09/11/2025
APRA's key priorities for the FS industry:
1. Cyber - 91% of banks, insurers and super funds rated cyber security as a Critical or High risk. Despite CPS 234 being in force since 2019 "the pace of improvement has been slower than expected or required".
2. Heavy reliance on Legacy systems - Digital transformation programs to replace business critical end of support systems pose operational and governance challenges that require strong risk oversight and robust technology roadmaps.
3. Cloud and concentration risk - There is an increasing reliance in the FS industry on the same 3rd or 4th party cloud providers (e.g. AWS, Azure) to deliver Critical Operations amplifying concentration risk. Robust contingency planning and scenario testing is even more essential under CPS 230.
APRA has published a speech by Member Suzanne Smith to the Financial Services & ASX Sector Assurance Forum in Sydney.