General insurers compliance in Australian Capital Territory

FAR deferred remuneration arrangements (40% deferral 4 years)

FAR accountable persons must have 40% of variable remuneration deferred 4 years.

Comply with APRA CPS 234 (Information Security)

APRA-regulated entities must maintain information security capability commensurate with the size and extent of threats.

Comply with Financial Accountability Regime (FAR) accountability obligations

Banking entities from 15 March 2024; insurers and super trustees from 15 March 2025.

Comply with claims handling + settling as a financial service (s 766A)

From 1 January 2022, insurance claims handling is a financial service requiring AFSL authorisation.

Comply with APRA CPS 220 (Risk Management)

APRA-regulated entities must have a comprehensive risk management framework.

Notify the OAIC and affected individuals of eligible data breaches

Eligible data breaches must be notified to OAIC and affected individuals 'as soon as practicable'.

Comply with Design and Distribution Obligations (DDO)

Issuers and distributors of retail financial products must have a Target Market Determination (TMD) and distribute consistently with it.

Comply with APRA CPS 230 (Operational Risk Management)

APRA-regulated entities must manage operational risk including a comprehensive third-party / outsourcing register from 1 July 2025.

Avoid unfair contract terms in standard form consumer & small business contracts

From November 2023, unfair contract terms carry pecuniary penalties — up to $100M per term (from 28 March 2026).

Manage business interruption claim definitions (post-pandemic precedent)

BI insurance policies must clearly define pandemic exclusions per Federal Court guidance.

Comply with General Insurance Code of Practice (ICA)

ICA Code binds member insurers on conduct + claims + complaints.

Publish a Privacy Policy compliant with APP 1

Every APP entity needs a clearly-expressed Privacy Policy covering APP 1.4 requirements.