The Australian Prudential Regulation Authority (‘APRA’) has recently released for comment a draft Prudential Standard CPS 231 outlining changes to the existing Prudential Standard APS 231 on Outsourcing.

CPS 231 is part of a package of changes being considered by APRA in order to develop a new framework — called the Level 3 framework — to provide for the supervision of conglomerate groups (‘Level 3 groups’). Conglomerate groups are groups that perform material activities across a number of APRA-regulated industries and/or access one or more non-APRA-regulated industries. The new framework will seek to address the risks faced by these Level 3 groups which are not currently met by the existing Level 1 or Level 2 Prudential Standards.

Key changes

The key changes proposed by APRA to the Prudential Standard impose additional requirements on the head of a Level 3 group (‘Head’). They are as follows:

  • the Head must develop and maintain an outsourcing policy for the group; and
  • where a non APRA-regulated institute is engaged in outsourcing arrangements that are material to the group, the Head must ensure that that the outsourcing of those business activities is undertaken in a way that complies with the requirements of the Prudential Standard.

The initial proposal in APRA’s March 2010 discussion paper on the supervision of conglomerate groups (‘Discussion Paper’) only intended the outsourcing prudential standards to apply to the Head, to APRA-regulated institutions within the Level 3 group already governed by the existing APS 231 standards, and to unregulated entities material to the Level 3 group. However, CPS 231 now indicates that the threshold as to whether or not the requirements in CPS 231 will apply, will depend on the materiality of the business activity which is being outsourced, not on the identity of the institution within the Level 3 group that is outsourcing it. Nonetheless, it is worthwhile noting that CPS 231 contemplates that not all entities within a conglomerate corporate group would form part of the Level 3 group, and that the composition of a Level 3 group would be determined by APRA on a case-by-case basis.

In addition, the following ancillary changes have been proposed to the standard:

  • a distinction is drawn between APRA regulated institutions and non-APRA-regulated institutions;
  • the standard is no longer limited to members of a Level 2 group but has been extended to apply to Level 3 groups. A Level 3 group comprises all institutions that are part of a consolidated entity of which an APRA-regulated institution is either the ultimate holding company, the ultimate Australian parent or a reporting entity as defined in Statement of Accounting Concepts SAC1 Definition of the Reporting Entity;
  • with regard to outsourcing agreements, the agreement must address the form in which the data is to be kept as and clear provisions identifying ownership and control of the data as well as reporting requirements (including content and frequency of reporting);

These amendments will commence on 1 January 2014.

What this means for you

Any Conglomerate which contains APRA-regulated institutions should note that CPS 231 will apply to the Head of the conglomerates, requiring it to develop an outsourcing policy which contains a strategy for outsourcing material business activities that will apply across the group. It will also need to review outsourcing activities undertaken by non-APRA regulated members of its group to determine if the outsourcing activities are material to the group, and if so, to ensure that they comply with CPS 231 (unless they are excluded from the group by APRA).

This means that conglomerates should consider whether there are members of that conglomerate (eg special purpose vehicles or related parties) that should not form part of the Level 3 group as the activities of those entities do not expose the group to risks that may affect its capital adequacy requirements under the proposed Level 3 framework. APRA will be the ultimate determinant of the constitution of any Level 3 group and the identity of the Head. It is worth nothing that in its Discussion Paper, APRA suggested that it had identified only 10–15 potential Level 3 groups involving approximately 65 APRA-regulated institutions.

Any conglomerate which is currently classified as a Level 2 group and supervised accordingly may need to review their policies to be in line with CPS 231 if they are considered by APRA to be a Level 3 group.

Further information

The Standard is available on the APRA website here.

Written submissions on the proposed changes should be sent to by 1 March 2013 and addressed to:

Neil Grummitt

General Manager, Policy Development

Policy, Research and Statistics

Australian Prudential Regulation Authority

GPO Box 9836