Cyber and AI risks are increasingly testing the resilience of the financial system. Threats are becoming more sophisticated, amplified by developments in frontier AI. Entities are also increasingly reliant on common technology platforms and material service providers. Looking further ahead, emerging technologies such as quantum computing could threaten the encryption methods that currently protect digital security.

As prudential regulator, APRA’s objective is to reduce the risk that cyber and AI threats could pose to financial stability. A serious cyber incident, operational disruption or control failure has the potential to affect the prudential standing of individual entities; where dependencies are shared, a disruption could undermine financial stability. Risk management practices must keep pace with the rapidly moving threat environment.

A lack of preparedness for geopolitical risks is a key potential vulnerability for the financial system. APRA-regulated entities are operating in the most uncertain international environment in decades. Risks associated with trade restrictions, sanctions, armed conflicts, cyber activity and growing strategic competition have the potential to create significant shocks to operational and financial resilience. Regulated entities must be prepared for a range of potential geopolitical risk scenarios.

There is the potential for geopolitical tensions and cyber risks to coincide with, and amplify, potential economic vulnerabilities. This would simultaneously test the financial resilience of APRA-regulated entities and their ability to continue providing critical financial services during periods of operational disruption. 

There are vulnerabilities in both the global and domestic economic outlook. Domestically, higher interest rates and inflation are placing pressure on household and business finances, at a time when households remain highly indebted and housing prices have fallen moderately.1 Internationally, trade fragmentation and policy uncertainty are contributing to a more volatile global environment.

In pursuing our prudential objectives, we aim to promote financial safety and stability in the most efficient way possible. This means maintaining a prudential framework that is proportionate to risk, minimises unnecessary complexity and supports competition, innovation and productivity.  

Consistent with Government’s productivity agenda, reducing unnecessary regulatory burden remains a key priority for APRA. During 2025-26, we progressed a range of actions that are freeing up capital to support lending and investment, improving data sharing across government and supporting growth and innovation. For example, our work with New Zealand in harmonising bank capital rules will reduce annual costs for banks operating in both jurisdictions by around $175 million. 

In 2026-27, we will progress additional reforms to streamline and simplify further the prudential framework. We will remove duplicative reporting, reduce administrative burden and provide greater flexibility for entities in meeting certain prudential requirements. We also plan to finalise proposed changes to our bank capital framework which could materially free up new lending capacity, to support business investment and productivity.

The Government has proposed a new role for APRA in regulating large stored-value facility providers, including issuers of Australian dollar stablecoins. While the timing of reforms remains subject to Government, APRA will need to develop new prudential and supervisory frameworks, and build specialised capabilities and expertise. APRA is working closely with Government and other regulators on implementation arrangements, to ensure a smooth transition.

The risk environment in which APRA operates has fundamentally shifted – our supervisors need to contend with risks that are increasingly volatile, complex and interrelated. To ensure APRA is ready to face current and future challenges, we must improve our agility.   

Technology presents a significant opportunity for APRA. A key priority is AI. Our objective is to become an AI-enabled regulator, identifying risks earlier, building richer insights and increasing our effectiveness. We are working with industry experts to leverage external best practice and broaden our thinking.

APRA’s effectiveness depends on the quality of its people. Our workforce needs to keep evolving to drive a high-performance culture. We will continue to invest in leadership, skills and professional development to support a continued talent pipeline across the organisation. Our goal is to maintain a culture that is inclusive, aligned to our values and focused on achieving APRA’s objectives.

As the central data collection agency for the financial sector, we collect information for our own supervisory purposes and share significant amounts of information with other government agencies. As cyber threats grow, we need to uplift our controls continually. In March 2026, we decommissioned our legacy Direct to APRA (D2A) data submission system for entity access following the identification of security vulnerabilities through a routine test. We have a low risk tolerance for system vulnerabilities that may expose APRA or regulated entities to attacks.

APRA is primarily funded through levies on regulated entities. APRA’s 2026–27 Corporate Plan has been developed based on an approved budget of $278 million, which is $2 million (1 per cent) lower than the previous year. Budgeted headcount is expected to fall slightly from 907 in 2025-26 to 900 this financial year.

APRA remains on track to meet the Australian Government’s target to achieve net zero greenhouse gas emissions from government operations by 2030. We will continue to improve energy efficiency, reduce the environmental impact of our operations and report publicly on progress.