AI agents for compliance teams in retail banking in Australia

Australian retail banks' compliance teams can use AI agents to test financial hardship requests against code timeframes, review home and personal lending files for responsible lending evidence, keep executive accountability maps current and gather CPS 230 evidence. APRA, ASIC and the OAIC hold banks and named executives accountable, so credit decisions, hardship outcomes and breach reports stay with people.

What fills a retail banking compliance team's week in Australia?

Australian banks are authorised deposit-taking institutions, supervised by APRA for prudential soundness and by ASIC for conduct, with the OAIC overseeing privacy. Retail banking compliance carries several heavy, recurring loads.

Responsible lending. Before lending to consumers, banks must make reasonable inquiries about the customer's situation, verify it and assess whether the loan is unsuitable. Lending files must show this was done. Home loans, personal loans and credit cards each have their own file standards.

Financial hardship. Customers in difficulty can ask for help, and the industry banking code sets expectations on how quickly banks respond and how they treat customers. Hardship requests have risen and fallen with economic conditions, and consistency is hard to maintain.

Executive accountability. An accountability regime requires banks to name the executives responsible for key functions and to map responsibilities clearly. When things go wrong, the map determines who answers.

Operational risk. APRA CPS 230 requires banks to manage operational risk, keep critical operations running through disruption and manage material service providers.

Scams and vulnerability. Banks are under pressure to detect scams, intervene and support vulnerable customers.

Where can agents help?

Depth caps what each agent may do: 1 reads, 2 drafts for a person, 3 executes routine work within bounds.

1. Hardship timeframe testing (depth 1). The agent reads hardship cases and tests each against code timeframes for acknowledgement, decision and communication, and checks that collection activity paused where it should have. It reports breaches by team and channel.
2. Responsible lending file reviews (depth 1). The agent samples approved loan files and checks for evidence of inquiries, verification of income and expenses, and the unsuitability assessment. It lists files where evidence is missing or inconsistent, such as declared expenses well below what bank statements show.
3. Accountability map upkeep (depth 2). When roles, structures or products change, the agent drafts updates to the accountability map and flags responsibilities that no longer have a named owner.
4. CPS 230 evidence (depth 2). The agent maps controls, incidents and service provider reports to each critical operation and drafts the evidence pack.
5. Breach register drafting (depth 2). For each incident, the agent drafts the facts and the reporting criteria that may be met, for the compliance lead.

Hardship testing and lending file reviews are the most retail-banking specific uses: both involve high volumes, clear standards and direct customer harm when they fail.

What stays with people?

Credit decisions. Whether a loan is unsuitable, and whether to approve it, rests with credit staff. A compliance agent reviews files after the fact; it does not lend.

Hardship outcomes. What help a customer receives, from deferred repayments to restructuring, is a judgement about their circumstances.

Accountability allocations. Who is responsible for what is a board and executive decision. The agent drafts the map; executives accept their responsibilities.

Breach reports to ASIC and APRA. Deciding that a breach is reportable, and the content of the report, stays with responsible officers.

Remediation. Deciding which customers were harmed and what they receive is a fairness judgement owned by people.

Which Australian rules apply?

Australia has no AI-specific law in force. The government has published a voluntary AI safety standard. Binding duties come from banking, consumer credit and privacy law. The broader view is in how AI agents are regulated in Australia.

APRA supervises authorised deposit-taking institutions. CPS 230 requires operational risk management, business continuity for critical operations and oversight of material service providers, which can include the provider of an agent that supports lending, hardship or complaints.

ASIC supervises conduct, including responsible lending, product design and distribution, breach reporting and complaints.

The executive accountability regime requires named responsibility for key functions, so every agent should map to an accountable executive.

Privacy Act 1988 and the OAIC. Lending and hardship files contain detailed personal and financial information, and hardship files often include health information, which is sensitive. Use must fit the purpose, and access should be limited. The details are in Australia's Privacy Act and AI agents.

AML and counter-terrorism financing law applies to banks' due diligence, monitoring and reporting.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

How do you start in the first 90 days?

Month one. Assess the agent's provider under CPS 230 and map the agent to its accountable executive. Start with hardship timeframe testing, which reads case records and produces a report.

Month two. Replay the agent against two quarters of hardship cases. Compare its breaches with the quality assurance findings for the same period, and investigate every difference.

Month three. Run monthly, reviewed by the hardship compliance lead. Begin responsible lending file reviews on personal loans, where files are simpler, before moving to home loans. For a contrasting market with a different regulator mix, see compliance agents in Nigerian retail banking. The guide to AI compliance agents explains why the agent stays second line.