Australia's APRA CPS 230 Operational Risk Amendments Take Effect July 1 as Insurers Race to Comply

Australia's financial sector is in the final stretch of preparing for the July 1, 2026 commencement of the amended Prudential Standard CPS 230 Operational Risk Management — one of the most significant operational resilience frameworks in the country's regulatory history. The Australian Prudential Regulation Authority (APRA) finalised targeted amendments to the standard on April 30, 2026, in direct response to industry feedback about practical difficulties applying certain contractual requirements to arrangements with non-traditional service providers (NTSPs).

The key change is a carefully scoped exemption: APRA-regulated entities — including general insurers, life insurers, banks, and superannuation trustees — will not be required to meet specific CPS 230 contractual obligations for material arrangements with designated categories of NTSPs where bespoke contract terms are not practicable. The exempt categories, set out in an attachment to the standard, include government agencies, regulators, central banks, and financial market exchanges such as clearing and settlement facilities. The rationale is that these entities operate under statutory frameworks that effectively substitute for typical commercial contract terms.

To operationalize the framework, APRA has updated the Material Service Provider (MSP) Register template, allowing entities to classify whether specific arrangements fall under the exemption, and has updated the corresponding Prudential Practice Guide CPG 230. APRA is also issuing an updated APRA Connect return for the 2026 reporting cycle to support submission of revised MSP information.

For insurers and superannuation trustees specifically, the compliance task is concrete and time-sensitive: before July 1, they must review their full material service provider portfolios, identify which arrangements qualify under the new exemptions, and update their MSP registers and internal reporting processes accordingly. APRA has indicated it expects the scope of these exemptions to narrow over time as domestic and international operational resilience practices and market contract terms develop. The amendments are part of the broader CPS 230 implementation program, which began with the final standard in 2023 and is designed to ensure all APRA-regulated entities can withstand and rapidly recover from operational disruptions — including cyber incidents, system failures, and third-party outages.