworks.
Three forms become one in December
- Who it affects
- banks and their investment arms holding substantial positions in listed entities
- What it can disrupt
- notice generation and registers built around Forms 603, 604 and 605
- Why it matters now
- commences 4 December 2026. Legacy forms accepted until 4 June 2027
Tracking pixels triggered determinations
- Who it affects
- banks running third-party pixels on product, application or internet banking pages
- What it can disrupt
- consent mechanisms and data flows quietly shipping sensitive signals to advertising platforms
- Why it matters now
- determinations made. The OAIC has told every APP entity to review its pixels.
$10.3m for unreported investigations
- Who it affects
- banks and deposit takers under the reportable situations regime
- What it can disrupt
- breach identification and escalation systems that let investigations go unreported or late
- Why it matters now
- penalty ordered by the Federal Court. Trustee accountability is a named 2026 priority.
350,000 car loans, one warning
- Who it affects
- banks writing car loans directly or through dealer and broker channels
- What it can disrupt
- distributor oversight, hardship workflows and fee disclosure that cannot show consumer outcomes
- Why it matters now
- REP 832 published across eight lenders. Enforcement flagged where obligations are not met.
Stop orders over target markets
- Who it affects
- banks issuing deposit, credit and investment products with target market determinations under DDO
- What it can disrupt
- target market determinations that drift from what the product actually is: objectives, liquidity, holding period
- Why it matters now
- interim stop orders issued. Private credit products remain in the spotlight.
Company search gets an API
- Who it affects
- banks doing company checks in onboarding, KYC and business lending
- What it can disrupt
- brittle ASIC Connect lookups and scraped registry data, which now have a supported replacement
- Why it matters now
- public beta live, part of the RegistryConnect modernisation programme.
Credit reporting scope just narrowed
- Who it affects
- banks as credit providers exchanging data with credit reporting bodies
- What it can disrupt
- data extraction rules and reporting configurations still submitting the newly exempt account category
- Why it matters now
- in force 9 June 2026. Relief now runs to 1 October 2031.
Economic exposure now counts as ownership
- Who it affects
- banks and their investment arms holding positions in listed entities
- What it can disrupt
- disclosure workflows that only track relevant interests, not economic exposure
- Why it matters now
- new obligations commence 4 December 2026. Updated guidance is already out
Compiled with care from public sources; errors and omissions excepted. Always check the linked source before acting. Regulatory Radar is general information, not legal or compliance advice.