(Re)Insurance and Regulation Focus - fortnight commencing 11 May 2026
11 May 2026
Key developments in the last fortnight
APRA calls for change in AI-related risk management and governance
APRA has released a letter to all APRA-regulated entities warning that governance, risk management, assurance and operational resilience practices are not keeping pace with the scale, speed, and complexity of AI adoption, calling for a step-change in how banks, insurers and superannuation trustees manage AI-related risks. The letter includes the findings of APRA’s supervisory review last year examining AI governance, which found that the use of AI introduced new financial and operational vulnerabilities for entities while information security practices are not coping with the rapid change of technology. APRA has also identified AI-related risks involving poor technical literacy of the Boards and the lack of contingency planning and transparency over AI model training. In its concluding remarks, APRA emphasised its expectation to “see a significant improvement in how entities are closing the gaps between the power of the technology they are using and their ability to monitor and control it”.
APRA Letter to Industry on Artificial Intelligence (AI) | APRA
ASIC puts industry on notice to uplift cybersecurity as frontier AI accelerates cyber threats
On 8 May 2026, ASIC Commissioner Simone Constant issued an open letter to AFS licensees and market participants, warning that frontier AI models are materially intensifying cyber risks by lowering the barrier to sophisticated attacks and accelerating both the speed and scale and cyber security exploitation. The letter reiterates ASIC’s existing expectation that cyber resilience is a core licensing obligation, and not merely an IT issue. ASIC has set out twelve practical actions focused on preparing the industry for these increased threats, including identifying and protecting critical assets and systems, strengthening cyber security fundamentals, minimising attack surfaces, patching vulnerabilities promptly and using AI for defensive purposes, where appropriate. ASIC will continue to monitor developments in this space closely and strongly recommends that its open letter is tabled at board and risk governance committees for all AFS licensees.
26-092MR ASIC calls for urgent cyber uplift as AI accelerates cyber threats | ASIC
APRA finalises targeted amendments to CPS 230
APRA has finalised targeted amendments to Prudential Standard CPS 230 Operational Risk Management, Prudential Practice Guide CPG 230 and the corresponding Material Service Provider Register template. The amendments, effective on 1 July 2026, introduce limited exemptions from specific contractual requirements in CPS 230 for material arrangements with certain categories of non-traditional service providers such as clearing and settlement facilities where counterparties typically contract on standard terms that cannot reasonably accommodate CPS 230’s prescribed content. These amendments were developed in response to industry feedback and reflects APRA’s ongoing effort to provide administratively efficient solutions for regulated entities while preserving the core objectives of operational resilience.
APRA finalises targeted amendments to CPS 230 Operational Risk Management | APRA
Consultation opens on curbing lead generation activity
The Treasury is seeking industry feedback on options to curb lead generation linked to financial products, with the objective to better protect consumers from high-pressure sales and cold calling. Lead generation refers to the process of identifying and attracting potential customers to build a sales pipeline. The purpose of the consultation and any subsequent law reform is to make lead generators more accountable for their conduct, strengthen the rules on unsolicited selling, address conflicted payment structures and disrupt harmful or misleading advertising. The consultation closes on 22 May 2026.
Curbing lead generation activity - Consult hub
APRA proposes to transition life insurance data collections to APRA Connect
APRA has written to all life companies to seek feedback on the proposed changes to the applicable reporting standards to transition all data collections from the legacy data collection system, Direct to APRA (D2A), to the current data collection system, APRA Connect. ARPA anticipates that this change will benefit both reporting entities and itself with reduced compliance burden, enhanced security, better data quality and a streamlined submission process via a single reporting platform. The consultation closes on 3 July 2026 and APRA expects any changes to take effect from the reporting period ending 31 December 2026.
Transition of Life Insurance D2A data collections to APRA Connect | APRA
Court rejects application to rein in class action exposure
In 2025, a class action was brought by consumers against a large finance company and a large insurer (together, the defendants) alleging that the defendants engaged in misleading or deceptive conduct, unconscionable conduct, unfair conduct, unjust transactions, and the provision of inappropriate personal advice in connection with the sale of add-on insurance through car dealerships. These insurance products were issued by the finance company and underwritten by the insurer between 2014 and 2021. The Supreme Court of Victoria refused an application made by the defendants for a soft class closure order, where the defendants wanted group members to register their claims within 12 weeks, or forfeit any share of a pre-trial settlement. For insurers, this decision is important as it means that an insurer defending a large open-class case in Victoria may have to head into mediation without a locked-in count of claimants and without the early certainty on exposure that usually shapes reserving and settlement strategy.
Court rebuffs bid to rein in class action exposure | Insurance Business
APRA and ASIC publish latest data on life insurance claims and disputes
APRA has published its life insurance claims and disputes statistics covering a rolling 12-month period from 1 January 2025 to 31 December 2025. These statistics present the key industry and entity-level claims and disputes outcomes for 14 Australian life insurers writing direct business, thereby providing important insights for industry participants. A selection of the published data is also published on ASIC’s MoneySmart online tool, which compares insurers across cover types and distribution channels on four metrics: the percentage of claims accepted, the length of time taken to pay claims, the number of disputes and the policy cancellation rates.
Life insurance claims and disputes statistics | APRA
Insurer fights ASIC’s allegations on misleading renewal notices
An insurer has rejected ASIC’s allegation in a Federal Court case that its general insurance renewal notices misled customers. In September 2025, ASIC commenced proceedings alleging that the insurer sent over 570,000 renewal notices over a period of five years which contained false and misleading representations about the 'last period premium' which did not reflect what customers had actually paid. This proceeding is a live test of how renewal-notice mechanics will be assessed under the misleading or deceptive conduct lens and signals that distorted comparisons may be conduct worthy of penalty action, not just remediation.
Key dates
- 15 May 2026 – Survey closes on ASIC’s proposed business register communications and digital improvements
- 22 May 2026 – Submissions close on Treasury’s proposed options to curb lead generation linked to financial products.
- 29 May 2026 – Submissions close on APRA’s proposal to remake Level 3 conglomerate standards.
- 1 July 2026 – AML/CTF obligations commence for tranche 2 entities.
- 1 July 2026 – Mandatory climate related financial reporting annual reporting period commences for Group 2 entities.
- 3 July 2026 – Submissions close on APRA’s proposal to transition life insurance data collections to APRA Connect.
In case you missed it
The Financial Accountability Regime commenced for insurers on 15 March 2025 and has been in-force for over a year. The Sparke Helmore team has been advising on the application of FAR and compliance measures, including conducting FAR simulation exercises for Accountable Persons, embedding and testing the effectiveness of entities’ FAR implementations. If this is of interest to you, please reach out and let us know.
