Australia’s CPS 230 Ushers in a Stricter Era of Operational Resilience for Banks, Insurers and Super Funds

A Prudential Standard Built for Disruption, Not Just Compliance

Australia’s financial sector has entered a new regulatory chapter with the full commencement of Prudential Standard CPS 230 Operational Risk Management. From 1 July 2026, all APRA-regulated entities—banks, general and life insurers, private health insurers and superannuation trustees—must demonstrate that they can withstand severe operational disruptions and continue delivering critical services to customers and markets. The standard is not a paperwork exercise; it reframes operational resilience as a board-level obligation and a core component of prudential soundness.

CPS 230 requires entities to identify, assess and manage operational risks with effective internal controls, monitoring and remediation. It also demands a credible business continuity plan that keeps critical operations within defined tolerance levels during severe disruptions, and a comprehensive service provider management framework covering formal agreements and robust monitoring. The Australian Prudential Regulation Authority (APRA) has made clear that the approach must be proportionate to an entity’s size, business mix and complexity, but the underlying expectation is uniform: resilience must be demonstrable, not assumed.

What Changed on 1 July 2026

The standard first took effect on 1 July 2025, but the 2026 date carries particular weight. APRA finalised targeted amendments in April 2026 that introduced a narrow exemption from certain contractual requirements for material arrangements with non-traditional service providers such as central banks, clearing and settlement facilities, and payment system operators. The relief applies only where standardised terms are used or no formal agreement exists, and it does not dilute the obligation to actively manage the operational risks arising from reliance on those providers.

For non-significant financial institutions, 1 July 2026 also marks the point at which deferred business continuity and scenario analysis requirements become fully enforceable. In practice, this means smaller insurers, credit unions and superannuation funds can no longer treat resilience planning as a future project; the supervisory expectation is that frameworks are embedded and evidence is available on request.

A Shift From Implementation to Assurance

Industry analysis suggests the compliance conversation is moving from “what must we build” to “how do we prove it works.” Deloitte Australia notes that with CPS 230 live, regulated entities must transition from implementation to embedding independent assurance in business-as-usual, covering operational risk management, business continuity management and service provider management. Material service providers themselves are also expected to establish assurance programmes that validate the robustness of the controls underpinning their clients’ critical operations.

This assurance lens matters because CPS 230 sits alongside the Financial Accountability Regime (FAR), which sharpens individual accountability for prudential outcomes. Boards and senior managers are therefore not merely signing off on a framework; they are accountable for whether that framework actually performs under stress. The practical implication is that internal audit, risk functions and third-party oversight teams must collaborate more closely than many legacy operating models allow.

What Resilience Looks Like in Practice

APRA’s Prudential Practice Guide CPG 230 signals flexibility in how entities meet the standard, but it does not lower the bar on outcomes. Entities are expected to maintain a library of severe but plausible disruption scenarios, test business continuity arrangements regularly, and understand the end-to-end resources—people, technology, data and premises—that support each critical operation. The register of material service providers is a central artefact: it forces entities to name the third parties, related entities and connected parties on which critical operations depend, and to submit that register to APRA annually.