APRA and other Australian financial authorisations: a full lifecycle guide

APRA authorisation primarily addresses whether an entity has the capacity to meet its financial commitments to depositors, policyholders or superannuation members. The statutory definition of banking business includes accepting deposits and making advances of money, as well as other activities prescribed by legislation; providing finance without accepting deposits does not generally, by itself, require an ADI licence. Assuming liability for losses is general insurance, while issuing and assuming liability under life policies is life insurance; health insurance involving hospital or general treatment uses private health insurance registration, while accident and sickness insurance must still be distinguished according to the specific definitions.ADI Guide General insurance guide Health insurance guide

Brokers, authorised representatives, underwriting agents, claims service providers and underwriters are different types of entity. Merely distributing products or acting for an authorised insurer does not justify claiming to be an APRA authorised insurer; conversely, holding AFSL does not authorise an entity to assume insurance or deposit-taking responsibilities that require authorisation from APRA. The regulatory boundary should be determined by contractual responsibilities, the flow of funds and actual operations, not by the product names used on a website.

• Prepare a product and funds-flow diagram identifying who receives the money, who owns it and who is responsible for repayment.
• Assess, item by item, authorisation for banking, general insurance, life insurance, health insurance, RSE, RSA or PPF.
• Also screen for AFSL, Australian Credit Licence, AUSTRAC and state-level requirements; a APRA licence is not a substitute.

The advantage of being directly authorised is that the business can provide services under a business model for which it bears responsibility, within the licence, registration scope and any conditions, without relying solely on a third-party licensed institution. The corresponding costs are that capital must be capable of ongoing replenishment, the board must have genuine decision-making capacity, and systems must be able to handle client money and regulatory reporting. Authorisation is not proof of commercial success, investment safety or government endorsement.

A restricted ADI is suitable for new entrants still building their resources and systems and may be used for testing only within strict boundaries; it is not a full banking licence with lower capital for the long term. NOHC is for group holding or control structures and does not permit the direct conduct of banking or insurance business. RFC is data registration and does not confer deposit-taking or underwriting eligibility. RBA payment system rules, settlement account eligibility and private network access also do not amount to APRA banking authorisation.

• The business plan must explain the cost difference between assuming risk on one's own account and operating as an agent.
• Do not use unsupported statements such as ‘government certified’, ‘capital-guaranteed licence’ or ‘buy it and immediately operate all business lines’.
• For restricted names such as bank and friendly society, separately verify consent from APRA; registering a company name does not confer authorisation to conduct business.

Banks, life insurers and private health insurers generally must apply as bodies corporate. General insurance has a separate, specific statutory arrangement for Lloyd’s underwriters; that exception should not be treated as an unrestricted route for individual underwriting. RSE may be applied for by an eligible body corporate or group of individual trustees; a group of individuals may apply only for a non-public offer category. An overseas bank branch and a local subsidiary are different legal models, with different capital and retail customer boundaries.RSE Guide

APRA will review direct and ultimate shareholders, related parties, group relationships, source of funds, reputation and capacity to provide ongoing support. Foreign ownership is not automatically prohibited, nor is it a reason to bypass local prudential responsibilities; application materials should explain information cooperation between the home-country and Australian regulators. For shareholdings and group restructures exceeding the FSSA threshold, all persons requiring approval should be identified before authorisation or completion of the transaction.

• Certificate of company registration, current constitution, ACN/ABN or applicable ARBN.
• An organisational chart tracing through to ultimate owners, a list of related parties, voting rights and control arrangements.
• Investor background, audited financial information, source of capital contributions and enforceable arrangements for additional capital support.
• Home-country authorisation, regulatory consent and cooperation materials for an overseas regulated parent; assess foreign investment approval where applicable.

Under the general local-body corporate governance rules in CPS 510, the board must have at least five members, a majority of whom are independent directors, and an independent chair. Subsidiaries of prudentially regulated parent entities have different non-executive and independent director requirements; read the exceptions. For Australian-owned institutions, a majority of directors are generally required to ordinarily reside in Australia. A foreign-owned Australian body corporate must have at least two directors who ordinarily reside in Australia, at least one of whom must be independent. RSE is subject to SPS 510, rather than directly adopting the five-member and independent-majority template above; a majority of its directors and senior managers must ordinarily reside in Australia.CPS 510 SPS 510

Directors and management should have financial, risk and technical experience proportionate to the business and be able to explain how the organisation's policies work in practice. The insurance arm must also put arrangements in place for a qualified actuary and auditor; RSE must have the capacity to manage members’ interests, investments and administration. External consultants can assist with drafting documents, but cannot replace the board’s understanding and responsibility. FAR accountable persons and ASIC responsible managers are not automatically interchangeable titles.

Company directors must apply for a director ID before appointment. Current ASIC guidance states that the new requirement for companies to provide director ID to ASIC begins on 2027-07-01; it must not be presented in advance as a registration obligation already applicable in 2026.ASIC director ID

• Directors’ résumés, evidence of independence and Australian residency, consent to appointment, fit and proper assessments, and applicable criminal background checks.
• Allocation of financial, risk, compliance, technology and product responsibilities for CEO; set out actuarial and audit responsibilities by branch.
• Board and committee charters, conflicts of interest, succession, remuneration and performance policies.
• Prepare registration of accountable persons, responsibility statements and any required responsibility maps in accordance with applicable FAR rules.

An Australian company's registered office must be a physical street address in Australia, not a PO Box; its principal place of business must also be a physical address. The registered office may be at a third party's office, such as an accountant's, but written consent to use the address must be retained. A PO Box may be used separately as a correspondence address. This company law arrangement does not mean that APRA will accept a bank or insurer with only a mail-forwarding service and no personnel or capacity to exercise control.ASIC Company address

The application should identify the head office, Australian business office, branches and main outsourced operational locations, and explain arrangements for access to data, records and supervision. APRA may hold on-site meetings and understand the actual operations. Overseas branches should separately specify the head office, main Australian office and local arrangements for service; the RSA form also expressly requires the registered office or address for service to be a street address.

• Consent to use the registered address, an office lease or proof of the right to use the premises.
• Explain key persons’ work locations, arrangements for on-site access and genuine operational capability.
• List of core systems, data processing, disaster recovery and outsourcing locations.
• When the address changes, update ASIC and the applicable industry regulatory details at the same time.

Paid-up share capital is simply shareholder contributions received by the company; net tangible assets NTA generally means net assets after deducting intangible assets, although the specific regulatory calculation may also be adjusted. CET1 is high-quality capital that meets regulatory conditions and excludes prescribed items. An insurer's prescribed capital amount is calculated according to risk and is subject to a floor; PCR may also include APRA supervisory adjustments. Having net assets in the financial statements does not mean that prudential capital requirements have been met.

Under current GPS 110, general insurance usually has a floor of five million, Category D/E has a floor of two million, a life LPS 110 company has an overall floor of ten million, and each health benefits fund under HPS 110 has a floor of five million. Eligible insurance capital must exceed PCR and be adjusted for intangible assets and other items in accordance with capital measurement standards. For RSE, distinguish the trustee’s operating funds from the operational risk financial resources under SPS 114; member funds or fund reserves must not all be described as the trustee’s registered capital.GPS 110 LPS 110 HPS 110 SPS 114

The capital budget must also cover preparation costs, start-up losses, risk stress and orderly exit. APRA requires relevant applicants to obtain verification of minimum regulatory capital from an external auditor before approval; for life insurance, verification covers each statutory fund and the company as a whole. An RSE application must include applicable audited financial position information for the most recent two years, but FAQ does not require the same independent solvency verification.APRA FAQ

• Establish a reconciliation table for accounting share capital, accounting net assets, NTA and eligible regulatory capital.
• List the initial licensing threshold, ongoing PCR, additional buffer and operating expenses separately; do not treat capital as an application fee.
• Provide base-case, growth-delay and stress scenarios, explaining the source of additional funds and the triggers for their provision.
• Do not state that capital requirements have been met while funding commitments remain unpaid or capital instruments are ineligible.

APRA accepts discussion of a draft business plan at the pre-application stage, but the formal assessment stage should include the final document approved by the board. Each policy or procedure should be a separate document, with a clear number, title and index; it is generally recommended to submit one to three batches, with the first batch including at least the business plan, financial information, governance and key risk information. The aim is not to name documents word for word as in the checklist; the priority is to show that the documents cover the requirements and are consistent with one another.APRA FAQ

Documents must be tailored to the actual products and systems. ADI focuses on credit, liquidity and capital; insurance on underwriting, liability valuation, reinsurance and claims; RSE on trusts, investments, member interests and administration; and PPF on stored-value liabilities, protection of funds and reconciliation. Older guidance can still help explain the structure of the materials, but old capital-standard references and outsourcing requirements must be updated.

• Three-year business plan and financial forecasts, risk appetite, stress testing and a case for sustainable profitability.
• Company and control information, directors’ and management’s professional histories, and auditor and actuary appointment information.
• Risk management, internal controls, capital or ORFR strategy, compliance, complaints and incident escalation mechanisms.
• Core system architecture, information security, critical operational tolerances, service-provider contracts and exit arrangements.
• Product terms, funds flows, distribution arrangements, applicable disclosures, business continuity and orderly exit plans.

Usually, first introduce the business to licensing@apra.gov.au. APRA states that the pre-application stage includes at least three meetings: an initial enquiry, feedback after the business plan has been developed in sufficient detail, and a challenge meeting before submission. The challenge meeting tests management's understanding of the business and prudential requirements, and the applicant must address the feedback before formally submitting. If there is no contact about progress for six months, APRA may consider that the application is no longer being pursued.APRA early communications

Formal assessment is an iterative process and may involve requests for further information, revisions, meetings and assessment by risk specialists. Significant changes to directors, management, shareholding or business plans should be notified promptly. The final decision-maker is independent of the licensing team; approval is determined by the written licence, registration and commencement date. Conditions may restrict product lines or the scale of business.APRA assessment process

• For pre-application discussions, provide an overview of the business, funds, owners, governance, IT, outsourcing and exit arrangements.
• Obtain the forms applicable to the branch, the latest document checklist and confirmation of fees.
• Maintain supplementary-information records by issue, response, evidence and approved version.
• After approval, first check the commencement date, conditions, public registers and other licences, and only then open the relevant business.

There is no statutory fixed assessment timeframe for applications for banking, general insurance or life insurance. APRA’s currently published usual timeframe is 12–18 months from initial lodgement to substantial completeness, followed generally by a 90-day decision period. For RSE applications, the SIS Act requires a decision within 90 days of receiving an application, with an extension of up to 30 days permitted; for PHI applications, if a decision is not notified within 90 days after an application or after further information requested by APRA is provided, a deemed refusal mechanism applies. The form must be lodged at least 90 days before the proposed registration date.APRA FAQ PHI application

RSA's official application form refers to a 60-day decision period, which may be extended in writing by a further 60 days during the first 60 days. Each of these timeframes has its own triggering conditions and special rules and they cannot all be described as service commitments. Commercial estimates should be calculated from the point at which directors and key personnel are in place, funds are received and systems can be verified; this guide does not invent institution-level approval success rates or a fixed commercial timeframe.

• Clearly label the schedule ‘statutory decision period’, ‘APRA usual timeframe’ and ‘project commercial budget’.
• Set separate dependencies for financing, systems, home-country regulation, AFSL/ACL, FSSA and foreign investment matters.
• Do not treat PHI’s 90 days as automatic approval if there is no response.
• The long-stop date for transaction completion should allow for supplementary information, regulatory conditions and remediation; do not rely on the sale contract to guarantee an approval date.

FSSA generally limits the aggregate stake of an individual and their associates in a bank, general insurer, life insurer and applicable holding company to no more than 20%; applicable approval is required for more than 20%. This involves tracing through ownership and calculating associates, not merely checking the target company's register of shareholders. The Treasurer or a lawfully delegated authority deals with the relevant approval, while APRA is involved in prudential assessment; it is incorrect to say that all transactions need only be notified to APRA. A holding below 20% is not an absolute safe harbour for arrangements involving actual control.Explanation of government shareholding approval FSSA legislation entry

RSE trustee control approvals follow a dedicated procedure under the SIS Act. Although the calculation of associates refers to the definition in FSSA, this does not mean that the same approval regime as for banks and insurers applies directly. Mergers, acquisitions, restructures and terminations of PHI health benefit funds are subject to separate processes under the health insurance legislation and the relevant approval forms. RSA must also check the control approvals for its underlying ADI or life institution. A share sale does not automatically change the licence holder, and an asset or business sale does not automatically transfer the original authorisation to the buyer.

As at the date of this guide, ACCC introduced mandatory merger filings for transactions meeting the thresholds from 2026-01-01, and prohibits proceeding before approval; there were also related legislative changes on 2026-09-16. Historical descriptions in old parliamentary reports stating that Australian mergers do not require prior notification should no longer be relied on. FSSA, ACCC, foreign investment approval and business transfer approval are separate matters and must be checked individually.ACCC mergers and acquisitions

• Due diligence on licence conditions, capital shortfalls, historical breaches, outstanding claims, litigation, audit findings and changes to outsourced control.
• Identify all applicant entities, including the buyer, ultimate investor, associates, joint control arrangements and intermediate holding companies.
• Prepare an assessment of post-acquisition capital, governance, risk appetite, systems integration and effects on members/customers.
• Make all required approvals and capital being in place conditions precedent to completion, avoiding completion followed by supplementary filings.

APRA institutions must continue to meet applicable prudential standards after approval, submit data periodically and pay the annual regulatory levy. Reporting systems and forms should be based on current industry arrangements and APRA notices; descriptions of D2A and APRA Connect on old pages should not be presented as requirements that never change. Capital, liquidity, business scale and licence conditions should all be included in routine monitoring.APRA Post-approval matters

The version of current CPS 230 consulted took effect on 2026-07-01 and emphasises operational risk, tolerance for critical operational disruption and governance of material service providers. The old guides 231/232 should not continue to be treated as the current core framework without checking. Institutions to which FAR applies must meet accountability, personnel, remuneration deferral and notification obligations. FAR applied to banks from 2024-03-15 and to the insurance and pensions industries from 2025-03-15; it must not continue to be described as a future arrangement. The statutory scope and exceptions must be checked for each entity.CPS 230 FAR Official FAQ

Insurers must prepare ICAAP, conduct an appropriate independent review at least every three years, and provide an implementation report to APRA annually, usually within three months after the end of the relevant reporting period. RSE should review ORFR targets and tolerance limits at least annually and reassess them after a material operational incident. Different branches have different audit, actuarial and public capital disclosure arrangements, so a single annual review checklist cannot be applied across the board.

• Establish an applicable regulatory reporting and levy calendar covering monthly, quarterly, annual and event-based requirements.
• Update information on responsible personnel, control structures, systems, products and material service providers.
• Conduct regular stress testing, disaster recovery exercises, complaint analysis and internal and external audits, and track remediation through to closure.
• Material capital deterioration, breaches or interruptions must be reported in accordance with the relevant standards and statutory time limits; do not wait for the annual review.

A limited business licence may retain product or scale conditions for an extended period. Before expanding the business, the applicant must demonstrate that the additional scope meets the prudential framework and obtain a variation to the conditions. Restricted ADI are subject to a transition or exit requirement of up to two years; long-term operation under the general conditions for a limited business must not be confused with restricted ADI. RSE must apply for a licence variation or cancellation using the approved form. Fund registration and MySuper authorisation must also be maintained separately.

Stopping new business does not extinguish existing obligations. Insurers must properly manage existing policies and run-off; deposit-taking institutions must ensure the orderly repayment or lawful transfer of customer liabilities; and RSA may remain subject to statutory obligations in respect of funds it holds even if its approval is revoked. If planning to exit, first consult the regulator and prepare plans for capital, customer notification, data retention and business transfer.

After a refusal, review may be sought under the relevant legislation and decision notice; not all APRA decisions follow the same pathway. An old APRA assessment page still refers to AAT, but ART replaced AAT on 2024-10-14. Formal guidance should use the current agency name and check reviewability and time limits.ART official announcement

• Check licence conditions before adding products, taking on a new customer group or making significant system changes.
• The exit plan should set out repayment, transfer, claims, audit, records and ongoing capital requirements.
• Cancellation of a licence, cancellation of product authorisation and company deregistration must be dealt with separately.
• On receiving an adverse decision, promptly check the internal review, ART or court options and applicable time limits; do not make a blanket promise based on an old webpage.

Current PPF regulation is divided among APRA, RBA and ASIC according to the nature and scale of the facility. PPF is a specific stored-value payment facility, not a universal licence for all remittances, wallets or merchant acquiring. The limited-value exemption under RBA remains listed at ten million Australian dollars; the 2026 annual report states that no adjustment has been progressed. Even if the PSRA exemption is met, this does not automatically exempt an entity from ASIC or AUSTRAC obligations. The Treasury's PSP licensing reforms remain at the stage of publication of the complete Tranche 1 draft; the proposed major SVF authorisation should not be presented as a current licence that can already be applied for.RBA PPF Exemptions Treasury reforms

Ordinary consumer loans, home mortgages, consumer leases and related credit services are principally assessed under ASIC’s ACL, not under a general money lender licence available in every state that can replace ACL. Specific pawnshops, second-hand dealers and businesses regulated by state law still require separate verification; for example, NSW pawnshops must hold a Fair Trading licence and report their business and goods storage locations. Statutory CTP insurance and similar requirements may also require a state scheme licence; APRA general insurance authorisation does not automatically confer eligibility to participate in that scheme.

• If only raising funds and not taking deposits, first assess ACL, the financing product AFSL and RFC data enrolment.
• Assess each payment business individually for stored value, redemption, payment obligations, system access, AFSL and AUSTRAC.
• CTP, workers’ compensation or self-insurance should each be checked against the relevant state’s scheme and laws; do not state that they apply uniformly nationwide.
• For an unverified future payment licence, provide reform monitoring only; do not claim that approval has already been granted.

Drew Tang (Mr Tang / Drew) | business manager; Rengangyongsheng (Hong Kong) Limited; English company name: Rengangyongsheng (Hong Kong) Limited. This guide is intended to help afsl8.com clients understand Australian financial authorisations, document preparation, project coordination and key points for acquisition due diligence. The official links in the text are provided to verify the regulatory basis.

This guide is not a document issued by APRA, ASIC, AUSTRAC or RBA, and does not indicate that the named individuals or company hold any authorisation, regulatory accreditation or approval described in it. The content does not replace Australian legal, tax, audit or actuarial advice; before applying, check the latest legislation, licence conditions, fees and regulatory guidance for the particular business. Commercial timelines are not a guarantee of approval, and the purchase, sale or transfer of authorisations or changes of control are not automatically completed by entering into a consultancy services contract.

• All capital amounts are in Australian dollars and, unless expressly stated otherwise, exclude consultancy fees and operating expenses.
• The published evidence date is 2026-11-05; future commencement dates and consultation proposals are separately marked.
• Retain official links and correction records; do not use outdated figures, search snippets or market rumours as promises of approval.

Complete guides to each subtype

The following are branches covering business activities, products or corporate structures; not every item corresponds to a separate statutory licence.

Frequently Asked Questions