APRA CPG 229: climate risk assessment for property lending

What CPG 229 requires

APRA's Prudential Practice Guide CPG 229 (Climate Change Financial Risks) was published in November 2021 and sets out APRA's expectations for how regulated entities — banks, insurers, and superannuation trustees — should manage climate-related financial risks. While technically guidance rather than a binding prudential standard, APRA has made clear that it expects entities to demonstrate compliance.

CPG 229 distinguishes between physical risks (direct damage from climate hazards) and transition risks (financial impacts from the shift to a low-carbon economy). For property lending, physical risk is the dominant concern. An ADI with a $50 billion residential mortgage book needs to understand which of those properties are exposed to flood, bushfire, coastal erosion, or extreme heat — and how that exposure changes under different climate scenarios.

The guide explicitly states that entities should use scenario analysis as a tool for understanding potential climate impacts. This isn't a box-ticking exercise. APRA expects entities to use scenarios that are relevant to their specific risk profile, consider multiple time horizons, and integrate the results into risk management and strategic planning.

Physical risk in mortgage portfolios

A residential mortgage is ultimately secured by a physical asset at a specific location. If that location is exposed to increasing climate hazards, the security value is at risk. The mechanisms are both direct and indirect:

• Direct damage. Flooding, bushfire, or storm damage reduces the value of the security. Even with insurance, there may be underinsurance, policy exclusions, or delays in repair that affect the borrower's financial position and the bank's recovery prospects.
• Insurance withdrawal. As premiums rise in high-risk areas, some borrowers drop coverage or face exclusions for specific perils. An uninsured loss can trigger default. An uninsurable property has reduced market value regardless of whether a loss event occurs.
• Value impairment. Properties in areas with increasing hazard exposure may experience price discounts as the market becomes more risk-aware. Research suggests 5-12% discounts for flood-exposed properties in NSW, with the discount widening after major events.
• Concentration risk. A bank with significant exposure to a single geographic area faces correlated losses from a single event. The 2022 Northern Rivers floods affected thousands of properties simultaneously within a concentrated lending area.

What data banks need

To meet APRA's expectations, an ADI's climate risk assessment for property lending should include:

Asset-level hazard exposure

Each property in the portfolio needs to be assessed against multiple hazards at its specific coordinates. Postcode-level assessment is insufficient — two properties in the same postcode can have completely different flood, bushfire, and coastal exposure depending on elevation, proximity to waterways, and vegetation.

The minimum hazard set for Australian property should include: riverine and flash flooding (with depth at multiple return periods), bushfire (BAL classification), coastal erosion and inundation (for coastal properties), and extreme heat stress (for properties in heat-affected regions).

Scenario-based projections

CPG 229 expects scenario analysis across multiple time horizons. For property lending, relevant scenarios should include at least a “Paris-aligned” pathway (SSP1.26 or SSP2.45) and a “high warming” pathway (SSP3.70 or SSP5.85). The time horizons should align with the bank's lending book — typically 5-year, 15-year, and 30-year windows to match mortgage terms.

Australia's primary source for regional climate projections is NARCliM 2.0, which provides downscaled CMIP6 projections for southeast Australia at approximately 4km resolution under SSP2.45 and SSP3.70. This data includes temperature, precipitation, wind, humidity, and derived indices including fire weather.

Statutory planning context

Physical hazard data alone is incomplete without understanding the statutory planning framework. A property in an LEP flood planning area faces development constraints that affect its long-term value and adaptability. A property on Bush Fire Prone Land faces additional construction costs under AS 3959. A property in a heritage conservation area may have limited options for climate adaptation upgrades.

These planning constraints are material to credit risk because they affect the borrower's ability to adapt the property, the cost of any future development, and the property's market value to future buyers. A comprehensive assessment integrates physical hazard data with statutory overlay data.

Stress testing approaches

APRA's climate vulnerability assessment (CVA) exercises have given ADIs practice in climate stress testing. The key lesson from early CVA rounds is that the quality of results is entirely dependent on the quality of input data. Banks that used postcode-level proxies got postcode-level results — insufficient for identifying specific at-risk exposures or for making portfolio-level decisions.

A property-level stress test should model:

1. Event-based scenarios. What happens to the portfolio if a 1-in-100 year flood event occurs in each major catchment? Which loans are directly affected? What is the total exposure at risk?
2. Chronic degradation. Under a high-warming scenario, which properties transition from “insurable” to “marginally insurable” to “uninsurable” over the next 20 years? What is the cumulative value impairment?
3. Correlated default. In a major climate event, multiple borrowers are affected simultaneously. If 500 borrowers in the Hawkesbury-Nepean experience a 1-in-100 year flood, what proportion are likely to default, and what is the recovery rate on water-damaged security?
4. Insurance discontinuity. If insurers withdraw flood cover from a catchment (as has occurred in parts of the Northern Rivers), what happens to property values and borrower behaviour?

What good property climate data looks like

For CPG 229 compliance, the data used for physical risk assessment should meet several criteria:

• Asset-level granularity. Risk assessment at the individual property coordinate, not aggregated to postcode or suburb. Flood depth varies by metres within a single street.
• Multi-hazard coverage. Assessment across flood, bushfire, coastal, and heat hazards. Single-peril assessment misses compound risks and creates blind spots.
• Scenario-based. Forward-looking under at least two SSP pathways with defined time horizons. Current-state-only assessment doesn't satisfy the scenario analysis requirement.
• Deterministic methodology. Results should be traceable to source data and explainable to auditors, board risk committees, and regulators. Proprietary ML models that produce a “score” without transparent methodology create audit risk.
• Statutory integration. Physical hazard data combined with planning overlay data (LEP flood areas, Bush Fire Prone Land, coastal vulnerability areas) provides the full picture of regulatory and physical constraint.
• Data provenance. Clear documentation of underlying data sources, update frequency, and known limitations. Auditors will ask where the data comes from.

Getting started

For ADIs early in their climate risk data journey, the practical starting point is:

1. Geocode your mortgage book. Ensure every property in the portfolio has accurate coordinates, not just addresses. Address-level geocoding is the foundation for property-level hazard assessment.
2. Run a multi-hazard screen. Identify which properties fall within statutory hazard overlays (flood planning area, Bush Fire Prone Land, coastal vulnerability area). This uses publicly available government data and gives an immediate view of regulatory exposure.
3. Prioritise detailed assessment. For the highest-exposure properties, obtain detailed hazard data: flood depth at multiple ARI, BAL classification, and projected changes under climate scenarios.
4. Build the reporting framework. Structure the results to map to CPG 229's framework: risk identification (which hazards, which assets), measurement (quantified exposure), monitoring (ongoing tracking), and management (mitigation actions and limits).