Australia's APRA CPS 230 Operational Risk Standard Set to Take Full Effect July 1

Australia's financial sector reaches a major regulatory milestone on July 1, 2026, when the Australian Prudential Regulation Authority's (APRA) cross-industry Prudential Standard CPS 230 Operational Risk Management takes full effect for in-scope entities. The standard, which has been in development since 2023, is designed to ensure that APRA-regulated entities across banking, insurance, and superannuation can withstand and rapidly recover from operational disruptions — including cyber incidents, system failures, and third-party service provider outages.

The July 1 commencement applies to pre-existing contractual arrangements with service providers, with requirements applying from the earlier of the next contract renewal date or July 1, 2026. Additionally, deferred requirements relating to business continuity and scenario analysis apply to non-significant financial institutions (non-SFIs) from this date, following a 12-month extension APRA granted to give smaller entities more time to comply.

Arriving simultaneously are APRA's finalised targeted amendments to CPS 230, which the regulator released on April 30, 2026. These amendments introduce limited exemptions from specific contractual requirements for material arrangements with certain categories of non-traditional service providers (NTSPs) — including government agencies, regulators, central banks, and financial market exchanges such as clearing and settlement facilities — where negotiating bespoke contractual terms is not practicable. APRA developed the exemptions in response to industry feedback, while preserving the core operational resilience objectives of the standard.

To implement the framework, insurers, superannuation trustees, and banks must review their full material service provider portfolios, identify which arrangements qualify for the exemptions, and update their Material Service Provider (MSP) registers and reporting processes before the July 1 deadline. APRA has updated the MSP Register template to accommodate the exempt provider categories and will issue an updated APRA Connect return for the 2026 reporting cycle. The regulator has signalled it expects the scope of these exemptions to narrow over time as operational resilience practices and market contract norms continue to develop. CPS 230 forms part of a broader strengthening of operational and cyber resilience across Australia's financial system, alongside the Financial Accountability Regime (FAR) that now extends to insurers and superannuation funds.