Australia APRA CPS 230: Finalized Targeted Amendments for Non-Traditional Service Providers

On April 30, 2026, the Australian Prudential Regulation Authority (APRA) finalized targeted amendments to its landmark prudential standard CPS 230 Operational Risk Management, the accompanying prudential practice guide CPG 230, and the Material Service Provider (MSP) Register template.

These amendments, which come into effect on July 1, 2026, address industry feedback regarding the practical challenges of applying CPS 230's strict contractual obligations to arrangements with non-traditional service providers.

1. Limited Exemptions for Non-Traditional Service Providers (NTSPs)

The amendments introduce limited exemptions from specific contractual requirements for material arrangements with certain categories of service providers where standard contractual negotiation is not practicable.

• Exempt Categories: APRA published a list of exempt service provider types in an attachment to CPS 230. These include:
  • Government agencies
  • Financial regulators
  • Central banks (e.g., the Reserve Bank of Australia)
  • Financial market exchanges / clearing and settlement facilities
• Exemption Mechanism: Exemption is granted by service provider type, which APRA determined is more efficient and easier for regulated entities to manage over time. APRA retains the authority to adjust this list and may grant additional exemptions on a case-by-case basis via written notice.

2. Tailored Operational Risk Management Expectations

APRA recognizes that risk management and due diligence must look different for arrangements with exempt service providers due to inherent information asymmetry, market dynamics, and rigid institutional structures.

• CPG 230 Guidance Updates: The updated guide CPG 230 clarifies that standard selection and due diligence processes (typically used for traditional cloud or technology vendors) are not required or expected to be identical when dealing with exempt entities (like central banks or financial market exchanges).
• Standardized Contract Definition: The standard's language has been clarified to better reflect that the exemption's intent is to accommodate arrangements where a regulated financial entity has an absolute inability to negotiate standard contract terms.

3. Material Service Provider (MSP) Register Updates

APRA released an updated MSP Register template and instructions to accommodate these changes. Regulated entities can now explicitly classify and record arrangements with exempt service providers on their MSP Register. APRA plans to issue an updated APRA Connect return in mid-2026 to incorporate these reporting changes.

4. Compliance Timelines

• July 1, 2025: Standard CPS 230 implementation began for major APRA-regulated entities.
• July 1, 2026: These finalized targeted amendments for NTSPs, along with transitional relief for smaller APRA-regulated entities, come into full effect.