ADI Licensing Process in Australia

1. Meaning of an ADI

An Authorised Deposit-Taking Institution (ADI) is a body corporate that holds an authority under s 9(3) of the Banking Act 1959 (Cth) to carry on banking business in Australia.

The statutory definition is important because an entity does not become an ADI merely because it calls itself a bank. It becomes an ADI when APRA grants the statutory authority.

The Banking Act generally restricts banking business to:

• the Reserve Bank of Australia; and
• bodies corporate that are ADIs.

Consequently, carrying on banking business without the necessary authority is unlawful.

What is "banking business"?

Under s 5 of the Banking Act, banking business broadly involves:

1. taking deposits; and
2. making advances of money,

together with other activities prescribed by the legislation.

Thus, an ordinary finance company that merely lends money, without taking deposits, does not necessarily require an ADI licence. APRA expressly states that a business proposing only to provide finance and not to take deposits does not require an ADI licence, although other APRA registration requirements may apply.

2. Statutory basis of ADI licensing

The principal legislation is the:

Banking Act 1959 (Cth)

The central provision is s 9.

Under s 9(2):

A body corporate wishing to carry on banking business in Australia may apply in writing to APRA for authority.

Section 9(2A) additionally gives APRA power to establish criteria for granting an authority by legislative instrument. Under s 9(3), APRA may grant the authority, which must be in writing.

The statutory structure can therefore be represented as:

Applicant → Application to APRA → APRA assessment → s 9 authority → ADI status → Prudential supervision

3. Why APRA is the licensing authority

The Australian Prudential Regulation Authority (APRA) is Australia's prudential regulator for banks, insurers and superannuation institutions.

ADI licensing is not simply a commercial registration process. APRA is concerned with whether the applicant can conduct banking business prudently and safely.

The underlying policy objectives include:

• protection of depositors;
• financial-system stability;
• adequate capital;
• adequate liquidity;
• sound governance;
• effective risk management;
• competent management;
• operational resilience; and
• the ability to respond to financial stress.

APRA expressly describes its licensing approach as seeking to balance competition and new entry with financial stability and depositor protection.

4. Who can apply?

For a locally incorporated ADI, the applicant must be a corporation/body corporate.

APRA cannot accept an application from:

• a partnership;
• an association; or
• an unincorporated entity.

This follows from the Banking Act's requirement that banking business be conducted by a body corporate.

The applicant must also consider other legislation, particularly:

• Financial Sector (Shareholdings) Act 1998 (Cth);
• Foreign Acquisitions and Takeovers Act 1975 (Cth);
• Corporations Act 2001 (Cth);
• AML/CTF legislation;
• APRA prudential standards; and
• other financial-services legislation applicable to the proposed business.

5. The two current licensing pathways

Under APRA's existing framework, there are two principal pathways for a new locally incorporated ADI:

A. Direct pathway

This is for an applicant that already possesses the resources, systems and capabilities necessary to commence banking immediately.

The applicant must be ready to comply with the full prudential framework from the commencement of its banking business.

B. Restricted ADI pathway

The Restricted ADI (RADI) pathway is designed for an applicant that needs additional time to develop its systems, resources and capabilities.

A Restricted ADI may conduct only limited banking business and generally has a maximum two-year restricted period in which to develop the capability required for a full ADI licence.

The Restricted ADI framework was introduced in 2018. APRA describes it as a mechanism intended particularly to assist smaller and innovative entrants while maintaining safeguards for depositors and financial stability.

Simple comparison

6. Stage One — Pre-application engagement

The first practical step is early engagement with APRA.

An applicant should not simply prepare an application and submit it without prior discussions.

APRA recommends early engagement because it allows the regulator and applicant to identify issues concerning:

• proposed business model;
• corporate structure;
• ownership;
• controllers;
• board and management;
• financial resources;
• capital;
• liquidity;
• risk management;
• technology;
• outsourcing;
• operational resilience;
• contingency arrangements; and
• proposed products.

APRA's present licensing guidance describes the process as iterative and recommends that applicants engage with the licensing team before formally applying.

Legal significance

This stage is important because APRA's decision is not based merely on whether the applicant has filled in a form.

The regulator assesses whether the applicant is substantively capable of operating as a prudentially sound bank.

7. Stage Two — Formal application

The applicant then makes a formal application under s 9 of the Banking Act.

The application must be supported by substantial documentation.

Typical areas include:

Corporate structure

• constitutional documents;
• group structure;
• ownership;
• controllers;
• proposed holding-company arrangements.

Business plan

• proposed banking products;
• target market;
• business strategy;
• financial projections;
• funding model;
• profitability assumptions;
• growth assumptions.

Capital

The applicant must demonstrate sufficient financial resources to support the proposed banking business.

Liquidity

The applicant must demonstrate appropriate arrangements for meeting its obligations as they fall due.

Governance

APRA examines:

• board composition;
• directors;
• senior management;
• accountability arrangements;
• skills and experience;
• independence;
• fitness and propriety.

Risk management

The applicant needs appropriate frameworks for:

• credit risk;
• market risk;
• liquidity risk;
• operational risk;
• technology risk;
• compliance risk;
• financial crime;
• outsourcing;
• cyber risk.

Information technology

A modern ADI must demonstrate that its IT architecture, cybersecurity and operational systems can support safe banking operations.

Resolution and contingency planning

APRA expects credible arrangements for responding to financial or operational stress.

8. Capital and financial resources

Capital adequacy is one of the most important components of ADI licensing.

The regulator is essentially asking:

If the bank suffers losses, does it have enough financial resources to absorb those losses without jeopardising depositors or the financial system?

The applicant must therefore provide credible capital plans.

APRA's proposed 2026 framework expressly identifies sufficient financial and non-financial resources as one of the core authorisation criteria, including adequate capital and liquidity positions and credible plans demonstrating their sufficiency under stress.

9. Governance and responsible persons

APRA places substantial importance on the quality of the people controlling and managing the proposed ADI.

The regulator will consider whether directors and senior executives have appropriate:

• experience;
• qualifications;
• competence;
• integrity;
• financial-sector knowledge;
• risk-management capability; and
• understanding of their regulatory responsibilities.

This reflects a fundamental prudential principle:

A well-capitalised bank can still fail if it is badly governed.

Therefore, ADI licensing examines not only the financial strength of the institution but also the quality of its governance.

10. Risk-management framework

The applicant must establish a risk-management framework appropriate to its size, complexity and business model.

This normally encompasses:

Credit risk

The ability to assess borrowers and control lending risk.

Liquidity risk

The ability to meet withdrawals and other obligations.

For example, APRA's APS 210 Liquidity requires ADIs to maintain adequate liquidity and stable funding and to withstand severe liquidity stress.

Operational risk

Controls against failures in:

• systems;
• people;
• processes;
• technology;
• outsourcing arrangements.

Compliance risk

The institution must have systems for complying with legislation and APRA requirements.

Cyber and technology risk

For a modern digital bank, technology risk is a major component of prudential risk.

11. APRA's assessment

Once the formal application is submitted, APRA assesses whether the applicant satisfies the relevant requirements.

The assessment can involve:

• document review;
• requests for additional information;
• meetings with directors and executives;
• review of policies;
• review of financial models;
• examination of technology arrangements;
• assessment of governance;
• consideration of ownership and controllers;
• examination of risk-management systems; and
• potentially onsite assessment.

APRA's present guidance describes the process as iterative. It may ask the applicant to revise or supplement the material provided.

Under the existing framework, the application process can take 12–18 months, depending upon the readiness and complexity of the applicant.

12. Grant of the ADI authority

If APRA is satisfied, it grants an authority under s 9(3).

The authority must be:

• in writing; and
• notified to the applicant.

APRA must also publish notice of the authority in the Gazette.

An example of the operation of s 9(3) can be seen in the 2019 authority granted to 86400 Ltd, which later became part of the Australian neobank landscape. The instrument expressly records that the authority was granted by an APRA delegate under s 9(3).

13. Conditions attached to the licence

An ADI licence is not necessarily unconditional.

Under s 9AA of the Banking Act, APRA can impose, vary or revoke conditions on an ADI's authority, provided the conditions relate to prudential matters.

For example, APRA has issued instruments varying conditions applicable to ADIs, including PayPal Australia.

Conditions may address matters such as:

• business activities;
• deposit-taking;
• lending;
• capital;
• governance;
• risk;
• outsourcing;
• geographic or product limitations;
• reporting.

Therefore:

Obtaining an ADI licence is not the end of APRA's regulatory relationship; it is the beginning of ongoing prudential supervision.

14. Post-licensing obligations

After authorisation, the ADI becomes subject to APRA's continuing prudential framework.

This includes:

• capital requirements;
• liquidity requirements;
• governance standards;
• risk-management standards;
• reporting;
• auditing;
• accountability requirements;
• operational-risk requirements;
• related-party exposure controls;
• supervisory engagement.

For example, APS 210 applies to all ADIs and requires appropriate liquidity risk management and sufficient liquid assets to withstand severe liquidity stress.

15. Revocation of an ADI licence

APRA also has power under s 9A to revoke an authority in appropriate circumstances.

This is important from a legal perspective because the licensing process creates an ongoing prudential relationship.

An ADI cannot simply satisfy APRA once and then operate without supervision.

The regulatory model is:

Authorisation → continuing compliance → supervision → intervention where necessary → possible revocation

16. Use of the word "bank"

The licensing system also protects the public from misleading representations.

The Banking Act regulates the use of restricted words such as:

• bank;
• banker;
• banking;

and similar expressions.

The purpose is to prevent consumers from mistakenly believing that an entity is an APRA-regulated institution.

APRA explains that non-ADIs generally need APRA's consent before using restricted banking terminology.

17. Important case law

Case 1: Australian Prudential Regulation Authority v Garrett [2023] FCA 956

This is one of the most directly relevant recent cases.

Facts

Andrew Morton Garrett operated and marketed businesses using names including:

• Dynamic Capital Bank;
• Banque de Capital Dynamique; and
• Banca di Como.

He was not authorised by APRA to conduct banking business.

APRA commenced proceedings in the Federal Court seeking orders preventing him from carrying on unauthorised banking business and using the word "bank".

Decision

Justice Lee granted orders permanently restraining Garrett from:

1. carrying on banking business;
2. using "bank" and similar words in relation to his purported businesses; and
3. representing that those businesses would carry on banking business.

He was also ordered to pay APRA's costs.

Legal principle

The case demonstrates the strict statutory importance of APRA authorisation.

A person cannot avoid the licensing regime merely by adopting a different commercial description or creating a business that presents itself to the public as a bank.

Relevance to licensing

The case illustrates the negative side of the licensing principle:

If an entity does not obtain an ADI authority, it cannot lawfully conduct banking business merely because it considers itself commercially capable of doing so.

18. Garrett contempt proceedings — [2024] FCA 235

The Garrett litigation continued.

After the 2023 orders, APRA alleged that Garrett continued engaging in activities contrary to the Federal Court's orders.

In Australian Prudential Regulation Authority v Garrett (Contempt Application) [2024] FCA 235, Justice Lee found Garrett in contempt for breaching the orders.

APRA's summary records that the court imposed a $10,000 fine, suspended for 18 months subject to compliance.

Importance

The case shows that ADI licensing is not merely a technical administrative requirement.

The Federal Court can be used to obtain injunctions preventing unauthorised banking activity, and breach of those orders can result in contempt proceedings.

19. Australian Prudential Regulation Authority v Gray — 2024

Another useful recent authority concerns Robert Bruce Gray.

APRA brought proceedings against Gray concerning businesses described as:

• Commercial Development Bank; and
• Creditnet Bank Internationale.

Justice Shariff made permanent orders restraining Gray from:

• carrying on banking business in Australia;
• using "bank" or similar terminology; and
• advertising or representing that the businesses would carry on banking business.

Principle

The case reinforces that the Banking Act protects the public from entities that hold themselves out as banks without the necessary APRA authorisation.

20. X v Australian Prudential Regulation Authority [2007] HCA 4

Although this case concerned insurance regulation rather than ADI licensing, it is important for understanding the broader legal relationship between APRA and judicial review.

The High Court considered APRA's exercise of prudential regulatory powers and the ability of affected persons to seek judicial intervention.

The case demonstrates an important distinction:

Judicial review ≠ merits review

A court does not ordinarily ask:

"Would we have made the same prudential decision as APRA?"

Instead, judicial review examines whether APRA acted:

• within its statutory power;
• according to law;
• for a proper purpose;
• having regard to legally relevant matters;
• without jurisdictional error.

This principle is highly relevant to ADI licensing decisions because APRA has specialised prudential expertise.

21. Kamha v APRA — relevance to APRA's discretion

Kamha v Australian Prudential Regulation Authority [2005] FCAFC 248 is another useful authority concerning APRA's prudential decision-making, although it arose under the Insurance Act rather than the Banking Act.

The Full Court recognised the importance of APRA's statutory prudential responsibilities and the potential problems caused by courts intervening prematurely in regulatory processes.

Relevance to ADI licensing

The broader principle is that courts are conscious that APRA exercises specialised regulatory functions.

Therefore, a dissatisfied applicant cannot normally ask a court simply to substitute its own commercial or prudential assessment for APRA's.

The challenge must ordinarily be based on legal error/jurisdictional error, rather than merely disagreement with APRA's prudential judgment.

22. Review of APRA decisions

APRA's decisions do not exist entirely beyond legal scrutiny.

There can be:

Internal review

Certain decisions are subject to internal review mechanisms under the Banking Act.

Merits review

Where the legislation specifically provides for it, a decision may be subject to merits review.

Judicial review

Administrative decisions may also be subject to judicial review under Australian administrative law principles.

The important distinction is:

Historical parliamentary material concerning the Banking Act confirms that decisions concerning the grant and revocation of banking authorities are subject to judicial review.

23. 2026 reform of the licensing framework

This is particularly important if you are writing the answer now.

On 13 May 2026, APRA released a consultation paper proposing a new ADI licensing framework.

The proposed framework seeks to make licensing:

• more transparent;
• more efficient;
• more predictable.

The draft framework would consist principally of:

1. ADI Licensing Criteria; and
2. ADI Licensing Guidelines.

The proposed Licensing Criteria would be contained in a legislative instrument, while the Guidelines would explain how APRA expects applicants to demonstrate compliance.

The proposed criteria focus on five broad ideas:

1. Effective supervision

The institution must be structured so that APRA can effectively supervise it.

2. Financial and non-financial resources

It must have adequate resources to operate prudently.

3. Skills and experience

It must have people with appropriate skills and experience.

4. Risk management

It must have an appropriate risk-management framework.

5. Stress response

It must have credible plans for responding to circumstances threatening its viability.

24. Proposed new timeframe

One of the major proposed reforms is a clearer timetable.

Under the proposed framework, a locally incorporated applicant would have 12 months from application to demonstrate compliance with the ADI Licensing Criteria, subject to an exceptional extension mechanism.

Once APRA considers an application substantially complete, it proposes to aim for a licensing decision within 90 days.

This is intended to make the process substantially more predictable than the current model.

25. Legal significance of the 2026 reform

The proposed reform is important because it attempts to shift ADI licensing from a relatively flexible, guidance-heavy model toward a clearer framework based on legally effective licensing criteria.

There is an important distinction:

Existing guidelines

APRA's existing licensing guidelines provide regulatory guidance and expectations.

Proposed criteria

The proposed ADI Licensing Criteria would have the status of a legislative instrument, whereas the Guidelines themselves would not create enforceable legal requirements.

This distinction matters when analysing:

• statutory power;
• procedural fairness;
• judicial review;
• enforceability;
• legitimate expectations; and
• the scope of APRA's discretion.

26. Foreign banks

A foreign bank has a different route.

An overseas bank may establish a foreign ADI branch in Australia for certain wholesale banking activities.

However, an overseas bank wishing to conduct retail banking business generally needs a locally incorporated Australian subsidiary, which must satisfy local prudential and capital requirements.

APRA also expects the foreign applicant to demonstrate that:

• it is adequately supervised in its home jurisdiction; and
• its home regulator has consented to the Australian banking operation.

27. Restricted ADI — detailed legal position

The Restricted ADI pathway deserves separate attention.

The policy rationale is straightforward:

A new bank may have a viable business model but lack the complete institutional infrastructure of an established bank.

Rather than forcing every applicant to build the entire infrastructure before receiving any authorisation, APRA permits eligible applicants to operate under restrictions while building:

• capital;
• systems;
• governance;
• compliance;
• risk-management capability;
• operational resources.

The restricted period is generally limited to two years. If the applicant cannot progress to full ADI status, it must exit the banking business.

28. The Financial Claims Scheme

Another important reason why ADI licensing is significant is the Financial Claims Scheme (FCS).

Deposits with eligible Australian-incorporated ADIs may receive government protection under the FCS, subject to the statutory conditions and the $250,000 per account-holder per ADI limit.

APRA's materials emphasise that the licensing regime protects depositors and that the FCS provides an additional safety net in the event of an ADI failure.

This explains why the law is particularly strict about entities presenting themselves as banks without authorisation.

29. Case-law principle in one sentence

The recent cases can be condensed into the following proposition:

Banking is a highly regulated activity; the right to conduct banking business derives from statutory authorisation, and APRA and the Federal Court can take strong enforcement action against persons who conduct or represent themselves as conducting banking business without the required authority.

This proposition is strongly illustrated by Garrett [2023] FCA 956 and the subsequent contempt decision in Garrett [2024] FCA 235.

30. Complete licensing flow

For examination purposes, remember the process as:

1. Determine whether proposed activities constitute banking business

↓

2. Establish appropriate corporate structure

↓

3. Engage APRA before application

↓

4. Select licensing pathway

• Direct ADI; or
• Restricted ADI

↓

5. Prepare business plan and supporting documentation

↓

6. Demonstrate capital and liquidity capability

↓

7. Establish governance and responsible-person arrangements

↓

8. Establish risk-management framework

↓

9. Establish IT, cybersecurity and operational resilience

↓

10. Submit formal s 9 application

↓

11. APRA conducts prudential assessment

↓

12. Applicant responds to APRA's questions/revisions

↓

13. APRA determines whether criteria are satisfied

↓

14. APRA grants or refuses authority

↓

15. Conditions may be imposed

↓

16. ADI enters ongoing APRA supervision

↓

17. Continuing non-compliance may lead to regulatory intervention/revocation

31. Exam-style conclusion

The Australian ADI licensing regime is fundamentally a prudential authorisation system rather than an ordinary business licence. Section 9 of the Banking Act 1959 (Cth) gives APRA the statutory power to authorise a body corporate to conduct banking business. The applicant must demonstrate that it possesses the financial, governance, managerial, technological and risk-management capabilities necessary to operate safely.

The existing framework provides both a direct pathway and a Restricted ADI pathway, allowing APRA to accommodate both established applicants and innovative new entrants. Following authorisation, the ADI remains subject to APRA's prudential standards and ongoing supervision.

The case law demonstrates the strength of this regulatory regime. In Australian Prudential Regulation Authority v Garrett [2023] FCA 956, the Federal Court restrained an unauthorised operator from carrying on banking business and using the word "bank"; the subsequent [2024] FCA 235 proceedings resulted in a finding of contempt when the orders were breached.

Accordingly, ADI licensing protects depositors, preserves confidence in the banking system, promotes financial stability and ensures that only institutions capable of satisfying APRA's prudential requirements are permitted to conduct banking business in Australia.

Finally, for a 2026 legal answer, it is essential to mention APRA's current licensing reform: the proposed new ADI Licensing Criteria and Guidelines are intended to make the process more transparent and efficient, but APRA states that the final framework is expected later in 2026.