Key points

• The deadline for APRA-regulated entities to comply with APRA Prudential Standard CPS 230 (Operational Risk Management) (CPS 230) is fast approaching.
• Banks, insurers, superannuation funds and other APRA-regulated entities should by now be well-progressed with their plans to become compliant with new APRA Prudential Standard CPS 230, which comes into effect on 1 July 2025.
• APRA-regulated entities have until 1 July 2026 to uplift their pre-existing contractual arrangements with their material service providers to meet the new requirements of CPS 230. 

Who will this affect?

APRA-regulated entities that will need to become compliant with CPS 230 include:

• authorised deposit-taking institutions, including banks;
• general insurers;
• life insurers;
• private health insurers; and
• registrable superannuation entity licensees (i.e. superannuation funds).

These APRA-regulated entities have until 1 July 2025 to comply with the new requirements of CPS 230. CPS 230 will replace the following existing Prudential Standards:

• Prudential Standard CPS 231 (Outsourcing), which applies to authorised deposit-taking institutions;
• Prudential Standard HPS 231 (Outsourcing), which applies to private health insurers;
• Prudential Standard SPS 231 (Outsourcing), which applies to superannuation funds;
• Prudential Standard CPS 232 (Business Continuity Management), which applies to authorised deposit-taking institutions; and
• Prudential Standard SPS 232 (Business Continuity Management), which applies to superannuation funds.

Prudential Standard CPS 234 (Information Security) will continue to operate alongside CPS 230.

One of the key requirements of CPS 230 is that formal agreements with material service providers must contain a number of specified provisions. While Prudential Standards CPS 231, HPS 231 and SPS 231 all contain similar (but slightly different) requirements, the provisions required to be included under CPS 230 are somewhat different, so it is likely that any existing contractual arrangements will need to be uplifted.

Where an APRA-regulated entity has pre-existing contractual arrangements in place with a material service provider, the APRA-regulated entity must ensure that each of its contracts with its material service providers meets the requirements of CPS 230 by the earlier of the next renewal date of the contract with the service provider or 1 July 2026. In practice, this is likely to require APRA-regulated entities to prepare, negotiate and agree on amendments to their existing contracts with all of their current material service providers.

Entities that are service providers to APRA-regulated entities should expect to receive requests from their customers to agree to variations of their existing contracts to cover compliance with CPS 230. Prudent service providers may wish to consider proactively issuing their own preferred variation agreements to avoid (or at least mitigate or reduce) the demands on their own legal and contract management teams to review and negotiate bespoke variation requests from their customers.

A recap of the key obligations that have changed

CPS 230 introduces a number of requirements that are either new or which differ in a substantial way from obligations under the existing Prudential Standards that will be replaced once CPS 230 comes into effect. Some of these key obligations are set out below, but note this is not an exhaustive description of all of the new or different requirements under CPS 230.

1. Business continuity

While the requirement to maintain a Business Continuity Plan (BCP) is not new, CPS 230 introduces the concepts of ‘critical operations’ and ‘tolerances levels’.

Critical operations are the processes undertaken by an APRA-regulated entity or its service provider which, if disrupted beyond tolerance levels, would have a material adverse impact.

Tolerance levels are:

• the maximum period of time the entity would tolerate a disruption to a critical operation;
• the maximum extent of data loss the entity would accept as a result of a disruption; and
• the minimum service levels to maintain while operating under alternative arrangements during a disruption.

Entities are required to notify APRA within 24 hours if the entity has suffered a disruption to a critical operation outside of tolerance levels.

2. Expanded operational risk management requirements 

The board of an APRA-regulated entity is ultimately accountable for overseeing the entity’s operational risk management. The board’s role includes approving the entity’s BCP and tolerance levels for disruptions to critical operations, approving the entity’s service provider management policy, reviewing the results of any testing and overseeing the implementation of any findings and remedial measures. 

Entities must notify APRA within 72 hours after becoming aware of an operational risk incident that is likely to have a material financial impact on the entity or a material impact on its ability to maintain critical operations. 

3. Material service providers

CPS 230 introduces the concept of ‘material service providers’, which differs from (and is arguably wider than) the focus on the outsourcing of material business activities regulated under CPS 231, HPS 231 and SPS 231. 

A material service provider is a provider that an APRA-regulated entity relies on to undertake a critical operation or that exposes it to material operational risk. In relation to material service providers, entities must: 

• maintain and submit a register of material service providers to APRA annually;
• notify APRA within 20 business days of entering an agreement with a material service provider or within 20 business days of materially modifying an agreement with a material service provider;
• notify APRA prior to entering into any material offshoring arrangement or when there is a significant change proposed to the arrangement;
• maintain a board-approved 'service provider management policy'; and
• only rely on a service provider if the APRA-regulated entity can ensure it can continue to meet its prudential obligations in full and manage the associated risks. 

4. Additional powers for APRA 

Under CPS 230, APRA can: 

• require an entity to hold additional capital, impose conditions on the entity’s licence, conduct an independent review, and require remediation to be undertaken if APRA considers the entity’s operational risk management has material weaknesses;
• require an entity to review and change its tolerance levels for a critical operation;
• set tolerance levels for an entity or class of entities where APRA identifies a heightened risk or material weakness;
• require an entity to review or modify a service provider arrangement where APRA identifies heightened prudential concerns; and
• direct that business operations be classified as ‘critical operations’ and that service providers be classified as ‘material service providers’.

Key steps to prepare for compliance with CPS 230

APRA-regulated entities should:

1. Review Current Plans: conduct a thorough review of your current operational risk management and business continuity plans.
2. Identify and Address Gaps: identify any gaps in your current plans and address them promptly.
3. Engage with Service Providers: ensure your service providers meet the new standards and update any contractual agreements as necessary.

Dentons can assist APRA-regulated entities navigate the impact of CPS 230 and identify any gaps in your current policies and processes. This may include drafting new clauses to be included in your third-party contracts and updating existing agreements that require uplifting as a result of this new standard.