Sign in

Medium New version AU Action required

APRA publishes CPS 230 Operational Risk Management effective 1 July 2026

Original title: APRA — CPS 230 Operational Risk Management

Published
Source: apra.gov.au
Effective
Deadline
Not stated
Framework: APRA CPS 230
CPS 230 (prudential standard determination No. 1 of 2026) source

Why it matters

APRA has published CPS 230 Operational Risk Management, a revised prudential standard coming into force on 1 July 2026 that replaces the previous 2023 version. The standard requires APRA-regulated entities to effectively manage operational risks with internal controls and monitoring, maintain critical operations within tolerance levels through severe disruptions with credible business continuity plans, and comprehensively manage risks from service providers. Entities must tailor their operational risk approach to their size, business mix and complexity.

What changed

  • Revokes and replaces Banking, Insurance, Life Insurance, Health Insurance and Superannuation (prudential standard) determination No. 2 of 2023, including the previous CPS 230 Operational Risk Management and its 2024 variation
  • Expands the scope to apply to ADIs, authorised banking NOHCs, general insurers, authorised insurance NOHCs and their subsidiaries, life companies (including friendly societies), registered NOHCs, private health insurers, and RSE licensees
  • Establishes requirements for entities to identify, assess and manage operational risks with effective internal controls, monitoring and remediation
  • Requires entities to maintain critical operations within tolerance levels through severe disruptions with a credible business continuity plan
  • Requires comprehensive service provider management policies, formal agreements and robust monitoring of service provider risks

Who is affected

All APRA-regulated entities across all industries: Authorized Deposit-taking Institutions (ADIs), general insurers, life companies, private health insurers, and superannuation fund trustees (RSE licensees) in Australia

What to do

APRA-regulated entities must effectively manage operational risks, maintain critical operations through disruptions, and manage risks from service providers.

Open the official document

AI-assisted summary of the official document; the official text prevails. Not legal advice.