An exemption instrument does not feel like risk. It feels like paperwork — a determination remade, a sunset date reset, a consultation response filed away. But APRA’s recent work on section 66 of the Banking Act 1959 is a reminder that exemptions are load-bearing walls: they quietly hold up naming conventions, product structures and legal permissions that most organisations have stopped actively managing. When the wall moves, whatever was leaning on it moves too.
The 30-Second Take
APRA has closed out a consultation on section 66 instruments — the rules that restrict who can use protected words like “bank”, “credit union” and “ADI”.
Two instruments were allowed to sunset on 1 October 2025, one restricted-word determination was remade unchanged, and a broader exemption covering foreign bank holding companies and multilateral development banks is still under consideration, with APRA expecting to communicate its position in early 2026.
None of this is dramatic on its own. All of it requires someone inside every affected institution to know whether the business depends on the instrument that just changed — and to be able to prove it if asked.
APRA: A Live Example of Embedded Reliance
In its consultation response on Banking Act 1959 section 66 instruments, APRA confirmed it received four submissions, all supportive, on a set of what it called minor proposals. The detail matters more than the label.
One instrument, Banking (restricted word or expression) determination No. 1 of 2015 (which determines that “credit co-operative” is a restricted expression), was remade without change ahead of its 1 October 2025 sunset date. A separate consent covering use of the term “Offshore Banking Unit” was allowed to lapse on the same date. Meanwhile, Banking exemption No. 1 of 2018, which lets foreign banks issue wholesale securities, is being reconsidered for a wider scope after respondents pushed for it to cover more entities and activities — a decision APRA says is still coming.
For any institution whose disclosures, marketing copy or product documentation reference these instruments, the practical question is not whether the law changed in the abstract. It is whether their own paperwork, naming conventions or legal opinions were quietly built on an instrument that has now sunset, been remade, or is sitting in regulatory limbo awaiting a 2026 decision.
A Different Kind of Exposure: AFCA’s New Naming Power
Section 66 is about what an exemption lets you say.
A parallel governance risk is what happens when a regulator decides to say something about you. From 12 March 2026, the Australian Financial Complaints Authority gained an ASIC-approved rule — Rule A.11.6 — allowing it to publicly name financial firms that fail to comply with its Determinations. AFCA has confirmed it intends to use this power, while giving firms notice and a chance to explain before publication. The examples AFCA has flagged are cases where a firm is clearly refusing to comply, not ambiguous ones.
The link to the section 66 situation is direct: both are cases where an institution’s exposure depends on a compliance or governance gap becoming visible to a regulator, a complaints body or the public. Whether the trigger is an outdated legal opinion resting on a sunset exemption, or a Determination nobody actioned, the failure mode is the same — nobody owned the follow-through.
How Other Regulators Handle the Same Problem
The UK offers a useful contrast. Under the Bank of England’s Prudential Regulation Authority, firms seeking relief from a rule must proactively apply for a waiver or modification under section 138A of the Financial Services and Markets Act, and the PRA assesses each application against statutory tests before granting it — the relief is not simply issued and left to sunset quietly years later. That places the burden of demonstrating ongoing eligibility squarely on the firm applying, rather than on a regulator remaking or retiring an instrument on its own timetable. Australian institutions relying on APRA-issued exemptions don’t face that same proactive re-application requirement, which is exactly why embedded reliance is easier to lose track of here than it would be under a modification-by-consent model.
Questions Your Board Should Be Asking Now
- Do we rely on the section 66 exemption regime anywhere in our naming, marketing or product documentation — and can we point to the specific instrument?
- Who owns the register of legal exemptions and determinations our business depends on, and when was it last reviewed?
- If an instrument we rely on sunsets or is remade with different conditions, what is our process for finding out and responding?
- Do we have any open AFCA Determinations where the compliance status is unclear or contested internally?
- If AFCA named us publicly for non-compliance tomorrow, who would be accountable for the response, and is that agreed in advance?
- Would our governance framework catch a “quiet” regulatory change like a sunsetting exemption, or only a headline enforcement action?
Exemptions, determinations and Determinations all share one governance trait: they are only safe to rely on if someone is actively watching them.