Updated October 2026 to reflect the end of all transition periods on 1 July 2026 and APRA's April 2026 amendments.
CPS 230 in brief
CPS 230 is APRA's prudential standard for operational risk management. It applies to all APRA-regulated banks, insurers and superannuation trustees. It commenced on 1 July 2025 and, since 1 July 2026, applies in full to every entity and every material service provider contract. It requires entities to:
- identify their critical operations and set Board-approved tolerance levels for disruption
- maintain and annually test a credible business continuity plan
- manage material service providers under a Board-approved policy, with compliant contracts and a register submitted to APRA
- notify APRA of material operational risk incidents within 72 hours, and of disruptions outside tolerance within 24 hours.
CPS 230 replaced five older standards covering outsourcing (CPS 231, SPS 231, HPS 231) and business continuity (CPS 232, SPS 232). Its companion guide, CPG 230, sets out APRA's expectations for good practice but is not enforceable.
The standard was a response to a run of operational failures in financial services, including the findings of the Banking Royal Commission and high-profile cyber incidents. Boards now carry clear accountability for operational resilience, not just financial risk. This guide explains what CPS 230 requires, the key dates, and where most organisations still have gaps.
What CPS 230 requires
CPS 230 rests on three pillars, all overseen by the Board.
1. Operational risk management
Entities must identify, assess and manage operational risks across people, processes, technology, data and service providers. That means an up-to-date risk profile, controls that are designed well and regularly tested, and timely remediation of control weaknesses. Incidents and near misses must be recorded and fed back into the assessment of controls.
Three notification deadlines apply:
| Event | Notify APRA |
|---|---|
| Disruption to a critical operation outside tolerance | Within 24 hours |
| Operational risk incident likely to have a material financial impact, or a material impact on critical operations | Within 72 hours of becoming aware |
| Entering into or materially changing a material arrangement | Within 20 business days |
Offshoring arrangements with a material service provider must be raised with APRA before they are entered into.
2. Business continuity
Entities must identify their critical operations. APRA prescribes some by default, such as payments and deposit-taking for banks, claims processing for insurers and investment management for super funds. For each one, the Board approves tolerance levels covering:
- the maximum period of time a disruption can last
- the maximum extent of data loss
- the minimum service levels to maintain during a disruption.
The business continuity plan must be credible and tested at least annually against a range of severe but plausible scenarios, including the failure of a material service provider.
3. Material service providers
A material service provider is one the entity relies on to undertake a critical operation, or one that exposes it to material operational risk. CPS 230 widens the old outsourcing rules: it covers any provider meeting that test, not just outsourced activities, and expects entities to understand fourth parties further down the supply chain.
Entities must have a Board-approved service provider management policy, formal legally binding agreements meeting CPS 230's content requirements, ongoing monitoring of providers, and a register of material service providers submitted to APRA annually.
The Board's role
The Board is ultimately accountable. It must approve the business continuity plan, tolerance levels and the service provider management policy, and review risk and performance reporting on material service providers. Senior managers are accountable for operational risk in their areas, which links CPS 230 to the Financial Accountability Regime.
Key dates and who it applies to
All transition periods ended on 1 July 2026. CPS 230 now applies in full to every APRA-regulated entity.
| Date | What happened |
|---|---|
| July 2023 | APRA finalises CPS 230 |
| June 2024 | APRA finalises CPG 230 and gives smaller entities extra time on business continuity |
| 1 July 2025 | CPS 230 commences for all APRA-regulated entities |
| 1 Oct 2025 | First material service provider registers due to APRA |
| 30 April 2026 | APRA finalises targeted amendments for non-traditional service providers |
| 1 July 2026 | All transition periods end and the April 2026 amendments take effect |
Who it applies to: authorised deposit-taking institutions (banks, building societies and credit unions), general insurers, life insurers, private health insurers, superannuation trustees, and authorised or registered non-operating holding companies. It also reaches non-regulated entities within those groups.
What ended on 1 July 2026:
- Pre-existing contracts. Contracts with service providers in place before CPS 230 started had until the earlier of their next renewal or 1 July 2026 to comply. Every material arrangement must now meet the standard.
- Smaller entities. Non-significant financial institutions had an extra year to meet the business continuity and scenario analysis requirements. That deferral is over.
The April 2026 amendments: APRA introduced limited exemptions from specific contractual requirements for material arrangements with certain non-traditional service providers, such as central banks and clearing and settlement facilities, where compliant contracts are not practicable. Entities relying on an exemption still need to manage those arrangements and record them in an updated register.
If your organisation supplies APRA-regulated entities, you are likely to be affected indirectly. Expect contract changes, audit and access rights, business continuity questions and incident notification obligations from your financial services clients.
Where organisations are still falling short
With the standard fully in force, the focus has shifted from building frameworks to proving they work. The gaps we see most often sit in third party risk and testing.
- Incomplete service provider inventories. Material service providers are identified, but the critical operations they support and the fourth parties behind them are not fully mapped.
- Contracts that lag the policy. Legacy agreements renewed in a hurry can be missing the audit, access, termination and notification terms CPS 230 requires.
- Point-in-time assurance. Providers are assessed at onboarding, then rarely again. CPS 230 expects ongoing monitoring of risk and performance.
- Untested tolerance levels. Tolerances are set on paper but have not been tested against severe but plausible scenarios, including a provider outage.
- Slow incident escalation. The 24 and 72-hour clocks start when the entity becomes aware, which leaves little room for unclear ownership or manual reporting.
A structured third party risk management program closes most of these gaps. It gives you a single view of material providers, risk-based due diligence, continuous monitoring and evidence the Board can rely on. Our guide to third party risk management goes deeper on building one.
How to test your CPS 230 compliance
Use these questions to check where you stand. Each one maps to a CPS 230 requirement APRA will look for evidence of.
Governance
☐ Has the Board approved the business continuity plan, tolerance levels and service provider management policy?☐ Are senior managers' operational risk accountabilities documented and aligned with the Financial Accountability Regime?
Operational risk
☐ Is the operational risk profile current, and are controls tested on a regular, risk-based schedule?☐ Are incidents and near misses recorded and used to reassess control effectiveness?
☐ Can you meet the 24-hour and 72-hour APRA notification deadlines, with clear owners and escalation paths?
Business continuity
☐ Are all critical operations identified, including those APRA prescribes?☐ Does each have tolerance levels for time, data loss and minimum service?
☐ Was the plan tested in the last 12 months against severe but plausible scenarios, including a provider failure?
Material service providers
☐ Is the register complete, current and in APRA's 2026 template, including any exempt providers?☐ Do all material arrangements now meet CPS 230's contract requirements?
☐ Are providers monitored on an ongoing basis, with fourth-party risks understood?
What about CPG 230?
CPG 230 is APRA's practice guide. It is not enforceable, but it shows how APRA expects entities to meet the standard, and supervisors use it as a benchmark. It covers areas such as documenting ownership of risks and controls, control assurance, monitoring fourth parties, and weighing in-house against outsourced services. Treat it as the bar for good practice.
Build on frameworks you already have
Organisations already using ISO 31000 for risk management, or the NIST Cybersecurity Framework and CPS 234 for information security, have a head start. Much of CPS 230 maps to those frameworks, so the work is usually extending them to cover critical operations, tolerances and service providers rather than starting again.
How Avocado can help
Avocado works with banks, insurers and super funds to meet CPS 230 and prove it to APRA. Our governance, risk and compliance services cover gap assessments against CPS 230 and CPG 230, policy and framework uplift, control testing and Board reporting. Our third party risk management team builds and runs service provider assurance programs, and our observability practice helps you detect and measure disruption against your tolerance levels in real time.
Talk to our team about where you stand.
FAQ
What is CPS 230?
CPS 230 is APRA's prudential standard on operational risk management. It sets minimum requirements for managing operational risk, maintaining critical operations through disruption, and managing material service providers.
When did CPS 230 come into effect?
CPS 230 commenced on 1 July 2025. Transition arrangements for pre-existing service provider contracts and for smaller entities' business continuity requirements ended on 1 July 2026, so it now applies in full.
Who does CPS 230 apply to?
All APRA-regulated entities: banks and other authorised deposit-taking institutions, general, life and private health insurers, and superannuation trustees. Service providers to these entities are affected through their contracts.
What is the difference between CPS 230 and CPG 230?
CPS 230 is the enforceable standard. CPG 230 is APRA's prudential practice guide, which explains how APRA expects the standard to be met. CPG 230 is not enforceable, but APRA uses it as a benchmark.
What is a material service provider under CPS 230?
A service provider the entity relies on to undertake a critical operation, or one that exposes the entity to material operational risk. APRA lists some categories that are material by default, such as providers of core technology and cloud services.
What are tolerance levels under CPS 230?
Board-approved limits for each critical operation: the maximum time a disruption can last, the maximum data loss, and the minimum service levels to maintain during disruption.
How quickly must incidents be reported to APRA?
Within 24 hours for a disruption to a critical operation outside tolerance, and within 72 hours for an operational risk incident likely to have a material impact.
Which standards did CPS 230 replace?
CPS 231, SPS 231 and HPS 231 on outsourcing, and CPS 232 and SPS 232 on business continuity management.
How does CPS 230 relate to CPS 234?
CPS 234 covers information security. CPS 230 covers operational risk more broadly. The two overlap on incident management, third party controls and resilience testing, so they are best managed together.
