APRA CPS 230: What operational resilience requires

• CPS 230 is APRA's Prudential Standard for Operational Risk Management. It has been in force since 1 July 2025.
• It applies to banks, building societies and credit unions, general, life and private health insurers, and superannuation trustees.
• It has three pillars: operational risk management, business continuity planning and service provider management.
• Each entity sets Board-approved tolerance levels for its critical operations and tests them against severe but plausible scenarios.
• Since 1 July 2026 it applies in full, including to older service provider contracts and to entities that are not significant financial institutions.

CPS 230 is APRA's Prudential Standard for Operational Risk Management. It requires regulated entities to manage operational risk, be able to keep critical operations running through disruption within set tolerances, and manage the risks from the third parties those operations depend on. It came into force on 1 July 2025, replacing five older standards on outsourcing (CPS 231, SPS 231 and HPS 231) and business continuity (CPS 232 and SPS 232).

Looking for the standard itself? Read CPS 230 on APRA's website. This page explains what it means and how to meet it.

CPS 230 brings operational resilience together under three pillars:

1. Operational risk management: identify critical operations, set tolerances, test, and report.
2. Business continuity planning: keep critical operations running through disruption.
3. Service provider management: manage the risks from material service providers.

Identify your critical operations and the processes, people, technology, data and third parties they depend on. For each, set Board-approved tolerance levels (often called impact tolerances): the maximum time you would tolerate a disruption, the maximum data loss, and the minimum service levels you would maintain on alternative arrangements. Then scenario-test against severe but plausible disruption, and report operational risk and incidents to the Board.

CPS 230 names the operations every entity must treat as critical, unless it can justify otherwise:

• Banks and other ADIs: payments, deposit-taking and management, custody, settlements and clearing
• Insurers (general, life, private health): claims processing
• Superannuation trustees: investment management and fund administration
• Every entity: customer enquiries, and the systems and infrastructure that support critical operations

Maintain a business continuity plan that sets out how you identify, manage and respond to disruption within your tolerances. It must include disaster-recovery planning for critical information assets, and be backed by the people, resources and technology needed to execute it. The Board oversees the BCP as part of overall risk management.

Test it through a program that covers every critical operation against a range of severe but plausible scenarios, including disruption at a material service provider. The program must include a business continuity exercise every year, and the plan is reviewed and updated as needed every year. Entities that are not significant financial institutions had until 1 July 2026 to meet these business continuity and testing requirements.

Writing or reworking the plan? See what a business continuity plan must contain, or how business continuity planning works end to end.

Maintain a register of your material service providers and manage the risks from them: monitor arrangements, assess performance, and keep compliance with the service agreement. The register of material service providers is submitted to APRA annually, and APRA must be notified within 20 business days of entering into or materially changing an agreement for a service on which a critical operation relies.

See the detail: CPS 230 material service provider requirements.

CPS 230 now applies in full. Check you can show each of these is in place:

• A register of your critical operations, including the minimum set CPS 230 names for your industry unless you can justify otherwise
• Board-approved tolerance levels for each critical operation: the maximum time you would tolerate a disruption, the maximum data loss you would accept and the minimum service levels you would keep on alternative arrangements
• A business continuity plan that sets out how you stay within those tolerance levels, reviewed and updated as needed every year
• A testing program that covers every critical operation against a range of severe but plausible scenarios, including a business continuity exercise every year
• A register of material service providers, submitted to APRA every year
• A process to notify APRA within 20 business days of entering into or materially changing an agreement for a service a critical operation relies on
• A process to notify APRA within 24 hours of a disruption to a critical operation outside tolerance, and within 72 hours of a material operational risk incident
• Regular reporting of your operational risk profile to the Board, including any failure to meet tolerance levels, with a remediation plan

Each item comes from the standard itself: CPS 230 on APRA's website. For the supplier side in detail, see CPS 230 material service providers.

CPS 230 is the standard. It is binding, and it sets out what an APRA-regulated entity must do. It also expects an approach that suits the entity's size, business mix and complexity.

CPG 230 is the guidance. APRA's Prudential Practice Guide CPG 230 is not binding. It explains how APRA expects entities to meet the standard's requirements.

The April 2026 update. APRA amended CPS 230 in April 2026 to give limited exemptions from specific contractual requirements for arrangements with a set list of providers, such as regulators, central banks, exchanges, clearing and settlement facilities and payment systems. All other CPS 230 requirements still apply to those arrangements. CPG 230 was updated at the same time, and both apply from 1 July 2026.

Read both on APRA's operational risk management page.