Board expresses disappointment over findings, vows to lift standards via rectification plan
The Australian Prudential Regulation Authority (APRA) has imposed new licence conditions on Bendigo and Adelaide Bank after an independent review found longstanding weaknesses in the bank's management of non-financial risk.
The action, announced this Tuesday, requires the bank to complete a rectification program, appoint an independent reviewer and provide board attestation as work progresses.
What the root cause analysis found
APRA said the licence conditions follow an independent root cause analysis it required Bendigo Bank to undertake in December 2025, after the bank's own review of anti-money laundering and counter-terrorism financing (AML/CTF) controls surfaced broader concerns.
Deloitte, engaged to run that analysis, found non-financial risk weaknesses across the organisation, and determined that Bendigo Bank “does not have a clear, complete and reliable view of its regulatory obligations, material risks and key controls”.
The regulator said material deficiencies exist across governance, accountability, compliance management, risk oversight and risk management capability, and that these problems have persisted despite several years of remediation work under the bank's enterprise-wide risk transformation program, known internally as BEN+.
APRA deputy chair Therese McCarthy Hockey said today’s action reflects the seriousness of the weaknesses identified across Bendigo Bank’s risk management framework.
"Although Bendigo Bank is financially sound, with strong capital and liquidity positions, APRA is concerned with the gaps in its non-financial risk management framework. The weaknesses identified by the root cause analysis are significant, longstanding and require decisive action.
“APRA appreciates the constructive and cooperative engagement we have received from Bendigo Bank, and we are encouraged by the Board’s commitment to ensure our concerns are addressed promptly, effectively and in full.”
The $50 million operational risk capital add-on APRA imposed on Bendigo Bank in December 2025 will stay in place until the regulator is satisfied the underlying issues have been resolved. APRA said it has worked closely with the Australian Securities and Investments Commission (ASIC) and the Australian Transaction Reports and Analysis Centre (AUSTRAC) to coordinate the regulatory response.
Bendigo Bank's response
Bendigo Bank chief executive and managing director Richard Fennell (pictured) said the bank's non-financial risk capabilities are "clearly not where they need to be" and that he will personally sponsor the rectification plan.
“We take our obligations very seriously. This is a key priority for the Board and Executive Team, and the rectification plan will be sponsored directly by me as CEO,” said Fennell. “Elevating our risk maturity is fundamentally about better serving our customers and the community. It is critical we get this right so we can continue delivering for all our stakeholders.”
Bendigo Bank chair Vicki Carter expressed disappointment at the findings. "The Bank understands that we have significant work ahead of us to uplift our risk management,” she said. "The Board is fully committed to ensuring the Bank has the necessary capability and capacity to do so. We understand the important role we need to play to ensure we emerge as a stronger Bank and one that can continue to deliver on our purpose of feeding into the prosperity of our customers and communities.”
