APRA Targets Cyber Governance Failures: CPS 234 Compliance Lessons As Bank Faces $8m Penalty

APRA’s most recent accountability enforcement action against Bendigo and Adelaide Bank (BAB) for failures to address known cyber weaknesses within its group demonstrates how seriously it takes cyber risk management.

APRA has alleged in Federal Court proceedings that clear gaps in executive accountability by BAB under the BEAR framework (the precursor to FAR) resulted in cyber-attacks and has sought to impose over $8 million in penalties.

What happened?

CPS234 weaknesses and cyber attack

APRA commenced proceedings on 10 August 2026, lodging both the Originating Process and Statement of Agreed Facts and Admissions (SAFA).

The SAFA details a series of cyber security recommendations that remained unactioned over an extended period, ultimately culminating in a cyber-attack in March 2023 on BAB’s Alliance Bank business. The resulting loss to consumers was $140,110, a fraction of the proposed penalty.

The SAFA sets out a long history of known cyber vulnerabilities, including weak password configurations, lack of mandatory multi-factor authentication and CAPTCHA, a high-priority recommendation for external testing and an observation of “immature” information security governance at the provider of a core banking system software, Ultradata.

These findings were logged into a tracking tool but were never escalated to BAB or Alliance Bank management.The findings were not assessed against BAB’s Operational Risk Framework or provided to the third-party provider for remediation.The vulnerabilities remained unactioned until March 2023 when a brute force cyber-attack necessitated action.

BAB’s own internal post-incident review concluded that the cyber-attack could likely have been avoided had the identified risks been properly assessed, escalated, and managed.

BEAR accountability mapping failures

APRA identified, and BAB accepted, a material gap in BEAR accountability since 29 August 2022. At that time BAB updated its Chief Technology Officer's accountability statement to specifically exclude "IT Operations for Alliance Bank" and "Support and maintenance of Business Managed IT". These responsibilities were not allocated to any other accountable person, despite being flagged at a BEAR workshop for new ownership. From 29 August 2022 until 30 August 2023, no accountable person's statement covered Alliance Bank information technology operations.

APRA has sought Federal Court orders under the Banking Act 1959 (Cth) that BAB failed to:

• take reasonable steps to conduct the business of Alliance Bank with due skill, care and diligence by not:
  • having adequate customer authentication controls;
  • undertaking a systematic testing program for the customer authentication controls as required under CPS234;
  • having appropriate information security governance and risk management for systems that allowed digital access to customer accounts; and
• ensuring that the responsibilities of the accountable persons covered all parts or aspects of the Alliance Bank operations.

APRA is also seeking pecuniary penalties including costs.

What should APRA-regulated entities be doing now?

The obligations imposed by CPS 230 and CPS 234 requires regulated entities to regularly and diligently test and consideration controls in place to manage cyber risk. Action items and recommendations arising from audits and incident reviews can be overwhelming – simple slips can problematically mean that they do not make their way to decision makers and accountable persons. All APRA regulated entities, not just those subject to FAR, should be regularly reviewing audit findings and recommendations, ensuring that they are progressed according to significance and potential to cause consumer harm.

BEAR has, of course, been superseded by FAR. APRA has been clear that FAR entities must have full and comprehensive accountability mapping. For prudentially regulated entities, accountability maps and statements should be thoroughly reviewed and stress-tested for gaps. This is particularly so in times of organisational change - mergers, successor fund transfers, and corporate restructures.

How we can help you

Our Regulatory, Corporate and Cyber practices can provide practical advice on mapping accountabilities under FAR, and understanding obligations CPS230 and CPS234.We have in depth experience in addressing audit and review findings, including from CPS234 tripartite reviews, and supporting directors and executives in developing, implementing and managing their governance arrangements.