APRA is Australia's prudential regulator for banks, insurers and superannuation funds, operating through binding Prudential Standards — notably CPS 234 on information security and CPS 230 on operational risk management. It regulates the soundness and resilience of institutions; it does not require any of them to expose data or interfaces to third parties.
APRA Prudential Standards
APRA is the counterweight to the Consumer Data Right in any honest reading of Australian financial and insurance regulation: one regime is about safety, the other about access, and only one of them opens an API.
- CPS 234 (Information Security) - Requires regulated entities to maintain information-security capability commensurate with threats, including clear accountability and testing of controls.
- CPS 230 (Operational Risk Management) - Extends to service-provider management and business continuity, which reaches the third parties an insurer integrates with.
- APRA Connect - The regulator’s own reporting platform, with a published XSD and XBRL taxonomy — genuinely machine-readable, and pointed entirely at regulatory reporting rather than at insurance transactions.
- Prudential, not access-granting - Nothing in the prudential framework obliges an insurer to publish a contract, a scope catalogue, or a developer surface.
The State of Australian Insurance APIs found a market with the complete legal machinery for open insurance — the CDR, already proven in banking and energy — and no live obligation to use it, because the CDR’s extension to general insurance was designated and then deferred. APRA holds the sector’s real regulatory relationship, and APRA’s mandate has never been to make insurers legible to developers.
Referenced in API Evangelist papers
This regulation shows up in my published research. These reports read the machine-readable evidence provider by provider — and put this regulation in the context of a real sector.
The State of Australian Insurance APIs
APRA supervises prudentially and mandates no data exposure — and its own APRA Connect reporting taxonomy is the closest thing Australian insurance has to a published machine-readable standard.
