iscover 
The regulator also said that as of yet, Bendigo has failed to “deliver sustainable improvement”, following an independent root cause analysis conducted by Deloitte.
The analysis, which the Australian Prudential Regulation Authority (APRA) required Bendigo to undertake in December 2025, found that the bank’s non-financial risk management weaknesses were prevalent across the organisation.
The analysis found:
- Bendigo Bank’s non-financial risk management weaknesses are prevalent across the organisation.
- The bank does not have a clear, complete, and reliable view of its regulatory obligations, material risks, and key controls.
- There are material deficiencies in governance, accountability, compliance management, risk oversight, and risk management capability.
- Key weaknesses have persisted despite several years of remediation activity as part of Bendigo Bank’s enterprise-wide risk transformation program (BEN+).
APRA therefore added that it was not satisfied that Bendigo had addressed the underlying root causes of its risk management deficiencies or delivered sustainable risk uplift, despite having had “significant opportunity” to do so.
Licence conditions imposed
APRA said that the licence conditions require Bendigo to undertake a “comprehensive rectification program, engage an independent assurer and provide board attestation” as part of the work to address its risk management shortcomings.
APRA will also require Bendigo to maintain its $50 million operational risk capital add-on, which was implemented at the end of 2025, until it is satisfied the bank has “effectively addressed the underlying prudential concerns”.
APRA’s deputy chair Therese McCarthy Hockey said the action reflected the “seriousness of the weaknesses” identified.
“Although Bendigo Bank is financially sound, with strong capital and liquidity positions, APRA is concerned with the gaps in its non-financial risk management framework. The weaknesses identified by the root cause analysis are significant, longstanding and require decisive action,” she said.
“APRA appreciates the constructive and co-operative engagement we have received from Bendigo Bank, and we are encouraged by the Board’s commitment to ensure our concerns are addressed promptly, effectively and in full.”
Reacting to the licence conditions, the CEO and managing director of Bendigo and Adelaide Bank, Richard Fennell, said: “Our current non-financial risk management capabilities are clearly not where they need to be, and our risk rectification plan will be designed to drive a fundamental shift in our management of non-financial risk.”
“The rectification plan will strengthen our approach to risk management, including governance and compliance management. It will reinforce accountability and address our risk capability and culture deficiencies. We will continue to work collaboratively with our regulators to ensure we meet their expectations and importantly our own,” he said.
The program is a significant undertaking and expected to take approximately three years at an initial estimated cost of $70 million, which has been included in the bank's 2026 financial year results.
“We take our obligations very seriously. This is a key priority for the Board and Executive Team, and the rectification plan will be sponsored directly by me as CEO. Elevating our risk maturity is fundamentally about better serving our customers and the community. It is critical we get this right so we can continue delivering for all our stakeholders” Fennell said.
The chair of the bank, Vicki Carter, said she acknowledged the shortcomings and was "very disappointed".
"The bank understands that we have significant work ahead of us to uplift our risk management. The board is fully committed to ensuring the bank has the necessary capability and capacity to do so.
"We understand the important role we need to play to ensure we emerge as a stronger Bank and one that can continue to deliver on our purpose of feeding into the prosperity of our customers and communities,” Carter said.
The existing capital charge of $50 million, which came into effect on 1 January 2026, remains in place
Court backs recent action
In some cases, Bendigo has been attempting to stamp out potential risks within its customer base.
This week, a Victorian Supreme Court judgment sided with the bank over its decision to debank a legal brothel operator over money laundering concerns.
The case involved Gotham City, a licensed South Melbourne brothel, and companies associated with the business, which had held accounts with Bendigo.
The plaintiffs said the bank had discriminated against the business because it operated in the lawful sex industry and had failed to properly follow its own Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) processes before closing the accounts.
The court rejected those claims, however, finding the decision to close the brothel’s accounts was made to manage potential money laundering risks arising from activity across the accounts.
[Related: Bendigo appoints senior UK banker to executive team]
Want to see more stories from trusted news sources?Make Broker Daily a preferred news source on Google.