Strengthening readiness for geopolitical shocks
The Australian Prudential Regulation Authority (APRA) has issued new requirements for banks, insurers, and superannuation trustees to bolster their defenses against geopolitical instability. According to APRA Chair John Lonsdale, institutions must now integrate geopolitical risk into their core governance, risk management, and crisis preparedness frameworks to ensure the continued delivery of critical financial services amid an increasingly complex global environment.
Did You Know? Geopolitical shocks differ from traditional market volatility because they can build gradually, escalate rapidly, and transmit stress through multiple interconnected channels simultaneously, such as simultaneous cyber threats, sanctions, and supply chain disruptions.
Addressing Gaps in Risk Management
APRA’s supervision, conducted alongside the Council of Financial Regulators (CFR), revealed that while financial entities are aware of geopolitical risks, their maturity in managing these threats varies significantly. Common gaps identified include a failure to treat geopolitical tensions as amplifiers for existing material risks, such as financial and non-financial exposures.
Many institutions currently lack explicit strategies for nation-state actions like sanctions, restricted market access, or reduced capital mobility. Furthermore, the rapid adoption of artificial intelligence has altered the cyber threat landscape, yet many Boards reportedly lack the technical literacy required to challenge these emerging risks effectively. Reliance on overseas third-party providers also complicates the ability of these entities to mitigate threats during periods of international tension.
Minimum Expectations for Financial Entities
To address these vulnerabilities, APRA has set minimum expectations for how regulated entities must manage prudential risks. These expectations require that geopolitical risk be explicitly reflected in an entity’s strategy, risk appetite, and Board oversight. Management is now expected to identify and address material gaps, with clear accountabilities and timelines for remediation.
Specific areas of focus include:
- Operational Resilience: Maintaining critical operations during geopolitical disruptions.
- Personnel Security: Implementing policies to detect and manage insider threats and foreign interference.
- Political Risk: Establishing processes for sanctions compliance and managing offshore asset exposure.
- Financial Resilience: Incorporating geopolitical stress scenarios, such as market closure or capital trapping, into liquidity and capital planning.
Expert Insight: The shift from viewing geopolitical events as “external” to treating them as core operational risks represents a fundamental change in regulatory philosophy. By forcing Boards to account for disinformation and foreign interference alongside standard liquidity metrics, APRA is signaling that the era of treating international tension as an unpredictable “black swan” event is over.
What May Happen Next
In its 2026-27 Corporate Plan, APRA intends to incorporate targeted readiness assessments into its supervisory plans for larger entities that face heightened geopolitical exposure. These assessments will focus heavily on crisis preparedness, personnel risk, and political risk, with supervisors expected to take action where they identify weak governance or inadequate planning.
Smaller, less complex entities are expected to take a proportionate approach, focusing on the risks most material to their specific operations and counterparties. Should geopolitical conditions continue to evolve, entities may face more frequent and consequential stress tests as regulators seek to ensure the Australian financial system remains resilient under a wide range of international scenarios.
Frequently Asked Questions
What does APRA define as a geopolitical risk?
APRA defines geopolitical risk as the potential for adverse impacts on the financial system arising from international tension, which includes trade restrictions, sanctions, grey-zone activities, and conflicts.
Are all financial entities expected to respond in the same way?
No. APRA does not expect all entities to respond identically. Smaller and less complex entities are expected to focus on the risks most material to their own operations, customers, and service providers.
What is the role of the Board in this new framework?
Boards are expected to satisfy themselves that geopolitical risk is reflected in strategy and risk appetite, ensure management is addressing identified gaps, and oversee reporting on offshore dependencies and service provider vulnerabilities.
How will your institution adapt its current crisis playbook to account for the potential of rapid, interconnected geopolitical shifts?