Strengthening readiness for geopolitical shocks

Executive Summary

• APRA expects regulated entities to move beyond awareness of geopolitical risk and demonstrate operational readiness.

• Geopolitical risk should be embedded across governance, strategy, capital and liquidity planning, operational resilience and crisis preparedness.

• Banks, insurers and superannuation funds face different prudential implications, but all should reassess stress testing, third-party dependencies and board oversight.

• APRA has indicated that where it identifies inadequate preparedness, it may take supervisory action.

Geopolitical shocks: Key expectations

In its 17 June 2026 letter to banks, insurers and superannuation funds, APRA set out its minimum expectations for strengthening readiness for geopolitical shocks, including events such as sanctions, trade restrictions, armed conflict, market closures, funding stress, cyber-attacks, foreign interference, insider threats and disinformation campaigns.

The key message is that awareness of geopolitical risk is no longer enough: APRA expects regulated entities to embed these risks into governance, strategy, risk appetite, business planning, capital and liquidity planning, investment stress testing, third-party risk management, and general crisis preparedness. APRA also signals that where it identifies heightened exposure, weak governance or inadequate preparedness, it may take supervisory action.

APRA identifies several common gaps across the financial system:

• Geopolitical actions such as sanctions, restricted market access and reduced capital mobility are not always explicitly reflected in business plans, credit strategies, funding strategies or investment strategies.

• Risk management is not keeping pace with rapidly evolving non-financial threats, including personnel security risks, foreign interference, insider threats, disinformation and cyber-attacks linked to geopolitical developments.

• Boards may lack sufficient technical literacy to challenge management on technology-related risks, including AI and cyber-related vulnerabilities.

• Reliance on critical third parties, often overseas, increases exposure to technology, operational and supply-chain disruptions.

• Crisis exercises are not always severe or integrated enough to give boards and executives confidence that the entity could withstand and respond to a major geopolitical shock.

Impact on banks

Banks are likely to face the most direct prudential impact through credit, funding, liquidity, payments, sanctions compliance and operational resilience channels. APRA’s expectations imply that banks should reassess how geopolitical stress scenarios could affect wholesale funding access, offshore markets, correspondent banking relationships, cross-border payments, customer sectors exposed to trade restrictions, and concentration risks in critical technology providers.

In practical terms, banks may need to strengthen scenario analysis around funding market closure, sanctions escalation, cyber disruption, offshore service disruption and customer confidence shocks. They will also need to ensure geopolitical risk is explicitly reflected in ICAAP, liquidity stress testing, recovery planning, operational resilience frameworks and board reporting.

Impact on insurers

For insurers, the key impact is likely to fall across investment portfolios, reinsurance arrangements, claims volatility, operational resilience and third-party dependencies. Geopolitical shocks can affect asset values, market liquidity, currency exposures and access to offshore reinsurers or service providers. APRA’s publication suggests insurers should test whether capital, liquidity and investment strategies remain robust under scenarios involving market closure, sanctions, cyber disruption or sudden deterioration in global risk sentiment.

Insurers should also consider whether geopolitical events could drive correlated claims impacts, such as cyber incidents, business interruption pressures, supply-chain disruption, travel-related claims or broader economic stress affecting policyholders. Board oversight will need to extend beyond traditional underwriting and market risk to include cyber, AI, disinformation, foreign interference and overseas third-party risks.

Impact on superannuation funds

For superannuation funds, the main implications relate to investment governance, liquidity management, member confidence, outsourcing and operational continuity. APRA’s emphasis on investment stress testing for market closure, sanctions and funding stress is particularly relevant to funds with global listed assets, private markets exposure, foreign exchange exposure, offshore managers, custodians and administrators.

Funds may need to review whether their liquidity frameworks and investment stress testing adequately capture geopolitical disruption, including impaired access to markets, valuation uncertainty, sanctions affecting assets or counterparties, and pressure from member switching or withdrawals. They should also ensure that trustees have sufficient visibility over offshore service providers and that crisis exercises test both investment and operational consequences of severe geopolitical events.

Overall assessment

APRA’s letter effectively raises the bar from passive risk awareness to demonstrable readiness. The common theme for banks, insurers and superannuation funds is that geopolitical risk should be treated as an enterprise-wide resilience issue, not just a macroeconomic or investment risk. Boards and executives will need to show that they understand their entity’s exposure, have tested severe but plausible scenarios, have clear response plans, and can maintain critical services through simultaneous financial, operational, technology and confidence shocks.