Banking, Insurance and Life Insurance (prudential standard) determination No. 2 of 2026

law://au/li/2026/f2026l01034@2026-11-13

Contents

Banking, Insurance and Life Insurance (prudential standard) determination No. 2 of 2026Prudential Standard 3PS 221 Aggregate Risk ExposuresBanking Act 1959Insurance Act 1973Life Insurance Act 1995I, Peter Kohlhagen, delegate of APRA:under subsection 11AF(3) of the Banking Act REVOKE Banking, Insurance and Life Insurance determination No. 2 of 2016, including Prudential Standard 3PS 221 Aggregate Risk Exposures made under that determination;under subsection 32(4) of the Insurance Act REVOKE Banking, Insurance and Life Insurance determination No. 2 of 2016, including Prudential Standard 3PS 221 Aggregate Risk Exposures made under that determination;under subsection 230A(5) of the Life Insurance Act REVOKE Banking, Insurance and Life Insurance determination No. 2 of 2016, including Prudential Standard Prudential Standard 3PS 221 Aggregate Risk Exposures made under that determination;under subsection 11AF(1) of the Banking Act DETERMINE the prudential standard which applies to all ADIs and authorised banking NOHCs;under subsection 32(1) of the Insurance Act DETERMINE the prudential standard which applies to all general insurers, authorised insurance NOHCs, and subsidiaries of general insurers and authorised insurance NOHCs; andunder subsection 230A(1) of the Life Insurance Act DETERMINE the prudential standard which applies to all life companies, friendly societies, registered life NOHCs, and subsidiaries of life companies and registered life NOHCs.This instrument commences on 1 October 2026.Dated: 21 July 2026Peter KohlhagenExecutive DirectorPolicy and Advice DivisionInterpretationIn this instrument:ADI has the meaning given in section 5 of the Banking Act.APRA means the Australian Prudential Regulation Authority.authorised banking NOHC has the meaning given to the expression authorised NOHC in section 5 of the Banking Act 1959.authorised insurance NOHC has the meaning given to the expression authorised NOHC in subsection 3(1) of the Insurance Act 1973.friendly society has the meaning given in section 16C of the Life Insurance Act.general insurer has the meaning given in section 11 of the Insurance Act.life company has the meaning given in the Schedule to the Life Insurance Act.registered life NOHC has the meaning given to the expression registered NOHC in the Schedule to the Life Insurance Act.subsidiary has the meaning given in the Corporations Act 2001.the Banking Act means the Banking Act 1959.the Insurance Act means the Insurance Act 1973.the Life Insurance Act means the Life Insurance Act 1995.the prudential standard means the Prudential Standard 3PS 221 Aggregate Risk Exposures in the form set out in the Schedule.SchedulePrudential Standard 3PS 221 Aggregate Risk Exposures comprises the document commencing on the following page.

Prudential Standard 3PS 221 #

Aggregate Risk Exposures #

Objectives and key requirements of this Prudential Standard #

This Prudential Standard requires a Level 3 Head to ensure that an aggregate risk exposure external to the Level 3 group does not expose prudentially regulated institutions within the group to excessive risk.The ultimate responsibility for the aggregate risk exposure policy of a Level 3 group rests with the Board of its Level 3 Head.The key requirements of this Prudential Standard are that a Level 3 Head must:have a policy for the Level 3 group that deals with the measurement, management and monitoring of, and reporting on, aggregate risk exposures associated with all risk types within the group;develop and implement effective systems and processes to manage, monitor and report on aggregate risk exposures; andmeet minimum requirements with respect to aggregate risk exposures and certain related matters.The requirements in this Prudential Standard are in addition to the obligations imposed on prudentially regulated institutions under other Prudential Standards.

Table of Contents #

AuthorityApplicationInterpretationAggregate risk exposuresThe role of the Board of a Level 3 HeadThe aggregate risk exposures policyInternal reporting systemsLimits and approvalsNotification requirementsAdjustments and exclusionsPrevious exercise of discretion

Authority #

section 11AF(1) of the Banking Act;section 32(1) of the Insurance Act; andsection 230A(1) of the Life Insurance Act.

Application #

This Prudential Standard applies to each Level 3 Head.This Prudential Standard commences on 1 October 2026.

Interpretation #

Terms that are defined in Prudential Standard CPS 001 Defined terms appear in bold the first time they are used in this Prudential Standard.Where this Prudential Standard provides for APRA to exercise a power or discretion, this power or discretion is to be exercised in writing.In this Prudential Standard, unless the contrary intention appears, a reference to an Act, Regulation or Prudential Standard is a reference to the Act, Regulation or Prudential Standard as in force from time to time.

Aggregate risk exposures #

For the purposes of this Prudential Standard, aggregate risk exposures arise from exposures to individual counterparties, a group of related individual counterparties, a group of counterparties with similar characteristics (e.g. in specific geographical locations or industry sectors) or to particular asset classes (e.g. property holdings or other investments) where the exposures have the potential to result in material losses for the Level 3 group or an individual prudentially regulated institution in the group. Aggregate risk exposures include both on- and off-balance sheet exposures. Unlimited exposures to any individual counterparty (e.g. a general guarantee of the obligations of a counterparty) are not permitted unless agreed with APRA.For the purposes of this Prudential Standard, when determining aggregate risk exposures the Level 3 Head must ensure that exposures to the wider conglomerate group to which the Level 3 group belongs are taken into account.For the purposes of this Prudential Standard, aggregate risk exposures exclude any exposures held, in accordance with written legal agreements, by the Level 3 group on behalf of entities external to the Level 3 group (e.g. custodian arrangements), even if the assets are held in the name of a Level 3 institution in the group.A Level 3 Head must have an ‘aggregate risk exposures policy’ that addresses all material risk exposures associated with the operations undertaken by Level 3 institutions in the Level 3 group. The policy must include systems and procedures to identify, measure, monitor, evaluate, report and control or mitigate all material risks arising from aggregate risk exposures.A Level 3 Head must conduct forward-looking scenario analysis and stress testing of the Level 3 group’s material aggregate risk exposures. The analysis must assess the impact of changes in market conditions and key risk factors on these aggregate risk exposures, and how these changes impact on the group’s risk profile, capital strength and earnings.The management of aggregate risk exposures must be a part of the Level 3 group’s risk management framework.[1]

The role of the Board of a Level 3 Head #

approve the aggregate risk exposures policy for the Level 3 group;ensure that adequate systems and controls are in place to identify, measure, aggregate, manage, monitor and report on material risk exposures in the Level 3 group in a timely manner and that those systems and controls are documented;engage in oversight, which may be via a board committee, of the approach to the identification, measurement, management and monitoring of aggregate risk exposures and compliance with the aggregate risk exposures policy, which includes receiving regular reviews of material aggregate risk exposures of the Level 3 group; andreview the aggregate risk exposures policy at least annually to ensure that this policy remains adequate and appropriate for identifying, measuring, aggregating, managing and monitoring the Level 3 group’s risk exposures.

The aggregate risk exposures policy #

be conceptually sound, consistently implemented, transparent and be subject to independent review;capture all material aggregate risk exposures;include limits on acceptable levels of aggregate risk exposures for the Level 3 group;a clear statement of the respective responsibilities and compliance obligations of the Board of the Level 3 Head, its board committees and senior management of the Level 3 group in relation to the monitoring and management of aggregate risk exposures;escalation procedures for aggregate risk exposures that facilitate responses to identified policy breaches between formal reporting cycles;the circumstances in which aggregate risk exposure limits may be exceeded and the authority required for approving such excesses;thresholds and procedures for reporting material changes to the Board of the Level 3 Head, in both formal reporting cycles and outside formal reporting cycles;consideration of the impact of material changes in macroeconomic conditions, including foreign exchange rates, interest rates and inflation; anda timetable for a regular review of the reports by the Board of the Level 3 Head.various types of counterparties;an individual counterparty or group of related counterparties;individual industry sectors;geographical locations;financial products, including risk transfer products;specific funding sources;various asset classes such as equities, property holdings and other investments;various market risks such as interest rate, foreign exchange and commodities; andany other material risks,that cover asset and liability exposures and that are commensurate with the Level 3 group’s risk appetite, risk profile and capital strength, and the size, business mix and complexity of the group; andservice providers;outsourcing;business continuity management; andany other operational risks.

Internal reporting systems #

A Level 3 Head’s management information systems must incorporate reporting systems in relation to aggregate risk exposures across the Level 3 group.[2]Reports on material aggregate risk exposures must be provided to APRA on request.

Limits and approvals #

whether the Level 3 group has been acting in a manner that is consistent with the aggregate risk exposures policy;the characteristics of aggregate risk exposures, including their number, size and nature;the characteristics of the Level 3 group, including the nature of its business and the experience of its management; andother relevant factors to be considered on a case-by-case basis.

Notification requirements #

of a breach of the limits in the aggregate risk exposures policy;of any significant breach of, or material deviation from, the aggregate risk exposures policy; orthat the aggregate risk exposures policy did not adequately address a material risk,and advise of remedial actions taken, or planned to be taken, to deal with the issue.A Level 3 Head must submit to APRA a copy of its aggregate risk exposures policy as soon as practicable, and no more than 10 business days, after Board approval.

Adjustments and exclusions #

APRA may adjust or exclude a specific requirement in this Prudential Standard in relation to the Level 3 Head.[3]

Previous exercise of discretion #

A Level 3 Head must contact APRA if it seeks to place reliance, for the purposes of complying with this Prudential Standard, on a previous exercise of discretion made by APRA under a previous version of this Prudential Standard.[1] Refer to Prudential Standard CPS 220 Risk Management (CPS 220).[2] Refer to CPS 220.[3] Refer to subsection 11AF(2) of the Banking Act, subsection 32(3D) of the Insurance Act and subsection 230A(4) of the Life Insurance Act.

Sourced from the Federal Register of Legislation at legislation.gov.au, © Commonwealth of Australia, licensed under CC BY 4.0. Compilations may have been reformatted.

Banking, Insurance and Life Insurance (prudential standard) determination No. 2 of 2026

Banking, Insurance and Life Insurance (prudential standard) determination No. 2 of 2026

Prudential Standard 3PS 221 #

Aggregate Risk Exposures #

Objectives and key requirements of this Prudential Standard #

Table of Contents #

Authority #

Application #

Interpretation #

Aggregate risk exposures #

The role of the Board of a Level 3 Head #

The aggregate risk exposures policy #

Internal reporting systems #

Limits and approvals #

Notification requirements #

Adjustments and exclusions #

Previous exercise of discretion #

History · 1 version

Prudential Standard 3PS 221 #

Aggregate Risk Exposures #

Objectives and key requirements of this Prudential Standard #

Table of Contents #

Authority #

Application #

Interpretation #

Aggregate risk exposures #

The role of the Board of a Level 3 Head #

The aggregate risk exposures policy #

Internal reporting systems #

Limits and approvals #

Notification requirements #

Adjustments and exclusions #

Previous exercise of discretion #

Key facts