Australia’s prudential regulator is intensifying its supervision of artificial-intelligence risk, private-credit exposures and the technology providers shared by financial institutions, while preparing a system-wide stress test built around AI-driven disruption.
In its November System Risk Outlook, the Australian Prudential Regulation Authority said banks, insurers and superannuation funds remain financially strong. Its first System Risk Stress Test found that participating banks and funds were resilient to the market and liquidity shocks examined. The exercise nevertheless exposed vulnerabilities in concentration, common dependencies and mismatched assumptions that could amplify pressure across institutions.
APRA’s 2027 exercise will extend that work to banks, superannuation funds and life insurers. It will test severe but plausible scenarios in which rapid AI adoption disrupts business models or a reassessment of AI-related asset values produces a sharp market correction.
The regulator is also increasing its supervisory engagement with institutions using AI. Existing prudential standards on governance, information security, operational resilience and third-party risk remain the foundation, but APRA wants stronger evidence that emerging risks are identified and managed. It is formalising information collection on material service providers, after significant institutions reported dozens of providers supporting critical operations.
Private credit presents a separate visibility problem. APRA estimates the Australian market at no more than A$250 billion, less than four per cent of the banking system, with direct links to prudentially regulated institutions limited overall. But recent insolvencies, withdrawal restrictions and weaknesses identified in governance, valuation, disclosure and liquidity management have sharpened concern about concentrated exposures.
Quantum preparedness is now part of the same supervisory agenda. APRA is asking regulated institutions to identify vulnerable cryptography across systems, sensitive data and service providers, and has begun testing preparedness with a subset of firms. The regulator’s message is less that a single shock is imminent than that overlapping financial and operational pressures now need to be managed as one problem.
