Australia's APRA CPS 230 Operational Risk Amendments Take Effect July 1, 2026

Australia's financial sector is reaching a critical compliance milestone as the Australian Prudential Regulation Authority's (APRA) amended Prudential Standard CPS 230 Operational Risk Management takes full effect on July 1, 2026. APRA finalized the targeted amendments on April 30, 2026, in response to industry feedback highlighting practical difficulties in applying certain contractual requirements to arrangements with non-traditional service providers (NTSPs).

The key change is a carefully scoped exemption: APRA-regulated entities — including banks, general insurers, life insurers, and superannuation trustees — will not be required to meet specific CPS 230 contractual obligations for material arrangements with designated categories of NTSPs where bespoke contract terms are not practicable. The exempt categories, listed in an attachment to CPS 230, include government agencies, regulators, central banks, and financial market exchanges such as clearing and settlement facilities. The rationale is that these entities operate under statutory frameworks that effectively substitute for typical commercial contract terms.

To implement the framework, APRA has updated the Material Service Provider (MSP) Register template to allow entities to classify whether arrangements fall under the exemption, and will issue an updated APRA Connect return for the 2026 reporting cycle. For the insurance sector specifically, insurers and superannuation trustees must review their full material service provider portfolios before July 1, identify which arrangements qualify under the new exemptions, and update their MSP registers and internal reporting processes accordingly.

The broader CPS 230 framework, which has been in development since 2023, aims to ensure that all APRA-regulated entities can withstand and rapidly recover from operational disruptions including cyber incidents, system failures, and third-party service provider outages. APRA has indicated it expects the scope of these exemptions to narrow over time as domestic and international operational resilience practices develop and market practice on contract terms continues to evolve. With the July 1 deadline now days away, compliance teams across the Australian financial sector are finalizing their preparations — failure to have updated registers and compliant arrangements by the deadline exposes firms to supervisory action.