APRA APS 222 Associations with Related Entities explained

What APS 222 is, in one line

**Prudential Standard APS 222 *Associations with Related Entities* is the Australian Prudential Regulation Authority (APRA) standard that governs how an authorised deposit-taking institution (ADI) manages and limits its dealings with, and exposures to, related entities — other entities in its group, including parents, subsidiaries and entities connected through control or shareholding. Its stated objective is that ADIs "identify, monitor and control contagion risks arising from their associations and dealings with related entities and those creating step-in risk".

In short: if you run a bank, building society or credit union in Australia and it sits inside a wider corporate group, APS 222 sets the boundaries on how exposed you can be to the rest of the group.

The standard is made under section 11AF of the Banking Act 1959 and the current version commenced on 1 January 2022. It is part of the wider financial services regulatory architecture.

Who APS 222 applies to

APS 222 applies to all ADIs on a Level 1 basis (the ADI itself, or its extended licensed entity), except purchased payment facility (PPF) providers. A foreign ADI is only required to comply with paragraphs 23 to 28 of the standard. Its quantitative exposure limits are measured against the ADI's Level 1 capital calculated under APS 111.

The standard is built around the concept of a related entity, which APS 222 defines broadly as an entity that "could give rise to risk to the ADI" because of conflicts of interest or contagion. It also uses the concepts of related individuals (for example senior managers and Board members) and step-in risk entities — entities "to which an ADI is likely to provide support beyond any legal or contractual obligation to do so". Do not assume "related entity" maps neatly onto the accounting definition of a subsidiary; check the definitions in the standard itself.

What the standard requires

APS 222's key requirements are that an ADI must:

• have a Board-approved policy governing its associations and dealings with related entities;
• identify, monitor, manage and control potential contagion risk between the ADI and its related entities and step-in risk entities;
• meet minimum requirements for dealings with related entities and step-in risk entities that may give rise to prudential concerns; and
• keep its exposures to related entities within limits.

The policy must, at a minimum, require the ADI to deal with related entities on an arm's-length basis and on market terms and conditions, and set individual and aggregate exposure limits having regard to what would be approved for unrelated entities of equivalent credit status and to the impact on the ADI's stand-alone capital and liquidity if a related entity failed.

Two further rules carry weight:

• Provision of support. An ADI must not provide support to, or accept support from, related entities unless the support is expressed clearly in legal documentation, fixed as to time and amount, and consistent with its policies and the standard.
• Group operations. Where an ADI shares premises, back-office functions or outsourced services with group members, it must ensure those arrangements do not adversely affect its safety and soundness as a stand-alone entity, document them in written service agreements, and ensure service providers are obliged to follow APRA directions.

If APRA is not satisfied with an ADI's systems and controls, or considers it exposed to substantial contagion risk, it may set higher capital requirements, require additional controls or reporting, or require the ADI to reduce contagion risk.

Exposure limits and how they work

Exposures to related entities must not exceed the following limits, measured against Level 1 Tier 1 Capital:

Exposure	Limit (% of Tier 1 Capital)
An individual related ADI (or overseas-based equivalent)	25%
All related ADIs and overseas-based equivalents, in aggregate	75%
An individual regulated related entity (other than an ADI)	25%
An individual unregulated related entity	15%
All related entities other than related ADIs, in aggregate	35%

When these limits apply, the large exposure limits in paragraph 30 of APS 221 do not apply to the ADI's exposures to its related entities. An ADI's exposure to a subsidiary within its extended licensed entity (ELE) is not subject to these limits. The standard also notes that none of the limits permits a transaction that another prudential standard prohibits.

Contagion and step-in risk: the substance behind the rules

The numbers exist to serve a principle: an ADI must remain sound as a stand-alone entity. Group structures can transmit problems into the regulated ADI. A stressed parent, a failing subsidiary or an associate with reputational problems can all create pressure on the ADI to provide funding, capital or other support.

APS 222 addresses this in two ways:

• Contagion risk. The ADI must identify, monitor and control the ways in which problems in related entities could spread to it, including through shared operations, branding and product distribution.
• Step-in risk. Even where there is no contractual obligation, an ADI may feel commercial or reputational pressure to support an entity. Attachment A sets requirements for identifying, measuring and managing that step-in risk.

This is why governance and policy requirements carry as much weight as the quantitative caps.

What ADIs need to do in practice

For compliance, risk and finance teams, APS 222 translates into a recurring set of obligations:

• Maintain a current related-entity register that captures the prudential definition, not just accounting subsidiaries, plus step-in risk entities.
• Measure exposures consistently on a Level 1 basis, including off-balance-sheet and contingent exposures.
• Apply and monitor the limits continuously, with clear escalation when exposures approach the caps.
• Document arm's-length dealing for intra-group transactions, pricing and services, and put any support into fixed, documented terms.
• Test stand-alone resilience — can the ADI operate safely if a related entity fails or a shared service is withdrawn?
• Report to APRA through the relevant reporting standards.
• Refresh the Board-approved policy periodically and after any material change to group structure.

New group structures — particularly where an ADI sits alongside a fintech, payments or crypto venture, or an insurance or funds-management arm — deserve specific attention. APS 222 contains specific restrictions on funds management: for example, an ADI must not act as manager, responsible entity or trustee in relation to funds management, and must deal with a funds management vehicle on an arm's-length basis.

Common pitfalls and supervisory focus

• Under-scoping "related entity." Relying on the accounting consolidation boundary and missing entities the prudential definition captures, or step-in risk entities.
• Incomplete exposure measurement. Overlooking guarantees, undrawn facilities and derivatives that are still exposures in substance.
• Non-arm's-length dealings. Intra-group pricing or funding on favourable terms that effectively subsidises the rest of the group at the ADI's expense.
• Undocumented support. Informal comfort or support that is not fixed as to time and amount.
• Treating limits as a one-off check** rather than a live, continuously monitored control.

Treat the published version of APS 222 on the APRA website as the source of truth for limits, definitions and effective dates.