ASIC And APRA Corporate Plans 2026–27: What Regulated Entities Should Expect

APRA and ASIC have released their 2026–27 Corporate Plans, signalling more intensive supervision and enforcement, alongside targeted measures intended to reduce unnecessary regulatory burden. Their priorities span operational resilience, cyber security, artificial intelligence, consumer protection, insurance, superannuation, market integrity and digital assets. For regulated entities, the plans provide a practical roadmap of the areas most likely to attract supervisory attention, information requests and, where deficiencies are identified, enforcement action.

APRA Corporate Plan 2026–27

APRA’s 2026–27 Corporate Plan responds to a more volatile environment shaped by cyber threats, frontier artificial intelligence, geopolitical tensions, economic uncertainty and growing sector-wide dependence on common technology platforms and service providers. Cross-sector operational resilience, including preparedness for non-traditional risks and threats, is a central focus for APRA.

Operational, cyber and geopolitical resilience. APRA will continue targeted reviews of CPS 230 implementation and compliance, including thematic reviews of general insurers and specialist payment providers.

As cyber threats accelerate, APRA will expect boards to demonstrate effective oversight of AI, technology and cyber risk, maintain controls that evolve with the threat environment and participate in information-sharing arrangements. Following recommendations from the Australian Signals Directorate, APRA will also seek information about entities’ progress towards post-quantum cryptography, with appropriate prioritisation of critical systems.

Geopolitical risk will become a routine supervisory issue across APRA-regulated entities. APRA will expect strategies, risk appetites, crisis plans and board reporting to address supply and trade disruptions, sanctions, conflict, grey-zone activity and personnel risk.

Sector priorities. For insurance, APRA identifies affordability, climate-related exposure, legacy products and rising claims costs as continuing structural pressures.

APRA will examine banks’ small and medium-sized business lending in the first half of 2026–27, followed by housing lending in the second half. A new system-risk stress test will examine cross-sector interconnectedness.

In superannuation, selected large trustees will be required to commission independent reviews of valuation governance for unlisted assets. Platform trustees face proposed investment-governance reforms, potential capital requirements associated with the proposed trustee compensation reforms, and heightened supervision following recent fund failures.

Governance reform and regulatory simplification. APRA intends to finalise revised governance requirements in the first half of 2026–27. Administrative requirements under the Financial Accountability Regime will be streamlined, alongside a broader regulatory simplification package intended to remove outdated guidance and address implementation issues.

ASIC Corporate Plan 2026–27

Under its theme, “easier to deal with, harder to avoid”, ASIC’s 2026–27 Corporate Plan combines enforcement and consumer protection with initiatives to drive productivity, responsible innovation and system resilience. Its five strategic priorities focus on:

1. consumer and small-business outcomes,
2. professional conduct and reliable information,
3. retirement and superannuation services,
4. resilient and innovative operations, and
5. market integrity.

As with APRA, ASIC has committed to reducing regulatory complexity and strengthening cooperation with other regulators.

Consumer, insurance and credit priorities. ASIC will continue its scam-site takedowns, consumer warnings and implementation work under the Scams Prevention Framework. It will examine non-bank small-business lending, including unfair contract terms; assess buy now pay later providers’ compliance; and monitor banks’ use of AI for risks of consumer harm.

Insurance remains a significant focus. ASIC will examine “disaster chasers” to identify risks of consumer harm and continue reviewing life insurers’ service performance. Insurers should expect continued scrutiny of claims handling, distribution, outsourcing, customer communications and frameworks for supporting vulnerable customers.

Reporting and governance. ASIC will continue its work on compliance with financial reporting and audit obligations across listed and unlisted companies, superannuation entities and managed investment schemes, with particular attention to valuations. Misconduct by directors and auditors, related-party transactions, illegal phoenix activity and corporate governance failures remain enforcement priorities.

Superannuation. Following the Shield and First Guardian failures, ASIC will maintain its focus on the superannuation sector. Areas of scrutiny will include trustees’ use of complaints data, performance under the retirement income covenant, oversight of advice-fee deductions and exposure to high-risk lead generation. ASIC will also review recommendations concerning separately managed accounts, managed investment schemes and private-credit distribution.

Markets, digital assets and resilience. ASIC will strengthen its expectations concerning cyber and operational resilience, crisis preparedness and supervision of critical market infrastructure, including ASX. Across public and private markets, ASIC will monitor leverage, liquidity, valuations and the retail distribution of private credit. It also intends to address AI-enabled manipulation, deepfakes and misinformation. Proposed digital asset reforms would introduce licensing and supervision of digital asset platforms and tokenised custody platforms, supported by guidance, systems changes and industry engagement.

What regulated entities should do now

Regulated entities should map the plans against their business model, products, governance arrangements and current remediation programs, then identify where additional assurance or uplift is required. Our Regulatory and Corporate team can help translate those priorities into a practical, risk-based program of work. We can assess how the regulators’ stated priorities intersect with your business model, strategy, products and existing risk profile, and identify areas requiring immediate attention, further assurance or longer-term uplift.

We can support gap assessments and framework updates, remediation plans, board and executive briefings, regulatory engagement, and responses to information requests, prudential reviews or investigations. Our sector experience enables us to distinguish between issues likely to attract close regulatory scrutiny and those that can be managed proportionately, helping you prioritise resources, demonstrate effective oversight and prepare confidently for APRA’s and ASIC’s evolving expectations.