APRA's CPS 230 Amendments: Limited Exemptions for Central Banks, Regulators and Exchanges, Effective July 1, 2026

Australia's prudential regulator has made targeted changes to its operational risk standard for banks, insurers and superannuation funds. On April 30, 2026, the Australian Prudential Regulation Authority (APRA) finalised limited amendments to Prudential Standard CPS 230 Operational Risk Management, to the related practice guide CPG 230 and to the template for the Material Service Provider (MSP) Register. The changes take effect on July 1, 2026. This article is based on APRA's media release, on a summary of that release published by a law firm's regulatory blog, and on an explainer by an IT-services firm, which is a vendor blog and should be checked against APRA's own documents. An earlier version of this article included several points, such as the specific timing of an annual register deadline, that those sources do not confirm, and they have been removed.

CPS 230 is the standard that governs how APRA-regulated entities manage operational risk, meaning the risk of loss from failed internal processes, people, systems or external events. According to the IT-services explainer, it commenced on July 1, 2025 and replaced the earlier standards CPS 231 and CPS 232 and their industry equivalents. It applies to banks, general and life insurers, private health insurers, friendly societies and superannuation trustees, and affects their suppliers indirectly, because regulated entities have to write required protections into contracts with their material service providers.

Those requirements are demanding. The explainer lists, among them, the need to identify critical operations and set board-approved tolerance levels for disruption; to test business continuity plans at least annually against severe but plausible scenarios; and to keep a register of material service providers and to submit it to APRA. It also describes notification duties: within 72 hours of becoming aware of an operational risk incident likely to have a material financial impact, within 24 hours if a critical operation is disrupted beyond tolerance, and within 20 business days of entering or materially changing an agreement that supports a critical operation. Contracts with material service providers must cover specified services and service levels, data ownership and return, audit and access rights including for APRA, notification of subcontracting, termination rights and transition assistance. These details come from the explainer, which says some commercial terms, such as notice periods and liability caps, remain negotiable.

So why were amendments needed? APRA says the changes respond to industry feedback. Some service providers are not ordinary commercial suppliers. A central bank or a clearing and settlement facility operates under its own legal framework and generally cannot negotiate bespoke contract clauses with a regulated entity. Requiring a contract that includes APRA access rights or termination rights in such cases is impracticable. APRA's media release describes the aim as targeted and administratively efficient solutions for entities with material arrangements with these non-traditional service providers, while preserving the core objectives of operational risk management.

The law-firm summary gives more detail on how the exemption works. It applies by provider type, according to a list in an attachment to CPS 230. The exempt categories listed are government agencies, regulators, central banks and financial market exchanges. APRA refined how the categories are defined after consultation but did not materially change their scope. APRA can update the list and can also grant case-by-case exemptions by written notice. The practice guide CPG 230 was updated to explain APRA's expectations, for example that due diligence and selection may look different for exempt providers, and CPS 230 was clarified so that the standardised contract exemption covers arrangements in which the entity cannot negotiate terms. A cross-reference in Table 1 of CPG 230 was aligned with the renumbered notification paragraph of the standard.

The MSP Register template was also updated. According to the summary, entities can now classify arrangements with exempt providers as exempt, and the updated template is intended for the 2026 submission. APRA said an updated APRA Connect return would be issued in the coming weeks.

July 1, 2026 matters for another reason. The IT-services explainer says it is the date on which the CPS 230 transition arrangements end: existing contracts with material service providers had to comply by then even if they had not come up for renewal, and a concession given to non-significant institutions on business continuity and scenario analysis also ended. In other words, the amendments and the end of the grace period arrive together.

The exemption is narrow. The explainer notes that it does not apply to ordinary commercial suppliers such as software, claims or payroll firms. It also notes that CPS 230 has no fine schedule of its own, and that consequences of non-compliance include heightened supervision, remediation requirements, licence conditions and links to the Financial Accountability Regime. We have not verified those statements against APRA's text.

What should insurers do? The practical steps are to review the list of material arrangements to see which, if any, involve exempt provider types, to document why contract terms cannot be met, to update the register in line with the new template, and to watch for the updated APRA Connect return and any changes to the exempt list. Entities should read the final standard and practice guide on APRA's website, because this summary cannot substitute for the legal text.