APRA CPS 511 Remuneration Guide: Variable Pay, Deferral, Malus and Clawback for Financial Institutions

APRA's Prudential Standard CPS 511 (Remuneration) is one of the most consequential reforms for how Australian banks, insurers and super funds compensate their people. It fundamentally reshapes variable pay structures by requiring meaningful deferral, introducing enforceable malus and clawback provisions, and placing the Board Remuneration Committee at the centre of oversight. This guide covers every key obligation.

What CPS 511 Requires: Overview

CPS 511 applies to all APRA-regulated entities — ADIs, general insurers, life insurers, private health insurers, and RSE licensees. It replaced parts of the old CPS 510 (Governance) that dealt with remuneration and elevated remuneration into a standalone prudential standard. The core objective is aligning pay outcomes with risk outcomes and long-term financial soundness.

The standard distinguishes between Significant Financial Institutions (SFIs) and non-SFIs, with more prescriptive requirements for SFIs. Key obligations include:

• Remuneration policy approved by the Board, reviewed annually
• Variable remuneration deferral with minimum periods and proportions
• Malus and clawback provisions for risk, compliance, and conduct failures
• Board Remuneration Committee oversight (mandatory for SFIs)
• Risk and financial soundness alignment in all incentive design
• Special provisions for senior executives, material risk-takers, and significant persons

Variable Remuneration Deferral

The deferral framework is the backbone of CPS 511. It ensures that variable pay is not crystallised before the risk consequences of decisions are known. The minimum deferral requirements differ by entity type and role.

Deferred variable remuneration must be subject to performance adjustment throughout the deferral period. Entities cannot accelerate vesting except in limited circumstances (such as death or total permanent disability), and hedging or insurance against unvested remuneration is prohibited.

Malus Triggers: When Unvested Pay Is Reduced

Malus is the downward adjustment or cancellation of unvested deferred remuneration. CPS 511 requires entities to apply malus where any of the following triggers occur:

• Risk management failure — the person's decisions contributed to a material risk event or unexpected loss
• Compliance breach — a material breach of law, regulation, or internal policy attributable to the person or their area of responsibility
• Misconduct — fraud, dishonesty, or behaviour that materially damages the entity
• Financial misstatement — restatement of results that would have led to a lower variable pay outcome
• Material downturn — significant deterioration in entity financial performance linked to excessive risk-taking
• Reputational harm — conduct that caused significant reputational damage to the entity

The Board (or Remuneration Committee) must have documented criteria for when and how malus is applied. Malus decisions must be supported by evidence, documented, and communicated to the affected individual.

Clawback Enforcement

Clawback goes further than malus — it allows the entity to recover variable remuneration that has already vested and been paid. Under CPS 511, clawback provisions must extend for a minimum of 4 years after vesting and cover the same triggers as malus.

Key requirements for clawback:

• Employment contracts must contain enforceable clawback clauses
• The entity must have a documented clawback policy approved by the Board
• Clawback must be capable of being enforced regardless of whether the person has left the entity
• Entities must consider legal enforceability and take reasonable steps to recover amounts
• The Board must report annually on the application of malus and clawback

Board Remuneration Committee

For SFIs, CPS 511 mandates a dedicated Board Remuneration Committee. The committee must:

• Comprise at least 3 non-executive directors, with a majority being independent
• Be chaired by an independent non-executive director (not the Board Chair)
• Have a formal charter defining scope, authority, and reporting obligations
• Oversee the design of the remuneration framework and annual policy review
• Approve variable remuneration outcomes for senior executives and material risk-takers
• Receive independent input from the CRO / risk function on risk-adjusted pay
• Monitor and approve the application of malus and clawback
• Engage an independent remuneration consultant at least every 3 years

Non-SFIs are not required to establish a separate committee but must ensure equivalent Board-level oversight of remuneration decisions, including documented processes for risk adjustment of variable pay.

Alignment with Risk Management and Financial Soundness

CPS 511 explicitly links remuneration to the entity's risk management framework (CPS 220) and long-term financial soundness. Key alignment obligations:

• Risk-adjusted performance metrics — variable pay must be assessed against risk-adjusted metrics, not just revenue or profit
• CRO sign-off — the Chief Risk Officer must provide independent input on whether risk outcomes warrant adjustment to variable pay pools
• Downward adjustment in loss years — variable remuneration pools must be materially reduced or eliminated when the entity makes a loss or capital falls below target
• No guaranteed variable remuneration — except for sign-on arrangements limited to the first 12 months
• Non-financial metrics — incentive structures must incorporate conduct, compliance, and customer outcome measures alongside financial targets

Transition Timeline and Key Dates

Entities that had existing deferral arrangements in place before 1 January 2024 were permitted to maintain those arrangements for the duration of the existing deferral period. However, all new awards from 1 January 2024 must meet the full CPS 511 requirements, and by 1 January 2027 no grandfathered arrangements should remain.

Common Compliance Gaps

Based on APRA supervisory observations and industry feedback, the most common gaps include:

1. Weak clawback enforceability — contracts contain clawback clauses that are untested or legally ambiguous
2. Insufficient risk adjustment — variable pay pools adjusted on financial performance but not meaningfully on risk or conduct metrics
3. CRO input is advisory only — risk function provides input but it is routinely overridden without documented rationale
4. Malus rarely exercised — entities have malus policies but have never applied them, raising questions about effectiveness
5. Inadequate coverage of material risk-takers — entities define the population too narrowly, excluding traders, underwriters, or investment staff with material risk exposure
6. Hedging not monitored — no systems to detect or prevent personal hedging of deferred remuneration

GoComply covers 110 regulatory sources and 110 compliance rules across APRA, ASIC, AUSTRAC, Privacy Act, FAR, and more. This article is for informational purposes only — consult qualified compliance professionals for specific obligations. Browse all resources.