APRA Prudential Standard CPS 230
On 1 July 2025, APRA Prudential Standard CPS 230 Operational Risk Management came into effect. This standard introduced strengthened requirements for managing operational risks, ensuring business continuity, and overseeing service provider arrangements across the financial services sector.
CPS 230 applies to all APRA-regulated entities, being:
- Authorised deposit-taking institutions (ADIs), foreign ADIs and authorised non-operating holding companies (as defined in the banking legislation)
- General insurers, including Category C insurers, non-operating holding companies authorised under the insurance legislation, and parent entities of Level 2 insurance groups
- Life companies, including friendly societies, eligible foreign life insurance companies, and non-operating holding companies registered under the life insurance legislation
- Private health insurers
- Registrable superannuation entity licensees in respect of their business operations
To support a smooth transition, there is temporary relief from certain obligations under CPS 230 until 1 July 2026 in specific circumstances:
- Contracts with a service provider in place as of 1 July 2025 need not be compliant with CPS 230 until the earlier of the next contract renewal date or 1 July 2026 (this applies to all APRA regulated entities)
- Requirements in relation to the CPS 230 business continuity plan and related testing and review processes are deferred until 1 July 2026 for non-significant financial institutions (non-SFIs) only
Eligible entities may transition to CPS 230 in full before the conclusion of the 12-month extension. Those that do not transition early are required to continue complying with the previous prudential standards on business continuity until 30 June 2026.
Support for CPS 230 content mapping
To support clarity and reduce duplication, we have streamlined our content structure. CPS 230 content is now consolidated within the Operational Risk Management (ORM) module, while obligations related to repealed standards have been archived in the relevant industry modules.
Each archived obligation in the industry modules, as well as each active obligation in the ORM module, includes a historical note indicating where equivalent content was previously located or is currently maintained.
For entities with deferred business continuity requirements, a brief summary of the applicable CPS 232 obligations is included within the relevant ORM obligations. The historical notes also direct users to the full coverage of the repealed CPS 232 standard.
To assist with navigation, the ORM Mapping Summary Tool includes:
- Tab 1 – A list of CPS 230 provisions mapped to obligations in the ORM module
- Tab 2 – A list of ORM obligations mapped to archived industry module obligations (transitional provisions are highlighted in red)
Although the industry module obligations have been archived, they remain accessible for reference.