APRA's Fit and Proper Standard: Competence, Assessment and Notification

Australia’s prudential fitness regime puts an obligation on institutions that most competence frameworks leave implicit: before assessing whether someone is fit for a role, the institution must have written down what the role actually requires. Prudential Standard CPS 520 Fit and Proper, which commenced on 1 July 2019, requires the competencies for each responsible person position to be clearly defined and documented.

It is made under section 11AF of the Banking Act 1959, section 32 of the Insurance Act 1973, section 230A of the Life Insurance Act 1995 and section 92 of the Private Health Insurance (Prudential Supervision) Act 2015 — so it reaches banks, general insurers, life companies and private health insurers alike.

Who is a responsible person

The standard defines responsible persons by institution type, with a separate attachment for each. Across them the population typically includes directors, senior managers, the appointed auditor, and — for insurers and life companies — the Appointed Actuary and Reviewing Actuary. Private health insurers cover directors and officers; foreign authorised deposit-taking institutions cover senior managers of the Australian operations.

Two features widen the net. The standard catches persons performing activities for a subsidiary where those activities could materially affect the institution. And it states plainly that a person need not be an employee of the institution to be a responsible person — so contractors and secondees can fall inside it. APRA can also determine in writing that a particular person is, or is not, a responsible person.

The competence obligation

The standard’s stated objective is that people in positions of responsibility have appropriate skills, experience and knowledge, and act with honesty and integrity. The operative requirement is twofold.

First, the institution must clearly define and document the competencies required for each responsible person position. This is a drafting obligation that precedes any assessment, and it is where most implementations are thinnest — assessing a person against an undocumented standard is not assessment.

Second, the test is framed around prudence: whether it would be prudent for the institution to conclude that the person possesses the competence, character, diligence, honesty, integrity and judgement to perform the duties properly. Alongside that sit requirements that the person is not disqualified under the relevant Act, and that there is either no conflict of interest or none creating a material risk.

Notably, the standard sets no minimum qualification or years of experience for responsible persons generally. The only specific criteria attach to two roles.

Auditors and actuaries: the only prescribed thresholds

For appointed auditors, the standard requires registration as a company auditor under the Corporations Act, a minimum of five years’ relevant experience in auditing APRA-regulated institutions, relevant and recent experience, membership of a recognised professional body, independence from the Appointed Actuary where applicable, no concurrent role as chief executive or director of the institution or a related body corporate, and ordinary residence in Australia.

For Appointed Actuaries: appropriate formal qualifications, a minimum of five years’ relevant experience providing actuarial services to such entities, Fellowship or Accredited Membership of the Institute of Actuaries of Australia, independence from the auditor, no chief executive or director role, and ordinary residence in Australia.

Both sets of criteria can be disapplied in exceptional circumstances, provided the institution notifies APRA promptly and APRA raises no objection.

Timing: the three clocks

Assessment must be completed before a person takes up a responsible person position. Two exceptions carry deadlines:

• Where the position is filled by members’ resolution, or by an APRA determination, the assessment must be completed within 28 days of appointment or determination.
• An interim appointment without a full assessment is permitted for up to 90 days, or longer with APRA’s written agreement, counting any prior interim periods — and reasonable steps must still be taken first, with a full assessment before any permanent appointment.

Thereafter the policy must require annual assessments, or as close to annual as is practicable, for each responsible person position.

There is also a trigger-based obligation. Where information arises that might change an existing fit and proper conclusion, the institution must take reasonable steps to satisfy itself that no material concern exists — and where a concern does exist, a full assessment must be conducted.

The policy itself

The institution must maintain a documented Fit and Proper Policy, which must be approved by the Board and must form part of the institution’s risk management framework. A group policy may be adopted where the Board approved it. Reasonable steps must be taken to ensure every responsible person is aware of and understands it, and a copy must be given to a director candidate as soon as practicable after nomination, and to any other person before their assessment.

The policy must set out the assessment process — who conducts assessments, what information is obtained and how, the matters considered, and the decision-making process — and must specify the actions to be taken where someone is assessed as not fit and proper. Enquiries must be thorough: the institution must make all reasonable enquiries, including for sensitive information under the Privacy Act 1988.

Consequences and notification

Where the institution assesses, or a reasonable person in its position would assess, that someone is not fit and proper, it must take all steps it reasonably can to ensure they are not appointed or, if already in post, do not continue to hold the position.

APRA must be notified within 10 business days of such an assessment — and if the person remains in the role, the notification must state the reason and the action being taken. Separately, the institution notifies APRA of each responsible person’s position title, full name, date of birth for identification, position and main responsibilities, and whether they have been assessed, with revised information due within 28 days of any change or new appointment.

The whistleblowing provisions, and a gap in the records rule

The policy must include whistleblowing arrangements: consent to disclosure to the assessor or to APRA, a route for reporting non-compliance with the standard to APRA, and consent for former responsible persons to disclose the reasons for their resignation or removal. The institution must not constrain disclosures to APRA, including through confidentiality clauses, and must take reasonable steps to ensure no good-faith discloser suffers detriment.

On records, the policy must require sufficient documentation of each assessment to demonstrate the fitness and propriety of current and “recently past” responsible persons. No retention period is specified, and “recently past” is not defined. That is unusual among the regimes we cover — the FCA sets three, five and indefinite periods, Singapore sets five years, Hong Kong three — and it means an Australian institution has to set and justify its own retention rule rather than configure a given one.

For the Irish analogue, with its pre-approval controlled functions, see our guide to the Central Bank Fitness and Probity regime. For the Australian health professions, which take a different approach based on CPD hours by registration, see our guide to Australian CPD requirements. Our CPD course library covers the governance and risk foundations these roles assume.

Frequently asked questions

Does CPS 520 set minimum qualifications?

Not for responsible persons generally. The only prescribed thresholds attach to appointed auditors and Appointed Actuaries, each requiring a minimum of five years’ relevant experience alongside professional membership and independence conditions.

How often must fit and proper assessments be done?

Before appointment, then annually or as close to annual as practicable. A fresh full assessment is also required where information arises that raises a material concern about an existing conclusion.

Can someone start before being assessed?

In limited circumstances. An interim appointment is permitted for up to 90 days, or longer with APRA’s written agreement, with reasonable steps taken beforehand and a full assessment required before permanent appointment. Where appointment is by members’ resolution or APRA determination, assessment must follow within 28 days.

What must be notified to APRA, and when?

An assessment that a responsible person is not fit and proper must be notified within 10 business days, with the reason and action taken if the person remains in post. Changes to responsible person details are due within 28 days.

How long must assessment records be kept?

The standard does not say. It requires sufficient documentation to demonstrate the fitness and propriety of current and recently past responsible persons, without defining a period or the term “recently past”, so the institution must set a defensible retention rule itself.