Don’t let a breach get out of reach

The Australian Prudential Regulation Authority (APRA) will limit high debt-to-income (DTI) home lending to pre-emptively contain a build-up of housing-related vulnerabilities in the financial system.

While overall bank lending standards remain sound, APRA has observed a pick-up in some riskier forms of lending over recent months as interest rates have fallen, housing credit growth has picked up to above its longer-term average and housing prices have risen further.

Combined with a resilient labour market, these trends suggest a shift in the financial risk cycle and a potential build-up of vulnerabilities that could undermine banking sector and household financial resilience if left unchecked. In particular, high DTI lending has started to pick up, albeit from a low base, driven by high DTI loans to investors. This is expected to increase further in this part of the cycle, and already high household indebtedness could increase further.

Given these dynamics, APRA is acting now to contain the potential build-up of housing-related risks from high DTI lending by activating a DTI lending limit, with support from the Council of Financial Regulators.

From 1 February next year, the limit on home loans will allow authorised deposit-taking institutions (ADIs) to lend up to 20 per cent of their new mortgage lending at debt of six times income or more. The limit will apply separately to ADIs’ owner-occupier and investor lending.

The Australian Prudential Regulation Authority (APRA) has imposed additional licence conditions on Australian Ethical Superannuation Pty Ltd (AES), the trustee for the Australian Ethical Retail Superannuation Fund, to address concerns regarding its expenditure management.

The conditions follow APRA’s intensified scrutiny of fund expenditure¹ which has included an APRA review of AES’s related-party expenditure practices.

APRA’s review identified deficiencies regarding the robustness of AES’s approach to related-party expenditure, particularly in relation to investment management agreements with its parent company, Australian Ethical Investments. AES has not demonstrated that it has adequate processes to scrutinise and justify how the fees it pays to its parent company are consistent with the best financial interests of members.

Under the additional licence conditions, AES will be required to appoint an independent third party to review and recommend improvements to these outsourcing decisions and enhance compliance with key regulatory duties, and to implement any recommendations made.

Space, communications and defence systems manufacturer Electro Optic Systems Holdings Limited (EOS) has admitted breaching its continuous disclosure obligations by failing to disclose to the ASX a materially significant decline worth tens of millions of dollars in its 2022 annual revenue forecasts.

Between May and June 2022, EOS issued earnings guidance to the ASX that it expected its 2022 revenue to equal or exceed $212.3 million.

By 25 July 2022, EOS became aware that its 2022 revenue was likely to be $164 million with a possibility of an additional $27 million.

However, EOS did not disclose that information for 14 weeks, until 31 October 2022.

ASIC Chair Joe Longo said, ‘Providing accurate and timely earnings guidance to investors is a core obligation of listed entities and vital to properly informed decision-making in our public markets.

‘EOS has accepted that it failed to correct its guidance when it became aware that its annual revenue forecast was overstated by tens of millions of dollars.

‘Continuous disclosure of market-sensitive information is fundamental to upholding market integrity and supporting a fair and efficient financial system,’ the Chair said.

ASIC and EOS will ask the Federal Court to impose a $4 million penalty, which reflects the seriousness of the contravention while considering EOS’s ongoing cooperation with ASIC’s investigation and its early admission of liability. The penalty is subject to consideration and approval by the Federal Court.

APRA and ASIC have today jointly released the 2025 Retirement Income Covenant (RIC) Pulse Check report, which assesses the progress trustees have made in developing retirement income strategies for Australians approaching or in retirement.

The report highlights that despite RIC obligations being introduced over three years ago on 1 July 2022, the gap is widening between trustees actively promoting better retirement outcomes for their members and those that are not.

While some trustees have shown leadership by investing significant effort to meet the needs of their members transitioning to and in retirement, with some innovating and driving best practice, far too many have been content with making only incremental improvements.

APRA and ASIC again call on industry to lift its focus on improving retirement outcomes for their members. All trustees should take steps to meet better practices as outlined in the report.

ASIC Commissioner Simone Constant said the over 1.5 million Australians already in retirement and the wave of 2.5 million entering retirement over the next decade, deserve better from their superannuation trustees.

The Australian Prudential Regulation Authority (APRA) has released its quarterly superannuation performance publication for the September 2025 quarter.

Key statistics for the superannuation industry as at 30 September 2025:

Total superannuation assets increased by 3.0 per cent over the quarter to $4.5 trillion as at September 2025, of which $3.2 trillion was in APRA-regulated funds.

Total contributions increased by 12.7 per cent to $215.6 billion in the year ending in September 2025. Employer contributions increased by 8.8 per cent over the year to $153.2 billion. Member contributions increased by 23.6 per cent over the year to $62.4 billion.

Benefit payments increased by 12.7 per cent to $136.2 billion in the year ending in September 2025. This increase was the result of lump sum payments rising by 13.8 per cent to $75.3 billion and pension payments increasing by 11.3 per cent to $60.9 billion.

Key statistics for entities with more than six members for the year to September 2025:

*Net contribution flows comprise of contributions plus net benefit transfers, less benefit payments

Copies of the publication are available on APRA’s website

Andrew John Spira, a former director of private credit lenders Skyecap Pty Ltd and Pineapple Funding Pty Ltd, has been permanently banned by ASIC from the financial services and credit industries after he was convicted of fraud by a Darwin court.

Mr Spira was arrested in May 2023 after attempting to leave Australia on a false UK passport, attempting to pay for chartered flights using stolen credit card details, and making false declarations in an Australian passport application.

On 17 November 2023, Mr Spira was convicted in the Northern Territory Local Court of numerous offences, including dishonestly obtaining a financial advantage by deception. He was sentenced to an 18-month good behaviour order and ordered to pay restitution.

As a result of his fraud conviction, ASIC has permanently banned Mr Spira from:

• providing any financial services or engaging in any credit activities
• controlling, whether alone or in concert with one or more other entities, an entity that carries on a financial services business or another person who engages in credit activities, and
• performing any function involved in the carrying on of a financial services or engaging in credit activities.

Under the Corporations Act and the National Consumer Credit Protection Act, ASIC may permanently ban a person from the financial services and credit industries if they are convicted of fraud.

ASIC has made an interim stop order preventing City Finance Lending Pty Ltd (City Finance Lending) from issuing its small amount credit contract (SACC) product to retail clients because of deficiencies in its target market determination (TMD).

City Finance Lending’s SACC product allows consumers to borrow up to $2,000 for personal purposes ‘to meet an unexpected expense or to make a discretionary expense and who meets [City Finance’s] eligibility criteria.’

ASIC is concerned that the TMD for City Finance Lending’s SACC may be deficient in several key areas.

One of Australia’s largest superannuation fund trustees has been ordered by the Federal Court to pay a penalty of $23.5 million for unreasonable delays experienced by thousands of members and claimants arising from serious failures to handle insurance claims in a timely manner.

The penalty has been imposed against United Super Pty Ltd, the trustee of the Construction and Building Unions Superannuation Fund (Cbus), following admissions by Cbus that serious failures caused delays in processing death benefits and total and permanent disability (TPD) insurance claims and impacted more than 7,000 Australians in distressing situations.

The penalty exceeds the $18.5m in revenue United Super declared in the 2024 financial year.

The penalties come on top of Cbus’s own remediation program to pay approximately $32 million in compensation to the estimated 7,402 affected claimants and members for lost earnings and wrongfully charged fees.

ASIC Deputy Chair Sarah Court said Cbus’s failures needlessly exacerbated the distress of people who were already in upsetting situations.

In August 2025, Bendigo and Adelaide Bank Limited (ASX: BEN) (the Bank) engaged Deloitte to conduct an
independent investigation of suspicious activity indicative of money laundering at one of its branches (the Branch)
after the Bank identified and reported the matter to AUSTRAC and law enforcement.

The Deloitte review focused on activity at the Branch, in the period between 1 August 2019 and 1 August 2025.
The Bank ensured the Deloitte review was sufficiently broad to identify both the nature and scope of the issues at
the Branch, and any related systemic Anti-Money Laundering and Counter-Terrorism Financing issues.
In its review, Deloitte concluded that deficiencies existed throughout the relevant period regarding the Bank’s
approach to the identification, mitigation and management of money laundering (ML) and terrorism financing (TF)
risk.

Deloitte observed that these deficiencies extend beyond just the Branch and identified weaknesses and
deficiencies across many key aspects of ML/TF risk management, including in relation to the Bank’s approach to
ML/TF risk assessment and enhanced customer due diligence; oversight of ML/TF risks; its transaction monitoring
program and its approach to customer risk rating.
In relation to transaction monitoring, Deloitte’s findings confirmed that there was deficient coverage of many ML/TF
risk indicators.

The Board is very disappointed with the findings and is fully committed to ensuring that the Bank undertakes the
necessary enhancements to its systems, processes and frameworks to ensure it is fully compliant with its
obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth).
The Board has committed to fully funding the uplift program to address all deficiencies identified in the Deloitte
review.

While the final outcomes (including costs) are unknown at this stage, the Bank will keep the market informed in line
with its continuous disclosure obligations. The Bank will continue to engage constructively with AUSTRAC, APRA
and ASIC in relation to this matter.

ASIC has cancelled the Australian financial services (AFS) licence of Ivy League Capital Pty Ltd (Ivy League Capital).

This follows Ivy League Capital’s failure to lodge audited financial reports for the year ended 30 June 2022 and all subsequent years for which it was required to lodge audited financial reports.

Ivy League also failed to maintain membership of the Australian Financial Complaints Authority (AFCA) scheme.

The cancellation takes effect from 17 November 2025.

Two directors of Sheffield Insurance Pty Ltd (Sheffield) have been convicted of two offences and fined $15,000 over their role in Sheffield failing to lodge financial statements and auditor’s reports with ASIC for five years.

Phillip Bird of Alexander Heights, WA and Daniel Holmes of Beechboro, WA, were convicted and fined after each pleaded guilty to two charges of aiding, abetting, counselling or procuring Sheffield to commit an offence, one offence being the failure to lodge profit and loss statements and balance sheets (together, financial statements) and the second offence being the failure to lodge auditors’ reports.

ASIC had alleged that, as Sheffield’s directors, Mr Bird and Mr Holmes failed to take steps to ensure that Sheffield lodged financial statements and auditors’ reports with ASIC for each financial year between 2019 and 2023 inclusive and were aware of the obligation to do so.

As the holder of an Australian financial services (AFS) licence, Sheffield is required to lodge financial statements with ASIC within 3 months of the end of each financial year.

The Australian Prudential Regulation Authority (APRA) has released a response to consultation on proposed minor amendments to the prudential and reporting framework for authorised deposit-taking institutions (ADIs), insurers and registrable superannuation entity (RSE) licensees.

The response letter issued today follows the release of the proposed update for consultation in September 2025. These minor updates help APRA keep the prudential framework up-to-date between comprehensive reviews.

The letter to industry, finalised prudential and reporting standards and non-confidential submissions are available on the APRA website at: Minor updates to the prudential framework.

The Australian Prudential Regulation Authority (APRA) has launched a new report on APRA’s assessment of risks and vulnerabilities facing the Australian financial system.

The new System Risk Outlook report, which will be published twice a year, increases transparency around what APRA is seeing in the domestic and international risk environments to inform its regulatory priorities.

Key insights from this first publication include:

• Risks to the Australian financial system from overseas are heightened, and the geopolitical environment is expected to remain volatile for some time. While the system is well-placed to absorb potential shocks from overseas, this resilience could be eroded if institutions are not prepared for a wide range of scenarios. APRA and the other agencies on the Council of Financial Regulators are strengthening the system’s resilience through a dedicated geopolitical risk work program.
• APRA is closely monitoring any build-up of domestic vulnerabilities, particularly in the housing market, including high household debt. While overall housing lending standards remain sound, APRA is seeing some signs of a pick-up in higher risk lending, particularly high debt-to-income borrowing by investors.
• The increasing interconnectedness of the financial system has elevated the potential for shocks in one sector to have a system-wide impact.

Today’s report also includes a summary of the findings from Phase 1 of APRA’s inaugural system risk stress test, which was undertaken this year with the four major banks and six large superannuation funds. The key findings from Phase 1 suggest that the structural features of super funds mean that the industry acts as an important stabiliser for the system during stress but, in some cases, their actions can also amplify the negative effect of the shock on members and the system.

The full System Risk Outlook report is available at: System Risk Outlook – November 2025.

In her address at the Women in Payments Gala Evening in Sydney, ASIC Commissioner Kate O’Rourke said significant structural changes taking place in payments were being supercharged by both technology and consumer demand, and that payments licensing reforms designed to bring different participants in the value chain under appropriate degrees of regulation were important for ensuring customer trust.

Key points

• The significant structural changes taking place across the payments landscape are being supercharged by technology – while also responding to consumer demand.
• The level of trust consumers place in payment products and providers makes it all the more important that the regulatory settings are up to the task – and that they’re able to evolve as the sector evolves.
• The payments licencing reforms are designed to bring different participants in the value chain under appropriate degrees of regulation – according to how much risk their activities present to consumers and the payments system more generally.

The Office of the Australian Information Commissioner (OAIC) has run an initial consultation with children, young people and parents and carers, to learn their views about online privacy.

Last year, the Privacy and Other Legislation Amendment Act (2024) introduced a mandate for the OAIC to develop a Children’s Online Privacy Code (the Code). This new Code, due to come into effect at the end of next year and will specify how online services that are likely to be accessed by children must comply with the Australian Privacy Principles.

We want to ensure that the Code reflects the real experiences and needs of children and their families. To this end, back in May and June 2025, the OAIC invited children, young people and parents and carers to share their views about children’s online privacy to ensure that the Code reflects their voices and experiences.

We asked children in Years 3 to 6, teens in Years 7–12 and parents and carers to tell us how they feel about children’s online privacy. Over 337 participants completed worksheets that asked questions about online privacy. Participants were presented with several scenario-based exercises and then asked a series of open-ended questions. The children expressed, in their own words, their perspectives in response to the open-ended questions.

You can access the full summary of children, young people and parents and carers responses to our questions, including quotes in their words.

AUSTRAC has issued a letter to the online payment platforms sector, warning businesses to tighten their controls to prevent payments for child sexual exploitation.

The warning comes after a supervisory campaign easily identified a number of customers suspected to be making payments for child sexual exploitation.

AUSTRAC’s regulatory operations team found issues across the sector, with low suspicious matter reporting, poor transaction monitoring and clear failures to identify and manage high-risk customers.

AUSTRAC has directed WorldRemit to appoint an external auditor, sent letters of concern to five businesses, and is currently investigating several others.

AUSTRAC CEO Brendan Thomas said the campaign focussed on detecting child sexual exploitation activities within the customer base of several online payment platform businesses.

“The team conducted their own transaction monitoring simulation, identifying suspicious customer behaviour and transfers that were very likely payments for child sexual exploitation,” Mr Thomas said.

“They applied the same typologies that AUSTRAC expects the businesses to be applying themselves, exposing a number of customers who should have been flagged for investigation and subject to suspicious matter reports.

“In fact, some of these customers should have had their accounts closed immediately given the severity of the risks they posed. These customers were referred to the Australian Border Force and law enforcement.

ASIC has suspended the Australian financial services (AFS) licence of Surety Compliance Limited (Surety) until 27 October 2026.

Surety is the responsible entity of the Private Investment Fund (Scheme).

This follows Surety’s failure to meet minimum financial requirements and hold professional indemnity insurance.

The terms of the suspension mean Surety may continue to provide financial services that are necessary for, or incidental to, the payment of redemptions from and winding up of the Scheme.

During the suspension Surety is required to meet obligations, if applicable, to have a dispute resolution system and be a member of the Australian Financial Complaints Authority scheme and hold professional indemnity insurance cover.

Surety may apply to the Administrative Review Tribunal for a review of ASIC’s decision.

The Australian Prudential Regulation Authority (APRA) has released for consultation a draft instrument to exempt a specified class of persons from the change of ownership and control provisions of the Superannuation Industry (Supervision) Act 1993.

The proposed exemption would remove the requirement for management employees and company secretaries with a direct controlling interest in an RSE licensee of less than 2% to apply to APRA before acquiring a controlling stake.

APRA welcomes feedback on the proposed class exemption, including any risks associated with the proposal and other circumstances APRA should consider when finalising the exemption.

Submissions should be sent to superannuation.policy@apra.gov.au by 16 December 2025.

The letter to industry and the draft instrument are available on the APRA website at: Proposed class exemption: Approval to own or control an RSE licensee

Australians reported nearly $260 million in losses to scams in the first nine months of 2025, with the National Anti-Scam Centre warning that online shopping scams are on the rise.

Between January and September 2025, the National Anti-Scam Centre’s Scamwatch service received 159,319 scam reports with financial losses of $259.5 million. This represents a 16 per cent increase in losses and a 20 per cent decrease in reports compared to the same period last year.

As Australians engage with Black Friday sales, shoppers are urged to stay alert for scams disguised as genuine deals. Shopping scams were the most reported scam type involving financial loss so far this year, with 9,628 of the total 19,662 reports received resulting in $8.6 million in losses. This was an increase of 19 per cent in reported losses from the same period in 2024.

“Scammers love Black Friday sales too because they know shoppers are looking for bargains and they rely on creating urgency and pressure that can come with a busy shopping period,” ACCC Deputy Chair Catriona Lowe said.

“We remind consumers to take their time, check the legitimacy of websites and its offers, and be cautious about sharing personal or financial information online. A few simple checks before making a purchase can make all the difference in avoiding a scam and keeping your money safe.”

Online content, such as fake websites, advertisements, social media, and mobile apps, were the most common method used by scammers for initial contact, resulting in $122 million in losses, or 47 per cent of overall scam losses.

Some shopping scams involve the compromise of social media accounts to reach unsuspecting victims. Compromised social media accounts are increasingly used by scammers to target victims’ personal networks, particularly on Facebook and Instagram.

After gaining access, scammers impersonate the account holder to promote scams such as fake ticket sales, ‘fire sales’, grant offers, and investment schemes.

The future of capital markets plenary session at the ASIC Annual Forum garnered plenty of interest last week, with industry largely satisfied at the transparent and consistent approach the corporate regulator has taken to consultation on the current state of private markets, and the principles-based nature of its response.