APRA Steps Up Pressure on Bendigo Bank Over Persistent Risk Weaknesses

Key Takeaways

• APRA Imposes Licence Conditions: The regulator has imposed licence conditions on Bendigo and Adelaide Bank after finding longstanding and pervasive weaknesses in its non-financial risk management framework.
• Years of Remediation Have Fallen Short: Several weaknesses have persisted despite years of work under Bendigo Bank’s enterprise-wide BEN+ risk transformation program.
• Fundamental Risk and Control Gaps Remain: Deloitte found the bank lacks a clear, complete and reliable view of its regulatory obligations, material risks and key controls, alongside deficiencies in governance, accountability, compliance management and risk oversight.
• Board Attestation and Independent Assurance Required: Bendigo Bank must undertake a comprehensive rectification program, engage an independent assurer and provide board attestation as part of the work.

Deep Dive

The Australian Prudential Regulation Authority imposed licence conditions on Bendigo Bank after an independent review found weaknesses in non-financial risk management spread across the organization, including shortcomings in governance, accountability, compliance management and risk oversight. Some had persisted through years of remediation.

APRA required Bendigo Bank to commission an independent root cause analysis in December 2025, looking for an explanation of why the problems had endured. Deloitte conducted the review. Its findings suggest a bank that has struggled not merely with individual controls, but with knowing precisely what needs to be controlled.

According to APRA, Bendigo Bank does not have a clear, complete and reliable view of its regulatory obligations, material risks and key controls. Deloitte also found deficiencies in the bank’s risk management capability and concluded that weaknesses were prevalent across the organization.

None of this arrived at the beginning of a remediation effort. Bendigo Bank has already been working through BEN+, its enterprise-wide risk transformation program, for several years. Yet many of the problems the program was supposed to address remained.

APRA’s conclusion was unusually plain. The regulator is not satisfied that Bendigo Bank has dealt with the root causes of its deficiencies or produced a sustainable improvement in risk management, despite what it described as significant opportunity to do so.

Under the licence conditions, Bendigo Bank must carry out a comprehensive rectification program and engage an independent assurer. Its board will also be required to provide an attestation as part of the work.

“Although Bendigo Bank is financially sound, with strong capital and liquidity positions, APRA is concerned with the gaps in its non-financial risk management framework,” APRA Deputy Chair Therese McCarthy Hockey said. “The weaknesses identified by the root cause analysis are significant, longstanding and require decisive action.”

That is precisely what makes the episode worth watching. Capital and liquidity are readily visible measures of a bank’s condition. The machinery underneath them (obligations identified correctly, risks understood, controls working, accountability established) is easier to tolerate as unfinished business, particularly when a transformation program is already supposed to be fixing it.

Eventually, the existence of the program becomes part of the problem. Several years of remediation followed by a finding of pervasive weaknesses leaves a regulator with an awkward question: not what has the bank done, but what has actually changed?

APRA has answered by demanding evidence that reaches beyond the bank’s own assessment of its progress. Independent assurance and board attestation put a harder edge around the next phase of remediation. The existing capital add-on gives that demand a financial consequence that will remain until APRA is convinced the work has stuck.

McCarthy Hockey said Bendigo Bank had engaged constructively and cooperatively with the regulator, adding that APRA was encouraged by the board’s commitment to addressing its concerns “promptly, effectively and in full.”

The action also extends beyond APRA. The prudential regulator said it has worked closely with the Australian Securities and Investments Commission and the Australian Transaction Reports and Analysis Centre, with the licence conditions forming part of a coordinated regulatory response focused on risk governance, accountability and oversight.

Bendigo Bank therefore enters another period of remediation, but under different terms. Completing actions and closing workstreams will not settle the matter. APRA has already seen years of that. What the regulator wants now is proof that the weaknesses underneath them are gone and that they stay gone.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.