Australia's APRA CPS 230 Operational Risk Standard Takes Full Effect July 1

Australia's most significant operational resilience framework in recent memory reaches a critical milestone on July 1, 2026, when Prudential Standard CPS 230 Operational Risk Management takes full effect for entities regulated by the Australian Prudential Regulation Authority (APRA). With the deadline now days away, insurers, banks, and superannuation trustees are in the final stages of ensuring compliance.

CPS 230 is designed to ensure that all APRA-regulated entities in the banking, insurance, and superannuation sectors are resilient to operational risks and disruptions — including cyber incidents, system failures, and third-party service provider outages. The standard requires entities to manage their full range of operational risks, maintain robust business continuity plans, and carefully oversee material arrangements with service providers.

In April 2026, APRA finalised targeted amendments to CPS 230, the corresponding Prudential Practice Guide CPG 230, and the Material Service Provider (MSP) Register template. These amendments introduce a limited exemption from specific contractual requirements for material arrangements with certain categories of non-traditional service providers (NTSPs) — including government agencies, regulators, central banks, and financial market exchanges such as clearing and settlement facilities — where bespoke contract terms are not practicable. The rationale is that these entities operate under statutory frameworks that effectively substitute for typical commercial contract provisions.

For the insurance sector specifically, insurers and superannuation trustees must review their entire material service provider portfolios, identify which arrangements qualify for the new exemptions, and update their MSP registers and internal reporting processes before the July 1 commencement date. APRA has updated the MSP Register template to allow entities to classify whether arrangements fall under the exemption, and will issue an updated APRA Connect return for the 2026 reporting cycle. The regulator has signaled it expects the scope of exemptions to narrow over time as market practice on contract terms develops. The framework has been years in the making, with the standard originally finalised in 2023 and its effective date previously moved to July 1, 2025, with transitional arrangements for pre-existing contracts applying until July 1, 2026.