CPS 230 is now fully in force: what it means if you supply a bank, insurer or super fund
By Gavin Oh, CISO
If you provide services to a bank, insurer or superannuation fund, you may recently have received a contract variation, a lengthy supplier questionnaire, or both. The reason is APRA's Prudential Standard CPS 230. Its last transition period ended on 1 July 2026, and existing contracts with service providers now have to comply too, not just new ones.
CPS 230 is a regulation for APRA-regulated entities, not their suppliers. In practice, though, much of the work lands on suppliers. Here's what's happening, what you'll be asked for, and how to respond.
What is CPS 230?
CPS 230 is APRA's cross-industry standard for operational risk management. It requires banks, insurers and super funds to identify their critical operations, set tolerance levels for disruption, and manage the risks that come from relying on service providers. It replaced APRA's older outsourcing and business continuity standards with a single, broader framework.
The part that affects suppliers most is the requirement to manage material service providers: the suppliers a regulated entity relies on for critical operations or that expose it to material operational risk.
Are you a material service provider?
Your customer decides, based on how much they depend on you. The range of suppliers caught is wider than many expect. IT, software, payroll, printing, cloud hosting, call-centre, claims handling, professional services and facilities providers can all be classified as material, and APRA can also require an entity to classify a particular provider or type of provider as material.
A simple test: if your service stopped tomorrow, could your customer still serve its own customers? If the honest answer is no, expect to be treated as material.
What your customer's contract must now include
CPS 230 sets minimum requirements for agreements with material service providers. If you're classified as material, expect your contract to cover:
Defined services and service levels. The agreement must specify the services and associated service levels, so expect measurable SLAs and reporting against them.
Rights and responsibilities. This includes ownership of assets, ownership and control of data, dispute resolution, audit access, liability and indemnity.
Subcontractors. You must notify your customer of other providers you materially rely on to deliver the service, and you remain responsible for any failure by a subcontractor.
Termination and force majeure. Expect clear termination rights, and a force majeure provision stating which parts of the contract continue during a force majeure event.
APRA access. The agreement must allow APRA access to documentation, data and other information about the service, and you must agree not to impede APRA in its role as regulator. APRA must also have the right to conduct an on-site visit to the service provider.
Expect the questionnaire too
Contract clauses are only part of it. Your customer must actively manage the risk you represent, so expect detailed due diligence in four areas:
Your own suppliers ("fourth parties"). Questionnaires now routinely ask suppliers to disclose their subcontractors and key dependencies, including which cloud platforms and data centres they use.
Business continuity. Your customer's business continuity plan must be tested annually against severe but plausible scenarios, including disruptions to services from material service providers. You may be asked to take part, or to show how you'd keep your service running.
Incident notification. Your customer has strict deadlines for notifying APRA of significant incidents, and it can only meet them if you tell it quickly. Expect tight notification timeframes in your contract.
Security evidence. CPS 230 sits alongside CPS 234, APRA's information security standard, so expect questions about your security controls and how you can prove them.
What about the April 2026 changes?
APRA finalised targeted amendments to CPS 230 on 30 April 2026, which took effect on 1 July 2026. The main change is a narrow exemption: a regulated entity doesn't need to comply with specified contractual requirements for a material arrangement if it uses standardised terms or isn't documented in a formal agreement, and the provider falls within a listed category. The changes were aimed at arrangements with non-traditional service providers, such as large platforms that won't negotiate individual contracts.
Most suppliers shouldn't assume this applies to them. The exemption covers only the specified contractual requirements; all other CPS 230 requirements still apply.
What to do now
Ask whether you're classified as material. If a customer hasn't told you, ask. It affects what they'll need from you.
Review contract variations carefully. Audit rights, notification timeframes and termination provisions all have real operational and commercial consequences. Get legal advice before you sign, and make sure you can actually deliver what you agree to.
Map your own dependencies. List the subcontractors, cloud platforms and other providers your service relies on. You'll be asked.
Get incident response ready. Make sure you can detect, assess and notify customers of incidents within the timeframes you agree to.
Test your business continuity. A plan that has never been tested won't satisfy a customer who must test its own.
Have your evidence ready. Independent certification such as ISO 27001 answers many security questions at once, and can shorten due diligence considerably.
How we can help
Cyber Systems HQ helps suppliers to APRA-regulated entities understand what their customers will expect, close the gaps, and answer due diligence with confidence. If you've received a CPS 230 contract variation or questionnaire, or expect one soon, talk to us or learn more about our APRA CPS 234 & CPS 230 services.
This article is general information only and isn't legal advice. Get professional advice about your specific contracts and obligations.