Operational Risk Management (APRA CPS 230)
CPS 230 requires regulated financial institutions to manage operational risk end to end: understand the risks in their operations, keep critical operations running through severe disruptions, and control the risks introduced by the service providers they depend on. It consolidates what were previously separate outsourcing and business continuity standards into a single cross-industry framework.
Who Needs It
CPS 230 applies directly to every APRA-regulated entity: authorised deposit-taking institutions (including foreign ADIs), general insurers, life companies and friendly societies, private health insurers, and registrable superannuation entity licensees. The transition period has now closed: pre-existing service provider contracts were required to comply by the earlier of their next renewal or July 1, 2026, and the business continuity requirements deferred for entities that are not significant financial institutions took effect on the same date.
The standard also reaches organizations APRA does not regulate. A material service provider is a vendor that a regulated entity relies on for a critical operation, or that exposes it to material operational risk; common examples include core banking and IT infrastructure providers, claims processors, credit assessors, and fund administrators. That designation is made by the regulated customer, not by the provider. The obligations differ by role:
- Regulated entities carry the compliance burden directly. They must identify their material service providers, maintain a register of them for submission to APRA, perform due diligence before engaging or materially changing an arrangement, and ensure contracts contain the provisions CPS 230 requires. Responsibility cannot be outsourced along with the service.
- Material service providers feel the standard through their contracts. Regulated customers will expect service levels that fit within their approved disruption tolerances, participation in their business continuity testing, disclosure of material subcontractors, audit and access rights (including for APRA), and independent assurance over controls.
If you sell into Australian financial services, expect CPS 230 terms to appear in contract negotiations even though APRA has no direct authority over you.
How the Standard Is Structured
CPS 230 is organized around three connected requirement areas, all under board-level accountability. The board must approve the entity's tolerance levels, business continuity plan, and service provider management policy, and must oversee the operational risk profile rather than simply receive it.
Operational risk management. Entities must maintain a current assessment of their operational risk profile across legal, regulatory, compliance, conduct, technology, data, and change management risks. This includes mapping the processes and resources that support critical operations (including dependencies on service providers), monitoring and testing control effectiveness, running scenario analysis for severe events, and remediating material control weaknesses to closure. Material operational risk incidents must be reported to APRA within 72 hours of the entity becoming aware of them.
Business continuity. Entities must identify their critical operations, and APRA prescribes a starting list (such as payments, deposit-taking, claims processing, and fund administration) that entities must include unless they can justify otherwise. For each critical operation the board approves tolerance levels: the maximum tolerable disruption period, maximum acceptable data loss, and minimum service levels during disruption. A business continuity plan must cover activation triggers, resource arrangements, dependencies, execution risks, and a communications strategy, and must be tested at least annually against severe scenarios including service provider failure. Breaches of tolerance levels must be reported to APRA within 24 hours.
Service provider management. Entities must maintain a board-approved policy covering how material service providers are identified, monitored, substituted, and exited, including risks from fourth parties (the providers' own subcontractors). Formal agreements must address service levels, data ownership, subcontracting, liability, termination rights, and APRA's access and audit rights. APRA must be notified within 20 business days of entering into or materially changing an arrangement that supports a critical operation, and consulted before material offshoring arrangements.
Amendments effective July 1, 2026 introduce limited exemptions from specific contractual requirements for material arrangements with certain categories of service providers, identified in an attachment to the standard. The updated Prudential Practice Guide CPG 230 clarifies APRA's expectations for managing arrangements with these exempt providers, and the current Material Service Provider register template accommodates them.
For the artifacts that typically satisfy manually evidenced control areas, see Example Evidence.