Updated October 2026 to reflect the end of all transition periods on 1 July 2026 and APRA's April 2026 amendments.
CPS 230 is APRA's prudential standard for operational risk management. It applies to all APRA-regulated banks, insurers and superannuation trustees. It commenced on 1 July 2025 and, since 1 July 2026, applies in full to every entity and every material service provider contract. It requires entities to:
CPS 230 replaced five older standards covering outsourcing (CPS 231, SPS 231, HPS 231) and business continuity (CPS 232, SPS 232). Its companion guide, CPG 230, sets out APRA's expectations for good practice but is not enforceable.
The standard was a response to a run of operational failures in financial services, including the findings of the Banking Royal Commission and high-profile cyber incidents. Boards now carry clear accountability for operational resilience, not just financial risk. This guide explains what CPS 230 requires, the key dates, and where most organisations still have gaps.
CPS 230 rests on three pillars, all overseen by the Board.
Entities must identify, assess and manage operational risks across people, processes, technology, data and service providers. That means an up-to-date risk profile, controls that are designed well and regularly tested, and timely remediation of control weaknesses. Incidents and near misses must be recorded and fed back into the assessment of controls.
Three notification deadlines apply:
| Event | Notify APRA |
|---|---|
| Disruption to a critical operation outside tolerance | Within 24 hours |
| Operational risk incident likely to have a material financial impact, or a material impact on critical operations | Within 72 hours of becoming aware |
| Entering into or materially changing a material arrangement | Within 20 business days |
Offshoring arrangements with a material service provider must be raised with APRA before they are entered into.
Entities must identify their critical operations. APRA prescribes some by default, such as payments and deposit-taking for banks, claims processing for insurers and investment management for super funds. For each one, the Board approves tolerance levels covering:
The business continuity plan must be credible and tested at least annually against a range of severe but plausible scenarios, including the failure of a material service provider.
A material service provider is one the entity relies on to undertake a critical operation, or one that exposes it to material operational risk. CPS 230 widens the old outsourcing rules: it covers any provider meeting that test, not just outsourced activities, and expects entities to understand fourth parties further down the supply chain.
Entities must have a Board-approved service provider management policy, formal legally binding agreements meeting CPS 230's content requirements, ongoing monitoring of providers, and a register of material service providers submitted to APRA annually.
The Board is ultimately accountable. It must approve the business continuity plan, tolerance levels and the service provider management policy, and review risk and performance reporting on material service providers. Senior managers are accountable for operational risk in their areas, which links CPS 230 to the Financial Accountability Regime.
All transition periods ended on 1 July 2026. CPS 230 now applies in full to every APRA-regulated entity.
| Date | What happened |
|---|---|
| July 2023 | APRA finalises CPS 230 |
| June 2024 | APRA finalises CPG 230 and gives smaller entities extra time on business continuity |
| 1 July 2025 | CPS 230 commences for all APRA-regulated entities |
| 1 Oct 2025 | First material service provider registers due to APRA |
| 30 April 2026 | APRA finalises targeted amendments for non-traditional service providers |
| 1 July 2026 | All transition periods end and the April 2026 amendments take effect |
Who it applies to: authorised deposit-taking institutions (banks, building societies and credit unions), general insurers, life insurers, private health insurers, superannuation trustees, and authorised or registered non-operating holding companies. It also reaches non-regulated entities within those groups.
What ended on 1 July 2026:
The April 2026 amendments: APRA introduced limited exemptions from specific contractual requirements for material arrangements with certain non-traditional service providers, such as central banks and clearing and settlement facilities, where compliant contracts are not practicable. Entities relying on an exemption still need to manage those arrangements and record them in an updated register.
If your organisation supplies APRA-regulated entities, you are likely to be affected indirectly. Expect contract changes, audit and access rights, business continuity questions and incident notification obligations from your financial services clients.
With the standard fully in force, the focus has shifted from building frameworks to proving they work. The gaps we see most often sit in third party risk and testing.
A structured third party risk management program closes most of these gaps. It gives you a single view of material providers, risk-based due diligence, continuous monitoring and evidence the Board can rely on. Our guide to third party risk management goes deeper on building one.
Use these questions to check where you stand. Each one maps to a CPS 230 requirement APRA will look for evidence of.
CPG 230 is APRA's practice guide. It is not enforceable, but it shows how APRA expects entities to meet the standard, and supervisors use it as a benchmark. It covers areas such as documenting ownership of risks and controls, control assurance, monitoring fourth parties, and weighing in-house against outsourced services. Treat it as the bar for good practice.
Organisations already using ISO 31000 for risk management, or the NIST Cybersecurity Framework and CPS 234 for information security, have a head start. Much of CPS 230 maps to those frameworks, so the work is usually extending them to cover critical operations, tolerances and service providers rather than starting again.
Avocado works with banks, insurers and super funds to meet CPS 230 and prove it to APRA. Our governance, risk and compliance services cover gap assessments against CPS 230 and CPG 230, policy and framework uplift, control testing and Board reporting. Our third party risk management team builds and runs service provider assurance programs, and our observability practice helps you detect and measure disruption against your tolerance levels in real time.
Talk to our team about where you stand.
CPS 230 is APRA's prudential standard on operational risk management. It sets minimum requirements for managing operational risk, maintaining critical operations through disruption, and managing material service providers.
CPS 230 commenced on 1 July 2025. Transition arrangements for pre-existing service provider contracts and for smaller entities' business continuity requirements ended on 1 July 2026, so it now applies in full.
All APRA-regulated entities: banks and other authorised deposit-taking institutions, general, life and private health insurers, and superannuation trustees. Service providers to these entities are affected through their contracts.
CPS 230 is the enforceable standard. CPG 230 is APRA's prudential practice guide, which explains how APRA expects the standard to be met. CPG 230 is not enforceable, but APRA uses it as a benchmark.
A service provider the entity relies on to undertake a critical operation, or one that exposes the entity to material operational risk. APRA lists some categories that are material by default, such as providers of core technology and cloud services.
Board-approved limits for each critical operation: the maximum time a disruption can last, the maximum data loss, and the minimum service levels to maintain during disruption.
Within 24 hours for a disruption to a critical operation outside tolerance, and within 72 hours for an operational risk incident likely to have a material impact.
CPS 231, SPS 231 and HPS 231 on outsourcing, and CPS 232 and SPS 232 on business continuity management.
CPS 234 covers information security. CPS 230 covers operational risk more broadly. The two overlap on incident management, third party controls and resilience testing, so they are best managed together.