Ann: Quarterly Activities & Cashflow Report, page-36

I don't follow. Most Banks own or lease their data centres for example through Digital Reality which are considered on-premise. APRA requires that all customer sensitive data be stored on-premise i.e. in your own DC. This happens today outright.

I don't get how moving to DXN would make data more secure. If anything, Banks are being driven to in-source firewall and network management to their own staff members rather than other companies. The main friction point between APRA and the Banks is what work load is allowed off premise into the cloud (i.e. AWS, Azure etc.). So you'll find dev and test environments in cloud but production always on-prem.

Another dimension is hardware vendors installing racks inside on-prem DCs and providing a hybrid cloud. Racks that aren't owned by the Bank but still on-prem with the appropriate access controls.