APRA CPS 230: What Banks, Insurers and Super Funds Now Expect From Their Service Providers

Short answer: APRA CPS 230 is the prudential standard that requires Australian banks, insurers and super funds to manage operational risk, keep critical operations within tolerance levels through severe disruptions, and govern material service providers. It took effect on 1 July 2025. If they rely on your service for a critical operation, expect deeper due diligence and specific contract terms.

Related guides:

• APRA CPS 234 checklist for information security
• Business continuity plan testing
• What is DORA? Everything you need to know

Key takeaways

• CPS 230 has three pillars: operational risk management, business continuity for critical operations, and management of service providers.
• It has applied since 1 July 2025. As of November 2026, the main transition dates (including the deadline for pre-existing service provider contracts) have passed.
• Core technology services are on APRA's minimum list of material service providers for every regulated entity, which pulls many SaaS platforms into scope.
• Material arrangements need a formal agreement with prescribed terms, including APRA access and on-site visit rights, sub-contractor notification and termination rights.
• Your customer's tolerance levels will shape the SLAs, recovery objectives and test evidence they ask you for.

What is APRA CPS 230 and who does it apply to?

CPS 230 Operational Risk Management is a cross-industry prudential standard that applies to every APRA-regulated entity and aims to make them resilient to operational risks and disruptions.

According to the current text of Prudential Standard CPS 230 (July 2026 version), it applies to authorised deposit-taking institutions (ADIs), general insurers, life companies, private health insurers registered under the PHIPS Act, and RSE licensees (superannuation trustees). The Board is ultimately accountable for operational risk management, including business continuity and the management of service provider arrangements.

The standard asks each entity to:

1. Manage operational risk: assess its risk profile, test internal controls and address incidents.
2. Maintain critical operations: register them, set tolerance levels, and test a credible business continuity plan (BCP).
3. Manage service providers: keep a policy, a material service provider register and formal agreements.

APRA's companion guidance is Prudential Practice Guide CPG 230. It is not enforceable in itself, but it explains what APRA considers sound practice.

CPS 230 sits next to the information security standard, not on top of it. The standard requires entities to meet CPS 234 for information security, and a security incident already reported under CPS 234 does not need a separate CPS 230 notification. If you also serve EU financial entities, the concepts will feel familiar from DORA, but the obligations differ.

When did CPS 230 take effect, and has the transition ended?

CPS 230 took effect on 1 July 2025, and as of November 2026 the transition periods that APRA announced have all ended.

Date	What happened	Source
17 July 2023	APRA finalised CPS 230	APRA media release
13 June 2024	APRA finalised CPG 230	APRA media release
1 July 2025	CPS 230 came into force	APRA media release
1 October 2025	APRA requested the first material service provider register submissions	Response to submissions on CPG 230
30 April 2026	APRA finalised targeted amendments for non-traditional service providers	APRA letter to industry
1 July 2026	End of transition for pre-existing contracts and for non-SFI business continuity requirements; amendments take effect	APRA media release, plus the sources below

Two transition rules matter most to vendors. First, the original 2023 standard said that for pre-existing contracts with service providers, the requirements apply from the earlier of the contract's next renewal date or 1 July 2026. Second, APRA's response to submissions on CPG 230 gave non-significant financial institutions (non-SFIs) an extra 12 months, to 1 July 2026, for the business continuity and scenario analysis requirements.

In practice, a contract signed before July 2025 should by now have been brought into line. If a customer has not raised it yet, expect the request.

What are critical operations and tolerance levels?

Critical operations are processes, run by the entity or its service provider, that would have a material adverse impact on customers or the entity's role in the financial system if disrupted beyond tolerance levels.

CPS 230 sets minimum critical operations that an entity must classify unless it can justify otherwise:

Entity type	Minimum critical operations
ADIs (banks)	Payments, deposit-taking and management, custody, settlements and clearing
Insurers (general, life, private health)	Claims processing
RSE licensees (super)	Investment management and fund administration
All entities	Customer enquiries, and the systems and infrastructure needed to support critical operations

For each critical operation, the entity must set tolerance levels for the maximum period of disruption, the maximum data loss and the minimum service levels while running on alternative arrangements. CPG 230 links these to familiar recovery metrics: recovery time objective (RTO), recovery point objective (RPO) and recovery level objective.

If your platform supports claims processing for a private health insurer, or customer enquiries for a bank, your RTO, RPO and degraded-mode capability need to fit inside your customer's tolerance. CPS 230 also requires the entity's BCP testing program to include disruptions to material service providers, and CPG 230 says entities would seek to confirm those providers maintain robust BCP testing and could consider joint testing. Our guide to business continuity plan testing covers the exercise types worth having on file.

When is a vendor a CPS 230 material service provider?

A vendor is material if a critical operation depends on its service, or if the arrangement carries material operational risk for the entity.

The standard lists services whose providers must be classified as material unless the entity can justify otherwise. For all entities, that includes risk management, core technology services and internal audit. Sector lists add, for example, credit assessment for ADIs, underwriting and claims management for insurers, and fund administration for super trustees.

A few points from the standard and CPG 230 that vendors often miss:

• Materiality can be cumulative. A provider may be material through one arrangement or several.
• Fourth parties count. The entity's policy must address risks from parties your service relies on to deliver a critical operation, and CPG 230 says a prudent entity would take reasonable steps to list them in its register.
• Registers go to APRA. Each entity must submit its material service provider register to APRA annually.
• Narrow exemptions exist, but not for typical SaaS. The April 2026 amendments exempt certain contract terms for listed categories such as central banks, regulators, exchanges and payment schemes. APRA's letter on the amendments notes that some submissions asked for IT and cloud providers to be added, and APRA did not materially change the scope.

Which CPS 230 requirements for vendors end up in your contract?

For every material arrangement, CPS 230 requires a formal, legally binding agreement with a defined minimum set of terms, so expect your customer's paper to include them.

Before entering into or materially changing a material arrangement, the entity must assess your ability to provide the service on an ongoing basis, plus financial and non-financial risks such as location and concentration. The agreement itself must, at a minimum:

1. Specify the services and service levels.
2. Set out rights and responsibilities, including ownership of assets, ownership and control of data, dispute resolution, audit access, liability and indemnity.
3. Help the entity meet its legal and compliance obligations.
4. Require you to notify the entity of other material service providers you rely on through sub-contracting.
5. Make you liable for failures of your sub-contractors.
6. Include a force majeure clause stating which parts continue.
7. Allow termination of the whole arrangement or parts of it.
8. Give APRA access to documentation, data and information about the service, the right to an on-site visit, and your agreement not to impede APRA.

The entity must also be able to execute its BCP and exit in an orderly way, and must monitor your performance and controls. CPG 230 suggests periodic reviews could cover information security incidents, service disruptions, control effectiveness and business continuity capabilities. In our experience, this becomes an annual review request rather than a one-off questionnaire.

What does CPS 230 require entities to notify APRA about?

The notification duties sit with the regulated entity, but your incident and change processes decide whether your customer can meet them.

Trigger	Deadline to notify APRA
Operational risk incident likely to have a material financial impact or a material impact on critical operations	As soon as possible, no later than 72 hours after becoming aware
Disruption to a critical operation outside tolerance	As soon as possible, no later than 24 hours
Entering into or materially changing an agreement for a service relied on for a critical operation	As soon as possible, no more than 20 business days after
Material offshoring arrangement, or a significant change to one	Before entering into it

All four come from CPS 230 itself. Offshoring covers services physically performed outside Australia, even by an Australian-incorporated provider, so tell customers early about any offshore move.

Expect clauses requiring you to report incidents fast enough for a 24-hour or 72-hour clock. If you also supply critical infrastructure sectors, the SOCI Act CIRMP guide covers a parallel set of supplier expectations.

How should a SaaS or HealthTech provider prepare?

Prepare by mapping which of your services support a customer's critical operations, then assembling contract terms and evidence that show you can stay within their tolerance levels.

• Map your role. For each APRA-regulated customer, record which critical operation your service supports, such as claims processing or customer enquiries.
• Publish recovery objectives. Document RTO, RPO and degraded-mode service levels per product, and confirm they fit typical customer tolerances.
• Test and keep evidence. Run at least an annual BCP and disaster recovery exercise, record results and remediation, and offer to join customer tests.
• List your fourth parties. Maintain a current list of sub-processors and hosting providers, with locations, and a process to notify customers of changes.
• Prepare a CPS 230 contract schedule. Pre-draft clauses for APRA access and on-site visits, audit rights, sub-contractor liability, force majeure, partial termination and data ownership.
• Write an exit plan. Describe data return formats, transition assistance and timeframes so customers can show an orderly exit is possible.
• Tune incident notification. Set customer notification timelines that leave room for 24-hour and 72-hour APRA deadlines.
• Flag offshoring early. Track where data, processing and support staff are located, and give advance notice of offshore changes.
• Package evidence once. Keep security evidence, assurance reports and BCP results together.

How SecureSlate helps

SecureSlate does not have a built-in CPS 230 framework, so teams set up CPS 230 as a custom framework, with custom controls for items such as recovery objectives, exit planning and APRA access clauses. Multi-framework control mapping links them to evidence you already collect for SOC 2, ISO 27001 or HIPAA.

Vendor risk management tracks your own fourth parties and their locations, risk management keeps your operational risk register, and audit management organises evidence for customer reviews. Agentless read-only cloud integrations and the device agent collect configuration evidence continuously. Security questionnaire automation drafts due diligence answers from your approved library, and a trust center shares reports and policies under access controls.

Start a free SecureSlate trial to set up CPS 230 as a custom framework.

FAQ

Does APRA CPS 230 apply directly to my SaaS company?

No. CPS 230 binds APRA-regulated entities. It reaches you through your customer, which must run due diligence, include prescribed contract terms and monitor you if you are a material service provider.

What is the difference between CPS 230 and CPS 234?

CPS 234 covers information security. CPS 230 covers operational risk more broadly, including critical operations, business continuity and service providers. A security incident reported under CPS 234 does not need a second CPS 230 notification.

Can APRA really visit my premises?

For a material arrangement, CPS 230 requires the agreement to give APRA on-site visit rights and access to documentation, data and information about the service.

Is a contract we signed before July 2025 still exempt?

As of November 2026, generally no. The original standard applied its requirements to pre-existing contracts from the earlier of the next renewal date or 1 July 2026, and that date has passed.

Disclaimer (legal note)

This article is for general information only and is not legal, regulatory or professional advice. Requirements vary by framework, industry and jurisdiction. Consult qualified advisors for your specific obligations.