Lead signal
No insurance-specific rule moved this window, but the cross-industry signals are loud: APRA's licence conditions on a bank turned on its view of obligations and controls, and regulators want AI-era cyber plans tested, not described.
Regulatory changes on the radar
Show radar
Regulatory radar overview
Select a numbered signal to read its detail. Size and colour show severity.
Zoom and drag to explore. The radar stays open until you hide it.
Licence conditions over a risk framework
- Who it affects
- insurers under APRA's risk management standards, which face the same obligations-and-controls test
- What it can disrupt
- obligations registers and controls inventories that cannot show every obligation and who controls it
- Why it matters now
- Conditions imposed 18 August: a rectification program, an independent assurer and board attestation. The $50m capital add-on stays.
Regulators want AI cyber plans tested
- Who it affects
- insurers under APRA's operational risk and security standards
- What it can disrupt
- incident playbooks, escalation paths and third-party maps never tested at the speed of AI-enabled attacks
- Why it matters now
- Board checklist published. APRA and ASIC point to existing standards, so the test is evidence, not new rules.
Company register access is being tiered
- Who it affects
- commercial insurers verifying business policyholders and their officeholders
- What it can disrupt
- KYC, credit and collections workflows that pull director details from open register searches
- Why it matters now
- Proposed, not final. Consultation closed 12 October; new access settings planned from 1 July 2027, fully in place by 1 August 2028.
Compiled with care from public sources; errors and omissions excepted. Always check the linked source before acting. Regulatory Radar is general information, not legal or compliance advice.