APRA D2A Decommissioned: What Regulated Entities Need to Know

What happened

On 20 March 2026, the Australian Prudential Regulation Authority decommissioned its Direct to APRA (D2A) data submission system following the identification of security vulnerabilities through a routine penetration test conducted on 19 March. The decision was immediate and precautionary.

APRA has put interim submission arrangements in place to ensure continuity of reporting obligations. APRA has indicated that XML files are the preferred format for interim submissions. Entities are also advised to uninstall the D2A client as a precautionary measure — APRA has noted that the presence of the D2A program could pose residual risk to your organisation's data integrity and security. Entities that have not received direct guidance from APRA on the interim process should contact dataanalytics@apra.gov.au immediately.

The authority has also confirmed it is accelerating its program to migrate all remaining data collections to APRA Connect.

Three things every regulated entity needs to understand

1. Your reporting obligations have not changed

The decommissioning of D2A does not alter any reporting obligation. Submission deadlines, data requirements and prudential standards remain in full effect. Regulated entities are expected to meet their obligations through the interim arrangements APRA has communicated. Entities that have not received that communication should contact APRA's data analytics team directly at dataanalytics@apra.gov.au.

2. Data quality standards remain unchanged

Interim submission arrangements do not reduce APRA's expectations around data quality. Entities should continue to apply the same validation rigour to their submissions regardless of the submission channel. Errors, omissions and validation failures will be managed through APRA's standard data query process. The integrity of your submission remains your responsibility.

3. The APRA Connect transition is now an immediate priority

APRA Connect has to date been the platform for new and redesigned data collections — including SDT for superannuation and redesigned collections under AASB 17 and LAGIC for insurance. Legacy reporting forms across all industries remained on D2A until its decommissioning. No industry has yet been through the migration of legacy D2A collections to APRA Connect. That migration is now being accelerated for all regulated entities simultaneously. Entities should begin assessing their APRA Connect readiness now rather than waiting for formal migration timelines to be communicated.

How RegCentric can help

RegCentric supports regulated entities across banking, insurance and superannuation with APRA reporting. RegConnect is available free for three months to help entities meet their reporting obligations during the transition period. Details at regconnect.com.au/free-trial.