1. What is an ADI?

An Authorised Deposit-taking Institution (ADI) is a body corporate authorised by the Australian Prudential Regulation Authority (APRA) under the Banking Act 1959 (Cth) to carry on banking business in Australia.

ADIs include:

• banks;
• building societies; and
• credit unions/mutual ADIs.

APRA's licensing regime is principally concerned with ensuring that an institution has the financial, governance, risk-management and operational capacity to conduct banking business prudently.

The statutory objectives are particularly important. Section 2A of the Banking Act 1959 identifies two principal objectives:

1. protecting the interests of depositors consistently with the continued development of a viable, competitive and innovative banking industry; and
2. promoting financial-system stability in Australia.

The Act achieves these objectives, among other things, by restricting who may conduct banking business and providing for APRA's prudential supervision of ADIs.

2. Statutory foundation of the licensing system

The principal legislation is the Banking Act 1959 (Cth).

Section 9 is central to the licensing framework. A body corporate wishing to conduct banking business in Australia may apply to APRA for authority. APRA may grant that authority, and the authority is given in writing.

The Act also gives APRA power to establish licensing criteria by legislative instrument.

The important distinction is:

The Banking Act supplies the statutory authority; APRA's licensing framework explains how an applicant demonstrates that it satisfies the statutory and prudential requirements.

The current APRA framework therefore operates alongside:

• the Banking Act 1959;
• APRA prudential standards;
• reporting standards;
• conditions attached to the ADI authority;
• APRA directions and supervisory requirements; and
• other applicable financial-services legislation.

APRA describes the prudential framework as encompassing legislation, prudential standards, reporting requirements, conditions of authorisation and other written requirements imposed by APRA.

3. What constitutes “banking business”?

This is one of the most important issues when analysing whether an ADI licence is required.

Under the Banking Act, “banking business” principally involves:

• taking deposits, other than deposits received as part-payment for identified goods or services; and
• making advances of money.

The legislation also permits other activities to be prescribed by regulation.

Therefore, an organisation cannot simply avoid the licensing regime by describing itself as a:

• financial technology company;
• investment platform;
• financial cooperative;
• lending platform; or
• alternative bank.

The substance of the activities matters.

An entity engaging in activities that legally constitute banking business generally needs the appropriate APRA authority.

4. Who can apply?

The Banking Act requires the applicant for an ADI authority to be a body corporate.

Consequently, APRA does not grant a conventional ADI authority to an:

• individual;
• partnership;
• ordinary unincorporated association.

APRA expressly states that only corporations can carry on banking business under the Banking Act.

This is an important preliminary eligibility requirement.

5. The traditional ADI licensing pathways

Historically, APRA operated two principal pathways for locally incorporated applicants.

A. Direct pathway

The direct pathway was designed for an applicant that already possesses the resources and capabilities necessary to operate an ADI.

The applicant must be capable of immediately complying with the applicable prudential framework.

The direct applicant therefore needs to demonstrate, among other things:

• adequate capital;
• appropriate governance;
• competent directors and senior management;
• effective risk management;
• appropriate systems and controls;
• operational capability;
• appropriate technology and security arrangements;
• credible business and financial plans; and
• appropriate contingency arrangements.

APRA describes the direct pathway as suitable where the applicant is already sufficiently prepared to establish an ADI.

B. Restricted ADI pathway

The Restricted ADI (RADI) pathway was introduced in 2018.

It was intended particularly for smaller or newer entrants that did not yet possess the complete resources and capabilities required for a full ADI licence.

A RADI could conduct limited banking activities while developing its:

• capital;
• systems;
• governance;
• risk-management capability;
• operational infrastructure; and
• broader prudential capability.

The restricted period was generally limited to two years.

The purpose was to encourage competition and innovation while preventing an inexperienced institution from immediately undertaking unrestricted banking activities.

6. Major 2026 reform — the RADI pathway is being removed

This is particularly important if you are studying the current Australian law in 2026.

APRA reviewed the ADI licensing framework and concluded that the existing process could be made clearer, more transparent and more efficient.

In May 2026 APRA released a proposed new framework. The principal changes include:

1. Legally effective licensing criteria

Instead of relying primarily on licensing expectations contained in guidelines, APRA proposes to place the core ADI licensing requirements in a legislative instrument.

2. Twelve-month timeframe

A locally incorporated applicant would generally have 12 months from lodging its application to demonstrate that it satisfies the ADI Licensing Criteria.

3. RADI pathway discontinued

APRA proposes to discontinue the Restricted ADI pathway.

4. Publication of licensing decisions

APRA proposes to publish licensing decisions, including refusals, subject to the treatment of applications withdrawn before a decision.

5. Separate criteria and guidance

The proposed framework distinguishes between:

ADI Licensing Criteria — legally effective requirements; and

ADI Licensing Guidelines — explanatory guidance about how an applicant can demonstrate compliance.

APRA specifically states that the guidelines themselves will not create enforceable legal requirements.

The consultation closed on 31 July 2026, and APRA has indicated that it intends to finalise the new framework in late 2026.

Thus, as at 21 August 2026, one should be careful not to describe the proposed framework as if every element were already operative.

7. Proposed substantive licensing criteria

Under the 2026 draft framework, a locally incorporated applicant would need to demonstrate that it:

(a) Can be effectively supervised

The entity must be structured and operated in a way that allows APRA to supervise it effectively.

This is significant for:

• corporate structure;
• ownership;
• control;
• outsourcing;
• related entities;
• group arrangements; and
• transparency of operations.

(b) Has sufficient resources

The applicant must possess sufficient financial and non-financial resources to conduct banking business prudently.

This encompasses more than simply showing a particular amount of capital.

APRA will be concerned with whether the institution can actually support its proposed business model.

(c) Has appropriate skills and experience

Directors, senior executives and other responsible personnel must possess the appropriate competence and experience.

(d) Has an effective risk-management framework

The applicant must demonstrate an appropriate framework for identifying, assessing, controlling and monitoring risks.

(e) Has credible stress and viability arrangements

The applicant must have credible plans for responding to circumstances that threaten its viability.

These five areas form the core of the proposed 2026 ADI Licensing Criteria.

8. Governance is central to licensing

ADI licensing is not merely a capital adequacy exercise.

APRA examines whether the proposed institution has sound governance.

This includes the competence and suitability of:

• directors;
• senior management;
• responsible persons;
• risk personnel;
• compliance personnel; and
• other persons exercising significant influence.

APRA's current prudential framework includes CPS 520 Fit and Proper, which establishes requirements for determining whether persons occupying responsible positions are fit and proper.

Similarly, CPS 510 Governance establishes minimum foundations for sound governance. Its objective is to ensure that an APRA-regulated institution is managed prudently by a competent board capable of making reasonable and impartial decisions in the interests of the institution while considering the interests of depositors.

9. Risk management

An ADI must demonstrate an effective risk-management framework.

Relevant risks can include:

• credit risk;
• market risk;
• liquidity risk;
• operational risk;
• information-security risk;
• cyber risk;
• outsourcing risk;
• compliance risk;
• strategic risk; and
• financial-crime risk.

The licensing assessment therefore examines whether the applicant's proposed business model can actually be controlled within an appropriate risk appetite.

This is particularly important because an apparently profitable banking model can nevertheless be unacceptable if its risk-management arrangements are inadequate.

10. Capital and financial resources

APRA's concern is not simply whether an applicant has enough money to open its doors.

The institution must have sufficient financial resources to withstand adverse circumstances.

Capital requirements are subsequently governed by APRA's prudential framework, including applicable standards dealing with:

• regulatory capital;
• liquidity;
• credit risk;
• operational risk;
• leverage;
• reporting; and
• financial resilience.

The prudential framework is ongoing: obtaining the licence is not the end of APRA supervision.

The applicant becomes subject to continuing prudential obligations once authorised.

11. Technology, outsourcing and operational capability

A modern ADI must also demonstrate appropriate operational infrastructure.

APRA's licensing process considers matters including:

• IT strategy;
• outsourcing;
• governance;
• risk management;
• contingency planning;
• financial resources; and
• ownership and controllers.

APRA recommends early engagement with its licensing team precisely because these matters can require substantial preparation before the formal application.

12. APRA's licensing process

Broadly, the process involves:

Pre-application engagement → Formal application → APRA assessment → Demonstration of capability → APRA decision → Ongoing prudential supervision

The pre-application stage is particularly important.

An applicant generally needs a coherent package addressing:

1. business plan;
2. corporate structure;
3. ownership;
4. controllers;
5. board and management;
6. financial resources;
7. capital plan;
8. risk-management framework;
9. compliance framework;
10. technology;
11. outsourcing;
12. information security;
13. operational resilience;
14. recovery and contingency planning; and
15. implementation timetable.

APRA states that it begins its substantive assessment when it receives a sufficiently complete and high-quality application.

13. Conditions on an ADI licence

Obtaining an ADI authority does not mean the institution can conduct any conceivable financial activity without restriction.

Under s 9AA of the Banking Act, APRA can impose, vary or revoke conditions relating to prudential matters.

The authority granted to 86400 Ltd, for example, expressly illustrates the statutory mechanism by which APRA grants authority and notes APRA's power to impose or vary prudential conditions.

Therefore:

ADI authorisation + prudential conditions + APRA standards = the operating regulatory perimeter.

14. Foreign banks

The framework differs for an overseas bank.

A foreign bank may establish an Australian branch as a foreign ADI, subject to APRA's requirements.

This is conceptually different from establishing an Australian-incorporated bank.

APRA has separate guidance for overseas banks operating in Australia and recognises the different risk profile and business model of foreign ADI branches.

15. Key case law

There is relatively little reported Australian case law directly concerning the merits of an APRA ADI licensing decision. That is important to acknowledge.

The more useful recent cases concern APRA's enforcement of the licensing boundary—particularly persons conducting or representing themselves as banks without authorisation.

Case 1 — Australian Prudential Regulation Authority v Garrett

This is an important recent Federal Court enforcement case.

Australian Prudential Regulation Authority v Garrett involved Andrew Morton Garrett and businesses he represented as banks, including:

• Dynamic Capital Bank;
• Banque de Capital Dynamique; and
• Banca di Como.

APRA sought an injunction because the businesses were not authorised to conduct banking business.

Justice Lee granted orders permanently restraining Mr Garrett from:

• carrying on banking business;
• using “bank” or similar terminology in relation to the purported businesses; and
• advertising or representing that those businesses would conduct banking business.

The decision demonstrates the practical importance of the statutory licensing prohibition: an entity cannot simply hold itself out as a bank and conduct banking activities without APRA authorisation.

Subsequent contempt proceedings

The matter subsequently became more significant.

In May 2024, the Federal Court found Mr Garrett in contempt of court for failing to comply with the injunction.

Justice Lee imposed a $10,000 fine, suspended for 18 months, conditional upon compliance with the orders.

Legal significance

The case demonstrates that APRA's licensing regime is not merely an administrative registration system.

APRA can use the Federal Court to obtain coercive orders preventing unauthorised banking activities.

16. Case 2 — Australian Prudential Regulation Authority v Gray [2024] FCA 79

This is probably the most directly useful recent authority for an examination or research paper.

In Australian Prudential Regulation Authority v Gray [2024] FCA 79, APRA brought proceedings concerning Robert Bruce Gray.

APRA alleged that Mr Gray was unlawfully conducting a banking business contrary to the Banking Act.

His purported businesses included:

• Commercial Development Bank; and
• Creditnet Bank Internationale.

Justice Shariff permanently restrained Mr Gray from:

1. carrying on banking business in Australia;
2. assuming or using “bank”, “banker”, “banking” or similar expressions in connection with purported banking businesses; and
3. advertising, representing or stating that a business would carry on banking business.

The judgment expressly proceeded by reference to s 65A of the Banking Act, together with the relevant prohibitions concerning unauthorised banking business and use of banking terminology.

Significance

Gray demonstrates the strength of the licensing boundary.

The court was prepared to grant permanent injunctive relief where the evidence established unauthorised banking activity.

It is particularly useful for understanding that the regulatory concern extends beyond the actual acceptance of deposits. Holding out and representations concerning banking activities can themselves attract statutory consequences.

17. What these cases tell us about the licensing framework

Taken together, Garrett and Gray demonstrate three important principles.

Principle 1 — Banking is a regulated activity

A person cannot simply decide to establish a “bank” without obtaining the appropriate authority.

Principle 2 — The prohibition is enforceable through the courts

APRA can seek Federal Court injunctions to stop unauthorised banking activity.

Principle 3 — Misleading the public about banking status is itself serious

The statutory regime protects depositors partly by preventing businesses from creating the impression that they are APRA-regulated banks when they are not.

APRA expressly links these enforcement actions to depositor protection and the risk that consumers may incorrectly believe they are dealing with an APRA-regulated institution.

18. Why the licensing framework exists

The regulatory philosophy can be understood as a balance between two competing interests:

Competition and innovation

versus

Financial stability and depositor protection

The Banking Act expressly recognises this balance.

The objective is not simply to prevent competition. Rather, Australia wants new banks, fintechs and innovative business models to enter the market without creating unacceptable risks to depositors or the financial system.

This explains why APRA historically created the RADI pathway but is now proposing to remove it after finding that the pathway had limited take-up and presented difficulties for some entrants in developing sustainable business models.

19. ADI licence versus AFSL

This distinction is frequently examined in Australian financial-services law.

An ADI licence is principally concerned with the authority to conduct banking business.

An Australian Financial Services Licence (AFSL) under the Corporations Act concerns the provision of specified financial services.

They are not interchangeable.

For example, an organisation may need an AFSL for particular financial-product activities while separately requiring ADI authority if it proposes to conduct banking business.

Consequently:

Having an AFSL does not automatically make an entity an ADI.

Conversely, becoming an ADI does not mean that every financial service the entity might want to provide is automatically authorised under every other regulatory regime.

20. ADI licence versus Australian credit licence

There is similarly a distinction between:

ADI authorisation under the Banking Act; and

Australian credit licensing under the National Consumer Credit Protection Act 2009.

A lender that makes loans may require credit licensing depending on the nature of its activities, but merely making loans does not necessarily make the entity an ADI.

The definition and structure of banking business under the Banking Act must therefore be analysed separately.

21. Practical legal test

When assessing whether a proposed Australian financial business needs an ADI licence, I would analyse it in this order:

Step 1 — Identify the activities

What exactly will the entity do?

Step 2 — Determine whether it is taking deposits

Are customers providing money that constitutes a “deposit” rather than paying for identified goods or services?

Step 3 — Determine whether it makes advances

Will the entity advance money to customers?

Step 4 — Consider the combined activities

Taking deposits and making advances are central indicators of banking business.

Step 5 — Examine representations

Does the business describe itself as:

• a bank;
• banking institution;
• deposit-taking institution; or
• provider of banking services?

Step 6 — Identify other licences

Consider whether the business also requires:

• AFSL;
• Australian credit licence;
• AUSTRAC registration/compliance;
• payment-related regulatory permissions; or
• other approvals.

Step 7 — Analyse corporate structure

Determine whether the applicant is an appropriate Australian body corporate or whether it is a foreign bank seeking foreign ADI status.

Step 8 — Assess APRA prudential readiness

Evaluate:

• capital;
• liquidity;
• governance;
• risk;
• technology;
• cyber security;
• outsourcing;
• management;
• financial resources;
• recovery planning; and
• operational resilience.

22. Current position in August 2026

The most important current development is that Australia is moving from the older APRA licensing framework toward a more legally codified framework.

The proposed 2026 model is:

APRA says it intends to finalise the new framework in late 2026.

One illustration of the continuing importance of the regime is APRA's July 2026 grant of an ADI licence to Revolut Payments Australia Pty Ltd, demonstrating that the licensing system continues to be used for new entrants while the framework is being reformed.

23. Important provisions to remember for an exam

For a law-school answer, I would focus on these provisions/concepts:

Banking Act 1959 (Cth)

• s 2A — objects of the Act;
• s 5 — key definitions, including ADI and banking business;
• s 7 — restriction/prohibition relating to carrying on banking business without authority;
• s 9 — authority to carry on banking business;
• s 9AA — conditions on authority;
• s 13 onwards — APRA's supervisory and information powers;
• s 65A — court enforcement/injunctive powers;
• s 66 — restrictions concerning use of “bank” and related terminology.

The exact statutory wording should always be checked against the current Federal Register compilation, because the Banking Act has been amended repeatedly. The current Federal Register version provides the authoritative legislative text.

24. Conclusion

The Australian ADI licensing framework is fundamentally a prudential licensing system administered by APRA under the Banking Act 1959 (Cth).

Its central principle is straightforward:

A person cannot lawfully conduct banking business in Australia without the appropriate authority from APRA.

But obtaining the authority is only the beginning. An applicant must demonstrate adequate:

capital + governance + management + risk management + technology + operational capability + financial resources + resilience.

The cases Australian Prudential Regulation Authority v Garrett and Australian Prudential Regulation Authority v Gray [2024] FCA 79 show that the licensing requirement is actively enforceable through the Federal Court, including permanent injunctions against unauthorised banking businesses.

The 2026 reforms are especially important: APRA is moving toward legally effective, outcomes-based licensing criteria, a 12-month demonstration period, greater transparency of licensing decisions, and discontinuation of the RADI pathway.