APRA CPS 230 Operational Risk Management Guide: Critical Operations, Tolerances and Service Providers

APRA's CPS 230 turns operational resilience from a business continuity document into a set of board-approved tolerances, testable plans and service provider controls, with notification clocks of 24 hours, 72 hours and 20 business days. The standard has applied to Australian banks, insurers and superannuation trustees since 1 July 2025, its transition for older service provider contracts ends on 1 July 2026 at the latest, and APRA finalised targeted amendments on 30 April 2026 that also commence on 1 July 2026. This guide covers who is in scope, the obligations paragraph by paragraph, current status, enforcement, what CPS 230 means for the machine identities and integrations behind critical operations, and a practical compliance sequence. It is for operational risk, resilience, technology and security leads at APRA-regulated entities and the providers that serve them. Status line: checked against APRA's published standard and web pages on 27 October 2026.

Key takeaways

• Three pillars, one standard: CPS 230 covers operational risk management, business continuity of critical operations, and management of material service providers, with the board ultimately accountable for all three (para 19).
• Tolerances are the anchor: for every critical operation the entity sets a maximum period of disruption, a maximum data loss and minimum service levels while on alternative arrangements (para 37).
• Clocks are short: notify APRA within 72 hours of a likely material operational risk incident (para 32) and within 24 hours of a critical operation disruption outside tolerance (para 41).
• Service providers are named for you: core technology services, risk management and internal audit are material service provider categories for every entity unless justified otherwise (para 49), and the register goes to APRA annually (para 50).
• Machine identities sit on the critical path: service accounts, API keys and integration tokens connect entities to their core technology providers, so their failure or compromise is an operational risk incident and a tolerance problem, not only a cyber issue.

Scope: who and what is covered

CPS 230 applies to authorised deposit-taking institutions (ADIs), general insurers, life companies, private health insurers and RSE licensees in respect of their business operations, along with related entities listed in paragraph 2. For foreign ADIs, Category C insurers and eligible foreign life insurance companies, it applies to the Australian branch operations only (para 3). Heads of groups must comply and apply the requirements on a group basis (para 4).

Both lists apply "unless justified otherwise", so an entity can depart from them only with a documented rationale. A material service provider is one the entity relies on to undertake a critical operation, or one that exposes it to material operational risk (para 48). CPS 230 sits beside APRA's information security standard; see the APRA CPS 234 Guide for the cyber controls, and the Australian Privacy and Cyber Rules Guide for the wider legal picture.

Key obligations

Governance and operational risk management

• Board (paras 19-21): oversees operational risk and key controls with regular risk profile updates; approves the business continuity plan (BCP) and tolerance levels, reviews test results and oversees remediation; approves the service provider management policy and reviews reporting on material service providers.
• Senior management (para 22): gives the board clear information on expected impacts to critical operations when decisions could affect their resilience.
• Risk coverage (para 23): the full range of operational risks, including legal, regulatory, compliance, conduct, technology, data and change risk.
• Controls testing (para 29): regular testing with frequency matched to materiality, results reported to senior management and gaps fixed promptly; material weaknesses remediated with clear accountability and root cause analysis, and unremediated gaps kept in the risk profile (para 30).
• Incidents (para 31): incidents and near misses identified, escalated, recorded and addressed in a timely way.

Business continuity

• Register of critical operations (para 33) and reasonable steps to reduce the likelihood and impact of disruption.
• BCP contents (para 39): tolerance levels, triggers for activation, actions to stay within tolerance, execution risks and dependencies, and a communications strategy.
• Monitoring (para 40): track whether tolerances are met and report failures and remediation plans to the board.
• Testing (paras 42-43): a systematic testing programme across all critical operations, including an annual BCP exercise, using severe but plausible scenarios, tailored to material risks including disruption at material service providers. APRA may require an APRA-determined scenario.
• Review (paras 44-45): the BCP is updated at least annually and internal audit periodically reviews it and gives the board assurance.

Service provider management

• Policy (para 47): a service provider management policy that, among other things, addresses risks from fourth parties that material service providers rely on to deliver critical operations.
• Register (para 50): a register of material service providers, submitted to APRA annually.
• Due diligence (para 52): before entering or materially modifying a material arrangement, assess financial and non-financial risks, including geographic and concentration risk. See the Third-Party Concentration Risk Guide.
• Formal agreements (para 53): services and service levels; rights and responsibilities including data ownership, audit access and liability; legal and compliance obligations; notification of material sub-contracting; provider responsibility for sub-contractor failures; force majeure; termination rights including partial termination.
• APRA access (para 54): agreements must give APRA access to information and on-site visits and must not impede APRA.
• Internal audit (para 61): reviews proposed material arrangements that outsource a critical operation and reports regularly on compliance with the policy.

Notifications to APRA

A cyber incident can trigger several of these at once, and APRA's information security standard has its own notification duties. Build one incident decision tree that evaluates all of them.

Timeline and current status

Status as of 27 October 2026, from APRA pages (operational risk management page last updated 30 April 2026).

The April 2026 amendments add limited exemptions for material arrangements with non-traditional service providers where contractual compliance is impracticable. Under paragraph 57 and the Attachment, the formal agreement, APRA access and certain related requirements (paras 53, 54, 55(d), 59(a) and 59(c)) do not apply where the provider is a government agency, regulator, central bank, financial market exchange, clearing and settlement operator, payment system or scheme operator, or financial messaging infrastructure, and the arrangement uses standardised terms or is not documented in a formal agreement. APRA may grant other exemptions by written notice (para 58). The exemption narrows contract duties only: the provider still counts for business continuity and risk purposes, and CPG 230 sets expectations for these arrangements.

Enforcement and penalties

CPS 230 does not set its own fines. A prudential standard is enforced through APRA's general supervisory and enforcement powers, which APRA describes as including:

• Directions: requiring an entity to take or cease particular actions.
• Licence conditions: constraints on how the regulated business operates.
• Enforceable undertakings: often accepted as an alternative to formal legal action.
• Disqualification: of individuals from accountable person roles under the Financial Accountability Regime Act 2023, or by the Federal Court on APRA's application.
• Court action and infringement notices: infringement notices are available for breaches of the SIS Act and FSCODA.

In practice the first signs of trouble are supervisory: requests for the critical operations register, tolerance rationale, test results and the material service provider register. Because the board approves tolerances and the service provider policy, individual accountability under the Financial Accountability Regime is the lever that makes CPS 230 personal for executives.

What it means for AI agents and non-human identities

CPS 230 never mentions service accounts or AI agents, but critical operations in a modern bank or insurer run on them. Claims processing, payments and fund administration depend on API integrations to core technology providers, batch jobs with stored credentials, and increasingly AI agents that triage enquiries or claims. Each is a dependency the BCP must name and a risk the controls testing must cover.

The Snowflake Breach 2024 shows the pattern: infostealer-captured, unrotated credentials without MFA were used against around 165 customer accounts of a data platform, without any flaw in the platform itself. For a CPS 230 entity, that is a material service provider scenario in which the weak point was the customer's own credentials. For AI agents, record each agent that supports a critical operation in the dependency map, give it its own scoped identity and a manual fallback, and include it in the testing programme. See the Service Account Security Guide and the Third-Party Access Guide.

Compliance steps

1. Confirm critical operations: start from the paragraph 35 defaults, document any departure, and record the register approved by the board.
2. Set tolerances with evidence: for each operation define maximum disruption, maximum data loss and minimum service levels, and test them against real recovery capability rather than aspiration.
3. Map end-to-end dependencies: people, processes, technology, data, service providers, fourth parties and the credentials connecting them. Machine identities with expiry dates belong on this map.
4. Classify material service providers: apply the paragraph 49 categories, add others that expose you to material operational risk, and populate the register in APRA's template.
5. Remediate contracts: close paragraph 53 gaps (sub-contracting notice, audit and APRA access, data ownership, termination) before renewal or 1 July 2026, whichever is first; document where the NTSP exemption applies.
6. Build the notification decision tree: one runbook covering the 24-hour, 72-hour and 20-business-day triggers alongside CPS 234 duties, with named decision makers.
7. Test: run the systematic testing programme with an annual BCP exercise using severe but plausible scenarios, including a material provider outage and a credential compromise. Feed findings to the board and track remediation.
8. Assure: schedule internal audit reviews of the BCP and of service provider policy compliance, and review the BCP at least annually.

Decision guidance

• Large, complex entities: expect APRA to probe group-wide application (para 4), concentration risk across providers, and evidence that tolerances drove investment decisions.
• Smaller entities: the obligations are the same in kind; proportionate depth lies in how much analysis supports each tolerance and how often controls are tested (para 29 ties frequency to materiality).
• Exempt provider or material provider: the NTSP exemption removes contract terms, not the need to plan for the provider's failure. Keep it in the register and the BCP.

Detection, measurement and framework mapping

• Tolerance breaches: number of critical operation disruptions that exceeded tolerance, and time to restore against the maximum period.
• Notification timeliness: percentage of APRA notifications made inside the 24-hour, 72-hour and 20-business-day windows.
• Dependency coverage: share of critical operations with a dependency map that lists machine identities, owners and expiry dates.
• Contract readiness: share of material arrangements compliant with paragraph 53, or exempt with documented rationale.
• Test findings: open findings from BCP exercises and controls testing past their remediation date.

Common failure patterns

• Tolerances set by aspiration: a four-hour maximum disruption that no test has ever achieved will fail the first severe but plausible exercise.
• BCP without technical dependencies: plans list applications but not the certificates, keys and service accounts that link them to providers, so a credential expiry becomes an unplanned outage.
• Register built from procurement data: the material service provider register misses providers paid through other routes, or fourth parties that actually run the critical service.
• Separate clocks, separate teams: resilience owns the 24-hour tolerance notice, security owns cyber notices, and nobody owns the decision when one incident triggers both.
• Waiting for renewal: pre-existing contracts reach the 1 July 2026 backstop with paragraph 53 gaps still open.
• Treating the NTSP exemption as an exclusion: exempt providers drop out of the BCP and testing even though they still underpin critical operations.

Practitioner checklist

• Confirm the critical operations register against the paragraph 35 defaults and record board approval.
• Set and evidence tolerance levels for disruption, data loss and minimum service.
• Map dependencies, including service accounts, API keys and certificates with owners and expiry dates.
• Complete the material service provider register and submit it annually.
• Close paragraph 53 contract gaps or document the NTSP exemption.
• Run one notification decision tree for 24-hour, 72-hour and 20-business-day triggers.
• Include a provider credential compromise in the annual severe but plausible exercise.
• Bring machine accounts into controls testing and entitlement reviews.
• Schedule internal audit review of the BCP and service provider policy compliance.

Standards and references

• APRA: Prudential Standard CPS 230 Operational Risk Management
• APRA: Operational Risk Management
• APRA: APRA Finalises Targeted Amendments to CPS 230
• APRA: APRA Finalises New Prudential Standard on Operational Risk
• APRA: Operational Risk Management Consultation
• APRA: Enforcement
• NIST: Cybersecurity Framework 2.0
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: APRA CPS 234 Guide · UK Financial Operational Resilience Guide · Third-Party Risk Management Guide · Business Continuity and Disaster Recovery Guide. This guide summarises APRA Prudential Standard CPS 230 as amended in April 2026 and is not legal advice.