On 20 July 2023, the Australian Prudential Regulation Authority (APRA) and the Australian Securities Investment Commission (ASIC) released materials for consultation, to support the implementation of the Financial Accountability Regime (FAR) (see the joint media release here on APRA’s website and on ASIC’s website).
The consultation materials propose new disclosure rules which will likely intensify the spotlight on directors and senior executives in the banking industry (referred to as accountable persons under FAR). They comprise the following documents:
Financial Accountability Regime Act (Information for register) Regulator Rules 2023 (regulator rules ) - these rules prescribe information that will be included in a register of accountable persons under FAR that could be disclosed publicly.
ADI Key Functions descriptions - this document describes the key functions that authorised deposit taking institutions (ADIs ) will typically consider when developing their accountability statements and which must be included in the register of accountable persons.
Financial Accountability Regime (Consequential Amendments) Transitional Rules 2023 - these rules prescribe the information that ADIs will be required to provide to APRA and ASIC within 30 days of the commencement of FAR.
Whilst certain aspects of the proposed regulator rules are relevant only to ADIs, ASIC and APRA (the regulators) have invited insurance and superannuation entities to consider them. The regulators have signalled that they will consult on similar rules which are tailored for the insurance and superannuation industries in due course.
The closing date for written submissions on the regulator rules is 17 August 2023.
Increased disclosure requirements for bank directors and executives
Under the proposed FAR, the regulators are required to establish and keep a register of accountable persons. The register must contain, for each accountable person, details of:
the person’s name;
the period during which the person is an accountable person of an APRA-regulated entity (accountable entity );
any disqualification of the person by the regulators from being or acting as an accountable person;
the responsibilities which cause the person to be an accountable person of an accountable entity.
The regulators may make rules which prescribe additional information to be included in the register.
The proposed regulator rules seek to achieve this by introducing heightened disclosure of information relating to accountable persons on the register of accountable persons. It is proposed that the information on the register include details of:
an accountable person’s employment status;
whether the accountable person has responsibility for any one or more specified ‘key functions’ of the accountable entity;
the position title of the accountable person’s line manager; and
any suspension of the accountable person due to the person’s failure to comply with FAR.
Significantly, information on the register may be made available for public inspection on the internet by the regulators. It is currently unclear whether the regulators propose to make some or all of information on the register publicly available. The explanatory memorandum to the Financial Accountability Regime Bill 2023 (FAR bill) confirms that the register may be made public at the discretion of the regulators and that this allows the regulators to balance the need for confidentiality of sensitive information about financial services business with the need for public accountability and transparency (paragraph 1.166, explanatory memorandum).
Rolling bad apples
Any public disclosure of disqualifications or suspensions of accountable persons under FAR will likely make it more difficult for those with a history of poor conduct to switch to another firm. Such individuals are often referred to as ‘rolling bad apples’ by regulators globally.
The concern has led to the introduction of regulatory reference letters in the United Kingdom, whereby firms must request a reference for candidates for director and executive roles (among others) from each firm that employed or engaged the candidate within the previous six years. Those receiving a request for a regulatory reference must provide one, and in doing so, must disclose any founded and completed disciplinary outcomes against the candidate.
Guilt by association
It is difficult to conceive of good reason for including details in the register of accountable persons of the position title of the person the accountable person reports to. That information is already required to be included in accountability maps which are prepared under FAR and is typically included in the accountable person’s accountability statement.
By including the information in the register of accountable persons, the regulators may make this information available to the public. There are dangers associated with this where an accountable person has been disqualified or suspended under FAR. An adverse inference could be drawn in these circumstances that the line manager failed to adequately supervise the accountable person, or that the line manager had a level of awareness of the matters that caused the accountable person to be disqualified or suspended but failed to respond appropriately. Such inferences may be unwarranted in the circumstances. If they were, it would raise a question as to whether the regulators had taken steps to seek to disqualify the line manager under FAR.
The information proposed to be included in the register of accountable persons is the position title of the line manager, and not the name of the individual. Notwithstanding this, it would likely be relatively straight forward in most cases to identify the particular individual in the role, given that most executive accountable persons will report to the accountable entity’s CEO and the CEO will report to the Board.
Key functions to inform content of accountability statements
The regulator rules require ADIs to disclose to the regulators whether individual accountable persons are responsible for one or more specified ‘key functions’ of the ADI. There are 20 key functions which are listed in the regulator rules .
The concept of key functions does not expand the definition or scope of responsibilities of accountable persons under Minister rules or section 10 of the FAR bill. Draft Minister rules were released on 12 September 2022 setting out prescribed positions and responsibilities which inform whether a person will be an accountable person under FAR . Many of the key functions reflect aspects of certain of the proposed prescribed responsibilities in these Minister rules.
APRA has previously released guidance on ‘key functions’ to assist ADIs to implement the Banking Executive Accountability Regime (BEAR) (refer to Attachment A to APRA’s Information Paper dated 17 October 2018 on Implementing the BEAR (Information Paper)). BEAR, which currently applies only to ADIs and is administered solely by APRA, will be succeeded by FAR.
APRA indicated in the Information Paper that key functions are intended to assist the regulators to assess whether accountable entities are adequately assigning accountability across all operational areas to their accountable persons. In practice, they have informed the preparation of accountability statements for such persons under BEAR.
Similarly, the key functions in the regulator rules should inform the preparation of accountability statements for accountable persons under FAR. They include key functions of an ADI’s operations which are regulated by ASIC, such as the following:
| Key Function | Observations |
|---|---|
| Operational risk management | The key function aligns with the prescribed responsibility for ‘management or control of an accountable entity’s operations’, as well as the incoming APRA Prudential Standard CPS 230 Operational Risk Management (CPS 230) which is set to replace five prudential standards relating to business continuity and outsourcing, with a commencement date of 1 July 2025. |
| Recovery and exit planning and resolution planning | The key function aligns with the incoming CPS 230 (see above). |
Key Function
Observations
Collections and enforcement (default, debt collections and recovery)
The key function aligns with the proposed prescribed responsibility under FAR for ‘management of the accountable entity’s client or member remediation programs (including hardship arrangements)’.
Financial services regulator engagement
The key function is likely to be relevant to the obligation of an accountable entity under FAR to take ‘reasonable steps to deal with the regulators in an open, constructive and cooperative way’ and similarly to the obligation on an accountable person under FAR to ‘deal with the regulators in an open, constructive and cooperative way’ (sections 20(b) and 21(b) of FAR Bill 2023 respectively).
Hardship process
The key function aligns with the proposed prescribed responsibility for ‘management of the accountable entity’s client or member remediation programs (including hardship arrangements)’.
Product design and distribution obligations
The key function reflects one of ASIC’s stated enforcement priorities for 2023. The regulator has to date issued 81 interim stop orders under the design and distribution obligations (DDO) regime. In previous consultations relating to FAR, APRA proposed to introduce a prescribed responsibility for end-to-end product management in line with (APRA consultation letter dated July 2019, and Policy Proposal Paper dated 16 July 2021). It subsequently removed the responsibility in the draft Minister rules .
Scam management
The National Anti-Scam Centre has recently been established and is led by the Australian Competition and Consumer Commission (ACCC) and ASIC. ASIC’s enforcement priorities for 2023 include to ‘combat and disrupt investment scams’.
The key functions also refer to recent focus areas of APRA, as follows:
Key Function
Observations
Operational risk management
The key function aligns with the prescribed responsibility for ‘management or control of an accountable entity’s operations’, as well as the incoming APRA Prudential Standard CPS 230 Operational Risk Management (CPS 230) which is set to replace five prudential standards relating to business continuity and outsourcing, with a commencement date of 1 July 2025.
Recovery and exit planning and resolution planning
The key function aligns with the incoming CPS 230 (see above).
A full list of proposed key functions is provided in the regulator rules and an accompanying paper which describes each of them.
Welcome clarification regarding joint accountabilities
APRA has clarified that ADIs can assign a key function to more than one accountable person if this reflects different responsibilities in relation to that function. This is because there may be different responsibilities in relation to the key function along the end-to-end value chain. Joint accountability may apply in these circumstances as accountable persons do not necessarily have end-to-end accountability in relation that key function.
This issue is particularly relevant to the key function relating to end-to-end product management. As noted in the table above, APRA previously proposed that a prescribed responsibility for end-to-end product management be introduced in line with recommendation 1.7 of the Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry. Concerns were raised by the industry participants that no single accountable person could be said to have responsibility for products end-to-end. In most cases, a number of accountable persons including heads of business divisions, operations and technology, would likely be involved in different aspects of the product management process.
Key functions likely point to areas of focus for regulators under FAR
The key functions are likely to be reflective of the areas of an accountable entity’s operations that will receive particular attention from the regulators under FAR. Many of them reinforce recent communications from the regulators regarding their strategic and enforcement priorities.
Accountable entities and accountable persons would be well advised to pay particular attention to the adequacy of their arrangements relating to the key functions to ensure that they do not breach the accountability obligations under FAR in respect of them. These obligations require accountable persons to, among other things, conduct the responsibilities of their position as an accountable person by acting with due skill care and diligence and by taking reasonable steps to prevent material contraventions by the accountable entity of specified financial services laws.
Transitional provisions for ADIs
The consultation materials released by the regulators includes proposed transitional rules which apply to ADIs that are currently subject to BEAR.
The transitional rules would require ADIs to complete and submit an electronic notification form which will be made available by APRA via the APRA Connect portal. The information to be completed in the form includes information which is proposed to be included in the register of accountable persons.
Update on FAR bill 2023
The FAR bill and the Financial Accountability Regime (Consequential Amendments) Bill 2023 were introduced into Parliament on 8 March 2023 and are currently before the Senate. The next Senate sitting dates are scheduled for 31 July 2023 - 10 August 2023 .
It is anticipated that the FAR bill will be passed in the next Senate sitting. If so, FAR will apply to ADIs six months after the bill receives Royal Assent (as early as February 2024), and to insurance and superannuation entities 18 months following Royal Assent (approximately February 2025).
What APRA regulated entities should do now
APRA regulated entities may wish to make written submissions on the proposed regulator rules regarding the information to be included.
In any event, they should reflect on their proposed accountability statements under FAR and ensure the statements provide complete coverage of all key functions listed in the regulator rules that are relevant to them.
It would be prudent for entities to conduct a current state assessment of the sufficiency of their arrangements in each of the key functions. Uplift should occur where necessary to mitigate potential exposures under FAR ahead of the commencement of the regime.
How we can help
Should you require assistance with the preparation of a written submission on the proposed regulator rules, your implementation of FAR or the making of enhancements to your existing governance, risk management, compliance and other arrangements, please let us know.
We have implemented BEAR and FAR for a significant number of institutions in the banking, insurance and superannuation sectors and have led a number of internal BEAR investigations. We routinely provide strategic advice to Boards and executives on the management of potential exposures under the regime. Our capability extends to the implementation of the related APRA CPS 511 Remuneration.
For more information or assistance, contact our experts below.
Authors : Silvana Wood, Partner and Janina Del Rosario, Lawyer