Australia's APRA Operational Risk Standard CPS 230 Amendments Take Effect July 1

A key milestone in Australia's operational resilience framework arrives on July 1, 2026, as the Australian Prudential Regulation Authority's (APRA) targeted amendments to Prudential Standard CPS 230 Operational Risk Management take full effect. APRA finalized these amendments on April 30, 2026, in response to industry feedback highlighting practical difficulties in applying certain contractual requirements to arrangements with non-traditional service providers (NTSPs).

The central change is a carefully scoped exemption: APRA-regulated entities — including banks, general insurers, life insurers, and superannuation trustees — will not be required to meet specific CPS 230 contractual obligations for material arrangements with designated categories of NTSPs where negotiating bespoke contract terms is not practicable. The exempt categories, set out in an attachment to CPS 230, include government agencies, regulators, central banks, and financial market exchanges such as clearing and settlement facilities. These entities typically operate under statutory frameworks that substitute for standard commercial contract terms.

To implement the framework, APRA updated the Material Service Provider (MSP) Register template so entities can classify whether specific arrangements fall under the exemption, and it is issuing an updated APRA Connect return for the 2026 reporting cycle. Insurers, superannuation trustees, and other regulated entities need to review their full material service provider portfolios, identify which arrangements qualify under the new exemptions, and update their registers and reporting processes by the July 1 commencement date.

The broader CPS 230 framework, which took initial effect on July 1, 2025, is designed to ensure that all APRA-regulated entities across banking, insurance, and superannuation can withstand and rapidly recover from operational disruptions — including cyber incidents, technology failures, and third-party service outages. Additional deferred requirements relating to business continuity and scenario analysis apply to non-significant financial institutions from July 1, 2026 as well. APRA has indicated it expects the scope of the NTSP exemptions to narrow over time as domestic and international operational resilience practices mature.