The Australian Prudential Regulation Authority (APRA) has imposed licence conditions on Bendigo and Adelaide Bank Limited following findings of longstanding and pervasive weaknesses in the bank’s non-financial risk management framework and the failure of the bank’s previous efforts to deliver sustainable improvement.
Today’s action follows an independent root cause analysis that APRA required Bendigo Bank to undertake in December 2025 to understand the extent of non-financial risk management issues at the bank. Deloitte has now completed that root cause analysis and found:
Bendigo Bank’s non-financial risk management weaknesses are prevalent across the organisation;
the bank does not have a clear, complete and reliable view of its regulatory obligations, material risks and key controls;
there are material deficiencies in governance, accountability, compliance management, risk oversight and risk management capability; and
key weaknesses have persisted despite several years of remediation activity as part of Bendigo Bank’s enterprise-wide risk transformation program (BEN+).
As a result, APRA is not satisfied that the bank has addressed the underlying root causes of its risk management deficiencies or delivered sustainable risk uplift, despite having had significant opportunity to do so.
The licence conditions will require Bendigo Bank to undertake a comprehensive rectification program, engage an independent assurer and provide board attestation as part of the program of work to sustainably rectify its risk management shortcomings.
The regulator will also maintain Bendigo Bank’s existing $50 million operational risk capital add-on until APRA is satisfied that Bendigo Bank has effectively addressed the underlying prudential concerns.
APRA has worked closely with ASIC and AUSTRAC and these licence conditions support a coordinated regulatory response and improvement in risk governance, accountability and oversight.