APRA's licensing process - frequently asked questions

Once you have developed an early stage business plan it can be beneficial to have a meeting with APRA. At this meeting APRA can provide high level views of any likely challenges with your proposals, allowing you to make adjustments to ensure your business develops in a way that is most likely to result in a successful application. APRA will also be able to provide advice about APRA’s prudential requirements and expectations and answer any questions you have about what to expect in the licensing process.   

It is likely that you will need to be licenced by ASIC. You may also need to seek authorisation or to register with other regulators, such as the RBA and AUSTRAC. You should allow time for their assessment processes.

Once you have lodged your application with APRA you should advise APRA in writing of the specific company name that you want to register and request APRA’s consent if the name includes an APRA regulated restricted term. APRA regulated restricted terms include the words ‘bank’, ‘banker’, ‘banking’, ‘building society’, ‘credit union’, ‘credit society’ and ‘friendly society’. If you want to register a company name that uses the restricted words in section 66 of the Banking Act 1959 (such as the words ‘bank’, ‘banker’ and ‘banking’), please also refer to the APRA’s Restricted Words under the Banking Act 1959 Guidelines:

If consent is granted by APRA, it will usually be subject to conditions, such as not using the company name publicly prior to licensing. It is an offence for a person to use a restricted word or expression under section 66 in relation to a financial business, except where APRA has granted a consent or exemption, or where a statutory exception applies.

If you want to register a company name that uses the restricted term ‘friendly society’ you will need to apply for consent from APRA under section 16E of the Life Insurance Act 1995.  It is an offence for a person to use the restricted expression “friendly society” in relation to a financial business, except where APRA has granted a consent or determined that section 16E does not apply to that person. 

The pre-application process involves submission of your business plan to APRA followed by a feedback meeting. The pre-application process is for the benefit of both the applicant and APRA. During the pre-application process APRA will seek to discuss with you potential issues with your application ahead of the formal licensing process.  This will identify areas APRA will be likely to specifically focus on or require additional information.

This will allow you to address issues ahead of developing all your related materials and will also assist you to ensure that a full application is submitted. This meeting will also give APRA familiarity with your proposal ahead of receiving the detailed application documents which can assist with allocating resources and begin considering any policy issues that may arise.

Once you have completed the pre-application process and you are ready to submit your application, you should contact APRA to advise of your intended timeframe for submission. This will enable APRA to allocate resources to the application and schedule assessments. APRA will then provide access to SecureDocs to submit your application. 

Once you have completed the pre-application process and submitted sufficient documentation APRA will provide you with an invoice for the application fee and the account details to make the Electronic Funds Transfer (EFT). The application fee is non-refundable.

APRA considers the application received once we have a received a substantial component of the required application documentation. The documentation needs to be Board approved where required, be at an acceptable standard for APRA to commence assessment and APRA must have received payment of the application fee.

Yes, APRA has a secure portal for uploading documents. This portal generally has capacity for 1 GB of data and this can be extended if required. Access is granted to individuals, as such you will need to advise APRA of the identity of persons who will be able to upload documents for your licence application.

APRA expects each policy, procedure or other document is submitted as a separate file, with a clear index which includes a numbering system and document title to facilitate navigation of the documents.

APRA prefers that you submit documents in one to three batches. APRA expects the first batch to at least include details of your business plan, financials, governance and all of the documents for the major risk area of your business, e.g. credit risk for an ADI or insurance risk for an insurer. Submitting all documents relevant to a particular risk category together will enable a more efficient review. 

If submitting in batches, APRA expects the first batch to also include an index of all the documents to be submitted, what each document covers and which batch each document will be included in. Documents need to be consistent and coherent with documents submitted in prior batches.

No, the checklist is a guide. It is possible that one Board approved document will cover multiple areas as relevant to your business.  However your application should make it clear what each document is covering.  

APRA does not require you to submit hard copy documents

As part of the pre-approval phase, APRA will review a business plan which may be a draft in order to provide high level feedback that will assist in the finalisation of the application. During the assessment phase, documents should be board approved finals.

Your entity will need to have a range of skills and experience to successfully manage a regulated entity, appropriate to your size, business model and business plan. This will include staff with the appropriate level of skill and experience working in the relevant industry sector. Having experience from multiple organisations of different sizes is also useful, including from organisations of a similar size to your proposed business. APRA takes into consideration the level of relevant skills and depth of experience of the entity and in particular that of the proposed Responsible/Accountable People in assessing the licence application.

Policies need to at least meet the minimum requirements of the Prudential Standards. They also need to be tailored for the individual organisation and APRA will test through discussions and onsite visits during the licensing process how these policies will be implemented and used by your business.

Yes, your entity will need to comply with all of the applicable Prudential Standards. You should complete self-assessments against the requirements of the Prudential Standards. A self-assessment consists of a paragraph by paragraph review of the requirements of the prudential standard and cross references the relevant clause in your policies or otherwise contains an explanation as to why a requirement is not applicable. The purpose of the self-assessment is to enable management and the Board to gain comfort that the entity will meet the requirements or alternatively highlight areas of non-compliance that may lead to further discussions with APRA. APRA may ask to see your self-assessments.

In the event that your entity is unable to meet a prudential requirement, there may be exceptional circumstances where APRA will consider a request to adjust or exclude a requirement, for example where the proposed business model is substantially different to existing models and it is not possible under this business model to comply with the requirement.

You should be aware that a request to adjust or exclude a requirement of the Prudential Standard will likely add further time to the licence application due to the need to consider the proposal, including the impact on desired prudential outcomes and the precedent it would set. A request for an adjustment or exclusion of a requirement may not be approved. You should factor in time for the review of any request and have a contingency plan if the request is not granted.

Yes you can, however APRA expects that the policies are tailored for your organisation and that they will be implemented and used. The Board also needs to be able to articulate and understand why particular approaches and policies have been chosen. Management need to be able to explain how the policies would operate in practice.

It is important that your policies and procedures work in practice. As such the policy and procedures designed for a large and complex organisation will differ from those for a small start-up entity. Your entity should create documents suitable for use by your business.

An appendix is used for supplementary material that is not a core component of your document. Content that is required to meet a Prudential Standard is unlikely to fit in this category.

APRA reviews documents to assess adherence to and understanding of prudential standards, as well as to obtain a view in regard to the competency of your staff. APRA does not approve the individual policies, as ensuring the policies are suitable for your entity is the responsibility of the Board and management. APRA will seek to ensure that the policies meet the necessary prudential requirements and that APRA has confidence that they can be implemented effectively ahead of granting a licence.

This will depend on the quality of the documents submitted. Your timeline should allow for multiple rounds of feedback, revision and resubmission of documents. It is important to focus on the quality of the submissions rather than the speed of turn around, as the need for multiple feedback rounds has been shown to slow down the licensing process.

APRA’s aim is to ensure that you understand the prudential requirements including sound risk management. Initial feedback will focus on actions that need to occur prior to obtaining a licence. It is possible that more minor feedback can be addressed post licence, and APRA will make it clear where this is the case.

This is a pre-licence requirement to provide assurance that your production ready IT systems have adequate design, functionality and controls in order for your business to operate in a prudent manner.

The length of time to complete the assessment will vary and depend on a number of factors including: the industry, type of licence being applied for and the quality of the documentation provided. Generally, assessment will take at least 12 months from receipt of the application, but entities should plan to have sufficient resources to support a longer licensing timeframe. An exception is the Restricted ADI licence, which will likely take at least 6 months. Care should be taken in regard to public announcements to ensure that unintentionally misleading statements about the time expectations for being granted a licence are not made.

For Registered Superannuation Entities and Private Health Insurer applications, please see FAQ 3.11.

The Superannuation Industry (Supervision) Act 1993 provides APRA must decide an application for a Registered Superannuation Entity (RSE) licence within 90 days after receiving it. APRA may extend the period for up to 30 days under subsection 29CC(2).

Under the Private Health Insurance (Prudential Supervision) Act 2015, unless APRA provides written notice of its decision on the application, APRA is taken to have refused an application for registration as a private health insurer (PHI) within 90 days after the application was made, or 90 days after the day the applicant gives APRA further information as required by APRA.

There is no legislated time frame for licence applications under the Banking Act 1959, Insurance Act 1973 or the Life Insurance Act 1995.



To ensure that RSE & PHI applicants receive the same level of guidance as other industries there will likely be multiple rounds of feedback as part of the pre-licensing assessment process ahead of submitting a formal application.

What is a RAS?

The RAS is a document that provides boundaries within which both management and staff know how it is acceptable to operate. It provides ground rules which should be very clear for management in terms of what they are, and are not, allowed to do in pursuit of the institution’s business strategy and objectives. Without such boundaries and ground rules, management (and ultimately all staff) may be unaware that they are operating outside of the risk appetite set by the Board. 

How should the RAS be structured?

APRA does not prescribe the structure or form of your RAS and you are generally free to adopt a risk appetite that suits the particular circumstances of your business, within the requirements of the prudential standards.

A RAS should be a concise document and should not include all management reporting. It is unlikely that a RAS would need to have an appendix as it would not be expected that there would be ancillary information in a RAS.

What content should be covered in the RAS?

The RAS should cover both high-level qualitative statements and, where appropriate, quantitative measures, which combined clearly capture your attitude towards, and level of acceptance of, its different risks. The RAS should consider the material risks to your company as well as to your reputation with policyholders/depositors, investors and customers. The RAS should also closely align with your strategic direction.

Qualitative statements should set the overall tone for your approach to risk taking and should also clearly articulate the Board’s motivations for taking on or avoiding certain types of risks or exposures. In this way, qualitative statements advise stakeholders of your attitude toward risk taking by placing high-level boundaries around the types of activities you are prepared to undertake.

Qualitative statements are likely where a hard boundary for operations is being set rather than a metric with variables or a scale.

How do we demonstrate that the RAS has/will be applied?

Your business strategy and policies should operate in line with your RAS. Once the Board has approved your RAS, you should be able to evidence decisions being made in line with it.

Additionally, as the RAS needs to be used by a number of stakeholders consistently across all of your business operations it must be easy to communicate and written in plain English. A RAS which is not easily understood will be difficult to embed throughout your organisation, as staff will not know how they are expected to behave and what they are permitted to do in order to operate within the risk appetite. 

* Information contained in this section is a summary of all information available from APRA including Information Papers, letters to industry and speeches. The questions and answers are designed to clarify CPS 220 Risk Management but do not form part of the law or create enforceable requirements. If there is a conflict between the guidance contained in this FAQ and CPS 220 Risk Management, then the requirements of CPS 220 Risk Management prevail.

APRA requires the applicant to provide written verification from its appointed external auditor that it meets the minimum regulatory capital level required prior to licensing. This must include meeting the applicable minimum level of capital and capital ratios. The written verification should set out the steps taken by the external auditor in making the verification, including the calculation of minimum capital requirements where applicable. For life insurers, the verification should address the solvency of each statutory fund, as well as the minimum capital requirements and capital ratios for each of its statutory funds and the life company as a whole.



RSE applicants are required to attach an audited copy of the applicant’s statement of financial position for the last two years to their applications, but do not need a separate verification of solvency.

The level of detail and need for difference from the underlying ADI or insurer will depend on whether there are other entities under the NOHC and the type of operations in those entities. It is possible that one set of policies can cover both the NOHC and ADI or insurer with differences for the NOHC and ADI or insurer detailed in the document.  You should discuss the requirements that will suit your circumstances with APRA.

Yes, you will need at least a policy detailing how you will address managing Interest Rate Risk in the Banking Book (IRRBB). The market risk policy/ies should also specifically state that the ADI will not undertake any proprietary trading business if this is the case. 

The BEAR regime applies to Restricted ADI/ADIs and imposes notification obligations to APRA on compliance with the BEAR regime. Templates for these notification obligations, including accountability statements and accountability maps, are available on the APRA website and will need to be completed as a pre-licence requirement. The time frame for reporting changes of 14 calendar days applies to RADIs as well as ADIs.

Start-up ADIs are often reliant on securitisation warehouse facilities to quickly build lending volumes.

For start-up ADIs reliant on securitisation warehouse facilities (e.g. greater than 20 per cent of funding in any projected year), APRA expects the warehouse facility to be automatically placed into amortisation if the warehouse facility is not renewed.  Where this occurs, this will be considered long-term wholesale funding and will not add to the minimum MLH requirement.

This approach reduces the risk that the reliance on warehouse facilities would result in a situation where the new ADI either has to transfer the mortgages to the warehouse provider, who may replace the new ADI as servicer or sell the mortgages to another party, or take the assets back on balance sheet at the end of the contractual term if the facility is not renewed. These scenarios would likely threaten the viability of the start-up ADI, as it is unlikely to have sufficient funding to repay the facility, and loss of mortgages will eliminate servicing income and retained equity in the warehoused mortgages.  

Yes, in addition to the expectation that Restricted ADIs must hold capital of at least $3 million plus a resolution reserve (typically $1 million), APRA expects a Restricted ADI to have sufficient operating capital to enable the entity to cover expenses and planned lending for typically the first three months after licensing. This may vary where appropriate, for example where an applicant has a profitable existing business.

This operating capital would reduce the pressure on Restricted ADIs to raise money immediately after licensing and help ensure that the Restricted ADI has the resources it needs to operationalise during the restricted period. 

Yes, Restricted ADIs are expected to carry out some elements of banking business (i.e. at least one deposit or lending product) during the restricted phase.

The Information Paper states on page 22 that APRA expects Restricted ADIs to be conducting limited business during the restricted phase. APRA strongly re-inforces this expectation.

This will result in significant benefits to both the applicant and APRA, as set out below:

• ensures the Restricted ADI is building both staff and operational capabilities during the restricted phase;
• provides the Restricted ADI with an opportunity to test its business proposition with customers;
• demonstrates to investors and potential investors that the applicant can launch a product and attract customers, which should assist the applicant in raising capital; and
• allows APRA to assess the ability of the Restricted ADI to launch and manage products, providing a more informed assessment of risk management capabilities.