APRA CPS 230

1. 2026-11-09 Medium
   APRA publishes CPS 230 Operational Risk Management effective 1 July 2026

   APRA has published CPS 230 Operational Risk Management, a revised prudential standard coming into force on 1 July 2026 that replaces the previous 2023 version. The …

   New version Effective 2026-07-01 Action required

1. 2026-07-01 Amended CPS 230 and CPG 230 come into force, with the exemption for listed categories of service providers
2. 2026-07-01 CPS 230 applies to pre-existing service provider contracts not renewed earlier, and deferred business continuity requirements apply to non-significant financial institutions
3. 2026-04-30 APRA releases the final targeted amendments to CPS 230
4. 2025-12-10 APRA consults on targeted CPS 230 amendments for non-traditional service providers

1. 2026-04-23
   CPS 230 (prudential standard determination No. 1 of 2026) RevisionCurrent

   Remade standard, in force from 1 July 2026, with a limited exemption from specific contractual requirements for material arrangements with listed categories of service providers. source

   More

   • Exempt categories: government agencies, regulators, central banks, financial market exchanges, clearing and settlement facility operators, payment system operators and financial messaging infrastructure.
   • The exemption applies only where the arrangement uses standardised terms or has no formal agreement; all other CPS 230 requirements still apply.
   • It revokes determination No. 2 of 2023 as varied by variation No. 1 of 2024.
2. 2024-08-30
   CPS 230 variation No. 1 of 2024 Amendment

   Replaced the commencement paragraphs with transitional arrangements in effect from 1 July 2025, deferring certain business continuity requirements for non-significant financial institutions to 1 July 2026. source

   More

   • Pre-existing service provider contracts are covered from the earlier of renewal or 1 July 2026, as the original standard already provided.
   • For non-significant financial institutions, CPS 232 and SPS 232 requirements continue to apply until 30 June 2026.
3. 2023-09-11
   CPS 230 (prudential standard determination No. 2 of 2023) Major version

   The original operational risk management standard, commencing 1 July 2025 and replacing CPS 231, CPS 232, HPS 231, SPS 231 and SPS 232. source

All APRA-regulated entities must manage operational risk, keep critical operations within tolerance through severe disruptions and manage risks from service providers.

Who

ADIs (including foreign ADIs) and authorised banking NOHCs; general insurers and their NOHCs and Level 2 group parents; life companies, friendly societies, EFLICs and registered NOHCs; private health insurers; and RSE licensees. source

Critical operations

Processes run by the entity or its service provider which, if disrupted beyond tolerance levels, would have a material adverse impact on customers or the entity's role in the financial system; tolerance levels must be set for each. source

Material service providers

Providers the entity relies on to undertake a critical operation or that expose it to material operational risk; the entity keeps a register and submits it to APRA annually. source

Exempt service providers

Since 1 July 2026, specified contractual requirements do not apply to material arrangements with listed categories such as central banks and clearing and settlement facilities, where the arrangement uses standardised terms or has no formal agreement. source

The entity tests its business continuity plan, including an annual exercise, reports its service providers to APRA each year and has internal audit review the plan.

Business continuity testing

A systematic testing program covering all critical operations, including an annual business continuity exercise with severe but plausible scenarios. source

Internal audit

Internal audit periodically reviews the business continuity plan and assures the Board that it is credible and that testing is adequate. source

Incident notification

Notify APRA within 72 hours of an operational risk incident likely to have a material financial impact or impact on critical operations, and within 24 hours of a disruption to a critical operation outside tolerance. source

Service agreements

Notify APRA within 20 business days of entering into or materially changing an agreement for a service relied on for a critical operation, and before any material offshoring arrangement. source

APRA supervises compliance and can use formal enforcement powers when supervision does not resolve a problem.

Approach

APRA works mostly through supervision but will use formal enforcement powers to prevent and address serious prudential risks and to hold entities and individuals to account. source

Tolerance levels

APRA may require an entity to review and change its tolerance levels for a critical operation, and may set tolerance levels where it identifies heightened risk or material weakness. source

Enforceable undertakings

APRA may accept an enforceable undertaking from an institution or individual in connection with a matter within its functions or powers. source

1. Law text Prudential Standard CPS 230 Operational Risk Management (in force 1 July 2026)
2. Law text CPS 230 on the Federal Register of Legislation (F2026L00475)
3. Guidance Final targeted amendments to CPS 230 (APRA letter, 30 April 2026)
4. Guidance Operational risk management consultation page (CPS 230, CPG 230, MSP register template)

1. APRA CPS 234

   APRA's information security standard, with its own 72-hour incident notification, that CPS 230 sits alongside.

2. DORA

   The EU regulation on digital operational resilience for financial entities, focused on ICT risk and ICT third-party providers.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to APRA CPS 230 (RSS)