Regulated entities must minimise the risk and impact of failure 12 min read
APRA has released Prudential Standard CPS 190: Recovery and exit planning (CPS 190), which aims to ensure that all APRA-regulated entities are prepared for scenarios that may impact the financial viability of their business.
The new regime focuses on the 'financial resilience' of regulated entities, which is about seeking to reduce the likelihood that they will fail, by ensuring they have plans in place and resources to manage periods of stress. The goal is to minimise the impact of failure on consumers and the stability of our financial system in the event that a regulated entity experiences distress or failure. CPS 190 is the first new Prudential Standard forming part of APRA's 'strengthening crisis preparedness' package, which was released for discussion in December 2021.
In this Insight, we provide an overview of the new requirements in CPS 190, and the key implications for banks, insurers and superannuation trustees.
Key takeaways
- CPS 190 will seek to minimise the risk of entity failure by requiring all APRA-regulated entities to develop credible plans for managing stress that may threaten the entity's viability, rebuilding financial resilience and effecting an orderly exit from the regulated activity.
- A proposed new CPS 900 Resolution Planning (CPS 900) will seek to minimise the impact of entity failure by requiring large or 'complex' APRA-regulated entities to be pre-positioned to minimise the risk to beneficiaries and to financial system stability in the event of their failure.
- The new requirements in CPS 190 will apply to all APRA-regulated entities (other than registrable superannuation entities (RSE) licensees) from 1 January 2024, and to RSE licensees from 1 January 2025. It is currently proposed that CPS 900 will commence on 1 January 2024 for all APRA-regulated entities, including RSE licensees.
Key aspects of recovery and exit planning
CPS 190 will impose a new obligation on regulated entities to prepare a 'recovery and exit plan', which sets out how they would respond to stress that threatens their viability. The 'plan' has two separate and distinct aspects: recovery planning and exit planning.
Recovery actions refer to the regulated entity's capability (in a stressed environment) to execute actions like raising funds or reducing expenses in order to navigate stress and return to business as usual. On the other hand, exit actions refer to a regulated entity's plan to exit the regulated business, whether that be by way of acquisition, merger, transfer or winding down.
Additional aspects of CPS 190 are below:
- Principles-based requirements – entities will have flexibility to meet the CPS 190 requirements in a way that is appropriate having regard to their size, business mix and complexity.
- Integration with existing frameworks – the recovery and exit plan should be integrated with the entity's 'risk management framework', the 'capital management and liquidity management frameworks' or the 'business plan and business performance review' (as relevant for APRA-regulated entities).
- Additional requirements for 'significant financial institutions' (SFIs) – 'Significant Financial Institutions' are entities with total assets in excess of $30 billion in the case of an RSE licensee, $20 billion in the case of an authorised deposit-taking institution (ADI), $10 billion in the case of a general insurer or life company, and $3 billion for private health insurers. These requirements includes scenario analysis and quantitative assessments that address the entity's ability to rebuild capital and liquidity during or following periods of stress.
- Board oversight and responsibility for the plan – the board will need to approve the plan, oversee reviews and ensure findings are addressed by management, and oversee the execution of any recovery or exit actions. The board of an SFI will also need to ensure the entity has sufficient capacity to restore financial resilience in periods of stress.
- Group requirements – where an APRA-regulated entity is the head of a group, it must ensure that the requirements of CPS 190 are applied appropriately throughout the group, including to non-APRA regulated entities.
- Ability for APRA to give directions – entities will need to provide APRA with a copy of the recovery and exit plan within three months of review and approval by the board. APRA has powers to require amendments to the plan: eg to require entities include or exclude a particular recovery action. For entities other than RSE licensees, APRA may adjust prudential requirements for capital and liquidity where it assesses there to be material weaknesses.
- Capabilities, monitoring and execution – entities must maintain the capability required to execute the plan; this includes having access to the financial resources necessary to support implementation of the recovery and exit actions set out in it. Regulator monitoring of triggers that would require activation of the plan must also be undertaken.
- Periodic testing and review of the recovery and exit plan – entities must review and update the plan at least every three years, and SFIs must do this at least annually. Entities are also required to update their plans to reflect any significant changes in legal or organisational structure, business mix, strategy or risk profile. SFIs must undertake an independent comprehensive review of the effectiveness of the plan, and their readiness to execute it, at least every three years.
- Notify APRA if the recovery and exit plan has been activated – based on the draft CPG 190, it is anticipated that when the plan is 'activated' will ultimately be a matter of judgment and activation could result from activating any part of the plan.
Further details on the recovery and exit plan
An APRA-regulated entity’s recovery and exit plan must include:
- a concise summary that provides a guide on how to use the plan;
- a trigger framework for the early identification and monitoring of stress (ie warning indicators relevant to the entity's operating environment that indicate when the plan needs to be activated);
- governance arrangements for the monitoring of triggers and timely activation of the plan, which must include clear roles and responsibilities at a senior executive level;
- credible recovery actions that could be taken to stabilise and restore financial resilience;
- credible exit actions that could be taken to effect an orderly and solvent exit from regulated activity; and
- a communication strategy to support the execution of recovery and exit actions.
Consistent with APRA's approach in other new prudential standards, there are additional requirements for SFIs.
The recovery and exit plan for an SFI must also include:
- scenario analysis that assesses the effectiveness of the trigger framework, demonstrates how recovery and exit actions could be implemented, and measures the impact and effectiveness of those actions. The scenario analysis must address at least two scenarios that are severe enough to threaten the entity's viability;
- an assessment of recovery capacity, which is the aggregate impact of plausible recovery actions under each scenario. This must be measured in quantitative terms by calculating the amount of capital and liquidity that can be rebuilt during or following stress; and
- other measures including a timeline for the implementation of each recovery and exit action in the plan, analysis of any barriers to implementation, execution risks and key dependencies, a summary of the preparatory measures needed to support the timely and effective execution of the action and, where relevant, an estimate of the impact of the action on the capital and liquidity position of the APRA-regulated entity, based on credible assumptions.
While these requirements are specifically included for SFIs, APRA has said that CPS 190 sets out the minimum legally enforceable requirements that entities must adhere to. Non-SFIs that meet better practices (ie those above minimum requirements) may have this reflected in a lower risk rating under APRA's Supervision Risk and Intensity model.
Industry-specific guidance
While the reforms apply to all APRA-regulated entities, the new obligations will interact with APRA's existing industry-specific guidance in different ways.
Superannuation trustees, particularly funds with a 'profit-to-member' model, have been keenly waiting for APRA's crisis preparedness guidance following amendments to sections 56 and 57 of the Superannuation Industry (Supervision) Act 1993 that took effect on 1 January 2022, and significantly narrowed the circumstances in which the trustee and directors are able to be indemnified out of superannuation fund assets. CPS 190 imposes prudential obligations on RSE licensees to protect the financial viability of the trustee (as opposed to the financial viability of the fund). The objective here is to ensure that the trustee can continue to act in the best financial interests of beneficiaries in circumstances where they are under financial distress.
In our view, CPS 190 will complement (and not detract) from the significant work trustees undertook in response to the ss 56 and 57 amendments. However, in light of the CPS 190 requirements, we expect they will need to revisit any policies or frameworks established to manage their financial resilience, and potentially incorporate existing requirements into the recovery and exit plan.
Superannuation trustees should also note that there are important links between CPS 190 and existing requirements in SPS 515: Strategic planning and member outcomes, which is currently undergoing review by APRA. While CPS 190 is focused on managing risks to the trustee's viability (ie insolvency and personal financial distress) and is intended to supplement existing obligations on RSE licensees in relation to member outcomes, there is potential for tension between the two requirements – eg as APRA highlighted in its discussion paper, where an RSE licensee relies on fee revenue to capitalise the RSE licensee company, significant outflows or downward pressure on fees could place pressure on the RSE licensee’s financial position. In this scenario, APRA expects RSE licensees will consider the interdependencies between their business plan and their recovery and exit plan.
Finally, while RSE licensees may breathe a sigh of relief at the delayed commencement date for superannuation, there is no shortage of regulatory reforms for the superannuation industry. APRA has delayed the commencement date for RSE licensees to allow time for superannuation trustees to grapple with related forms, including the recently released discussion papers for superannuation transfer planning and financial resources for risk events in superannuation, which reinforce CPS 190's objectives by supporting transfers of members to another superannuation fund – see our Insight for further details.
CPS 190 will apply to all general insurers, life companies and private health insurers (or their Australian branch operations, in the case of foreign insurers).
Parts of the existing prudential framework (eg the Internal Capital Adequacy Assessment Process (ICAAP)1) require general insurers and life companies to set a strategy for ensuring adequate capital is maintained over time, and to undertake stress testing and scenario analysis relating to potential risk exposures and available capital resources. In its letter to regulated entities2, APRA has stressed the importance of strong linkages between the ICAAP, stress tests, and the recovery and exit plans required under CPS 190.
In particular, APRA's view is that prudent entities would use their assessment of recovery capacity to inform the setting of capital targets. Where recovery capacity is insufficient for restoring financial resilience following stress, a prudent entity should reflect this in higher capital targets. APRA has also said that prudent entities should leverage existing stress tests required under the capital adequacy frameworks as part of the 'scenario analysis' requirements for SFIs under CPS 190. APRA's view is that the CPS 190 recovery and exit plan should be continually tested under a range of different scenarios, in order to demonstrate credibility.
For private health insurers (who will be required to develop an ICAAP for the first time by 1 July 20233 under APRA's new capital framework for private health insurance providers)4 the need to integrate the requirements of CPS 190 into new capital arrangements from 1 January 2024 presents an additional challenge in what will already be a busy year.
CPS 190 will apply to all ADIs (including banks), non-operating holding companies and certain foreign ADIs (see below) but will not apply to purchased payment facility providers.
While most foreign ADIs will be excused from CPS 190 regulation, foreign ADIs with an Australian branch or locally-incorporated operations will be caught by the prudential rules where APRA determines that all or some of CPS 190 applies to that particular foreign ADI. For these regulated foreign ADIs, APRA expects that their recovery and exit plans would cover the relevant arrangements (instead of any plans established by the foreign head office or group), and that the foreign ADI's local recovery and exit plan is appropriate for the local risks, scenarios and triggers relevant to stresses experienced in Australia, while also integrating any material dependencies it may have on the foreign head office or group.
Across the broader spectrum of ADIs, the recovery and exit plan should be regarded as an integral part of the ADI's risk management framework, which includes important linkages to its ICAAP requirements, contingency funding plans and risk appetite (this also applies to insurers). More specifically, the triggers used in financial contingency planning under an ADI's recovery and exit plan would support the ADI transitioning capital planning under its ICAAP to a contingency response and also meeting its overall risk appetite.
In recent years, most banking entities have put together recovery and exit options in line with supervisory guidance, so the introduction of CPS 190 will formalise supervisory expectations by addressing gaps and inconsistencies in existing approaches, and improve the credibility of entity plans.
Like insurers, ADIs should be thinking about what adjustments they need to make in order to comply with the requirements set out in CPS 190 from 1 January 2024, and be mindful of how these adjustments will fit within their existing financial viability and resilience frameworks.
There's more to come...
APRA is planning to finalise the following related prudential requirements and standards in the first half of 2023:
- Prudential Standard CPS 900 Resolution Planning, which will require large or complex entities to take pre-emptive actions so that, in the event of their failure, APRA can work with them to ensure there is limited adverse impact on the community and the financial system.
- Prudential Practice Guide CPG 190 Recovery and exit planning, which aims to assist APRA-regulated entities in the implementation of CPS 190.
- Prudential Practice Guide CPG 900 Resolution Planning, which aims to assist SFIs and entities that provide critical functions in the implementation of CPS 900.
Consultation on draft CPG 190, CPS 900 and CPG 900 closed on 6 December 2022.
Next steps
APRA-regulated entities should start taking steps to develop a recovery and exit plan in early 2023, given the new governance arrangements that must be implemented and the need to ensure the plan is integrated with existing risk management frameworks.
If you would like to discuss this, or require assistance drafting a recovery and exit plan, please get in touch with any of the people below.
Footnotes
-
See Prudential Standard GPS 110 Capital Adequacy (for general insurers) and Prudential Standard LPS 110 Capital Adequacy (for life companies).
-
Letter to all APRA-regulated entities: Recovery and exit planning, dated 1 December 2022.
-
Noting that smaller private health insurers are subject to a two-year transition period to meet the new ICAAP requirements.
-
See APRA's media release: APRA finalises new capital framework for private health insurers.