Document ID: chunk:federal_register_of_legislation:F2023L00638:body:0:p4
Version: federal_register_of_legislation:F2023L00638
Segment Type: other
Provision Reference: 
Character Range: 8649–11938

14 applies by using the highest value of stored value liabilities held over the preceding six month period, measured in a manner approved by APRA.

Liquidity and asset requirements

    16.         A PPF provider must hold at all times high quality liquid assets equal to its stored value liabilities. High quality liquid assets must be free from encumbrances (except where approved for a prudential purpose by APRA).  Eligible assets include:

       (a)          cash;

       (b)          securities eligible for repurchase transactions with the Reserve Bank of Australia;

       (c)          bank bills and CDs issued by ADIs provided the issue is rated at least 'investment grade' (refer to Attachment C to Prudential Standard APS 116 Capital Adequacy: Market Risk);

       (d)          deposits (at call and any other deposits readily convertible into cash within two business days) held with other ADIs; and

       (e)          any asset approved by APRA (subject to any conditions imposed by APRA) as a high quality liquid asset for the purposes of this Prudential Standard.

Operational risk

    17.         The Board and senior management of a PPF provider must develop, implement and maintain a risk management framework to address operational risk that is appropriate to the size, complexity and business mix of the PPF provider.

    18.         The management of operational risk must include, but is not limited to, the risks associated with:

       (a)          the integrity of transaction data and timely processing of transactions;

       (b)          appropriate back-up and disaster recovery plans and facilities, including resilient critical processing systems (refer to CPS 232);

       (c)          regular testing of business continuity and disaster recovery arrangements (refer to CPS 232);

       (d)          outsourcing risk management to any third-party service providers (refer to CPS 231);

       (e)          internal and external fraud risk management, which must include the following elements:

           (i)            risk identification and assessment;

           (ii)         internal controls and mitigation strategies;

           (iii)       segregation of duties at both an operational level and in relation to functional reporting lines;

           (iv)        financial accounting controls; and

           (v)          staff training and awareness;

    (f)    controls against information security and physical security risks; and

    (g)   compliance obligations regarding relevant laws and regulations, for example those relating to licensing requirements under the Corporations Act.

    19.         A PPF provider must have in place effective management information systems and monitoring mechanisms to assist with early detection and correction of deficiencies in procedures for managing operational risk.

    20.         A PPF provider must consider the imposition of a limit on the amount of stored value that can be loaded, stored or paid on a device or account purchased from the PPF provider. APRA will closely examine any facility that allows a purchaser to load, store, or pay sizeable amounts of money to ensure that the integrity of the facility is not compromised. Where a PPF provider is