Removed: the legacy Direct to APRA (D2A) system for entity access, and the separate collection interfaces behind it.
Outcome: switched off in March 2026; every collection moving onto the single APRA Connect interface; the agency estimates that consolidation will save industry “approximately $6 million annually”.
In March 2026 Australia’s financial regulator decommissioned its legacy Direct to APRA (D2A) data submission system “for entity access following the identification of security vulnerabilities through a routine test,” and gave its reason in one sentence: “We have a low risk tolerance for system vulnerabilities that may expose APRA or regulated entities to attacks.”
APRA chose removal over remediation. The regulator that demands operational resilience from banks ran the experiment on itself.
Source: APRA, Corporate Plan 2026-27 (August 2026)