The Australian Prudential Regulation Authority (APRA) has released its 2026–27 Corporate Plan (the Plan), outlining its strategic priorities for the next four years and its policy and supervisory agenda for the next 12 to 24 months.

Although the Plan covers banking, insurance and superannuation, it provides valuable insight into the issues mutual banks can expect APRA to examine closely during 2026–27.

A central theme is resilience. APRA remains focused on whether regulated institutions can absorb shocks and continue providing critical services in the face of cyber incidents, AI-enabled threats, geopolitical tensions, reliance on common technology providers and economic stress. At the same time, APRA is seeking to balance financial safety with productivity, competition and the cost of regulation.

For mutual banks, five areas stand out:

1. Operational resilience is moving beyond CPS 230 implementation

Prudential Standard CPS 230 Operational Risk Management generally commenced on 1 July 2025, but implementation was only the first step.

APRA's Plan signals continued attention on cyber resilience, AI-enabled threats, concentrated reliance on common technology platforms and the management of material service providers.

The focus is likely to move from establishing frameworks to demonstrating that they work effectively. Boards and senior management should be prepared to show how critical operations and tolerance levels have been identified;

• how material service providers and concentration risks are managed;
• how business-continuity arrangements are tested; and
• how weaknesses are escalated and addressed.

Documented compliance alone will not be enough. Mutual banks should be able to demonstrate that their operational-resilience arrangements are embedded, tested and effective.

2. AI is emerging as a prudential risk issue

The Plan identifies frontier AI and AI-enabled cyber threats as areas requiring attention. While it does not create a standalone AI prudential standard, the use of AI may engage existing expectations concerning governance, risk management, information security, operational resilience and service-provider oversight.

Mutual banks should consider whether their frameworks adequately address:

• approved uses of AI and accountability for related risks;
• employee use of generative AI;
• AI used in credit, fraud, cybersecurity and customer service;
• data quality, privacy, security and human oversight; and
• AI functionality embedded in third-party products.

Institutions may be exposed to AI-related risks even where they have not developed or directly implemented an AI system. Understanding vendor-supplied technology will therefore be essential.

3. Third-party and concentration risks remain priorities

APRA has identified concentrated reliance on common technology platforms and material service providers as a potential threat to financial-system resilience.

This is particularly relevant to mutual banks that rely on shared core banking platforms, payment systems, cloud services and outsourced arrangements.

Institutions should understand:

• which critical operations depend on each provider;
• whether providers rely on material subcontractors;
• whether several services depend on the same infrastructure;
• whether viable alternatives or transition arrangements exist; and
• how disruption to a common provider could affect multiple institutions.

Contracts remain important, but they cannot eliminate concentration risk. Contingency planning, scenario testing and effective provider monitoring will also be required.

4. Governance and accountability reforms are continuing

APRA intends to finalise requirements designed to strengthen governance across regulated industries, with commencement currently expected at the beginning of 2028.

APRA and ASIC also intend to consult on changes to the Financial Accountability Regime (FAR) aimed at reducing administrative burden without weakening accountability standards.

Mutual banks should continue monitoring these developments and consider reviewing:

• board composition, skills and renewal;
• board and committee responsibilities;
• accountability statements and maps;
• escalation and consequence-management arrangements; and
• whether formal governance documents reflect actual decision-making practices.

The key issue will be whether governance arrangements support effective challenge, clear accountability and timely action—not merely whether the required documents exist.

5. Prudential expectations for banks continue to evolve

APRA's banking agenda remains focused on financial resilience while supporting productivity and reducing unnecessary regulatory burden.

Key initiatives include:

• thematic reviews of lending practices;
• consultation on revisions to bank liquidity standards;
• targeted changes to the bank capital framework;
• development of a system-risk stress test; and
• continued resilience and crisis-preparedness work.

The liquidity review may be particularly relevant to mutual banks. Its impact will depend on whether and how APRA differentiates according to institutional size, business model, funding profile and liquidity risk.

Mutual banks should also be prepared for scrutiny of lending standards, risk appetite and stress-testing assumptions as economic conditions evolve.

What does this mean for mutual banks?

APRA's Corporate Plan indicates that supervision is increasingly focused on an institution's capacity to anticipate, withstand and respond to disruption.

Boards should expect scrutiny of:

• operational and cyber resilience;
• service-provider and concentration risk;
• AI and technology governance;
• geopolitical and economic risk;
• lending standards and stress testing; and
• governance effectiveness.

The direction is clear: prudential compliance is increasingly connected to governance quality, operational effectiveness and organisation-wide resilience.

For mutual banks, this is more than a compliance challenge. Institutions that understand their dependencies, test their resilience and strengthen decision-making will be better placed to protect members, maintain trust and respond confidently to the next phase of prudential reform.

How MM Legal+ Can Help

At MM Legal+, we assist organisations with governance frameworks, policy development, technology and supplier contracting, operational resilience obligations and broader regulatory compliance requirements.

Need assistance reviewing your operational resilience arrangements, service provider contracts, or governance framework ahead of APRA's 2026-27 priorities? Contact MM Legal+ to discuss how we can help.