APRA v Bedingo And Adelaide Bank: A Wake-up Call For Directors And Officers

On 10 August 2026, after Bendigo and Adelaide Bank Ltd (BAB) admitted that it breached its obligations under the former Banking Executive Accountability Regime (BEAR) in relation to a cybersecurity incident suffered by BAB in March 2023, the Australian Prudential and Regulatory Authority (APRA) commenced proceedings against BAB.

This proceeding is a first from APRA and will be watched with interest given its potential far reaching implications not only for companies but also their directors and officers. APRA is not the only regulator active in this area, the Australian Securities and Investments Commission (ASIC) has made clear that one of its focuses for the next 12 months will be on whether corporations and their directors and officers have adequate systems in place to manage cyber, AI and privacy risk. Following the implementation of Financial Accountability Regime (FAR) and the recent decision in ASIC v Bekier [2026] FCA 196 (Bekier) it is no longer enough for directors and officers to simply know that their corporation has relevant risk management processes and procedures in place; they need to satisfy themselves that those processes and procedures are likely to be functioning as intended otherwise they expose themselves to civil penalty action by the regulators.

What happened?

Regulatory context

As at the time of the cybersecurity incident, BAB was subject to, amongst other things:

1. APRA CPS 234 Information Security, a mandatory information security standard which requires banks, insurers, superannuation funds, and third-party providers that handle their data, to maintain robust cybersecurity controls, processes and resilience; and
2. the BEAR. ¹

Key agreed background information

In December 2014, BAB entered into an agreement to launch a new banking model called “Alliance Bank” with the following credit unions (which became authorised representatives of BAB): AWA Mutual Ltd, BDCU Limited (BDCU), Circle Mutual Limited and Service One Mutual Limited (Service One). Alliance Bank’s banking function was conducted via a software solution called “Ultracs”, which had been developed by Ultradata Australia Pty Ltd (Ultradata).

In about September 2017, BAB engaged Deloitte to conduct a review on technology risks and controls in relation to, amongst other things, Ultracs. Deloitte’s report identified numerous areas of concern regarding Ultradata’s information security controls.

On 2 June 2020, CQR (now part of CyberCX) reported to BAB’s Information Security Team regarding its testing of customer authentication controls on the Ultracs instance used by Service One Alliance Bank (Report). CQR’s findings included the matters referred to concerns about weak passwords and the lack of multifactor authentication and made several recommendations for addressing those weaknesses.

On or about 27 October 2022, a threat actor conducted a brute force attack on the Ultracs instances of BDCU and Service One by exploiting the vulnerabilities identified by CQR, which resulted in thousands of BDCU Alliance Bank and Service One Alliance Bank customers being locked out of their accounts. Experteq (which hosted Alliance Bank’s Ultracs instances) recommended to the Head of Alliance bank implementing changes recommended by CQR. The same recommendations were repeated in a 29 November 2022 Ultradata customer bulletin, which was received by BAB. None of those recommendations were actioned.

The incident

Between about 3 and 7 March 2023, a threat actor executed a brute force attack on the Ultracs instance used by Service One (Incident). The threat actor gained access to 257 Service One customer accounts and ultimately made 154 payments from those accounts totalling $273,140.

BAB notified APRA about various matters arising from the Incident between March 2023 – June 2024.

Accountable persons & agreed contraventions

AFRA and BAB have agreed a Statement of Agreed Facts (SOAF) which:

1. identifies the following BAB officers (to include Chief Technology Officer and Chief Customer Officer) the as being accountable for the risk management issues relating to the Incident; and
2. admits that its conduct between 2 June 2020 (when it received the Report) to 2 June 2023 (by which time it had taken appropriate action in response to the Incident), contravened section 37C(a) of the Banking Act 1959 (Cth) by failing to have:

1. adequate customer authentication controls for the prevention and detection of unauthorised access to, and unauthorised payments from, Alliance Bank customer accounts;
2. a systematic testing program for the customer authentication controls applicable to Alliance Bank Digital Access; and
3. appropriate governance and risk management for the information security of the platform and managed services that enabled Alliance Bank Digital Access.

Whilst the SOAF arguably does its best to shield BAB’s Board from responsibility, it also raises questions as to the extent to which its Board ought to have appreciated the substantial gaps in risk management processes and procedures.

APRA and BAB have agreed that the appropriate civil penalty is AUD 8 million.

Key takeaways

APRA (and also ASIC) is no longer only focussing on the outcomes of incidents or misconduct but is also concerned about governance and executive accountability for the processes and procedures in place. APRA’s action against BAB also gives insight into what approach APRA (and ASIC) might take going forward with beaches of the FAR.

Beyond APRA having stated that it has worked closely with ASIC in relation to its investigations into BAB, Alliance Bank and the Incident, ASIC has been silent in relation to the Incident and the proceeding. It may be that ASIC is awaiting the outcome of the Federal Court of Australia’s decision before deciding what, if any, action to take against BAB or its directors and officers for potential breaches of the Corporations Act and the ASIC Act.

Whilst the SOAF accepts that the outcomes/reports of key tests of Alliance One’s systems, particularly Ultracs instances, were defective but were not escalated to senior management (such that they did not have knowledge if the issues), the decision in Bekier confirms that this may not be a defence. In Bekier it was found that executive management and the Board can only rely upon such a failure if they can demonstrate that they took adequate steps to ensure that the relevant risk management processes and procedures were appropriate and had satisfied themselves that they were likely working.

In terms of matters of cyber security and AI, it is clear that Australian regulators will now take enforcement action not only against regulated entities but also and their executives if:

1. their organisation is the victim of a cybersecurity incident, or commits a privacy breach (for example, through use of AI in a manner that is inconsistent with the Privacy Act); and
2. their organisation’s technology risk management processes and procedures are found to not be reasonable, and adequate protect that organisation’s individual risk profile,

this in turn could lead to direct action by affected consumers, third parties and/or shareholders. Though these actions will face significant hurdles in proving loss.

APRA’s civil penalty action against BAB is therefore another warning to Australia’s executives that they are under increased scrutiny particularly with respect to governance and risk management. With the implementation of FAR (which not only extends to banks but also insurers and superannuation trustees), there is increased exposure for the individual executives and directors having extended executives and directors’:

1. accountability beyond their duties in ss.180-181 of the Corporations Act, to include acting with ‘integrity’ and being 'open, constructive and co-operative' with the regulator and in respect of which there is presently no guidance in Australia; and
2. exposure as a result of a more expansive enforcement toolkit which not only includes disqualification but also a civil penalty framework and the potential for entities to withhold 40% of any remuneration attributable to the senior executive’s role for 4 years and/or reduce the remuneration for noncompliance.

In defending any regulatory action, it will be key for entities and their executives to demonstrate that they have taken “reasonable steps” set out in section 20 of FAR and clarified in section 22.

Footnote

1 Treasury Laws Amendment (Banking Executive Accountability and Related Measures) Act 2018 (Cth), which was effectively replaced by the FAR in September 2023