Australia Prudential Standard CPS 230

Why does it matter?

CPS 230 makes operational resilience a board-level obligation for Australian banks, insurers and superannuation trustees: critical operations must stay within tolerance levels through severe disruptions, and the entity must be able to show how.

Key benefits include:

• Clear accountability

The Board approves the tolerance levels and the business continuity plan, and senior managers hold defined responsibilities for operational risk.

• Resilience measured against limits

A maximum period of disruption, a maximum data loss and minimum service levels turn resilience into figures that can be tested and reported.

• Visible third-party exposure

A register of material service providers, with the fourth parties they rely on, shows which providers sit behind critical operations.

• Defined contact with the regulator

Fixed notification windows of 24 hours, 72 hours and 20 business days make it clear when and how fast to tell APRA.

• Tested continuity

An annual business continuity exercise using severe but plausible scenarios shows the plan works before a real disruption.

How does it work?

CPS 230 sits inside the risk management framework that CPS 220 Risk Management, or SPS 220 for superannuation, already requires. It sets three key principles: manage operational risks effectively, maintain critical operations within tolerance levels through severe disruptions, and manage the risks of using service providers. The requirements scale to the entity's size, business mix and complexity, and a Head of group applies them on a group basis.

Implementation follows the standard's sequence. An entity identifies and documents the processes and resources behind each critical operation, sets tolerance levels, builds a business continuity plan around them and tests it, identifies its material service providers and brings their agreements up to standard, and sets up incident and tolerance-breach escalation so APRA is notified on time. Internal audit reviews the business continuity plan and any proposed outsourcing of a critical operation.

SmartSuite supports this with one connected set of records: a critical operations register linked to tolerance levels, plans, test results, service providers and incidents, with Automations for reminders and escalations and Dashboards for board reporting.

Key Elements

• Operational risk management across the whole entity

Entities must identify, assess and manage legal, regulatory, compliance, conduct, technology, data and change management risks, test internal controls, and keep control gaps in the risk profile until they are fixed.

• Critical operations

Critical operations are processes that, if disrupted beyond tolerance levels, would materially harm customers or the entity's role in the financial system, and the entity keeps a register of them. APRA sets minimum classes: payments and deposit-taking for ADIs, claims processing for insurers, and investment management and fund administration for RSE licensees.

• Tolerance levels

For each critical operation the entity sets a maximum period of disruption, a maximum extent of data loss and minimum service levels during a disruption, and the Board approves them.

• Business continuity plan and testing

The plan holds the critical operations register, activation triggers, actions to stay within tolerance, key dependencies and a communications strategy. A systematic testing program covers all critical operations and includes an annual exercise using severe but plausible scenarios.

• Material service providers

Entities keep a register of material service providers, submit it to APRA annually, hold formal agreements that cover sub-contracting and APRA access, and manage the risks of fourth parties that a provider relies on for a critical operation.

• Notification to APRA

An entity notifies APRA as soon as possible and no later than 24 hours after a disruption to a critical operation outside tolerance, and no later than 72 hours after becoming aware of an operational risk incident likely to have a material financial impact or a material impact on critical operations. It also notifies APRA within 20 business days of entering or materially changing an agreement for a service it relies on for a critical operation.

• Board accountability

The Board is ultimately accountable for operational risk management, approves the business continuity plan, tolerance levels and service provider management policy, and receives a report on any failure to meet tolerance levels together with a remediation plan.

What does it cover?

CPS 230 applies to all APRA-regulated entities: authorized deposit-taking institutions (ADIs), including foreign ADIs; general insurers; life companies, including friendly societies; private health insurers; and RSE licensees in respect of their business operations. For foreign ADIs, Category C insurers and eligible foreign life insurance companies it covers only Australian branch operations. A Head of group applies it across the group, including entities that are not APRA-regulated.

The key dates are 17 July 2023, when APRA finalized the standard, and 1 July 2025, when it took effect. For contracts with material service providers that already existed on that date, the requirements applied from the earlier of the next renewal date or 1 July 2026. Targeted amendments finalized on 30 April 2026 took effect on 1 July 2026 and add limited exemptions from some contractual requirements for material arrangements with certain categories of provider, such as central banks and clearing and settlement facilities.

What are its objectives?

For an Australian risk team, meeting CPS 230 in practice looks like this:

Every critical operation sits on a register with a named owner, its dependencies and its three tolerance levels, approved by the Board.

The business continuity plan can be activated from defined triggers, and the latest test either showed the operation staying within tolerance or recorded the gap and the fix.

The material service provider register is current, each provider is linked to the critical operations it supports, and renewals and material changes start the APRA notification process.

Incident and disruption records show when tolerance was breached, and the 24-hour and 72-hour notifications are drafted from them.

Control testing, near misses and remediation feed one operational risk profile instead of separate registers.

The Board sees tolerance results, test findings and provider performance in regular reporting, and internal audit can trace each figure to evidence.

Framework in Context

CPS 230 builds on the general risk management requirements in CPS 220 Risk Management and SPS 220 Risk Management. Information security stays a separate standard: CPS 230 requires entities to meet CPS 234 Information Security, and an incident already notified under CPS 234 does not need a second notification under CPS 230. Prudential Practice Guide CPG 230 sets out APRA's expectations for applying the standard. Internationally, CPS 230 sits alongside the Basel Committee's operational resilience and operational risk principles, ISO 22301 for business continuity, ISO 31000 for risk management and the EU Digital Operational Resilience Act (DORA).

Common Framework Mappings

These frameworks sit closest to CPS 230's requirements for operational resilience, risk management and service provider oversight.

Mapped frameworks include:

APRA CPS 234

BCBS Operational Resilience Principles

BCBS PSMOR 2021

EU DORA

ISO 22301

ISO 31000:2018