APRA Puts Bendigo Under Licence Conditions: What a $70m, Three-Year Risk Overhaul Means for Your Panel

1. What APRA actually did

APRA has imposed additional conditions on Bendigo and Adelaide Bank’s banking licence. The bank must prepare and implement a comprehensive rectification program addressing its risk management deficiencies, engage an independent assurer to oversee that work, and provide board attestation as part of the remediation. The $50 million operational risk capital add-on already applied from 1 January 2026 stays in place until APRA is satisfied the underlying prudential concerns have been resolved.

The trigger was a root cause analysis conducted by Deloitte, commissioned after APRA directed a review in December 2025 — itself prompted by the bank’s own AML/CTF compliance review completed in November 2025. The findings were blunt. Non-financial risk management weaknesses were described as “prevalent across the organisation”. The bank was found not to have “a clear, complete and reliable view of its regulatory obligations, material risks and key controls”. Material deficiencies were identified in governance, accountability, compliance management, risk oversight and capability — and they had persisted despite years of remediation effort through the bank’s own transformation program.

APRA Deputy Chair Therese McCarthy Hockey framed the distinction that matters most for anyone reading this from a broker’s desk: “Although Bendigo Bank is financially sound, with strong capital and liquidity positions, APRA is concerned with the gaps in its non-financial risk management framework.” She described the weaknesses as “significant, longstanding and require decisive action”. APRA also noted the action was coordinated with ASIC and AUSTRAC.

The bank did not contest the assessment. CEO Richard Fennell said: “Our current non-financial risk management capabilities are clearly not where they need to be, and our risk rectification plan will be designed to drive a fundamental shift in our management of non-financial risk.” Chair Vicki Carter said the board was “very disappointed” and acknowledged “significant work ahead of us to uplift our risk management”. The program is expected to run for approximately three years at a pre-tax cost of $70 million, already booked in the FY26 result ($49.0 million after tax), with the CEO personally sponsoring it.

2. The week before: a BEAR admission and an $8 million penalty

On 11 August 2026, APRA announced that Bendigo and Adelaide Bank had admitted breaching its obligations under the Banking Executive Accountability Regime in relation to a cyber incident at Alliance Bank, which operated under the bank’s ADI licence. Between 3 and 7 March 2023, threat actors accessed approximately 257 customer accounts and executed 286 unauthorised transactions totalling around $490,000 across 87 customers. All affected customers were reimbursed; roughly $140,000 was never recovered.

The detail brokers should sit with is not the incident. It is the cause. Password settings permitted very weak passwords, multiple customer accounts shared identical passwords, and system design allowed attackers to identify valid customer IDs. These weaknesses had been flagged in penetration testing in 2020 and remained unaddressed until the breach in March 2023. The bank admitted it had failed to systematically test its authentication controls as required under Prudential Standard CPS 234 — there was no control testing of those systems between January 2021 and March 2023 — and that responsibility for the relevant IT operations sat outside any accountable person’s accountability statement for a twelve-month period.

A pecuniary penalty of $8 million has been proposed, subject to Federal Court approval. APRA confirmed the historical control weaknesses were remediated after the incident and said it has no current security concerns about the institution. BEAR was replaced by the Financial Accountability Regime in March 2024, but the underlying diligence and accountability obligations carried across.

3. Why this is a panel question, not a headline

Bendigo matters to the broker channel. Its residential lending book stood at $66.4 billion at FY26 out of $87.1 billion in total lending. Its dedicated broker proposition, Bendigo Bank Broker, replaced the Adelaide Bank brand through a rolling aggregator onboarding program that closed in August 2024 with nine aggregators offering Bendigo-branded product. At the time, the bank reported median conditional approval in under six minutes and unconditional approval in four days.

But the channel picture had already shifted before APRA acted. In the half to December 2025, third-party flows fell 21 per cent, dropping from 46 per cent to 36 per cent of new mortgages, with third-party share of the back book contracting from 47 per cent to 43 per cent year-on-year. Total lending fell 1.9 per cent to $84.2 billion and residential lending fell 2.3 per cent to $65.1 billion, with settlements down 15 per cent. The bank was clear about why: as Fennell put it, “We made the strategic decision to exit our legacy mortgage partner business which impacted loan growth for the half.” Proprietary retail channels wrote 47 per cent of new mortgages over the same period, supported by the new Bendigo Lending Platform, which cut average approval times to roughly seven days.

So the licence conditions land on a lender that was already deliberately re-weighting away from parts of the third-party channel and toward its own distribution. That combination — a strategic channel shift plus a mandatory three-year risk program — is what makes this a panel question rather than a news item. It is not a reason to stop writing Bendigo. It is a reason to know exactly how much of your book depends on it and why.

4. What a multi-year remediation actually does to service

The most useful precedent on the record is ANZ. APRA applied a $500 million operational risk capital add-on in 2019, increased it by $250 million in 2024, and increased it again to $1 billion in April 2025 when it accepted a court enforceable undertaking. APRA Chair John Lonsdale used almost identical language to the Bendigo finding: “Problems with the bank’s management of non-financial risks are persistent and prevalent across the bank.” The undertaking required an independent reviewer to conduct root cause and gap analysis, a remediation plan, independent oversight of delivery, written attestations from accountable persons and board committee chairs, and remediation accountability linked to executive remuneration scorecards.

The structure imposed on Bendigo is recognisably the same architecture at a smaller scale. What that architecture does inside a bank is predictable, and it is worth being honest that the following is a reasoned expectation rather than an announced fact:

• Change capacity gets rationed. Remediation work competes with product, pricing and platform work for the same delivery teams. Discretionary channel enhancements tend to move down the queue.
• Verification tightens before it loosens. When the finding is about controls and obligations, the earliest visible changes are usually in documentation standards, identity verification and source-of-funds evidence — areas that touch broker files directly.
• Exceptions become harder. Where a lender is being assessed on whether its controls are consistently applied, credit discretion narrows and escalations take longer.
• Communication improves before turnaround does. Banks under scrutiny typically invest in channel messaging early because it is cheap; service-level recovery follows the underlying system work, which is slow.

5. Reading the FY26 numbers: sound, but busy

The unaudited FY26 result released alongside the announcement supports APRA’s “financially sound” framing. Cash earnings after tax came in at $530.2 million, statutory net profit after tax at $375.1 million, and return on equity at 8.01 per cent. Net interest margin rose seven basis points to 1.95 per cent. The CET1 ratio sat at 11.34 per cent and the liquidity coverage ratio at 140.2 per cent for the June quarter. Customer deposits stood at $74.1 billion. In the second half, residential lending grew 1.9 per cent, agribusiness 10.6 per cent and portfolio funding 16.8 per cent.

Read those numbers as a broker rather than an investor. Residential lending returned to growth in the second half, which is a constructive signal for appetite. But the bank is now carrying a $50 million capital charge, a $70 million rectification program, and a separately disclosed AML/CTF compliance program that it flagged at the February half-year as costing $70–90 million over three years. It is also completing the RACQ Bank acquisition in the first half of FY27, adding roughly 90,000 customers. That is a substantial amount of simultaneous internal change for a bank of this size.

6. The read-across to your own business

Here is the part that applies whether or not you have ever written a Bendigo deal. APRA’s finding was not that the bank had no assurance over its systems. It received annual assurance reports. The finding was that holding assurance reports is not the same as testing the controls those reports are supposed to cover. Between January 2021 and March 2023 the authentication controls were never actually tested, and a vulnerability identified in 2020 sat unremediated for two and a half years.

Every broking business has a version of that gap. You have a compliance manual. You have an aggregator audit that samples files. You may have a cyber policy that a staff member signed on induction. None of that is the same as testing whether the control works.

Under the Best Interests Duty, the obligation is to act in the client’s best interests and to be able to demonstrate it — which in practice means your evidence has to survive being examined, not merely exist. ASIC’s reviews of the broker channel have consistently focused on the reasoning behind lender and product recommendations rather than the presence of a form. The same logic applies to your operational controls. Ask the uncomfortable questions:

• When a staff member left, who confirmed their CRM, aggregator platform and lender portal access was actually revoked — and is there a record of that check?
• How are client identity documents and bank statements stored, and who outside your business can reach them?
• If your lender selection was challenged on a file written eighteen months ago, would the reasoning on record explain why that lender, or only that a comparison existed?
• If a lender on your panel materially changed its policy or turnaround tomorrow, how would you find out — and how long would it take you to identify every affected file in your pipeline?

7. The client conversation: precision, not alarm

If a client asks — and some will, because “APRA cracks down on Bendigo” reads very differently in a news feed than it does in a prudential release — the honest answer is short. The regulator has required the bank to fix weaknesses in how it manages non-financial risk and has explicitly said the bank is financially sound with strong capital and liquidity. Their loan is not affected. Their deposits are not affected.

What you should not do is use the headline as a refinance trigger. Recommending a client move lenders on the strength of a regulatory news story, without a documented benefit to that client, is exactly the kind of reasoning that reads badly in a BID file review. If there is a genuine reason to review — rate, structure, servicing, a life event — the reason should stand on its own and be recorded on its own.

8. Your seven-point panel review

This is the practical output. It takes about an hour and it is worth doing for every lender on your panel, not just this one.

1. Measure your concentration. Pull the last twelve months of submissions by lender. Any lender above 25 per cent of your volume is a business dependency, not a preference.
2. Identify live exposure. List every file currently in progress with the lender in question, with settlement dates. This is the population that a service change would hit first.
3. Baseline the service metrics. Record current time-to-assessment, time-to-unconditional and escalation response now, so you can tell in ninety days whether anything has actually moved.
4. Name your substitutes. For each of your top three scenario types with that lender, identify two alternative lenders that would genuinely fit. If you cannot, your panel is narrower than your compliance file implies.
5. Check your accreditation spread. Substitutes only help if you are accredited and current. Confirm which accreditations are active and which require refresher training before you can submit.
6. Stress the documentation. Assume verification requirements tighten. Review whether your standard document collection covers identity, income and source of funds to the stricter end of current lender expectations rather than the looser end.
7. Record the reasoning. If you decide to keep, reduce or maintain your use of a lender, write down why, dated. Under BID, a documented and considered decision is defensible. An undocumented drift is not.

9. What to watch next

• 24 August 2026 — audited FY26 results. The first opportunity for channel and service commentary alongside the rectification plan.
• Federal Court approval of the $8 million penalty — the BEAR proceeding remains subject to the court.
• Appointment of the independent reviewer — the identity and scope of the assurer signals how broad the program will be.
• Third-party flow share at the FY27 half — whether 36 per cent stabilises, recovers or keeps sliding is the clearest read on channel intent.
• Coordinated regulator activity — APRA noted alignment with ASIC and AUSTRAC. Any further action from either would change the picture materially.