APRA IRB Accreditation Pathway: What Australian ADIs Must Now Demonstrate

ByOfficer

Last updated: June 2026

Treat IRB accreditation as a capital-saving shortcut and the project tends to stall about eighteen months in, when the model validators ask for three years of clean default data the bank never kept. The internal ratings-based approach lets a bank use its own estimates of borrower risk to set credit risk-weighted assets, instead of the fixed risk weights of the standardised approach. The prize is real. So is the build. On 4 June 2026, the Australian Prudential Regulation Authority finalised a new, more accessible IRB accreditation pathway for medium-sized authorised deposit-taking institutions that found the door too heavy.

Until now, only the largest banks have cleared the bar. APRA has approved six ADIs to use IRB: the four major banks, Macquarie Bank and ING Bank Australia. Everyone else calculates credit risk capital under the standardised approach in Prudential Standard APS 112. The new pathway does not lower the substantive requirements of Prudential Standard APS 113. It makes the route to meeting them clearer and less resource-intensive.

Related reading: the EU’s CRR3 output floor and how it limits internal-model capital savings.

What the new IRB accreditation pathway changed

APRA released a consultation paper, “A new pathway to internal ratings-based accreditation”, on 23 October 2025 and invited written submissions until 19 December 2025. On 4 June 2026 it published its response to submissions, a letter to industry finalising the new pathway. The substantive minimum requirements of Prudential Standard APS 113 remain those of the version that commenced on 30 September 2024. APRA framed the outcome as reducing some barriers to IRB accreditation for medium-sized ADIs while maintaining the integrity of the IRB approach.

The work delivers on Action 2 of the Council of Financial Regulators’ Review of Small and Medium-sized Banks, which makes it a competition measure as much as a capital one. IRB lets a bank match capital more closely to its measured risk, lowering credit risk capital on low-risk books in a way that can feed through to pricing. A more accessible route gives mid-tier lenders a reason to invest in risk infrastructure they would otherwise never build.

What APRA did not do is rewrite the standard’s minimum requirements. APS 113 is made under section 11AF of the Banking Act 1959 and the consolidated version commenced on 30 September 2024. Read the pathway as a change to the on-ramp, not the destination.

What APS 113 still requires you to demonstrate

APS 113 requires an ADI to obtain APRA’s prior approval before it may use the IRB approach for regulatory capital, and to keep meeting the minimum requirements both at initial implementation and on an ongoing basis. The substance sits in three places no pathway change removes.

Governance and the use test

Paragraph 20 requires the board, or the relevant board committee, and senior management to approve all material aspects of the rating and estimation processes. Those parties must hold a general understanding of the rating systems and a detailed understanding of the associated management reports. Paragraph 22 carries the reporting limb of the use test: internal ratings must be an essential part of reporting to the board and senior management, including risk profile by grade, migration across borrower grades, the parameter estimates for each grade, and a comparison of realised default rates against expectations. A rating system that exists only to produce a capital number, and plays no part in credit decisions, fails this test.

Rating systems, validation and the independent control unit

Paragraph 23 requires documented policies for the development, validation, implementation, governance and control of every rating system. Three artefacts are named explicitly and they are where programs commonly slip: a register documenting the specification, application, materiality and owner of each rating system; a change log covering all rating-system changes; and a centralised issues register. Paragraph 24 requires an independent credit risk control unit, functionally separate from the people who originate exposures, responsible for testing internal grades, producing summary reports, and reviewing whether rating criteria remain predictive of risk.

In my reading of these provisions, the binding constraint is almost never the risk-weight mathematics, which sits in Attachment A and does not move. It is paragraph 23. The model inventory, the change control, and evidence that an independent unit has challenged the models long enough to show a track record are what an applicant builds and runs for several cycles before APRA is satisfied.

Choosing FIRB, AIRB, retail IRB or supervisory slotting

APS 113 is not a single approach. Paragraph 17 sets four. Under foundation IRB a bank provides its own estimates of probability of default and effective maturity and relies on supervisory loss given default and exposure at default. Under advanced IRB it also estimates LGD, with senior unsecured and subordinated corporate exposures pushed back to supervisory LGD, while EAD stays supervisory. Retail IRB requires own PD, LGD and EAD, except that non-revolving retail exposures use supervisory EAD. Supervisory slotting asks only for a mapping of exposures into prescribed categories, then applies supervisory risk weights.

Paragraph 18 then removes the choice for several asset classes. FIRB applies to all sovereign, financial institution and large corporate exposures, where a large corporate is a counterparty with total consolidated annual revenue above 750 million dollars. Retail IRB applies to all retail exposures. Supervisory slotting applies to all project finance, object finance and commodities finance. A bank cannot cherry-pick advanced treatment for its riskiest specialised lending, which is the same logic behind supervisory slotting in the EU’s specialised lending rules.

Where IRB applicants commonly underestimate the work

The first misread is data. Own-estimate approaches need long, clean histories of defaults, losses and exposures, mapped to the rating grades the bank uses now, not the grades it used before a core-system migration. The data often exists but cannot be reconciled to the current rating scale, and rebuilding that lineage is the long pole.

The second misread is the standing cost. The independent control unit in paragraph 24 is a permanent function, not a project team that disbands at accreditation, and the same is true of the paragraph 23 validation cycle. A mid-tier ADI should price the run-rate of model risk management, not just the build, against the capital it expects to release. Where supervisors are heading on model governance, Australia’s regtech and model-risk direction is part of the same trajectory.

The capital question: IRB is not an automatic capital cut

Banks chase IRB for lower risk-weighted assets on low-risk exposures. That benefit is real but bounded. APRA’s framework constrains how far internal models can pull capital below the standardised result, which stays the comparison point for any board business case. A bank that models its way to a headline saving can find much of it clawed back by floors and overlays.

The EU manages the same tension through the output floor, which caps how low internal-model risk-weighted assets can fall against a standardised calculation. Australian boards should test the IRB case against both the gross modelled saving and the constrained number, the way EU teams now treat the standardised approach to credit risk as the binding floor. There is also a disclosure tail: an IRB bank carries heavier Pillar 3 capital disclosures than a standardised one.

What happens next

APRA’s response to submissions is published and the pathway is open. A medium-sized ADI should start with an honest gap assessment against paragraphs 20 to 24, the provisions that take years rather than months to satisfy, and read APG 113 alongside the standard before approaching the supervisor. Accreditation remains an APRA approval, and the regulator has been explicit that the integrity of the IRB approach is not up for negotiation even as the route gets clearer.

Frequently Asked Questions

What changed on 4 June 2026?

APRA finalised a new, more accessible pathway to IRB accreditation for medium-sized ADIs and published its response to submissions; the substantive minimum requirements of APS 113 are unchanged. It follows a consultation that ran from 23 October 2025 to 19 December 2025 and delivers on Action 2 of the Council of Financial Regulators’ Review of Small and Medium-sized Banks.

Did APRA lower the requirements to use IRB?

No. The substantive minimum requirements in APS 113, covering governance, the use test, rating systems, validation and the control unit, are unchanged. The pathway makes the route clearer and less resource-intensive, not the bar lower.

Which banks currently use the IRB approach in Australia?

Six ADIs: the four major banks, Macquarie Bank and ING Bank Australia. Every other ADI calculates credit risk capital under the standardised approach in APS 112.

What is the difference between FIRB and AIRB under APS 113?

Under foundation IRB a bank estimates its own probability of default and effective maturity and uses supervisory loss given default and exposure at default. Under advanced IRB it also estimates LGD, except for senior unsecured and subordinated corporate exposures, while EAD remains supervisory. Paragraph 18 assigns FIRB to sovereign, financial institution and large corporate exposures.

Will IRB definitely reduce our capital?

Not automatically. IRB can lower risk-weighted assets on low-risk exposures, but APRA’s framework constrains how far internal models can move capital below the standardised result. The business case should use the constrained number, not the gross modelled saving.

Related Articles

Key Takeaways

  • APRA finalised a more accessible IRB accreditation pathway for medium-sized ADIs on 4 June 2026, delivering on Action 2 of the CFR Review of Small and Medium-sized Banks.
  • The pathway lowers barriers to entry, not the substantive requirements of APS 113, which are unchanged.
  • Only six ADIs use IRB today: the four majors, Macquarie Bank and ING Bank Australia; all others use the APS 112 standardised approach.
  • The hardest requirements to satisfy are governance and the use test in paragraphs 20 and 22, and the rating-system register, change log and validation cycle in paragraph 23.
  • Paragraph 18 assigns FIRB, retail IRB or supervisory slotting to specific asset classes, so IRB cannot be switched on for a single portfolio.
  • IRB does not guarantee lower capital; the saving is constrained, and the standardised approach remains the comparison point.

Sources and References

Build the on-ramp before you cost the capital

The new pathway answers a fair complaint: the old route to IRB was too heavy for any bank short of the majors. What it does not do is make IRB easy. A medium-sized ADI that treats accreditation as a data-and-governance program first, and a capital exercise second, will read the new pathway the right way. Boards that chase the capital number before building the model inventory and the independent challenge function will spend two years learning why only six banks have managed it so far.

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.

Similar Posts