Oracle Java at an Australian bank. A worked market scenario.

An Australian bank is a hard case for the Oracle Java employee metric: a large domestic workforce, a New Zealand subsidiary, an offshore captive, heavy labor hire, and a regulator with views on who runs your critical services. This is that case worked end to end.

How to read this page. This is a modeled market scenario, not a client engagement. The bank is a composite of the structures we see in Australian financial services. Every Oracle rate is published. Every other figure is labeled as an assumption. There is no real institution, no logo and no quote here.

What does Oracle propose to an Australian bank?

A subscription priced on the whole group, counted at 34,600 people, which is 2,366,640 USD a year at Oracle's published band rate. The Java that drives the requirement runs on a fraction of that population.

The metric counts employees rather than Java users, including part time staff, contractors, agents and consultants supporting internal operations. We treat that definition as settled in the employee metric decoded and in the Oracle Java 2026 pillar.

The counted population, as Oracle opens

At 68.40 USD per employee per year the annual list cost is 2,366,640 USD, and a 36 month term commits 7,099,920 USD before any escalator. Oracle describes the subscription on its Java SE subscription page.

What makes the Australian count different?

Group structure, labor hire, and a currency the price list is not published in. Those three things move the number more than anything a procurement team would normally look at.

The trap that catches Australian banking groups

The intuitive move is to narrow the contracting entity to the Australian licensed bank, dropping the New Zealand subsidiary and the offshore captive out of the count. On the face of it that removes 8,300 people.

It also costs money. Once separated, each entity that runs Oracle Java needs its own subscription, priced from the bottom of the ladder rather than the top.

The same arithmetic explains why removing 9,700 people from the count, 28 percent of the population, saves only about 15 percent. The reduced count lands in a more expensive band. We work that mechanic through in the 50 developers and 10,000 employees case and in the employee tier worked example.

Australian workforce categories that need care

• Casual employees. A distinct legal category in Australia, redefined on 26 August 2024 under the Closing Loopholes reforms. The Fair Work Ombudsman guidance governs the classification, and a bank with a seasonal contact center can move several hundred people between categories across a year. Fix the measurement date in the ordering document.
• Labor hire workers. Employed by an agency but working on the bank's systems in support of internal operations. Concede these. Fighting them costs credibility you need elsewhere.
• The offshore captive. A wholly owned subsidiary, so its people are group employees. Offshoring into a captive reduces salary cost and does not reduce the Java count by a single person.
• The third party managed service. Staff of an independent provider running its own platform. This is the one exclusion worth building an evidence pack for, and it needs a written attestation from the provider that its own Java entitlements cover the environment.

Currency and the evidence you hand over

Oracle publishes the Java price list in United States dollars while an Australian entity is often quoted in Australian dollars. Fix the conversion basis and the rate date in the ordering document, or a currency move reprices a commitment you thought was fixed.

On evidence, provide an attested aggregate head count signed by an officer rather than a payroll extract. There is no reason for personal information about bank staff to leave the institution to settle a software quantity, and an attestation is easier to defend and easier to reproduce at renewal.

How much Java does the bank actually run?

Enough to make the subscription hard to avoid and nowhere near enough to justify it comfortably. Roughly 2,160 people genuinely need Java out of the 34,600 Oracle wants to count.

What the ratio says about this bank

Divide 34,600 counted people by 2,160 genuine Java users and the ratio is about 16 to 1. At the band rate that is 1,096 USD per Java user per year.

By the thresholds we set out in the ratio analysis, a bank at 16 to 1 is not an outlier. It is the case where the subscription is defensible while exit is blocked, and where the term length matters more than the rate.

Why removing the Temurin servers from scope changes nothing today

The 300 servers already running Eclipse Temurin carry no Oracle obligation, and they should never appear in an Oracle scope discussion. That is a correctness point, not a savings point.

Under the employee metric the bill is set by people, not instances. While one Oracle JDK remains anywhere in the group, the subscription covers all 34,600 people, so isolating free builds reduces the size of the problem at the next renewal rather than the invoice at this one.

How does APRA change the exit decision?

It turns a runtime swap into a governance event with a notification clock. Two prudential standards apply directly, and both have to be in the migration plan before the first cutover.

CPS 230 and the material service provider register

APRA's Prudential Standard CPS 230 Operational Risk Management commenced on 1 July 2026. It requires a register of material service providers, formal legally binding agreements with them, and provisions giving APRA access to documentation and data relating to the service.

• Notification timing. CPS 230 requires notification to APRA within 20 business days of entering a material service arrangement, and prior notification for material offshoring arrangements.
• Which way it cuts. If Java runtime support underpins a critical operation such as payments or core banking, a replacement support provider is a candidate for the register. So, arguably, is Oracle today.
• The question to ask before renewal. Does your current Oracle Java agreement already carry the CPS 230 access and audit provisions? If it does not, that is a reason to reopen the paper rather than roll it forward.
• Plan the governance ahead of the engineering. Assume a quarter of registration, assessment and notification work before the first production cutover.

CPS 234 and the security capability you have to evidence

APRA's Prudential Standard CPS 234 Information Security requires controls commensurate with vulnerabilities and threats, and requires the bank to assess the information security capability of any related party or third party managing its information assets.

Applied to Java, that means a move to a free distribution has to come with evidence of a security update cadence and a named owner for it. Eclipse Temurin publishes builds on the quarterly update cycle, and the bank's obligation is to show it consumes them, not merely that they exist.

The Australian change calendar compresses everything

• Financial year end on 30 June typically brings a change freeze across banking platforms.
• Peak trading over December and January usually brings a second freeze.
• Major regulatory program milestones take priority over discretionary technical work and consume the same change windows.
• The practical effect is roughly three usable change quarters a year, which is why a two year migration in a bank is not the same as a two year migration anywhere else.

What migration is actually available?

Everything except the core banking platform, which is the whole problem. Four of the five components in the estate can move inside twelve months, and the fifth decides whether any of it removes the subscription.

What moves, in what order

1. Engineering workstations and build pipeline. Immediate. Default the pipeline to a free build so no new Oracle binaries enter the estate.
2. The 40 server integration layer. Low risk, and useful as the pattern that proves the approach to the risk committee.
3. The 1,900 dealer desktops. Slower, because desktop packaging and regression testing in a markets environment is genuinely careful work.
4. The core banking platform. Blocked. It moves when the vendor certifies an alternative runtime, and not before.

The move that actually ends the subscription

Put runtime certification into the core banking vendor's next contract renewal. Written as a deliverable with a date, not as a best efforts statement, it converts a licensing dependency into a supplier obligation.

This is the highest value action on the page and it has nothing to do with Oracle. The bank does not control Oracle's metric. It does control what it buys from its core banking supplier, and that supplier wants a renewal.

What does the bank end up doing?

It buys a short subscription on the widest possible entity, removes the one population it can genuinely remove, and spends its real energy on the core banking vendor. The subscription is not avoided. It is contained and dated.

Where the common advice on the Oracle Java metric is wrong

The common advice to a bank in this position is to inventory the estate, strip the free OpenJDK installations out of Oracle's scope, and watch the bill collapse. We disagree, and we think that advice does real damage because it sets an expectation nobody can meet. Under the employee metric the bill is a function of people, not instances, so removing free builds from a scope document changes the invoice by exactly nothing while a single Oracle JDK remains anywhere in the group. The inventory is still essential, but for a different reason: it tells you whether zero is reachable, and by what date. In a bank with a vendor packaged core system, zero is usually not reachable inside one subscription term. The honest strategy is therefore to buy the shortest term that reaches the date your blocking vendor can certify an alternative, keep the counted entity wide because the band rate rewards it, and put your negotiating energy into the supplier who actually controls the dependency.

The bank is quoted for every employee in the group. Java runs the business for about two thousand of them. The gap between those numbers is not the negotiation. The date the core banking vendor can certify an alternative is the negotiation.

What should a buyer do next?

1. Draw the group structure first. List every legal entity Oracle intends to include, by name, and get the affiliate definition in writing before any price discussion.
2. Price the group counted together against the group counted separately. In most Australian banking structures, together is cheaper.
3. Separate the workforce into permanent, part time and casual, labor hire on your systems, captive employees, and third party managed service staff on a provider platform.
4. Get a written attestation from every managed service provider that its own Java entitlements cover the environment it runs for you.
5. Inventory every runtime and record its distribution, release and license, so you know the date on which zero Oracle Java becomes reachable.
6. Identify the blocking application and write runtime certification into that vendor's next renewal as a dated deliverable.
7. Check whether your Oracle agreement carries the CPS 230 access and audit provisions, and plan the material service provider assessment and notification before the first cutover.
8. Set the subscription term to reach the certification date and no further, with an annual recount and a divestiture carve out.
9. Fix the currency conversion basis and rate date in the ordering document, and supply an attested aggregate count rather than personal data.
10. Benchmark the quote using the method in the Oracle Java licensing benchmark, and read the ten facts on employee based licensing before signature. Bring in independent Oracle advisory before you reply in writing.

Related advisory: the Oracle Java 2026 pillar, how to benchmark an Oracle Java deal, and the employees per Java user ratio.

Frequently asked questions

Is this a real Australian bank?

No. It is a modeled market scenario built from the structures we see across Australian financial services, and it names no institution. Oracle's band rates are published figures. Every workforce and estate number is an assumption, labeled as such, so you can substitute your own.

Does the New Zealand subsidiary count toward the Australian bank's Java total?

Under a group level agreement, yes, because the count follows the contracting entity and the affiliates the agreement defines. Separating it is possible but usually costs more, since each separated entity is then priced from a smaller band. In this scenario splitting the group raises annual list cost by about 696,060 USD.

Does offshoring to a captive reduce the Java employee count?

No. A wholly owned offshore captive employs group staff, so those people stay in the count regardless of where they sit. Only a genuine third party provider running services on its own platform under its own licensing offers a defensible exclusion, and that requires a written attestation from the provider.

How do Australian casual and labor hire workers get counted?

Casual employees are counted like other staff, and labor hire workers on your systems generally fall inside the definition because they support internal operations. Casual employment was redefined on 26 August 2024, so a bank with seasonal contact center staffing should fix a measurement date in the ordering document rather than leave it open.

What does APRA CPS 230 mean for a Java migration?

It makes the change a governance event as well as an engineering one. CPS 230 commenced on 1 July 2026 and requires a material service provider register, formal binding agreements with APRA access provisions, notification within 20 business days of entering a material arrangement, and prior notification for material offshoring. Plan that work ahead of the first production cutover.

Does moving to Eclipse Temurin create a CPS 234 problem?

Not by itself, but it creates an evidence obligation. CPS 234 requires information security controls commensurate with the threat and an assessment of any party managing your information assets, so you need a documented update cadence and a named owner for it. Temurin publishes builds on the quarterly cycle, and your obligation is to show that you consume them.

Why not just remove the OpenJDK servers from Oracle's scope?

Because it does not change the bill. The employee metric prices people, not instances, so free builds already carry no obligation and removing them from a scope document saves nothing while any Oracle JDK remains in the group. Do the inventory anyway, because it tells you the date on which the subscription can end.

What is the single highest value action for a bank in this position?

Writing runtime certification into the blocking vendor's next contract renewal as a dated deliverable. The bank cannot change Oracle's metric, but it can change what it buys from the supplier that creates the dependency, and that supplier wants the renewal.