Prudential regulator APRA has accepted a court enforceable undertaking (CEU) from and imposed a higher capital add-on to the Australia and New Zealand Banking Group (ANZ), expressing “long-standing concerns” over the bank’s non-financial risk management practices and risk culture”.

The CEU comes after the release of an independent culture and risk governance review, commissioned by the ANZ Board and overseen by Oliver Wyman, with ANZ confirming today it would accept “all recommendations” of the report.

APRA, in accepting the new CEU, noted its “long-standing concerns over ANZ’s non-financial risk management practices and risk culture”, including the bank’s “operational risk and compliance management and a reactive risk culture”. 

APRA said it has “observed that these weaknesses remain present across the bank” as part of its supervision process.

Whilst accepting ANZ’s progress on its remediation program, the regulator conceded that completion of this program alone “will not effectively and sustainably address the broader non-financial risk weaknesses across ANZ”.

Under the terms of the CEU, ANZ has agreed to:

• appoint an independent reviewer to complete a Group-wide review of root causes and behavioural drivers of the persistent weaknesses in non-financial risk management practices and risk culture, and to conduct a gap analysis against current or planned remediation work;
• develop a comprehensive remediation plan to address the root causes;
• appoint an independent reviewer to provide assurance over the execution of the remediation plan;
• provide a written attestation from the relevant Accountable Person, the Chair of the Board Risk Committee and/or the Chair of the Board Audit Committee to APRA once ANZ is satisfied that the remediation activities under the plan have been completed and the target states substantially achieved; and
• incorporate accountabilities for delivery of the remediation plan into the accountability statements for Accountable Persons required under the Financial Accountability Regime, and to reflect this accountability in the remuneration scorecards.

APRA last August acted in response to a number of risk concerns related to employee conduct and non-financial risk management within ANZ’s Global Markets business.

In response, APRA required ANZ to commission an independent review to determine the root causes of the issues, whether they extend beyond the Global Markets business and if the bank’s existing multi-year remediation program would be sufficient to address them.

“The findings of the independent review have lent further credence to APRA’s concerns,” APRA wrote.

“While the review noted some improvements in the culture, conduct and risk governance in ANZ’s Global Markets business, it identified root causes that have contributed to the emergence and persistence of risk governance shortcomings. It also cautioned that shortcomings identified in ANZ’s Global Markets business may be present in other parts of the bank.”

In addition to its CEU, the regulator has also lifted its capital add-on from $750 million to $1 billion.

This also comes on top of last year’s increase in its operational risk capital threshold from $500 million, first applied in 2019, to $750 million.

APRA chair John Lonsdale noted at the time of the last increase – imposed in August 2024 – that ANZ was the only major bank yet to have its add-on from 2019 either removed or reduced.

Commenting on the newly imposed CEU, Lonsdale said ANZ “remains financially sound with robust levels of capital and liquidity, however problems with the bank’s management of non-financial risks are persistent and prevalent across the bank”.

“APRA has seen how long-standing non-financial risk management weaknesses have manifested in material prudential issues at some of ANZ’s peer banks. We have observed some similar weaknesses at ANZ and require these to be addressed as a priority.

In response, ANZ chair Paul O’Sullivan, commenting in a statement to the ASX, said the bank was “disappointed that we have not met APRA’s expectations about how the bank manages non-financial risk and its non-financial risk culture”.

“A strong non-financial risk regime is critical to protecting our bank and our customers.”

He added that the CEU provides the bank with a “clear roadmap for addressing APRA’s concerns”, with “both the board and management [bringing] a clear-eyed focus to completing this work, seeking to have the capital overlay removed as quickly as possible”.

ANZ said it is taking immediate action in response to the Oliver Wyman review (which handed down 19 recommendations and 53 sub-recommendations), including the appointment of a new executive role of group head non-financial risk program delivery, reporting directly to the CEO – to be filled by ANZ’s current head of Singapore and head of SEA, India and Middle East, Mark Evans.

ANZ will also appoint Dan Wong, currently of IAG, to the role of group general manager operational risk, reporting directly to CEO Kevin Corbally.