This letter sets out APRA’s expectations for banks in managing exceptions to housing lending policy. Some banks have recently announced changes to their exception processes to support borrowers that may be experiencing challenges. It is important that these changes are implemented prudently.  

Set out below is key references to APRA’s requirements and guidance for managing exceptions to loan policy, including for capital purposes.  

An ADI must have prudent credit risk policies and processes with respect to overrides, waivers or exceptions, including clear identification of approval authorities and limits that reflect the maximum level of allowable overrides, waivers or exceptions. An override occurs when an exposure is approved outside the ADI’s credit assessment criteria. This may also include where decisions suggested by models, such as a scorecard, are overridden. Overrides may occasionally be needed to deal with exceptional or complex credit applications. 

Exposures originated as overrides, waivers or exceptions to, or otherwise not in compliance with, credit risk policies must be regularly reported to an ADI’s relevant internal governance bodies and review functions. 

An ADI must ensure that the credit origination, credit assessment and approval function is properly managed and that credit exposures are within levels consistent with an ADI’s limits. An ADI must establish and enforce internal controls and other practices to ensure that overrides, waivers or exceptions to policies, processes and limits are reported in a timely manner to the appropriate level of management for action. 

The management, monitoring and reporting of overrides, exceptions or waivers is fundamental to ensuring credit policies are followed in practice. A disconnect between lending policies and lending practices can lead to a significant increase in credit risk. A prudent ADI would monitor the frequency, reasoning and materiality of overrides, exceptions or waivers, including where ADIs use automated decision models. It is prudent for risk appetite limits to appropriately reflect the maximum level of allowable overrides, exceptions or waivers. 

Typically, senior management is responsible for monitoring compliance with material policies, procedures and risk limits and reporting material breaches or overrides to the Board. Further, where risk limits are routinely breached or policies and procedures overridden, senior management and the Board could consider whether this is indicative of a less prudent lending culture than that reflected in its risk appetite and what steps could be necessary to remedy any identified deficiency. 

An override occurs when a residential mortgage loan is approved outside an ADI’s loan serviceability criteria or other lending policy parameters or guidelines. Overrides are occasionally needed to deal with exceptional or complex loan applications. However, a prudent ADI’s risk limits would appropriately reflect the maximum level of allowable overrides and be supported by a robust monitoring framework that tracks overrides against risk tolerances. It is also good practice to implement limits or triggers to manage specific types of overrides, such as loan serviceability overrides. APRA expects that where overrides breach the risk limits, appropriate action would be taken by senior management to investigate and address such excesses.  

There are varying industry practices with respect to defining, approving, reporting and monitoring overrides. APRA expects an ADI to have a framework that clearly defines overrides. In doing so, it is important that any loan approved outside an ADI’s serviceability criteria parameters should be captured and reported as an override. This includes loans where the borrower is assessed to have a net income surplus of less than $0 (even if temporary) or where exceptions to minimum serviceability requirements have been granted, such as waivers on income verification. ADIs may have their own definitions that include other types of loans (such as those outside LVR limits) as overrides for internal risk monitoring purposes.  

In addition, a sound framework would also detail the approval process, documentary requirements for an override approval (including acceptable reasons for an override) and an oversight mechanism to monitor and report such overrides. It is good practice to monitor and report the reasons for overrides, to provide an aggregate view for senior management and enable an assessment of trends. 

Deliberate misreporting or non-reporting of overrides is indicative of poor practice. A sound risk management framework would capture such instances, prompting appropriate investigation and swift and appropriate action where necessary. 

To classify a property exposure as a standard loan, an ADI must also complete an assessment with a positive determination that the borrower can meet their repayment obligations. While APS 112 includes minimum criteria for this assessment, it is not intended to be a complete list of factors that a prudent ADI would consider. APRA expects an ADI to have appropriate controls and justification for implementing serviceability overrides, which may be used to make a positive determination of a borrower’s ability to meet their repayment obligations.