In this edition, we cover the Australian Prudential Regulation Authority's (APRA) call for a ‘step-change’ in board oversight and how regulated entities manage risks associated with artificial intelligence (AI). We also provide a reminder on the amendments to ASX Listing Rules Guidance Note 5 CHESS Depositary Interests (Guidance Note 5), which took effect on 1 May 2026. In our legal update, we report on the $1.55 million penalty handed down by the Federal Court of Australia in ASIC’s proceedings against Money3 Loans Pty Ltd (Money3) for breaching responsible lending obligations.
In Over the Horizon, we consider the Reserve Bank of Australia’s (RBA) monetary policy decision on 5 May 2026 to raise the cash rate to 4.35% and the March Consumer Price Index (CPI) data that underpinned it.
Governance
APRA calls for a ‘step-change’ in AI risk management
On 30 April 2026, APRA published a letter to all APRA-regulated entities warning that governance, risk management, assurance and operational resilience practices are not keeping pace with the scale, speed and complexity of AI adoption. The letter draws on observations from its 2025 engagement with a group of selected banks, insurers and superannuation trustees. While boards are actively pursuing AI opportunities, APRA found many lack the technical literacy to effectively challenge management on AI-related risks. At a minimum, APRA expects boards to develop sufficient AI literacy to set strategic direction and provide effective oversight. Boards are also expected to ensure the entity has an AI strategy aligned with its risk appetite, supported by monitoring, reporting and clear escalation triggers. On cyber risk, and as discussed in our previous edition of Boardroom Brief and our recent article on Mythos-class autonomous AI, APRA flagged the threats posed by high-capability AI frontier models (including Anthropic Mythos) and expects a step change in cyber practices, including timely patching, closure of vulnerabilities and strengthened cyber hygiene. APRA also noted concentration risk where entities are materially dependent on a single AI provider across multiple use cases, raising concerns about credible substitution, portability or exit arrangements for critical services. Where entities fail to manage AI risks proportionately to their size, scale and complexity, APRA has signalled it will take stronger supervisory and enforcement action. Directors should keep in mind that traditional cyber assurance models may no longer reliably measure resilience against AI-related risks. Boards should be asking management whether threat models and third-party assurance programmes adequately account for AI-enabled threats and whether the entity’s governance, vendor arrangements and contingency planning are fit for purpose. Even beyond APRA-regulated entities, APRA’s letter sets a useful benchmark for the level of AI literacy, accountability and contingency planning now expected at board level.
Regulatory
Amendments to Guidance Note 5 for CHESS Depositary Interests (CDIs) now in effect
On 24 April 2026, ASX announced amendments to Guidance Note 5, with effect from 1 May 2026. The amendments follow regulatory clearance for changes to the ASX Settlement Operating Rules and the introduction of formal terms of appointment by CHESS Depositary Nominees Pty Limited (CDN), the entity that holds underlying securities on behalf of CDI holders. Together, these changes update the legal framework governing CDN’s depositary nominee services. For the first time, CDN will charge fees for its services, comprising a one-off appointment fee ($5,000, excluding GST) and an annual service fee tiered by market capitalisation of quoted CDIs. The revised Guidance Note 5 also clarifies that, while CDN remains the only depositary nominee currently offering CDI services, issuers may appoint another entity as their depositary nominee, provided it meets the requirements under the ASX Settlement Operating Rules. These amendments are relevant to any foreign-incorporated entities listed (or considering listing) on the ASX using a CDI structure. Directors should ensure company secretaries and registry teams are across the revised legal framework, and the new CDN fee arrangements should be factored into compliance and corporate administration budgets going forward.
Legal
The Federal Court orders Money3 to pay $1.55 million for responsible lending breaches
On 27 April 2026, the Federal Court ordered Money3 to pay penalties of $1.55 million for breaching its responsible lending obligations when providing car finance to vulnerable consumers. In September 2025, the Court found that, for five loans entered into between May 2019 and February 2021, Money3 did not make reasonable inquiries about, or verify, each borrower's living expenses against the bank statement transaction data it held. In one instance, the Court also found Money3 failed to make reasonable inquiries about the borrower's requirements and objectives. However, the Court rejected several of ASIC’s broader allegations, including that Money3 had entered into unsuitable loans and that it had failed to ensure its representatives complied with credit legislation. ASIC has identified misconduct exploiting consumers facing financial difficulty as a 2026 enforcement priority. Findings from ASIC's ongoing review of Australia’s motor vehicle finance sector, announced in November 2025, are expected to be released midway through this year. This decision underscores the importance of robust serviceability assessment frameworks. Boards of credit licensees, particularly those serving financially vulnerable borrowers, should satisfy themselves that bank statement data and other information already held by the business is being used to verify declared living expenses, and that inquiry and verification processes are operating effectively.
Over the Horizon
RBA raises cash rate to 4.35% as inflation hits three-year high
The RBA's Monetary Policy Board has decided to increase the cash rate by 25 basis points to 4.35%, citing persistent inflation and the impact of the Middle East conflict on fuel and commodity prices. The decision was carried by an 8-1 majority, with one member preferring to hold rates steady at 4.10%. This is the third consecutive rate increase this year.
The RBA decision followed last week’s March CPI data released by the Australian Bureau of Statistics, which showed annual headline inflation rising to 4.6%, the highest since 2023. Automotive fuel prices rose 32.8% in March alone, the largest monthly increase since the monthly CPI series began in 2017, reflecting the closure of the Strait of Hormuz and its impact on global oil supply. The RBA's preferred trimmed mean measure of underlying inflation was 3.5% on a quarterly basis and 3.3% on a monthly basis, both well above the RBA’s 2–3% target band. The Board noted early signs of second-round price effects, with firms beginning to pass higher input costs through to consumers. The Board also flagged materially heightened uncertainty about the outlook, acknowledging that a severe conflict could push inflation higher while simultaneously weakening economic activity. The shift from a narrow 5–4 vote at the March meeting to a decisive 8–1 majority suggests the Board's tolerance for above-target inflation is diminishing. Further rate increases remain a live possibility. The Board signalled that future decisions will be guided by incoming data and the evolving economic outlook, and that it is prepared to act further if needed to return inflation to the target band. Directors of companies with significant variable-rate debt or rate-sensitive earnings should ensure management is stress-testing budgets and forecasts against the possibility of further tightening.