APRA's CPS 230 Grace Period Ends July 1 With New Exemptions

Australia's prudential regulator, the Australian Prudential Regulation Authority, published targeted amendments to its operational risk standard on April 30, 2026. The standard, CPS 230 Operational Risk Management, applies to banks, insurers and superannuation trustees, and the amendments take effect on July 1, 2026, the same date on which the transition period for older service provider contracts ends. This article explains what the standard requires, what the amendments change, and what the date means for regulated firms and their suppliers. It is based on APRA's media release and a published explainer of the grace period and is a summary of public information, not legal or compliance advice.

What the amendments do

According to APRA's media release, the changes cover three documents: the prudential standard CPS 230 itself, its accompanying practice guide CPG 230, and the template for the Material Service Provider Register. The core change is to add limited exemptions from specific CPS 230 contractual requirements for material arrangements with certain categories of what APRA calls non-traditional service providers. Examples named in the release are central banks and clearing and settlement facilities. The exemptions apply where compliance with the contractual requirements is not practicable.

The reason is easy to see. A bank or insurer that uses a central bank's payment system or a clearing house cannot normally negotiate bespoke contract terms with that institution, which sets standard terms for all participants. A standard that required the same contractual protections as for an ordinary supplier would create a requirement that the firm could not meet. APRA said the changes respond to industry feedback and offer targeted, administratively efficient solutions while preserving the core objectives of operational risk management. The release does not describe the changes to the register template in detail, and it does not set out transitional arrangements beyond the July 1, 2026 effective date.

What CPS 230 requires

CPS 230 commenced on July 1, 2025 and replaced the earlier standards on outsourcing and business continuity, known as CPS 231 and CPS 232, according to the explainer from All IT Services. The core obligations include identifying critical operations and setting board-approved tolerance levels for downtime, data loss and disruption. Entities must maintain a business continuity plan, tested at least annually against severe but plausible scenarios, including disruption at a material service provider.

The standard also requires entities to manage their material service providers. A material service provider is one the entity relies on to maintain a critical operation, or one that exposes it to material operational risk. The entity makes the first judgement, and APRA can override it or declare a provider or class of providers material. Some services are material by default. Entities must keep a register of such providers, submit it to APRA each year, conduct due diligence and include required protections in contracts. The first registers were due by October 1, 2025, and an updated template applies to the 2026 submission, according to the explainer.

Why July 1, 2026 matters

When the standard began in 2025, existing arrangements with material service providers were allowed to continue on their old terms until the earlier of the contract's next renewal date or July 1, 2026. That period ends on July 1, 2026. A further concession, an extra 12 months granted in 2024 to smaller, non-significant institutions for business continuity and scenario analysis, also ends then. After that date, all material arrangements have to meet the standard's requirements, subject to the new exemptions for non-traditional providers.

For suppliers, that means customers may ask for contract changes. Technology and cloud providers that serve Australian financial firms can expect requests on topics such as incident reporting, audit and access rights, and arrangements for continuing service if the provider fails.

Notification timeframes

The explainer lists several notification periods that regulated entities must meet. Operational risk incidents likely to have a material financial impact must be notified within 72 hours, disruptions to a critical operation beyond the tolerance level within 24 hours, and new or materially changed agreements supporting critical operations within 20 business days. We have taken these from a secondary source rather than from the amendments themselves, so firms should check APRA's standard for the exact wording.

How APRA enforces it

The same explainer says CPS 230 does not carry a schedule of fines. APRA instead has other tools, including heightened supervision, formal requirements to fix problems, conditions on a licence and links to the Financial Accountability Regime, which places personal accountability on senior executives. The practical consequence for a firm is attention from its supervisor if it cannot show it has met the standard.

What it means for customers

Customers will not see CPS 230 directly. It shows up when a payment system stays up through a supplier outage, when an insurer can still process claims after a cyber incident, or when a super fund can keep paying members. The standard is meant to reduce the chance that a single failure at a supplier disrupts many firms at once. The exemptions for central banks and clearing facilities do not remove the requirement for firms to manage the risks of relying on those institutions. They only change how the contract rules apply.

What to watch next

Firms and their suppliers will look to APRA's supervisory focus in the months after July 1, to how the updated register template is used, and to any further guidance on non-traditional providers. APRA publishes its standards, guides and letters on its website. This article summarises public statements and is not legal advice.