APRA Licence Conditions: The Section 9AA Power Behind the Bendigo Action

ByRegReportingDesk

On 18 August 2026, APRA imposed licence conditions on Bendigo and Adelaide Bank Limited over what it described as longstanding and pervasive weaknesses in the bank’s non-financial risk management framework. The action is worth reading closely by every Australian authorised deposit-taking institution, because APRA reached for a power that sits underneath the banking authority itself rather than for a fine or a capital top-up alone. APRA also said Bendigo Bank remains financially sound, with strong capital and liquidity, so this was a prudential intervention driven by governance and control failings.

Licence conditions are the enforceable terms attached to an ADI’s authority to carry on banking business. Section 9AA allows APRA, at any time, to impose, vary or revoke conditions on a section 9 authority by written notice, provided the conditions relate to prudential matters. In Bendigo’s case, APRA said it was not satisfied that the underlying root causes had been addressed or sustainable risk uplift delivered. The Bendigo root cause analysis preceded the licence conditions. The registered conditions then impose requirements covering selection and engagement of an Independent Reviewer, a Rectification Plan, extension mechanics, attestation, reporting to APRA, variable remuneration and accountability, and the capital adjustment.

Related reading: APRA, BEAR and Bendigo: Accountability After a Cyber Incident

The Bendigo timeline at a glance

The licence conditions are the most recent step in a longer supervisory story, and the dates matter because they show a supervisor escalating over time rather than acting on a single event.

  • 2 June 2020 to 30 August 2023: the court materials identify two historical contravention periods. The section 37C(a) period runs from 2 June 2020 to June 2023, while the section 37D(1)(a)(i) accountability-coverage period runs from 29 August 2022 to 30 August 2023.
  • December 2025: APRA required Bendigo Bank to undertake an independent root cause analysis to understand the extent of its non-financial risk management issues.
  • 10 August 2026: APRA commenced civil penalty proceedings in the Federal Court, supported by a Statement of Agreed Facts and Admissions of the same date.
  • 18 August 2026: APRA imposed the licence conditions and confirmed it would maintain the bank’s existing 50 million dollar operational risk capital add-on.

The root cause analysis was completed by Deloitte. APRA has said its findings were that the bank’s non-financial risk management weaknesses are prevalent across the organisation, that the bank does not have a clear, complete and reliable view of its regulatory obligations, material risks and key controls, that there are material deficiencies in governance, accountability, compliance management, risk oversight and risk management capability, and that key weaknesses persisted despite several years of remediation under the bank’s enterprise-wide risk transformation program, known as BEN+.

How APRA licence conditions work under the Banking Act

The legal engine here is section 9AA of the Banking Act 1959. It allows APRA to impose conditions, or additional conditions, on an ADI’s authority to carry on banking business, and to vary or revoke those conditions. The conditions must relate to prudential matters. APRA acts by written notice to the institution, and section 9AA(4) requires APRA to ensure that notice that the action has been taken is published in the Gazette. The Bendigo conditions themselves are published as Gazette item C2026G00554 on the Federal Register of Legislation.

It helps to separate three different provisions that practitioners sometimes blur together. Section 9(3) is the grant power, the provision under which an authority to carry on banking business is issued in the first place; Bendigo and Adelaide Bank has held such an authority since 1995. Section 9AA is the conditions power, which lets APRA attach terms to a live authority. Section 9A is the revocation power, the most severe step, which ends the authority. Licence conditions sit in the middle of that ladder: they are forward-looking obligations attached to the authority, and a failure to meet them can expose an institution to escalation.

Section 9AA is one of several supervisory levers. Section 11AF lets APRA determine prudential standards that apply across classes of institution, and section 11CA lets APRA give an ADI a direction to comply in defined circumstances. Section 11AF allows prudential standards to apply to all ADIs, a specified class, or one or more specified ADIs. Section 11CA permits APRA to issue directions when statutory grounds are met, while section 9AA permits conditions on a section 9 authority. APRA’s 18 August release describes the Bendigo weaknesses and the conditions imposed but does not state that APRA selected section 9AA instead of another tool for the reason asserted here.

Section 9AA conditions are conditions on the section 9 banking authority, carrying no pecuniary penalty element. Separately, APRA’s Federal Court proceeding seeks declarations and pecuniary penalties for historical BEAR contraventions.

Why non-financial risk, not the balance sheet, drove the action

APRA was explicit that Bendigo Bank is financially sound, with strong capital and liquidity positions. The concern lived in the non-financial risk framework: governance, accountability, compliance management, risk oversight and risk management capability. Those are prudential matters within the meaning of section 9AA, which is why an authority-level condition was available even though the capital ratios were not the problem.

This is where a lot of board-level intuition goes wrong. Prudential supervision is often read as a capital-and-liquidity discipline, so a strong balance sheet is assumed to buy latitude on everything else. The Bendigo action shows the opposite emphasis. APRA’s CBA Prudential Inquiry described non-financial risks as operational, compliance and conduct risks. In the Bendigo action, APRA separately identified material deficiencies in governance, accountability, compliance management, risk oversight and risk management capability. Those matters sit within APRA’s prudential risk-management framework, including CPS 220 and CPS 230. Prudential Standard CPS 220 Risk Management sets the general risk-management framework. CPS 230 Operational Risk Management first commenced on 1 July 2025, but APRA’s targeted amendments took effect on 1 July 2026; the current CPS 230 is the 2026 determination, which sets more specific requirements for operational risk, business continuity and service-provider risk.

The trigger that tipped APRA from monitoring to conditions was persistence. The regulator said it was not satisfied that the bank had addressed the underlying root causes or delivered sustainable risk uplift, despite having had significant opportunity to do so. Read against the standards, the operative finding is the one about visibility: an institution that cannot show a clear, complete and reliable view of its regulatory obligations, material risks and key controls has a gap that a multi-year transformation program had not closed. APRA said the independent root cause analysis was required to understand the extent of the bank’s non-financial risk management issues; its 18 August release then set out Deloitte’s findings before stating that APRA was not satisfied that the underlying root causes had been addressed or sustainable risk uplift delivered.

The obligations inside the licence conditions

The registered conditions contain eight operative headings: Selection of Independent Reviewer, Rectification Plan, Feedback on Rectification Plan, Extensions of time, Attestation, Reporting to APRA, Variable remuneration and accountability, and Capital adjustment. Under the Feedback on Rectification Plan conditions, APRA may provide feedback and Bendigo must, within 15 Business Days of receiving it, consider and where appropriate incorporate the feedback, provide APRA with an amended Rectification Plan and/or a written explanation for any feedback not incorporated, and ensure that the Rectification Plan incorporates APRA’s feedback to APRA’s satisfaction. The Independent Reviewer’s Scope of Engagement must also provide for ongoing engagement with APRA, quarterly progress reports directly to APRA and escalation of material deviations.

A rectification program

The conditions require what APRA calls a comprehensive rectification program to sustainably fix the risk-management shortcomings. For a reporting function, the important feature is that a program of this kind is measured against a defined end state and reported against milestones, so the artifact is not a plan on a shelf but a tracked body of work with evidence of completion.

An independent assurer

The bank must engage an independent assurer; the registered conditions use the term Independent Reviewer. The Independent Reviewer must report quarterly directly to APRA and escalate material deviations from the Rectification Plan or matters likely to affect achievement of the Target States. Separately, Bendigo cannot apply to remove the Capital Add-On until the conditions’ APRA-satisfaction tests are met.

Board attestation

The conditions require written attestation once Bendigo is satisfied that all Rectification Activities under the Rectification Plan have been completed and the Target States have been substantially achieved. The attestation must come from the relevant Accountable Person(s), the Chair of the Board, and the Chair of the Board Risk Committee and/or the Chair of the Board Audit Committee.

A maintained capital add-on

APRA will maintain the bank’s existing 50 million dollar operational risk capital add-on until it is satisfied the underlying prudential concerns have been effectively addressed. The add-on is a capital requirement rather than a penalty, and it pre-dates these conditions. Holding it in place ties the release of capital to demonstrated risk uplift, which gives the whole program a financial incentive to finish.

Taken together, the conditions establish a remediation and supervisory-reporting framework: the Rectification Plan is subject to Independent Reviewer input, APRA feedback and Board approval; relevant Board papers and minutes must be provided to APRA within 15 Business Days of the specified meetings where progress against the Rectification Plan has been considered; Bendigo must provide written evidence that it has considered accountability for Rectification Activities in remuneration scorecards and considered progress when determining ongoing suitability and variable remuneration; attestation is required at the specified completion point; and Bendigo cannot apply to remove the Capital Add-On until the conditions’ stated tests are met.

Where the conditions sit alongside APRA’s other action

The licence conditions are one part of a coordinated response. On 10 August 2026, APRA commenced civil penalty proceedings against Bendigo and Adelaide Bank in the Federal Court, seeking declarations of contravention and pecuniary penalties. The proceeding is grounded in a Statement of Agreed Facts and Admissions and targets past conduct in the bank’s Alliance Bank operations, a network of authorised representatives operating under Bendigo’s ADI.

The court proceeding turns on two provisions of the Banking Act. APRA alleges a contravention of section 37C(a), which required the bank to take reasonable steps to conduct its business with due skill, care and diligence, in relation to customer authentication controls and the governance and risk management of the systems behind Alliance Bank’s digital access, tested against Prudential Standard CPS 234 Information Security. It also alleges a contravention of section 37D(1)(a)(i), because the responsibilities of the bank’s accountable persons did not cover all parts of its operations, with Alliance Bank information technology operations left out of every accountability statement. The enforcement route is section 37G, with the pecuniary penalty mechanics in Schedule 2 of the Act. Those obligations were the accountability rules then in force under the Banking Executive Accountability Regime, since replaced by the Financial Accountability Regime.

Two separate tracks are running, and it is worth keeping them apart. The Federal Court proceeding looks backward and asks the court to penalise historical breaches; the licence conditions look forward and require the bank to fix its current framework. APRA has also said it worked closely with ASIC and AUSTRAC, so the conditions support a wider regulatory response on risk governance, accountability and oversight. For teams tracking the financial-crime side of that coordination, our note on the AUSTRAC 2026 financial-crime risk snapshot sets out where the AML and CTF expectations are heading.

The precedent: capital add-ons and the CBA playbook

None of this is new machinery. APRA has previously used operational risk capital add-ons alongside formal remediation and independent review, including in the CBA and Westpac matters.

The clearest precedent is Commonwealth Bank. In May 2018, following the Final Report of the APRA Prudential Inquiry into CBA, APRA required the bank to hold an additional one billion dollars in operational risk capital, and on 30 April 2018 CBA entered into an enforceable undertaking. APRA reduced the overlay to 500 million dollars in November 2020 as the bank made progress, and released the remaining 500 million dollars effective 30 September 2022 once CBA had met its enforceable undertaking obligations. The overlay ran for more than four years, and it came off in stages tied to independently verified progress.

The following year, in July 2019, APRA applied a 500 million dollar operational risk capital add-on to each of ANZ, NAB and Westpac, reflecting higher operational risk identified in the banks’ own risk governance self-assessments, and it later added a further 500 million dollars for Westpac. Those add-ons were designed to stay in place until the banks completed the remediation that would close the gaps their self-assessments had exposed.

The read-across for Bendigo is the exit criterion. Across the cited precedents, APRA tied release of capital add-ons to remediation progress or completion and its own satisfaction or validation rather than a fixed expiry date. CBA and Westpac had independent reviewers; the cited APRA material does not establish independent assurance as a universal release condition for every bank. A board planning against the Bendigo conditions should assume a multi-year horizon and an evidence-based release, which is the same shape as an ICAAP-driven capital overlay elsewhere; our explainer on how supervisors calibrate Pillar 2A and ICAAP capital add-ons shows the parallel mechanics in another jurisdiction.

What other ADIs should take from the conditions

The value of the Bendigo action for everyone else is the diagnostic it hands you. APRA has named, in plain terms, the gap it found and the evidence it wanted to see.

The sharpest test is the visibility finding. APRA said the bank lacked a clear, complete and reliable view of its regulatory obligations, material risks and key controls. APRA identified Bendigo Bank’s lack of a clear, complete and reliable view of its regulatory obligations, material risks and key controls as a deficiency. CPS 220 requires an institution-wide risk-management framework and comprehensive view of material risks. Current CPS 230 also requires documentation, for the processes and resources needed to deliver critical operations, of associated risks, obligations, key data and controls. The sources reviewed do not prescribe the specific institution-wide ‘obligations-to-risks-to-controls mapping’ artefact asserted here for every ADI.

Accountability is the second read-across. The Financial Accountability Regime has applied to ADIs since 15 March 2024, replacing the Banking Executive Accountability Regime and putting joint administration in the hands of APRA and ASIC. Under that regime, responsibility for risk management sits with named accountable persons and with the board, which is exactly why a board attestation requirement bites. The accountability architecture will feel familiar to anyone who has worked under the United Kingdom’s individual-accountability rules; our comparison of the 2026 SM and CR accountability reforms traces the same design in a different market.

The third lesson is about sequencing. APRA required an independent root cause analysis before it imposed conditions, then held an existing capital add-on rather than lifting it. The sequencing reads as deliberate: the regulator gathered independent evidence, then attached obligations calibrated to what that evidence showed. For a reporting officer, the practical consequence is that the credibility of your remediation reporting now depends on whether an independent party would reach the same conclusion, which is the standard the assurer and attestation model is built to test.

Frequently Asked Questions

Are APRA licence conditions public, and where can they be read?

Section 9AA requires APRA to give written notice to the institution and to ensure that notice that the action has been taken is published in the Gazette. In Bendigo’s case, the conditions themselves are published as Gazette item C2026G00554 on the Federal Register of Legislation, and APRA’s media release links to that public text.

Can APRA impose licence conditions without going to court?

Yes. Section 9AA is an administrative power that APRA exercises by written notice, so it does not require a court order. That is why the Bendigo conditions could be imposed on 18 August 2026 while a separate civil penalty proceeding, which does require the Federal Court, ran in parallel. Decisions to impose conditions carry the review rights the Banking Act provides.

Is the 50 million dollar operational risk capital add-on a fine?

No. A capital add-on is a requirement to hold more capital against operational risk, not a pecuniary penalty. It is set to be maintained until APRA is satisfied the underlying concerns are addressed, which means it can be reduced or removed once risk uplift is demonstrated, as happened across the CBA and major-bank precedents.

What happens if an ADI breaches a licence condition?

Section 9AB provides that a body corporate commits a strict-liability offence if an act or omission results in contravention of a condition of its section 9 authority, subject to the statutory exception in section 9AB(1)(c); the penalty specified in section 9AB(1) is 300 penalty units. Separately, section 9A permits APRA to revoke an authority in specified circumstances, including failure to comply with an authority condition, and section 11CA contains direction powers where its statutory grounds are met.

How do the licence conditions interact with the Financial Accountability Regime?

They run in parallel. The licence conditions are imposed under the Banking Act’s prudential machinery, while FAR governs the accountability of the accountable entity and its accountable persons. The board attestation requirement is where they meet in practice, because attestation places a personal, board-level sign-off on the very risk-management work FAR already makes people accountable for.

Does the action affect Bendigo Bank’s depositors?

APRA emphasised that Bendigo Bank is financially sound, with strong capital and liquidity, and framed the action as targeting the non-financial risk management framework rather than the bank’s solvency. APRA lists Bendigo and Adelaide Bank Limited as an ADI covered by the Financial Claims Scheme. The FCS protects money held in protected accounts up to a total of $250,000 per account-holder with an ADI.

How is an APRA-required root cause analysis different from a self-assessment?

A self-assessment, as used by the major banks in 2019, is run by the institution on its own risk governance. The Bendigo root cause analysis was required by APRA and performed by an independent firm, and it was aimed at the underlying causes of the failings rather than a management stocktake. APRA’s 18 August release says the licence-condition action followed the independent root cause analysis and sets out Deloitte’s findings; it does not state that independence itself was the legal or evidentiary basis for imposing the conditions.

Key Takeaways

  • Section 9AA of the Banking Act 1959 lets APRA impose, vary or revoke conditions on an ADI’s authority; the conditions must relate to prudential matters, and APRA must ensure that notice that the action has been taken is published in the Gazette.
  • The Bendigo trigger was non-financial risk: governance, accountability, compliance management, risk oversight and risk management capability.
  • The registered conditions cover eight headings: Selection of Independent Reviewer, Rectification Plan, Feedback on Rectification Plan, Extensions of time, Attestation, Reporting to APRA, Variable remuneration and accountability, and Capital adjustment; they also prescribe specific timing, governance and reviewer-reporting requirements.
  • The add-on stays until APRA is satisfied; the CBA precedent ran from 2018 to a full release on 30 September 2022, so plan for a multi-year, evidence-based exit.
  • A separate Federal Court civil penalty proceeding, commenced 10 August 2026, targets past Alliance Bank conduct under Banking Act sections 37C(a) and 37D(1)(a)(i) and CPS 234 Information Security.
  • APRA identified Bendigo Bank’s lack of a clear, complete and reliable view of regulatory obligations, material risks and key controls as a deficiency; the cited sources do not prescribe a single institution-wide mapping artefact in that form for every ADI.
  • CPS 230 Operational Risk Management first commenced on 1 July 2025; APRA’s amended current determination commenced on 1 July 2026. CPS 230 operates as part of the risk-management framework required by CPS 220 and adds specific operational-risk requirements.
  • FAR has applied to ADIs since 15 March 2024, placing risk-management accountability on the board and named accountable persons, which is what makes board attestation bite.

Sources and References

The condition to watch next

The signal to watch in the Bendigo matter is a document trail: the independent assurer’s findings, the board’s attestation, and APRA’s own read on whether the rectification program has closed the visibility gap Deloitte identified. The conditions prevent Bendigo from applying to remove all or part of the 50 million dollar add-on until it has reasonable grounds to conclude that it can demonstrate compliance with the conditions, completion of the Rectification Activities and achievement of the Target States to APRA’s satisfaction. The conditions set no fixed expiry date; CBA’s separate add-on remained in place from May 2018 until 30 September 2022. For other ADIs, the Bendigo finding is a useful diagnostic: test whether existing risk and compliance documentation provides the visibility required by the applicable CPS 220 and CPS 230 obligations and whether Bendigo-like gaps exist. The Bendigo action does not establish one universal mapping artefact as the determinant of supervisory acceptance.

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.

Similar Posts