Australia’s financial system remains strong and stable, supported by financial buffers and operational resilience initiatives. The system has managed the pressures experienced to date, but persistent uncertainty and the possibility of multiple shocks occurring at once mean this resilience cannot be taken for granted. Maintaining resilience requires financial strength, operational readiness and crisis capabilities that work together under pressure.
Australia’s financial system has managed global market pressures but remains exposed to further shocks
A sharp adjustment in global financial markets could raise funding costs and reduce investment values across Australia’s financial system.
Long-term government bond yields in advanced economies are around their highest levels in at least 15 years amid persistent uncertainty and elevated government debt. Markets remain orderly, but a rapid and substantial further rise in yields could trigger a disorderly adjustment. A reassessment of technology-sector valuations or stress in global private credit markets could intensify these pressures. APRA is closely monitoring the implications for Australia’s financial system.
Artificial intelligence (AI) and reliance on material service providers are changing the nature and scale of operational risk
APRA is intensifying its focus on AI-related risks and improving visibility of material service providers.
AI creates new risks within institutions, accelerates external threats and could have broader effects across the economy. Reliance on material service providers also creates channels for widespread disruption. APRA is strengthening supervisory engagement on AI-related risks, improving visibility of system-wide dependencies and working with industry and other regulators to prepare for disruption that combines financial and operational pressures.
The banking system and most households have remained resilient as the housing market weakens
Substantial equity and repayment buffers, sound lending standards and bank capital underpin household and lender resilience.
Housing prices have fallen, credit growth has slowed and higher living costs are putting pressure on household budgets. However, equity and repayment buffers built up over recent years provide protection for many households, while lenders have retained sound lending standards and capital positions. High household indebtedness could amplify a more severe downturn, particularly if falling housing prices coincided with a substantial rise in unemployment. APRA is monitoring household resilience, lending standards and credit conditions closely.
The international environment
This chapter provides an overview of what APRA is seeing in the international environment. It highlights external shocks and global vulnerabilities that could affect the Australian financial system.
Overview
The international environment remains highly unpredictable, and vulnerabilities in global financial markets and critical infrastructure could amplify future shocks. Some pressures are already reaching Australia through higher fuel prices and higher bond yields. Rapid advances in AI are supporting investment and economic activity, but are also influencing financial markets, accelerating cyber threats and increasing reliance on material service providers. Financial institutions must also prepare for longer-term developments, including quantum computing, well before the associated risks crystallise.
The global risk environment remains highly unpredictable
Uncertainty in the global environment remains elevated. The World Uncertainty Index, which measures the frequency of references to uncertainty in over 140 country reports from the Economist Intelligence Unit, has eased from its recent peak but remains high by historical standards (Figure 1). Geopolitical and trade tensions remain significant sources of uncertainty, including the continuing Russia-Ukraine conflict and fragile conditions in the Middle East. Renewed escalation in the Middle East could disrupt commodity supplies and cause further volatility and sharp rises in fuel prices. Rapid developments in AI, further climate-related shocks and policy shifts could add to these pressures. If several of these developments occur together, their effects on the global economy and financial system could be amplified.
Figure 1
The economic effects of recent shocks are still unfolding. Higher fuel prices have already increased petrol and diesel costs for households and businesses, while the full flow-through to groceries and manufactured goods may take longer. These pressures could prolong high inflation and constrain economic growth. At the same time, the global AI boom is supporting investment and economic activity, particularly in countries with significant exposure to the AI supply chain.
Government bond yields have risen, while equity markets have been sensitive to AI-related developments
Bond markets play a central role in the global financial system. Bonds allow governments and companies to borrow money from investors. Government bond yields influence borrowing costs for businesses and households, both domestically and internationally. This is particularly true of US government bond yields, which provide an important benchmark for borrowing costs across global financial markets. Long-term government bond yields reflect expectations for future short-term interest rates as well as a term premium, which compensates investors for the additional risks of holding longer-term bonds.
Long-term government bond yields have increased sharply across advanced economies (Figure 2). Yields had already been increasing for some time as they were normalising from unusually low levels, but the more recent increases have pushed yields to new highs in several countries. These latest increases reflect a range of factors, including elevated government debt, a volatile geopolitical environment, higher expected inflation and official interest rates, greater competition for capital, and the growing role of price-sensitive investors such as hedge funds. While yields have declined a little in recent weeks, they remain close to their highest levels in at least 15 years.
Figure 2
Global government debt is high and rising. The IMF projects global public debt will exceed 100 per cent of gross domestic product in 2030, a level last recorded in the immediate aftermath of the Second World War. A range of spending pressures continue to build across many economies globally, including from geopolitical tensions, ageing populations and climate change. Persistent deficits and rising borrowing costs could make it harder for some governments to manage their debt sustainably. Highly indebted governments may also have less capacity to respond to future shocks and economic downturns.
At the same time, expectations of strong AI-related growth are affecting financial markets in several ways:
- Recent falls in technology stocks have highlighted equity markets’ sensitivity to expectations for AI-related earnings growth and productivity improvements (Figure 3). Strong performance by technology companies has contributed to equity price gains over the past few years and increased concentration in major share indices, particularly in the United States. Equity markets could come under further pressure if expectations for earnings growth, or the wider economic gains from AI, are not realised.
Figure 3
- Large technology companies investing in AI infrastructure, often referred to as ‘hyperscalers’, have more than doubled their corporate bond issuance this year. This borrowing is financing planned investment in data centres and other infrastructure, with some companies also turning to private credit for more flexible financing. Spillovers to broader corporate credit markets have so far been limited, with credit spreads outside the technology sector not widening materially.
- Advances in AI are accelerating a transformation in insurance markets as insurers integrate the technology in underwriting, pricing, claims and other consumer-facing activities. AI-related investment is also changing the risks insurers cover. For example, the scale and concentration of investment in data centres is testing conventional approaches to assessing and underwriting risk. Clusters of facilities and high-value equipment within individual centres mean a single event, such as a natural disaster, could cause substantial losses. The scale of some projects is also stretching available insurance capacity.
These developments leave global financial markets more vulnerable to further shifts in investor confidence. Further pressure in government debt markets could raise borrowing costs and spread to other markets. Higher bond yields could also place downward pressure on global equity prices, because fixed-income assets become more competitive alternatives and future company earnings are discounted more heavily. Disappointment about the earnings or wider economic gains from AI could deepen falls in equity markets. Together, these pressures could weaken confidence and amplify stress across the global economy and financial system.
Cyber and operational risks continue to intensify
Frontier AI is amplifying cyber threats and creating new operational risks
AI is changing both how cyber-attacks are carried out and how institutions defend against them.
AI is increasing the speed and scale at which software vulnerabilities can be identified and exploited. Frontier AI models, including those from Anthropic and OpenAI, are demonstrating increasingly advanced capabilities to find software vulnerabilities, develop ways to exploit them and automate complex cyber tasks. Major US technology companies have also reported a sharp increase in public disclosures of vulnerabilities since April 2026. As advanced AI capabilities become more widely available, malicious actors may be able to exploit vulnerabilities sooner, leaving financial institutions and material service providers less time to assess exposures, apply patches and contain cyber-attacks.
Agents with autonomous capabilities could create additional risks if they pursue assigned goals through actions that are not authorised. For example, in June this year an OpenAI agent circumvented controls to access an Australian Government website. Without effective human oversight and preventative controls, agents’ pursuit of their goals may lead to unintended harm.
- AI could also help institutions detect vulnerabilities and respond to cyber incidents more quickly. However, institutions will need to manage the risks from using AI and keep pace as attackers adopt the technology. International authorities such as the Financial Stability Board are developing guidance to help institutions use AI safely and effectively.
Common dependencies can amplify operational disruption
Reliance on material service providers, firms supporting financial institutions’ critical operations, can transmit disruption across institutions and borders. Of the top 100 providers reported by APRA-regulated institutions, 80 are headquartered or have their principal operations outside Australia (Figure 4). Some individual providers support institutions that collectively account for more than half of APRA-regulated financial assets, indicating potentially significant concentration. The consequences of disruption at these providers would depend on the criticality of the affected services and institutions’ capacity to restore them or move to other providers. Geopolitical instability could further disrupt access to overseas providers and complicate recovery.
Figure 4
Quantum computing could undermine encryption across the financial system
Sufficiently advanced quantum computers could eventually undermine the encryption protecting financial data and transactions. Although the timing of this threat is uncertain, transitioning to quantum-safe security may take many years and require extensive coordination and funding. International regulators are encouraging institutions to identify vulnerable encryption across their systems and begin planning for its replacement.
Quantum computers use the properties of quantum physics to perform some calculations in fundamentally different ways from conventional computers. Conventional computers process information using bits represented as 0s and 1s, whereas quantum computers use quantum bits, or ‘qubits’. They require different hardware and software and are likely to complement, rather than replace, conventional computers. Sufficiently advanced quantum computers could solve certain complex problems that conventional computers cannot practically handle. In the financial system, this could eventually improve areas such as modelling, stress testing, fraud detection and portfolio management.
Quantum computing could also undermine widely used encryption that protects financial data and transactions. A sufficiently powerful quantum computer could break some of the encryption currently used to secure communications, authenticate users and verify digital signatures. This could allow an attacker to access confidential information, impersonate trusted parties or alter transactions.
Some information may already be exposed to future quantum threats. Malicious actors could collect encrypted information today and retain it until quantum computers become capable of decrypting it, an approach known as ‘harvest now, decrypt later’. This is particularly relevant for sensitive financial information that needs to remain secure for many years, and information already stolen or compromised through cyber-attacks.
The consequences could extend across the financial system. Compromised encryption could disrupt critical financial services and cross-border transactions, cause financial losses and undermine confidence in digital transactions. Post-quantum cryptography offers a practical way to maintain secure systems and communications, but the transition will require changes across institutions, legacy systems and material service providers, supported by national coordination. The next chapter discusses transition milestones established by the Australian Signals Directorate to support Australian organisations.
Domestic developments
This chapter focuses on vulnerabilities and sources of resilience within the Australian financial system. It discusses how global shocks could spread to Australia and how APRA is reinforcing system resilience.
Overview
Australia’s financial system remains resilient, but the risk environment is becoming less forgiving. APRA-regulated institutions have so far managed higher global bond yields and movements in asset values without material disruption, while the banking system and most borrowers are well placed to manage a weakening housing market. However, exposure to global financial markets, together with shared operational dependencies, could transmit or amplify future shocks. This makes continued testing of institutions’ ability to manage financial and operational pressures together increasingly important.
Crisis preparedness must complement financial and operational resilience
Financial buffers and robust and reliable operations provide strong foundations for a resilient financial system. However, when financial and operational pressures coincide, they can test the system’s ability to absorb losses while maintaining critical services. Financial buffers and plans for individual events may not be enough if institutions cannot bring their responses together. Institutions and authorities need practical capabilities to combine information, make timely decisions and coordinate action under pressure. Institution-level capabilities need to be supported by arrangements across the financial system and the broader national response (Figure 5). Disruption to critical services can extend beyond any one institution’s control, making coordination across these levels essential. The following sections examine financial and operational resilience, before returning to the practical capabilities needed to manage complex crises.
Figure 5
Crisis preparedness at three levels
Financial strength is helping the system absorb global market pressures
Financial buffers provide a solid foundation for the resilience of Australia’s financial system. Banks and insurers remain well capitalised, while banks also maintain strong liquidity positions. These resources help institutions absorb losses, meet their obligations and continue providing financial services during stress. Australia’s connections to global financial markets provide access to diverse sources of funding. This adds to resilience but also creates channels through which overseas stress can reach Australia.
Australia’s financial system has remained resilient as government bond yields have risen globally. Funding markets remain orderly, and Australian banks continue to access finance at relatively favourable margins, indicating that they remain well regarded by global investors despite higher overall funding costs. Banks are also less reliant on offshore funding than in the past, reducing the impact of any disruption in global funding markets.
Higher yields have reduced the value of fixed-income assets held across the financial system, but the effects have so far been manageable. For insurers, declines in asset values are partly offset by corresponding declines in liabilities, while higher yields can support investment income over time. For superannuation funds, just under 20 per cent of investments are in fixed income (Figure 6). Funds also have substantial exposure to equity markets: more than 50 per cent of investments are in listed equities, which can decline in value when yields rise. However, funds’ long investment horizons and generally stable inflows reduce the need to sell assets during short-term market movements. These features help contain the system-wide effects of asset price falls, but do not prevent investment losses for members. The implications for individual members depend on their circumstances.
Figure 6
Conditions could become more challenging if global bond market pressures intensify or equity prices fall sharply. Australian institutions could face higher funding costs and further declines in investment values. Higher funding costs could, in turn, increase borrowing costs for households and businesses. Financial buffers and the structural features of the financial system would help absorb these effects, but a large or prolonged adjustment could test resilience. Persistent uncertainty could also affect resilience more gradually by delaying investment, encouraging more cautious financial decisions and making market signals harder to interpret, even before a discrete shock occurs (Box A).
Box A: How might uncertainty affect resilience even before a shock occurs?
Persistent uncertainty can affect resilience through decisions made before a shock occurs. Available evidence does not indicate that this has materially weakened the resilience of Australia’s financial system to date. However, prolonged uncertainty could affect resilience in several ways:
- Delayed investment in resilience. Financial institutions may postpone technology upgrades, operational improvements or other investments that would strengthen their capacity to withstand and recover from disruption. This can preserve flexibility in the short term, but prolonged delays may leave weaknesses unaddressed.
- More cautious spending, lending and investment. These decisions can strengthen individual financial positions, but widespread or prolonged caution could weaken economic activity and financial flows.
- Harder-to-interpret warning signs. Uncertainty can make it harder to distinguish temporary market movements from signs of emerging stress, complicating decisions about when to act.
These effects are not inevitable. Temporary caution can strengthen buffers and help avoid poorly informed decisions. But actions that protect individual financial positions can, if widespread or prolonged, weaken economic activity and resilience across the system. The implications depend on how long uncertainty persists and the cumulative response of households, businesses and financial institutions.
Recent stress testing provides further evidence of the financial system’s capacity to absorb significant market and liquidity stress. APRA’s inaugural System Risk Stress Test found that all participating banks and superannuation funds were resilient to the shocks examined. In the exercise, the superannuation sector’s response helped stabilise the system. However, the exercise also highlighted system-wide vulnerabilities, including concentration, mismatched assumptions and common dependencies that could amplify stress. Some of these vulnerabilities may become more consequential as the superannuation system grows, matures and becomes more connected to the broader financial system.
APRA continues to assess whether prudential settings remain fit for purpose as risks evolve. This includes proposed enhancements to banks’ capital and liquidity frameworks, with more risk-sensitive capital treatment for some development and construction lending. APRA is also proposing closer oversight of investment governance in superannuation.
In addition, APRA is evolving its stress testing of emerging system-wide risks. The 2027 System Stress Test will explore how AI-driven economic disruption could affect banks, superannuation funds, life insurers and the broader financial system. The exercise will look at risks that could emerge in severe but plausible downside scenarios, either from rapid AI adoption disrupting some business models, or a sharp downward reassessment of AI-related asset valuations.
Private credit risks require close monitoring as exposures evolve
Private credit is providing an additional source of finance for Australian businesses, but rapid growth has increased the importance of sound practices across the sector. Australia’s private credit market remains relatively small, at an estimated $250 billion or less than 4 per cent of the size of the banking system. This small size helps to contain immediate risks to financial stability. However, developments overseas highlight vulnerabilities that warrant close monitoring as the sector grows and becomes more connected to the broader financial system.
Recent overseas developments have reinforced concerns about asset quality, opaque lending arrangements and concentrated exposures. Company failures and increased investor withdrawal requests have drawn attention to exposures to sectors that may be disrupted by AI, such as software firms. Private credit is also financing the AI expansion: the OECD estimates that AI-related transactions accounted for 34 per cent of global private credit deal values in 2025, up from 9 per cent in 2024. While overseas stress has so far remained concentrated in certain borrowers and funds, growing connections with the wider financial system could increase the consequences in future.
Australia’s private credit market is concentrated in real estate, including property development and construction, rather than the technology exposures attracting attention overseas. Through the financing of data centres and associated construction, Australian funds may also become exposed to AI-related developments. Work by the Australian Securities and Investments Commission (ASIC) has identified persistent weaknesses in governance, valuation, disclosure, liquidity management and other market practices, and emerging stress is testing the resilience of some funds. The recent insolvency of a large property developer supported by many private credit funds, as well as temporary restrictions on investor withdrawals by some funds, has brought these vulnerabilities into sharper focus.
Direct links between private credit and APRA-regulated institutions remain limited overall. Private credit represents around 2 per cent of superannuation funds’ total assets, a conservative estimate of both domestic and international exposure. Exposures vary across funds, with some holding larger or more concentrated positions. Insurers’ investment exposures are relatively small but are expected to increase, while Australian banks’ direct exposures also remain small. Regulated institutions also have indirect exposures to domestic and overseas private credit markets, including through off-balance sheet exposures and broader market conditions.
Stress in private credit markets overseas could transmit to Australia. The opaque and indirect nature of some of these exposures makes the full extent of risks to the system difficult to assess. Risks may be greater for individual institutions with significant or concentrated exposures. APRA is increasing its supervisory focus on private credit and has proposed stronger requirements for superannuation investment governance, including for investment monitoring, valuations and accountability. APRA is also working with ASIC and other agencies on the Council of Financial Regulators (CFR) to improve visibility of emerging vulnerabilities and connections with the broader financial system.
The housing market has weakened, but the banking system and most households remain resilient
Australia’s housing market has weakened as higher interest rates, tax changes and softer sentiment have reduced demand. National housing prices have declined by about 6 per cent since March, to be around mid-2025 levels. Housing credit growth has slowed, particularly for investors, although it remains above its long-term average (Figure 7). Forward indicators point to further easing in housing and mortgage market activity.
Figure 7
Most households remain well placed to manage weaker housing market conditions. While higher living costs continue to put pressure on household budgets, many borrowers have built sizeable mortgage prepayment and equity buffers over recent years. The Reserve Bank of Australia (RBA) estimates that less than 2 per cent of variable-rate owner-occupier borrowers are currently experiencing a cash flow shortfall, and less than 1 per cent of all borrowers are in negative equity. Mortgage arrears have risen but remain low. Sound lending standards and capital positions provide further protection for the banking system against credit losses.
However, high household indebtedness could amplify a more severe downturn. Aggregate household debt is around 180 per cent of disposable income, which is high by historical and international standards (Figure 8). Highly indebted households and those with limited buffers have less capacity to absorb income losses or higher living costs. Risks to financial system stability would increase if a sharper fall in housing prices coincided with a substantial rise in unemployment or tighter credit conditions. For affected households, this could mean greater difficulty keeping up with repayments, a need to cut spending or, in some cases, having to sell their property. For lenders, this could increase credit losses, while weaker household spending and housing prices could amplify the broader downturn.
Figure 8
Maintaining sound lending standards is important as lenders compete strongly for borrowers in a slowing market. Riskier lending remains contained, but APRA and the other CFR agencies are monitoring for signs that competition among banks, as well as with non-bank lenders, is weakening lending standards. APRA’s limits on high debt-to-income lending, introduced in February 2026, remain a safeguard against a renewed build-up of riskier lending. APRA also regularly assesses its macroprudential settings to ensure they continue to support financial stability as credit and economic conditions change.
Preliminary results from the 2026 Trans-Tasman Stress Test provide additional assurance that the banking system would remain resilient under a much more severe economic downturn. The exercise assessed the largest Australian and New Zealand banks against a severe but plausible downside scenario incorporating financial and non-financial disruption (Box B).
Box B: Preliminary insights from the 2026 Trans-Tasman Stress Test
APRA and the Reserve Bank of New Zealand (RBNZ) recently completed the 2026 Trans-Tasman Stress Test. The five largest Australian banks and the four largest New Zealand banks participated in the exercise.
The stress test assessed banks’ resilience under a severe but plausible scenario involving an escalation in regional geopolitical tensions, a sharp oil price shock and a deep recession across Australia and New Zealand. The scenario also included a funding shock, market closure and a cyber-attack disrupting a bank-owned offshore operation. This was the most severe bank stress test scenario run by APRA.
The results of the stress test indicate that the Australian and New Zealand banking systems would remain resilient to a severe downturn. Notwithstanding substantial loss levels and pressure on capital and liquidity, banks continued to provide credit to households and businesses throughout the stress period, supporting the subsequent economic recovery.
This was the first joint Australia-New Zealand stress test since 2017. Using the same timeframe and scenario provided a consistent basis for assessing trans-Tasman risks, while still allowing each regulator to retain its own prudential framework and established approach to stress testing. This delivered several benefits.
1. Reduced burden on the participating banks
Banks regularly participate in stress tests run by APRA and the RBNZ. The single coordinated stress test reduced regulatory duplication, data requests and modelling effort.
2. Better understanding of cross-border risks
The Australian and New Zealand financial systems are closely linked, including through parent-subsidiary relationships and exposure to global macroeconomic conditions, markets and shocks. Assessing the resilience of respective banking systems under a common severe stress scenario provided a more complete view of trans-Tasman vulnerabilities.
3. Improved engagement between parent banks and subsidiaries
Feedback from participating banks indicated that the joint approach supported stronger engagement between Australian parent banks and their New Zealand subsidiaries and enhanced their ability to consider cross-border responses during periods of stress.
4. Stronger cooperation between prudential regulators
The exercise strengthened collaboration and information sharing between APRA and the RBNZ. It also provided opportunities to learn from each other's approaches to stress testing.
APRA will publish more detailed findings later this year. This will follow engagement with participating banks, consistent with APRA’s established approach to stress testing.
Operational resilience must keep pace with technological change
Australia is strengthening preparedness for AI-related risks
AI is creating opportunities for Australian banks, insurers and superannuation funds, but it is also creating new risks and exposing weaknesses in existing governance and controls. APRA’s prudential framework is technology neutral, and APRA does not regulate AI technology itself. However, through its supervision of regulated institutions, APRA supports the safe adoption of AI and plays an important role in strengthening the financial system’s resilience to AI-related risks.
APRA assesses AI-related risks through four connected channels (Figure 9). The first two channels concern how AI is used. Use within institutions can affect important decisions, customer outcomes, risk management and critical operations. Use against institutions can increase the speed and sophistication of cyber-attacks, fraud and other threats. The other channels concern how AI-related risks can spread or affect the wider system. Shared AI dependencies could allow a failure or compromise involving a common model, technology platform or service provider to affect multiple institutions. Broader economic and financial system effects could arise through impacts on employment, asset prices, competition and business models.
Figure 9
Four ways AI can create or amplify risks for financial institutions
APRA is translating this assessment into a more intensive and forward-looking supervisory approach to AI-related risks. Existing prudential requirements relating to governance, information security, operational resilience and third-party risk management provide an important foundation, although supervisory approaches will need to continue evolving as AI capabilities, uses and dependencies develop. APRA’s current priorities include:
- deepening supervisory engagement on institutions’ use of AI, with a focus on whether institutions can demonstrate that emerging risks are being effectively identified and managed
- examining preparedness for rapidly evolving threats, including AI-amplified cyber risks, through supervisory activity, industry collaboration and stress testing
- improving visibility of system-wide exposures, including by formalising APRA’s data collection for material service providers (discussed further below)
- monitoring and analysing the wider implications of AI adoption for financial markets, regulated industries and the economy, including through the 2027 System Stress Test, which will examine how AI-driven structural economic change could reshape existing vulnerabilities or create new ones across the financial system.
APRA is also working with a larger network of peer regulators and security agencies to strengthen the financial system’s preparedness for AI-related risks. A particular area of focus is AI-amplified cyber threats, including frontier AI accelerating the identification and exploitation of software vulnerabilities. Recent industry roundtables hosted by APRA and ASIC explored these risks and practical steps to strengthen preparedness (Box C). APRA will continue to evolve its supervisory approach as AI capabilities and uses develop, informed by international developments and emerging better practice.
Box C: From awareness to action on frontier AI cyber threats
Financial institutions need practical capabilities that can keep pace with the speed and scale of frontier AI threats. In June and July 2026, APRA and ASIC held nine industry roundtables on frontier AI involving more than 380 entities and 600 attendees. The roundtables brought together financial institutions, regulators and government agencies to consider the changing threat environment and practical steps to strengthen resilience.
The central message was that awareness and plans are not enough. Institutions need governance, controls and response capabilities that work under pressure as threats emerge and change rapidly.
Five priorities emerged from the discussions:
- Maintain strong cyber fundamentals. Timely patching, effective identity and access controls, and tested response and recovery arrangements remain critical as AI accelerates existing threats.
- Adapt governance and escalation processes. Decision-making arrangements need to support rapid assessment, escalation and action when information is incomplete or changing.
- Use AI carefully to strengthen cyber defences. AI could help institutions identify vulnerabilities and respond to incidents more quickly. However, it requires strong governance and human oversight and cannot replace cyber fundamentals.
- Manage shared dependencies. Institutions need visibility of where common technology platforms, models and service providers could allow disruption to affect several institutions at once.
- Strengthen industry collaboration. Threat intelligence sharing, supplier assurance and industry-wide incident coordination can improve resilience across the financial system.
The roundtables built on letters issued by APRA and ASIC earlier in 2026 and helped translate their expectations into practical priorities for industry. APRA will continue working with institutions, regulators and government to strengthen preparedness for rapidly evolving threats and system-wide disruption.
APRA is building visibility of material service providers
Information collected under Prudential Standard CPS 230 Operational Risk Management is improving APRA’s visibility of material service providers that support critical operations across the financial system. Among significant financial institutions, the typical bank identified 52 material service providers, while the typical insurer identified 28 providers and the typical superannuation fund identified 23 providers (Figure 10). Further work is needed to assess each provider’s systemic importance and substitutability, including the criticality of the services they provide and institutions’ recovery options. A more complete system-wide view is expected as the collection is formalised. Alongside this work, APRA is collaborating with industry and the RBA through the Industry Resilience Initiative to strengthen contingency arrangements for disruption to critical infrastructure, particularly payments.
Figure 10
APRA is strengthening preparedness for quantum computing
Australia is beginning the transition needed to prepare for the future risks from quantum computing. The Australian Signals Directorate recommends that organisations have a refined plan for transitioning to post-quantum cryptography by the end of 2026, begin implementation for critical systems and data by the end of 2028, and complete the transition by the end of 2030. While the timing of the quantum threat is uncertain, delayed planning and risk mitigation could leave institutions and the financial system exposed.
APRA is increasing its focus on quantum preparedness in 2026-27. APRA is encouraging the banks, insurers and superannuation funds it regulates to begin identifying where vulnerable cryptography is used across their systems, data and material service providers. This includes critical infrastructure and sensitive information that must remain secure over long periods. Building this visibility now will help institutions prioritise critical exposures, plan a transition and engage service providers before implementation timelines become constrained. APRA has begun engaging with a subset of regulated institutions to understand their preparedness for post-quantum cryptography.
APRA is adapting its approach to tokenisation as the technology develops
Tokenisation is moving from experimentation towards wider implementation, with some significant progress in the United States and other major markets. As discussed in the May 2026 System Risk Outlook, tokenisation could support faster settlement, greater automation and more efficient financial markets. However, wider adoption could also increase reliance on shared digital infrastructure and create new channels through which liquidity and operational stress could spread. The Financial Stability Board has highlighted that the cross-border use of global stablecoins could exacerbate these vulnerabilities and complicate oversight during stress.
Australia is at an earlier stage, but implementation is beginning to gather pace. Government, regulators and industry are working together to address challenges including coordination, interoperability, and legal and regulatory uncertainty, while maintaining consumer protection, market integrity and financial stability. APRA is working with the other CFR agencies and industry to understand emerging uses and risks, and to ensure its supervisory approach evolves as adoption grows.
Practical capabilities help to sustain resilience as risks evolve
The risks examined in this publication could interact in ways that are difficult to anticipate. A sharp adjustment in global financial markets could coincide with cyber disruption, failure at a material service provider, a severe climate-related event or pressure on household and business balance sheets. To manage complex crises, institutions and authorities need capabilities that bring together financial and operational information and support coordinated decisions under pressure. These capabilities require continued testing to assess how well they would work when several forms of disruption occur together.
The CFR agencies are working with industry to strengthen crisis preparedness at the institution, system and national levels. This includes the Geopolitical Risk Program, which is moving from identifying gaps and setting minimum expectations towards building and testing practical crisis capabilities. APRA is also applying lessons from this work to a broader group of large and complex banks, insurers and superannuation funds through targeted readiness assessments. These assessments consider whether existing arrangements can work together during severe disruption and where further improvement is needed.
Plans for individual events need to work together during complex crises. Institutions cannot predict every shock or develop a plan for every scenario. Exercises and real events help test whether separate arrangements support a coherent response, enabling decision makers to assess the situation, coordinate action and maintain critical services. Recent conflict in the Middle East has also provided a practical test of public sector arrangements, reinforcing the importance of timely intelligence, clear escalation and sustained coordination as conditions evolve.
APRA’s experience has highlighted five principles associated with effective crisis arrangements:
- See the whole picture. Bringing together financial, operational and other relevant information helps decision makers understand what is happening and act in time, even when information is incomplete or changing quickly.
- Turn information into action. Clear warning signs, defined responsibilities and decision-making authority help institutions act early and adjust as conditions change.
- Join up the response. Connected crisis arrangements and specialist plans help institutions manage several pressures at once, continue providing critical services and coordinate their response.
- Communicate and coordinate early. Clear communication arrangements and established links with regulators, government, industry participants and key service providers support a wider response when needed.
- Test, learn and sustain. Exercises and experience can reveal weaknesses, build familiarity and improve arrangements over time.
Maintaining resilience requires these capabilities to be developed before a crisis occurs and sustained as risks evolve. Connecting institution-level capabilities with system and national arrangements can help the financial system adapt and continue providing critical services through severe disruption.