APRA ECAI Recognition Guidelines: What ADIs Must Check in APS 112

ByOfficer

APRA ECAI recognition matters where APS 112 uses an external rating to determine a credit rating grade and risk weight. Many other standardised-approach exposures are risk-weighted under prescribed exposure-class, loan-to-value, default-status or other rules that do not depend on an ECAI rating. On 9 July 2026, APRA republished the guidelines that govern that recognition, after temporarily withdrawing them on 7 May 2026 for review. The document had not been touched since 2013, so the refresh matters to anyone who maps a rating to a credit rating grade before it lands in a capital return.

The headline change is modest on paper. APRA says the updated guidelines clarify the pathways for recognition as an ECAI, carry minor drafting and stylistic changes, and now refer explicitly to insurers as well as banks, because insurers also use ECAI credit ratings. There is no change to APS 112 itself, no new risk weights, and no template redesign. For a standardised-approach ADI the practical question is narrower and more useful: does the reporting your team files on Reporting Standard ARS 112.0 still rest on ratings from ECAIs APRA recognises, mapped to the correct grade?

That question is worth answering deliberately instead of assuming the answer is yes. This piece walks through what APRA changed in the ECAI recognition guidelines, how a recognised rating becomes a risk weight in APS 112, and what a reporting officer should check in the next standardised credit-risk return.

Related reading: our guide to APRA’s APS 112 risk-weight changes.

The dates that matter

The guidelines refresh has a short, clean timeline. Keep these against your reporting calendar so the change is filed against the right context and not treated as a surprise mid-quarter.

  • 2013: the previous version of the ECAI recognition guidelines, last updated.
  • 7 May 2026: APRA temporarily withdraws the guidelines for review, framed as part of its regular review of the standards and guidance that make up the prudential framework.
  • 9 July 2026: APRA publishes the updated guidelines, with clarified recognition pathways and an explicit reference to insurers.
  • Reporting periods ending on or after 30 September 2024: the current Reporting Standard ARS 112.0 applies.
  • Quarterly, within 35 calendar days after the end of the reporting period: the ARS 112.0 submission deadline.

What APRA changed in the ECAI recognition guidelines

The guidelines are guidance, not a prudential standard. They set out how APRA decides whether an external credit assessment institution meets the eligibility criteria that let ADIs and insurers use that institution’s ratings for regulatory capital purposes. They sit underneath the binding standards, most directly APS 112 for the standardised approach to credit risk and APS 120 for securitisation, and they explain how recognition works while leaving the risk weights to the standard.

Three things moved on 9 July 2026. First, APRA clarified the pathways to recognition, which had been described loosely in the 2013 text. Second, it made minor drafting and stylistic changes that tidy the document without shifting its substance. Third, it added explicit references to insurers because insurers may also use ECAI ratings in their capital calculations. Insurer ratings are converted into counterparty grades under CPS 001 and used in the relevant asset-risk standards; they do not use the APS 112 credit-rating-grade mapping. A bank reporting officer can read the insurer references as context and move on, but a reporting officer inside an insurance group should note that the recognition question now reaches their capital numbers too.

The unchanged parts matter just as much. The updated guidelines do not alter a single risk weight, credit rating grade, or reporting field. APRA’s 9 July release does not announce an amendment to the S&P Global Ratings, Moody’s or Fitch Ratings mappings in APS 112, to ARS 112.0, or to any reporting field; Tables 21 and 22 of the current standard remain the primary source for those mappings. The update functions as a current-control review, not a retrospective one: any correction to a previous return would still depend on whether the ADI identifies an error under the rules that applied to that return. The refresh is a prompt to confirm your inputs are clean, not an instruction to rebuild them.

How a recognised rating becomes a risk weight

The mechanism is worth stating plainly, because the guidelines only make sense once you can see where an ECAI rating enters the capital calculation. Under APS 112 an ADI uses the rating of a recognised ECAI to determine the credit rating grade of an exposure, and the grade drives the risk weight, which feeds risk-weighted assets, which is what the ADI reports on ARS 112.0. Break any link in that chain and the reported number is wrong.

APS 112 recognises the ratings of S&P Global Ratings, Moody’s, and Fitch Ratings, and Attachment F of the standard maps their long-term ratings into six credit rating grades. The mapping is fixed and mechanical once you know it. Grade 1 covers the AAA to AA- band (Aaa to Aa3 in Moody’s scale). Grade 2 covers A+ to A-. Grade 3 covers BBB+ to BBB-. Grade 4 covers BB+ to BB-. Grade 5 covers B+ to B-. Grade 6 covers CCC+ and below, down through default. Where an asset-class table uses external ratings, a better credit rating grade generally produces the same or a lower risk weight, while a weaker grade generally produces the same or a higher risk weight.

Exposures with no eligible rating fall to the unrated risk weight that APS 112 specifies for the relevant asset class, which for many exposure types is more punitive than an investment-grade rating would produce and, for some, more favourable than a low grade. That asymmetry is the reason a lapsed or withdrawn rating can move a capital number in either direction, and the reason a reporting team should watch rating status as carefully as rating level.

The recognition guidelines govern whether and how an ECAI’s assessments may be used. Recognition may be direct, where APRA conducts the assessment, or indirect, where APRA relies on direct recognition by another national supervisor with sufficiently similar criteria. For an exposure domiciled in a G20 or EMEAP country, an ADI may use an ECAI recognised by that country’s national supervisor and apply the mapping determined by that supervisor. Ratings that do not satisfy an applicable route under the guidelines should be treated as unrated.

The two recognition pathways, clarified

The clarified pathways are the substantive part of the update. APRA recognises an ECAI in one of two ways. The first is a direct assessment, where APRA evaluates the institution against its eligibility criteria and forms its own view. The second draws on recognition already granted by a comparable overseas prudential supervisor, which lets APRA rely on that work rather than duplicate it. The 9 July 2026 text sets out both routes more clearly than the 2013 version did.

The eligibility criteria APRA assesses follow the international pattern for ECAI recognition. An ECAI is expected to demonstrate objectivity in its methodology, with a rigorous and validated approach rather than an ad hoc one. It must show independence, so that ratings are not shaped by commercial or political pressure. Its assessments should be available on an international basis and on transparent terms. It must disclose its methodologies, default rates, and rating transitions publicly. It must hold sufficient resources to sustain quality credit assessment. And it must have credibility, evidenced by reliance from independent parties. These are the tests that stand behind the short list of recognised names in APS 112.

For a reporting officer, the recognition pathway affects the evidence that must be retained. For direct recognition, monitor APRA’s recognition and published mapping. For indirect recognition, the ADI or insurer using the rating is responsible for confirming that the ECAI remains directly recognised by the relevant national supervisor. The mapping must then follow the route permitted by the guidelines and the applicable prudential standard.

Why insurers now appear in the text

The explicit insurer references are the clearest signal of what the refresh is for. Credit ratings feed more than one capital calculation. A general or life insurer may use external ratings to assign counterparty grades for assets and counterparty exposures. Those grades feed the credit-spread and default stresses under GPS 114 or LPS 114. The mapping differs from APS 112: CPS 001 uses counterparty grades 1 to 7 and includes AM Best alongside S&P Global Ratings, Moody’s and Fitch Ratings. The updated guidelines therefore apply a common recognition framework across banking and insurance, but the resulting regulatory mappings remain framework-specific.

For a group containing both an ADI and an insurer, recognition governance may be coordinated, but the mapping logic must remain separate. The ADI applies the APS 112 credit rating grades, while the insurer applies the CPS 001 counterparty grades and the relevant GPS 114 or LPS 114 stresses. A recognition change may affect both frameworks, but it need not affect the same agencies, grades or calculations.

What this means for your ARS 112.0 return

The reporting vehicle for standardised credit risk is Reporting Standard ARS 112.0, made under section 13 of the Financial Sector (Collection of Data) Act 2001 and read alongside APS 112. It collects an ADI’s on- and off-balance sheet exposures that are subject to the standardised approach, and it applies for reporting periods ending on or after 30 September 2024. An ADI must provide the Level 1 information. If it belongs to a Level 2 group, Level 2 information must also be provided unless the ADI is a subsidiary of an authorised NOHC, in which case the ADI’s immediate parent NOHC provides the Level 2 information. Returns are due within 35 calendar days after the end of the reporting period. Except for the Level 2 information required under paragraph 7 of ARS 112.0, information provided by the ADI must be produced by systems, processes and controls reviewed and tested by the ADI’s external auditor under APS 310. All information remains subject to the ADI’s internal review and authorisation controls.

Against that backdrop, a guidelines refresh works as a data-quality checkpoint rather than a filing task. The first thing I look at when a ratings-based line moves on an ARS 112.0 return is whether the ECAI behind it is still one APRA recognises and whether the rating is current, because a stale mapping produces a number that reconciles internally but rests on the wrong input. A few checks earn their place in the quarter APRA republishes the guidelines:

  • Confirm the applicable recognition route for every ECAI used in the calculation. For directly recognised ECAIs, confirm APRA recognition and the relevant mapping; for indirectly recognised ECAIs, confirm continuing recognition by the relevant national supervisor and retain evidence of the mapping applied.
  • Re-run the rating-to-grade mapping against Attachment F of APS 112, so a grade boundary has not drifted in your reference data.
  • Check the treatment of unrated exposures, since a withdrawn or lapsed rating moves an exposure to the unrated risk weight for its class, and the prior grade no longer applies.
  • Confirm that ratings incorporating assumptions of implicit government support are handled as APS 112 requires for bank exposures, so they do not flow through at face value.
  • Confirm your handling of exposures that carry more than one eligible rating, or a rating on the issue instead of the issuer, follows the selection rules in APS 112 and the guidance in APG 112.

These are existing rules, the points where a recognition change would actually reach your capital number, and the republished guidelines are a reasonable trigger to run them once instead of assuming they still hold.

Where standardised ADIs most often trip up

The common mistake with a change like this is to file it under “guidance, non-binding, no action” and move on. That reading is technically correct and operationally risky. The guidelines decide which ECAIs feed a binding standard, so a change to a recognition changes an input to a number your ADI is obliged to report accurately, even though the guidance itself carries no binding force. The non-binding label sits on the guidance and does not attach to the capital figure it shapes.

Direct recognition is subject to APRA’s ongoing review, and APRA may withdraw recognition where an ECAI ceases to meet the criteria. Indirect recognition must also be monitored because the ADI or insurer is responsible for confirming continuing recognition by the relevant national supervisor. APRA’s 9 July release does not, however, announce that any ECAI was derecognised as part of this update.

A third is confusing the assessor’s brand with APRA’s recognition. A well-known rating agency is not necessarily recognised for every purpose or in every jurisdiction, and APRA’s recognition is what APS 112 relies on, and the agency’s market standing does not substitute for it. If your mapping recognises a rating because the agency looks familiar, when what matters is whether APRA recognises it, the exposure should be treated as unrated until you can confirm otherwise.

Australia embeds the diligence duty in the mapping rule itself, rather than setting it out as a standalone reliance duty. In the EU, the standardised approach layers a non-mechanistic reliance duty on institutions on top of the mapping, so a bank cannot lean on a rating without its own diligence. Reporting teams that work across both regimes can see the difference in form in our note on CRR3 credit-risk ECAI due diligence. APRA’s model runs through recognition and the Attachment F mapping, and it carries its own diligence duty: Attachment F requires an ADI using an ECAI rating to perform due diligence that the rating conservatively reflects the counterparty’s creditworthiness, and to assign a risk weight at least one bucket higher where that analysis points to more risk than the rating implies.

How this sits with the rest of APRA’s credit-risk framework

APS 113 applies to ADIs that have, or are seeking, approval to use the internal ratings-based approach. An IRB ADI may nevertheless retain exposures under the standardised approach through approved partial use or because particular exposure types remain subject to APS 112. ARS 112.0 continues to apply to those standardised exposures. The APS 113 internal ratings-based pathway is a different reporting world, and an ADI that runs standardised for part of its book and IRB for the rest needs to be clear which exposures the ECAI mapping actually governs.

Frequently Asked Questions

Do the updated guidelines change any APS 112 risk weights?

No. The 9 July 2026 update clarifies how APRA recognises an ECAI and adds references to insurers. It does not amend APS 112, the credit rating grades in Attachment F, or any risk weight. A standardised-approach ADI’s calculation method is unchanged; only the guidance around which ECAIs can feed it has been refreshed.

Which ECAIs can an ADI use under APS 112?

APS 112 Tables 21 and 22 publish mappings for the long- and short-term ratings of S&P Global Ratings, Moody’s and Fitch Ratings. The guidelines also provide direct and indirect recognition routes, including the G20 and EMEAP country route. An ADI should therefore confirm the applicable recognition route and mapping rather than treating the three agencies named in APS 112 as an exhaustive universal list.

What happens to an exposure that has no eligible rating?

It is treated as unrated and takes the unrated risk weight that APS 112 sets for its asset class. That weight can be higher or lower than a rated equivalent depending on the class, which is why a withdrawn or lapsed rating can move a capital number in either direction and should be caught in reporting review.

Do we need to refile past ARS 112.0 returns because of this?

APRA’s release does not state that the guidelines update requires historical ARS 112.0 returns to be refiled. An ADI should nevertheless apply its normal correction process if its review identifies that a prior return used an ineligible rating, an incorrect mapping or another reporting error.

How do the two recognition pathways affect us in practice?

They determine both the permissible mapping and the evidence required. Where an ECAI is indirectly recognised, the ADI or insurer using its assessments is responsible for confirming that the ECAI remains directly recognised by the relevant national supervisor. The pathways therefore cannot be treated solely as APRA’s internal process.

Does this reach insurers in our group?

It can. A general or life insurer uses ECAI ratings to set asset risk charges under its capital framework, and the 2026 guidelines now name insurers explicitly. A group that reports for both an ADI and an insurer shares the same recognised-ECAI reference point across the two frameworks, so a recognition change touches both.

What if an exposure carries two conflicting eligible ratings?

APS 112 sets the binding rules for issue-specific and issuer ratings and for exposures with multiple eligible ratings. Where two ratings map to different grades, the higher risk weight applies. Where three or more ratings differ, the two ratings producing the lowest risk weights are identified and the higher of those two risk weights applies. APG 112 separately provides general guidance on consistent ECAI use and due diligence.

When is the ARS 112.0 return due?

ARS 112.0 is ordinarily quarterly and is due within 35 calendar days after the reporting period. Level 1 information is provided by the ADI. Level 2 information is also required for a Level 2 group, but where the ADI is a subsidiary of an authorised NOHC, its immediate parent NOHC provides that information. Except for the Level 2 information required under paragraph 7, the information must be produced by systems, processes and controls reviewed and tested by the ADI’s external auditor. All information must also be subject to the ADI’s internal review and authorisation controls.

Related Articles

Key Takeaways

  • APRA republished its ECAI recognition guidelines on 9 July 2026, after temporarily withdrawing them on 7 May 2026 for review; the prior version dated from 2013.
  • The update clarifies the two recognition pathways, including a G20/EMEAP indirect route, makes minor drafting changes, and adds explicit references to insurers alongside banks. It changes no risk weight and no reporting field.
  • For a standardised-approach ADI, the guidelines decide which ECAIs may feed APS 112, so a recognition change is an input change to a capital number reported on ARS 112.0.
  • APS 112 recognises S&P Global Ratings, Moody’s, and Fitch Ratings, mapping their long-term ratings into grades 1 to 6 under Attachment F. Insurers use a separate CPS 001 counterparty-grade mapping that also includes AM Best.
  • An exposure with no eligible rating takes the unrated risk weight for its asset class, so rating status matters as much as rating level.
  • ARS 112.0 is ordinarily a quarterly return due within 35 calendar days after the reporting period end. Level 1 information comes from the ADI; Level 2 information comes from the ADI or, where it is a subsidiary of an authorised NOHC, from the immediate parent NOHC, and (except for that paragraph 7 information) is subject to external-auditor testing.
  • Treat the refresh as a data-quality checkpoint: confirm the recognition route for each ECAI, re-run the grade mapping, and check unrated and multiple-rating treatment.

Sources and References

Treat the guidelines refresh as a data-quality prompt

The republished ECAI recognition guidelines call for one careful look at reference data that most standardised-approach ADIs set up years ago and rarely revisit. The recognised-ECAI list decides which ratings are eligible, Attachment F decides which grade each rating maps to, and ARS 112.0 carries the number that results. A quiet update to the first link is exactly the kind of change that never announces itself in a reporting system, which is why the quarter APRA republishes the guidance is the right time to confirm the chain still holds end to end.

Last updated: July 2026

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.

Similar Posts