Australia's APRA Finalises CPS 230 Amendments for Operational Risk, Effective July 1, 2026

Australia's financial regulators have reached the final implementation phase of one of the country's most significant operational risk frameworks in recent memory. APRA finalised its targeted amendments to Prudential Standard CPS 230 Operational Risk Management on April 30, 2026, with the revised standard taking full effect from July 1, 2026. The amendments were developed in direct response to industry feedback highlighting practical difficulties in applying certain contractual requirements to arrangements with non-traditional service providers (NTSPs).

The key change is a carefully scoped exemption: APRA-regulated entities — including banks, general insurers, life insurers, and superannuation trustees — will not be required to meet specific CPS 230 contractual obligations for material arrangements with designated categories of NTSPs where bespoke contract terms are not practicable. The exempt categories include government agencies, regulators, central banks, and financial market exchanges such as clearing and settlement facilities. The rationale is that these entities operate under statutory frameworks that effectively substitute for — and in some cases override — typical commercial contract terms.

To implement the new framework, APRA has updated the Material Service Provider (MSP) Register template to allow entities to classify whether specific arrangements with a provider fall under the exemption. APRA will also issue an updated APRA Connect return for the 2026 reporting cycle to support submission of revised MSP information.

For the insurance sector specifically, insurers and superannuation trustees must review their full material service provider portfolios before July 1, identify which arrangements qualify under the new exemptions, and update their MSP registers and internal reporting processes accordingly. APRA has indicated it expects the scope of these exemptions to narrow over time as market practice on contract terms develops. The broader CPS 230 framework — which has been in development since 2023 — aims to ensure that all APRA-regulated entities can withstand and rapidly recover from operational disruptions, including cyber incidents, system failures, and third-party service provider outages.