APRA CPS 520 Fit and Proper: who must be assessed and how

What CPS 520 requires

CPS 520 (Fit and Proper) mandates that APRA-regulated entities establish a policy and processes. These must ensure each ‘Responsible Person’ is fit and proper for their designated role. This requirement is fundamental to maintaining the stability and integrity of the financial system. CPS 230 readiness scorer

The standard’s application extends to a range of regulated entities, including ADIs (banks, credit unions, building societies), general and life insurers, private health insurers, and RSE licensees (super fund trustees). Equivalent standards also apply to friendly societies and authorised non-operating holding companies.

CPS 520 operates within APRA’s broader prudential framework and is intended to be considered in conjunction with other standards. These include CPS 510 (Governance), CPS 511 (Remuneration), CPS 220 (Risk Management) and CPS 230 (Operational Risk).

Who is a Responsible Person

Responsible Persons are individuals who must be assessed for fitness and propriety under APRA CPS 520. This group includes directors, the CEO, and senior managers. The Standard requires assessment of those whose decisions can significantly affect the prudential management of the entity. Additionally, individuals filling key roles, as defined within the Standard, are also considered Responsible Persons.

The specific individuals who fall under this definition vary depending on the type of entity being assessed – for example, an ADI, an insurer, or a Registered Superannuation Entity (RSE). The Standard details the specific categories of individuals required to be assessed for each entity type.

It is important to recognise that the group of Responsible Persons identified under CPS 520 shares considerable overlap with, but is not precisely the same as, the accountable persons identified under the Financial Accountability Regime (FAR).

The fit-and-proper assessment

The fit-and-proper assessment is a core requirement of APRA CPS 520. It involves evaluating individuals against five criteria: character, diligence, honesty, judgement and integrity; competence, including knowledge, skills, experience and qualifications; financial soundness; reputation; and any conflicts of interest. This assessment is designed to determine whether a person possesses the qualities necessary to perform their role effectively and responsibly within the regulated entity. director duties self-check

Entities are obligated to undertake a fit-and-proper assessment before an individual is appointed to a key role, and must repeat this assessment at least once each year. This ongoing reassessment ensures that the individual continues to meet the required standards.

Any adverse findings are considered during the assessment process. These findings may include criminal convictions, regulatory action, civil judgments, bankruptcy, and actions taken by the Australian Securities and Investments Commission (ASIC) that prevent a person from holding certain positions.

Notifications to APRA

The Standard requires entities to notify APRA of matters concerning their Responsible Persons. These notifications cover key events such as the appointment of a Responsible Person, a Responsible Person ceasing to hold their role, and any adverse findings relating to a Responsible Person.

The Standard and associated Reporting Standards specify the required timing for these notifications. Entities must adhere to these timelines to ensure compliance.

APRA retains the authority to object to the appointment of a Responsible Person or to require the removal of a Responsible Person if it determines that the individual is not fit and proper.