BOQ enters enforceable undertakings with APRA and AUSTRAC

The Bank of Queensland Limited (BOQ) has entered into two enforceable undertakings, one with the prudential regulator APRA in relation to remedying deficiencies in its operational resilience, risk culture, and governance and another with the government financial intelligence agency AUSTRAC in relation to deficiencies in its Anti-Money Laundering and Counter-Terrorism Financing program.

The APRA EU

BOQ has confirmed that it has entered into a voluntary enforceable undertaking with APRA to address “remediation of weaknesses in BOQ’s risk management practices, controls, systems, governance and risk culture”.

The enforceable undertaking with the Australian Prudential Regulation Authority (APRA EU) acknowledges BOQ’s past risk management and risk culture weaknesses and commits to rectify these serious issues.

It comes after the regulator found the bank had breached several of APRA’s prudential standards in 2022 and 2023 and followed APRA’s prudential review into BOQ’s operational risk, compliance, and risk culture.

An independent report on the root causes of these issues was completed at APRA’s request in April 2023.

Under this EU, BOQ will be required to prepare a remedial action plan to address underlying weaknesses in risk management practices, controls, systems, governance, and risk culture, a draft of which is required to be submitted to APRA for approval within 120 days of the APRA EU.

It will set out an appropriate timeline for the implementation of remediation activities and be specific, measurable, and achievable.

The bank will also need to appoint an independent reviewer to provide written reports on the implementation of the remediation plan, whether it is sustainable and whether further work is necessary to ensure the root causes of the material weaknesses are addressed.

BOQ is also required to ensure accountability for the remediation activities in the remuneration scorecards of accountable and responsible persons specified in the plan and other staff, as relevant.

APRA has also determined to apply a capital adjustment to BOQ’s minimum capital requirements, adding $50 million to BOQ’s operational risk capital requirement. This will take effect from 30 May 2023.

The capital add-on will remain in place until such time as BOQ has delivered the remedial action plan under the CEU to APRA’s satisfaction.

APRA chair John Lonsdale commented: “Although BOQ is financially sound and comfortably above its core capital and liquidity requirements, there are significant gaps in its risk management framework that must be addressed as a priority, particularly in the non-financial risk, anti-money laundering and counter-terrorism financing spaces.

“I have communicated APRA’s concerns directly to the BOQ Chair and CEO. They understand what we require, have taken important steps towards being able to deliver that in recent months, and we look forward to receiving and approving a final, comprehensive remediation plan that will address the underlying issues raised.”

The AUSTRAC EU

In a separate move, the Australian Transaction Reports and Analysis Centre enforceable undertaking (AUSTRAC EU) aims to improve BOQ’s compliance with Australia’s anti-money laundering and counter-terrorism financing (AML/CTF) laws.

The action follows a compliance inspection by AUSTRAC that identified concerns relating to the adequacy of BOQ’s AML/CTF systems and controls.

The enforceable undertaking binds BOQ to an ongoing remedial action plan to improve its AML/CTF program, which AUSTRAC will monitor to ensure it is undertaken within 120 days.

BQQ said the plan is required to “address concerns raised and identified by AUSTRAC and, among other things, include clear and measurable actions, a clear timeline for completion and clear accountabilities for executives”.

As part of the enforceable undertaking, BOQ will engage an external auditor who will periodically report on the remedial action plan until the plan has been completed to the satisfaction of AUSTRAC.

The bank said it remained “committed to the remediation noted above and the commitments entered into with APRA and AUSTRAC will serve as a platform to continue the work commenced under the previously announced Integrated Risk Program” (a provision for which was announced on 14 April).

It said it “has made good progress in strengthening its financial resilience and holds strong capital and liquidity buffers”.

AUSTRAC chief executive Nicole Rose said that the two regulators had ensured the other had visibility of the progress of each of their actions against BOQ, as they worked in parallel on their separate investigations.

“The actions undertaken by AUSTRAC and APRA in relation to BOQ highlight whole of government efforts to maintain the integrity of Australia’s financial systems,” Ms Rose said.

“Businesses which do not have a strong AML/CTF program in place are vulnerable to exploitation by criminals, which is why AUSTRAC has been working with BOQ to harden their processes.

“I am pleased with BOQ’s cooperation over the past six months, and their commitment to taking remedial action to ensure they meet their obligations under the AML/CTF Act.”

Similarly, APRA chair Mr Lonsdale said: “The CEUs announced today, combined with the capital overlay that APRA has applied, provide a strong platform and clear incentives for BOQ to deliver on this important remediation agenda.”

BOQ to ‘work proactively and transparently with APRA and AUSTRAC’

Speaking after the EUs were announced, BOQ chairman Warwick Negus said: “We have acknowledged the concerns raised by APRA and AUSTRAC. BOQ remains committed to its multi-year Integrated Risk Program to build a stronger and simpler bank with an uplift in risk culture, frameworks, processes and controls. This program will be independently reviewed as previously announced and we will continue to work proactively and transparently with APRA and AUSTRAC.

“Our digital transformation is complementary to this strategic priority as we decommission multiple complex legacy systems and reduce our reliance on manual processes.”

The enforceable undertakings will be the first major challenge the bank’s new managing director and CEO Patrick Allaway will face since taking over leadership of the bank.

Mr Allaway was the bank’s chairman and had been acting in the role of CEO since the former MD and CEO George Frazis departed the bank last year.

However, he took on the role of managing director & CEO at the end of March — but only for the period up to December 2024 — while the search for a long-term CEO continues.

[Related: BOQ announces new CEO]