Australia's APRA CPS 230 Operational Risk Amendments Take Effect July 1, 2026

Australia's financial sector is in the final stretch of implementing one of its most significant operational resilience frameworks. APRA finalized its targeted amendments to Prudential Standard CPS 230 Operational Risk Management on April 30, 2026, with the revised standard taking full effect from July 1, 2026 — now just over a week away. The amendments were developed in response to industry feedback about practical difficulties in applying certain contractual requirements to arrangements with non-traditional service providers (NTSPs).

The key change is a carefully scoped exemption: APRA-regulated entities — including banks, general insurers, life insurers, and superannuation trustees — will not be required to meet specific CPS 230 contractual obligations for material arrangements with designated categories of NTSPs where bespoke contract terms are not practicable. The exempt categories include government agencies, regulators, central banks, and financial market exchanges such as clearing and settlement facilities, which typically operate under statutory frameworks that substitute for normal commercial contract terms.

To implement the framework, APRA has updated the Material Service Provider (MSP) Register template so entities can classify which arrangements fall under the exemption, and will issue an updated APRA Connect return for the 2026 reporting cycle. Insurers, superannuation trustees, and banks must now review their full material service provider portfolios, identify qualifying arrangements, and update their MSP registers and internal reporting processes before the July 1 commencement date.

CPS 230 is the cornerstone of Australia's approach to operational resilience across banking, insurance, and superannuation, aiming to ensure that all APRA-regulated entities can withstand and rapidly recover from operational disruptions — including cyber incidents, system failures, and third-party service provider outages. The broader framework has been in development since the final standard was issued in 2023, with the effective date moved to July 1, 2025 and transition arrangements provided for pre-existing service provider contracts. APRA has indicated it expects the scope of these NTSP exemptions to narrow over time as domestic and international operational resilience practices and market contract terms continue to develop. With the deadline imminent, compliance teams across the Australian financial sector are under pressure to finalize their preparations.