APRA finalises CPS 230 amendments

The Australian Prudential Regulation Authority (APRA) has finalised targeted amendments to prudential standard CPS 230 Operational Risk Management.

The amendments introduce limited exemptions from specific contractual requirements in CPS 230 for material arrangements with certain categories of non-traditional service providers (NTSPs), where contractual compliance is not practicable.

"Developed in response to industry feedback, these changes aim to provide targeted, administratively efficient solutions for regulated entities that maintain material arrangements with NTSPs, while preserving the core objectives of operational risk management," APRA said.

APRA's final amendments provide relief that is "narrowly targeted, administratively efficient, and responds to industry concerns", with the regulator adding the core objectives of CPS 230 will be preserved.

Under the changes, a regulated entity will not need to comply with specified contractual requirements in CPS 230 for a material arrangement if the arrangement is with, for example, government agencies, central banks, financial market exchanges, operators of clearing and settlement facilities, operators of payment systems and schemes, and financial messaging infrastructures.

An exemption will also be granted if the arrangement uses standardised terms or is not documented in a formal agreement.

"The exemption applies only to the specified CPS 230 contractual requirements. All other CPS 230 requirements continue to apply," APRA said in a letter to regulated entities.

"These amendments do not reduce the expectation that regulated entities actively manage the operational risks arising from reliance on these service providers."

APRA also made minor amendments to supporting guidance to clarify expectations for managing material arrangements with exempt service providers, and to enable entities to classify exempt arrangements in the Material Service Provider Register Template - which is available on APRA's website.

"APRA will have the ability to grant exemptions for additional service providers by written notice where appropriate. Over time, as domestic and international operational resilience practices mature, APRA expects the scope of exemptions to narrow rather than expand," APRA said.

"APRA will periodically review the operation of these exemptions to ensure they remain appropriate and aligned with prudential objectives."

The amendments will come into effect on 1 July 2026.