The Australian Prudential Regulation Authority (APRA) released both the results of the enforcement strategy review led by APRA Deputy Chair John Lonsdale and details of its new enforcement approach on 16 April.  In a statement, APRA Chair Wayne Byres said APRA would implement all the recommendations of the enforcement review, including adopting a 'constructively tough' appetite to enforcement.  

A high level overview of both the review findings and recommendations and APRA's new enforcement approach, which comes into immediate effect, is below.

APRA Enforcement Strategy Review 

The Review examined the appropriateness of APRA’s enforcement strategy and infrastructure, and assessed how enforcement should interact with APRA’s core role of prudential supervision and was conducted between November 2018 to March 2019.  The Review was led by APRA Deputy Chair John Lonsdale, who was supported by APRA staff and an independent advisory panel of experts.  The panel comprised: Dr Robert Austin (Former Judge of Supreme Court of New South Wales); Commissioner Sarah Court (Australian Competition and Consumer Commission); and Professor Dimity Kingsford Smith (Minter Ellison Research Professor of Risk and Regulation and Deputy Director (Research) of the Centre for Law, Markets and Regulation at the University of New South Wales).

The Final Report of the Review was presented to APRA Members on 29 March 2019 and released publicly on 16 April.

Some key findings

• APRA has performed well overall in its primary role of protecting the soundness and stability of institutions.  However, it could achieve better outcomes in the future by taking stronger action earlier where entities were are cooperative or open, and by being more willing to set public examples.
• APRA's appetite to use enforcement 'as a last resort and mainly where financial promises or stability are at risk has been too low' and in some cases has resulted in 'risks not being addressed in a timely manner'.
• APRA's 'last resort enforcement appetite' is reflected in the current size of its support function and enforcement infrastructure which represents about 3% of total staff.
• Though in most circumstances APRA's non-formal supervision approaches are 'highly effective' — that is to say, timely and resource efficient as compared with court based action — they also carry the risk that intended prudential outcome may not be achieved.  In addition, the approach could lead to less than optimal prudential outcomes eg protracted exposure to known risks, lack of deterrence.
• The report also observes that 'use of formal powers are an important part of the supervisory toolkit and using them appropriately can bring benefits. It can make non-formal supervision approaches more effective by reinforcing the credible threat that APRA will take stronger action where entities and individuals do not cooperate'.  Once consequence of APRA's low appetite has been to 'diminish the credible threat of consequences for failing to meet APRA's requirements'.
• APRA's enforcement appetite is also 'out of step' with international peer organisations.
• APRA's approach to enforcing behavioural risk is still maturing (as is the case for prudential regulators globally) and the regulator has been 'hesitant to use enforcement to compel remediation of behavioural risks, or to hold entities and individuals to account and achieve deterrence in respect of these issues'.
• APRA and the Australian Securities and Investments Commission (ASIC) need to coordinate more closely on enforcement matters to fulfil their respective mandates (as was emphasised by the Financial Services Royal Commission's final report recommendations).  

Review recommendations — some key points

The review makes seven recommendations to strengthen, but not to fundamentally alter, ASIC's enforcement approach — the proposed changes 'largely' align, the report states, with 'APRA's current approach which the review recommends 'be retained but reinforced'.  'APRA is expected to continue to achieve its mandate largely through non-formal supervisory approaches, with enforcement action used to prevent and address serious prudential risks' the report states.
In broad terms, the review recommends that going forward APRA should:

• take stronger actions earlier where entities and individuals are not open and cooperative
• be more forceful in holding entities and individuals to account for actions that could have an adverse impact on financial soundness and stability, or lead to other inappropriate prudential outcomes
• more actively consider the deterrence benefits of enforcement action
• be more innovative in the use of its powers or combinations of its powers
•  coordinate more effectively with the Australian Securities and Investments Commission (ASIC) where the two agencies have enforcement matters of common interest

In addition, it's recommended that APRA should:

• build 'a more forceful supervisory culture and approach'
• establish an APRA-member led committee to drive enforcement decision making and strengthen oversight
• establish an independent Banking Executive Accountability Regime (BEAR) Disqualifications Panel to make disqualification decisions under the BEAR
• seek legislative reforms (for example amendments to enhance APRA's enforcement powers and penalties) to help ensure the legislative framework can facilitate the regulator's increased enforcement appetite

In a statement Mr Lonsdale said the review found APRA had, on the whole, performed well in its primary role of protecting the soundness and stability of institutions, but that the regulator could achieve better outcomes in the future by taking stronger action earlier where entities were not cooperative or open, and by being more willing to set public examples.  He went on to say that 'The recommendations of the review will still mean that APRA as a safety regulator remains focused on preventing harm with the use of non-formal supervisory tools.  However, APRA will be more willing to use the full range of its formal powers – such as direction powers and licence conditions – to achieve prudential outcomes and deter unacceptable practices'.  

APRA Chair Wayne Byres said that the review acknowledges that as a supervision-led prudential regulator, APRA’s primary focus will always be on resolving issues before they cause problems for depositors, insurance policyholders and superannuation members, rather than relying on backward-looking actions after harm has occurred and that in most cases that this will continue to be achieved through 'non-formal tools'.  Mr Byres added that 'in future, APRA will be less patient with the time taken by uncooperative entities to remediate issues, more forceful in expressing specific expectations, and prepared to set examples using public enforcement to achieve general deterrence'.  

Specifics: Seven Recommendations

• Recommendation 1: Strengthening APRA-ASIC coordination on enforcement by developing clear principles for sharing information and taking coordinated action on matters of mutual interest.
• Recommendation 2: Increasing APRA’s enforcement appetite from a ‘last resort’ to a ‘constructively tough’ approach and setting this out in a Board-endorsed, publicly available enforcement strategy.  
  This means APRA should take enforcement action to hold entities and individuals to account to prevent and address serious prudential risks: a) earlier than it currently does, well before an imminent threat to financial viability; b) in broader circumstances than it currently does, including in relation to behavioural risks; and c) to achieve deterrence, including by making enforcement actions public where appropriate, to send strong messages that entities and individuals must comply with their prudential obligations.
• Recommendation 3: Assign clear responsibility to the supervisory divisions for applying the enforcement appetite. This means supervisors and their management should understand enforcement options, maintain supervisory watch lists of potential enforcement cases, escalate matters that meet the criteria set out in the enforcement appetite, and make recommendations to the new Enforcement Committee.
• Recommendation 4:
  • Build a more confident and forceful supervisory culture, emboldened by tone from the top of the organisation and management support, and refresh the supervisory approach, including the underlying infrastructure, to: a) better empower and support supervisors to undertake forceful supervision, including by holding entities and individuals to account through the use of enforcement; and b) appropriately tailor the approach to industry-specific factors, to take account of issues of relevance to each sector and actively facilitate the use of enforcement. 
  • Direct a relevant portion of the increase in APRA’s resources, as recently announced by the government, to its supervisory divisions as appropriate to reflect the additional work required to implement an increased enforcement appetite.

  [Note: In his (planned) opening remarks to the senate economics legislation committee, APRA Chair Wayne Byres said that additional funding would be deployed in this way. Mr Byres' remarks are covered in a separate post in Governance News 17/04/2019]

• Recommendation 5
  •  APRA should establish an APRA Member-led Enforcement Committee for enforcement decision-making to give APRA executives greater visibility of potential enforcement matters and ensure the constructively tough enforcement appetite is applied appropriately.  The Enforcement Committee would have responsibility for: a) overseeing watch lists of prospective cases; b) reviewing and challenging the supervisory strategy on escalated matters; c) deciding whether or not to take enforcement action on escalated matters; d) referring relevant cases to the APRA Banking Executive Accountability Regime (BEAR) Disqualifications Panel for decision; and e) reviewing APRA’s enforcement strategy on an ongoing basis to assess its suitability.
  • APRA should also establish an APRA banking executive accountability regime (BEAR) Disqualifications Panel comprised of independent persons to make disqualification decisions under the BEAR.  
  • Ensure appropriate oversight and challenge in relation to enforcement matters, including through the Member-led Enforcement Committee and through APRA’s Quality Assurance (QA) function.
• Recommendation 6:  Build an enforcement support infrastructure shaped around the new appetite, with the ability to take on an increased number of investigations and enforcement actions.  Seek the Government’s consideration to establish a new hypothecated enforcement fund for APRA.
• Recommendation 7: Seek the government’s consideration of legislative amendments that enhance APRA’s enforcement powers and penalties by: a) addressing impediments that could hinder the new enforcement appetite, including remedying the adequacy of penalties, closing gaps in APRA’s enforcement powers in superannuation and private health insurance, and removing barriers to conducting joint investigations with ASIC; and b) extending the BEAR across all APRA-regulated industries and, in so doing, considering the introduction of a civil penalty for a breach of accountability obligations by an accountable personIn a statement, Mr Byres indicated support for this recommendation and said that the proposed legislative changes would be referred to the government for its consideration.

[Note: The Review includes a table (Table 4: Assessment of effectiveness of certain APRA enforcement powers at p49) summarising the gaps in APRA's current enforcement powers.  The proposed changes are outlined in the report at p48-53. See: APRA Enforcement Strategy Enforcement Review: Final Report] 

Review in three years? The report suggests that a 'comprehensive review of the implementation of the recommendations' should be conducted in three years.

Impact for industry?

The report states that if the recommendations are implemented 'it can be expected APRA will continue to be a supervisory-led organisation that undertakes the majority of its work through non-formal approaches. Enforcement should not become its first option but will be used, where appropriate'.

More particularly, the report suggests industry should expect that APRA will:

1. act more quickly – by being less patient about the time taken to remediate issues;
2.  be more forceful – by being firmer in clearly setting and following up on expectations, and more ready to hold to account; and
3. be willing to set public examples – by being more transparent and sending strong public messages through enforcement action.

APRA's new approach to enforcement

APRA will use the following enforcement criteria to identify matters for potential enforcement action (though APRA specifies that the criteria are 'not exhaustive').
Where an entity or individual has not:

• adequately prevented or addressed prudential risks; or
• conducted business with honesty and integrity, or with due skill, care and diligence; or
• dealt with APRA in an open, cooperative and constructive way

and this has resulted in:

• an adverse impact on financial soundness, stability or, in the case of superannuation, the interests of members; or
• the risk or behaviour could have, or could have had, an adverse impact on financial soundness, stability or, in the case of superannuation, the interests of members. For example, actions that do not promote prudent risk management; or
• APRA's ability to make an accurate and timely assessment of an entity's prudential risk profile has been, could be or could have been impeded.

APRA will implement all the review recommendations including adopting a 'constructively tough' approach to enforcement

APRA's new approach is outlined in a board endorsed enforcement strategy document which the regulator also released on 16 April (in line with recommendation 2 of the enforcement strategy review). The purpose publicly releasing the document 'is to provide guidance on how APRA will approach its decisions to use enforcement action in relation to prudential risks'. The new enforcement approach comes into effect immediately.

An overview of APRA's stated enforcement objective, the criteria that APRA will use to determine whether enforcement action is appropriate, and the guiding principles that will inform the regulator's enforcement decisions is below.

APRA's enforcement objective

APRA's objective is to 'prevent and address serious prudential risks and hold entities and individuals to account'. 

• APRA focus, as a 'safety based regulator' is on 'preventing and mitigating harm, and its enforcement actions will be aimed at the proactive remediation of prudential risks, as well as holding institutions and individuals to account for their actions'.
• APRA states that 'enforcement action can also have a positive deterrent effect beyond the immediate target of the action',  On this basis, 'APRA may use enforcement to achieve the strategic benefits of general deterrence, including through public enforcement action to deliver wider prudential outcomes where appropriate'
• Though in most circumstances, 'non-formal tools are effective in achieving APRA’s prudential outcomes in a resource-efficient and timely manner' particularly where regulated entities are 'open and cooperative' the effectiveness of prudential supervision depends on regulated parties 'knowing that APRA will take firm action where prudential risks are not being properly addressed'. As such, APRA may select a combination of tools from its supervisory toolkit (which range from information gathering powers to more 'coercive and intrusive tools') to suit the particular circumstances.

Enforcement criteria — issues that will lead APRA to consider enforcement action

The four principles underpinning APRA's enforcement approach

Guiding APRA's strategic decisions on when and how to take enforcement action are the following four principles.

1. Risk based: APRA's appetite for enforcement should prioritise the issues and entities that pose the most serious prudential risks
2. Forward looking: APRA should use enforcement to prevent serious prudential risks from having a realised impact. 'The principle of deterrence will be an important forward-looking component of APRA’s decision making.'
3. Outcomes based: 'APRA’s appetite for enforcement action will be driven by the prudential outcomes that it is trying to achieve' and as such there will be cases where non-formal supervisory approaches are more appropriate than the alternative.
4. Deterrence: APRA should actively consider the need to deter similar practices from occurring in future including by making enforcement actions public where appropriate. 'However, as a prudential regulator APRA must always balance the benefits of public action against any immediate risks to financial stability'.

Other factors APRA will take into account: APRA states that it will also take into account other factors when considering the use of enforcement powers. These include:

1. Proportionality: Whether the action taken is proportionate and properly reflects the nature and seriousness of the matter under consideration and its potential impact on APRA’s prudential objectives
2. History and behaviour: APRA decision makers will have regard to the past conduct of the entity or individual before during and after the matter or event under consideration
3. Other Agencies: APRA decision makers will have regard to any relevant action proposed or being taken by other domestic and/or international regulatory or law enforcement agencies -including whether, if such agencies are taking action, it is necessary or desirable for APRA also to take its own action

[Sources: APRA Enforcement Strategy Review Final Report; APRA’s Enforcement Approach 16/04/2019; APRA media releases 16/01/2019; 16/01/2019; The SMH 16/04/2019;  [registration required] The AFR 16/04/2019; Investor Daily 16/04/2019; Financial Standard 16/04/2019]