Australia's APRA CPS 230 Operational Risk Amendments Take Effect July 1, 2026

Australia's financial sector is entering the final implementation phase of one of the country's most significant operational risk frameworks. APRA's targeted amendments to Prudential Standard CPS 230 Operational Risk Management, finalised on April 30, 2026, take full effect from July 1, 2026. The amendments were developed in response to industry feedback highlighting practical difficulties in applying certain contractual requirements to arrangements with non-traditional service providers (NTSPs).

The key change is a carefully scoped exemption: APRA-regulated entities — including banks, general insurers, life insurers, and superannuation trustees — will not be required to meet specific CPS 230 contractual obligations for material arrangements with designated categories of NTSPs where bespoke contract terms are not practicable. The exempt categories include government agencies, regulators, central banks, and financial market exchanges such as clearing and settlement facilities. The rationale is that these entities operate under statutory frameworks that effectively substitute for typical commercial contract terms.

To implement the framework, APRA has updated the Material Service Provider (MSP) Register template to allow entities to classify whether specific arrangements fall under the exemption. APRA will also issue an updated APRA Connect return for the 2026 reporting cycle to support submission of revised MSP information.

For the insurance and superannuation sectors specifically, regulated entities must review their full material service provider portfolios before July 1, identify which arrangements qualify under the new exemptions, and update their MSP registers and internal reporting processes accordingly. APRA has indicated it expects the scope of these exemptions to narrow over time as market practice on contract terms develops. The broader CPS 230 framework — which has been in development since 2023 and took initial effect in July 2025 — aims to ensure that all APRA-regulated entities can withstand and rapidly recover from operational disruptions, including cyber incidents, system failures, and third-party service provider outages. For non-significant financial institutions, certain deferred requirements relating to business continuity and scenario analysis also commence from July 1, 2026.