Do banks and ADIs need to comply with APRA CPS 220 (Risk Management)?
A computed answer from the Rules Mate applicability engine, with the exact condition, the outcome for every structure and size, and the primary source.
Short answer: Yes
Yes. This obligation applies to banks and ADIs whatever their structure or size. The deciding fact: ADI — APRA-regulated.
The obligation in brief
Comply with APRA CPS 220 (Risk Management). Prudential Standard CPS 220 Risk Management, in force since 1 July 2019, requires every ADI, general insurer, life insurer and private health insurer to maintain a risk management framework covering all material risks, consistent with its strategic objectives and business plan. The Board is ultimately responsible.
Trigger: Being an APRA-regulated institution in the banking, general insurance, life insurance or private health insurance industries, or the Head of a group of such institutions.
Why banks & adis get a different answer
Rules Mate runs its applicability engine across 9 business structures and 6 size bands for each of the 35 industries it maps. For 32 of those industries the answer for "Comply with APRA CPS 220 (Risk Management)" is no. Banks & ADIs is one of the 3 where the answer is different: yes.
The deciding fact for banks and ADIs: ADI — APRA-regulated.
About the industry: Authorised deposit-taking institutions regulated by APRA under the Banking Act 1959.
Compare a professional services (general) business with 6–19 employees structured as a Pty Ltd company: the obligation does not apply (Requires APRA regulation).
Answer by business structure and size
Each cell is the engine's outcome for a business in banks & adis with that structure and size, assuming it sells to consumers and small businesses and holds customer contact details. "Check" means the obligation turns on a fact the industry does not settle.
| Structure | No employees | 1–5 employees | 6–19 employees | 20–99 employees | 100–499 employees | 500+ employees |
|---|---|---|---|---|---|---|
| Sole trader | Yes | Yes | Yes | Yes | Yes | Yes |
| Partnership | Yes | Yes | Yes | Yes | Yes | Yes |
| Trust | Yes | Yes | Yes | Yes | Yes | Yes |
| Pty Ltd company | Yes | Yes | Yes | Yes | Yes | Yes |
| Public company | Yes | Yes | Yes | Yes | Yes | Yes |
| Not-for-profit (unregistered) | Yes | Yes | Yes | Yes | Yes | Yes |
| Registered charity | Yes | Yes | Yes | Yes | Yes | Yes |
| Super fund | Yes | Yes | Yes | Yes | Yes | Yes |
| Foreign company | Yes | Yes | Yes | Yes | Yes | Yes |
What the obligation requires
- When due
- Ongoing. Risk management declaration lodged within three months of the annual balance date (four months for an ADI or banking NOHC that is not a disclosing entity, and for a Level 3 Head). Risk appetite statement, business plan and risk management strategy sent to APRA within 10 business days of Board approval of a new or materially revised version. Annual audit review; comprehensive review every three years.
- Evidence to keep
- Board-approved risk appetite statement, risk management strategy and three-year business plan; CRO appointment and reporting lines; management information system reports on material risks; annual audit review report to the Board Audit Committee; triennial comprehensive review report to the Board Risk Committee; signed risk management declaration (with any qualification and remediation steps).
- Maximum penalty
- CPS 220 sets no fixed monetary penalty. It is made under the Banking Act 1959, Insurance Act 1973, Life Insurance Act 1995 and Private Health Insurance (Prudential Supervision) Act 2015, so a breach exposes the institution to APRA's supervisory and enforcement powers under those Acts. A Board must qualify its declaration where there has been a significant breach of the framework
- Regulator
- APRA
- Jurisdiction
- Commonwealth (national)
Other obligations where banks & adis differ from the norm
- Comply with APRA CPS 230 (Operational Risk Management): Yes
- Comply with APRA CPS 234 (Information Security): Yes
- Comply with Australian sanctions law + screening (DFAT): Yes
- Comply with Design and Distribution Obligations (DDO): Yes
- Comply with Financial Accountability Regime (FAR) accountability obligations: Yes
- Comply with NCCP responsible lending obligations: Yes
- All 32 answers for banks & adis
Questions
- Do banks and ADIs need to comply with APRA CPS 220 (Risk Management)?
- Yes. This obligation applies to banks and ADIs whatever their structure or size. The deciding fact: ADI — APRA-regulated.
- Is the answer the same for every industry?
- No. For 32 of the 35 industries Rules Mate maps, the answer is no. Banks & ADIs is one of 3 industries with a different answer.
Related
Sources
Computed by the Rules Mate applicability engine from the published obligation corpus; facts last checked 3 October 2026. Rules Mate is not a law firm and this is general information, not legal advice. Confirm your position with the regulator source or a qualified adviser before acting.