Home / Rules / APRA CPS 230 Operational Risk Management
APRA CPS 230 Operational Risk Management: the rules AI agent steps rest on
- Edition
- CPS 230, July 2026 issue (commenced 1 July 2026; supersedes the July 2023 issue)
- Checked current
- 2026-10-07
- Official source
- https://handbook.apra.gov.au/standard/cps-230
| Rule | Our statement | Steps that cite it |
|---|---|---|
| APRA CPS 230 para 32 (operational risk incident notification) | Clock: as soon as possible, and at the latest 72 hours from the time the entity becomes aware. Trigger: an operational risk incident the entity has determined is likely to cause a material financial impact, or to materially affect its ability to keep its critical operations running. An information security incident already notified to APRA under CPS 234 need not be notified again under this paragraph. | KC-05 S2 CPS 230 para 32: a second incident notification? |
| APRA CPS 230 para 41 (disruption beyond tolerance, 24 hours) | Clock: as soon as possible and no later than 24 hours after a critical operation is disrupted beyond its tolerance. The notification to APRA must describe the nature of the disruption, what action has been taken, the likely effect on business operations and the expected timeframe for getting back to normal operations. | KC-05 S3 CPS 230 para 41: disruption beyond tolerance; KC-05 S5 Who lodges with APRA? |
| APRA CPS 230 para 48 (register of material service providers) | The entity must identify its material service providers, keep a register of them and manage the material risks of using them. A material service provider (or material arrangement) is one the entity relies on to carry out a critical operation or one that exposes it to material operational risk; it may be an unrelated third party, a related party or a connected entity, and materiality may come from one arrangement or several taken together. | KC-07 S1 Is it a material arrangement? |
| APRA CPS 230 para 49 (services treated as material) | Unless it can justify otherwise, the entity must at least treat providers of these services as material: for an ADI, mortgage brokerage, credit assessment, and funding and liquidity management; for an insurer, insurance brokerage, reinsurance, underwriting and claims management; for an RSE licensee, custodial services, fund administration, investment management, and arrangements with financial planners and promoters; and for all entities, internal audit, risk management and core technology services. | KC-07 S1 Is it a material arrangement? |
| APRA CPS 230 para 52 (due diligence before a material arrangement) | Before it enters into, or materially modifies, a material arrangement the entity must (a) carry out suitable due diligence, including a suitable selection process and a check of whether the provider can keep delivering the service over time; and (b) evaluate the financial and non-financial risks of relying on the provider, including risks from geographic location or from concentration in the provider or in parties the provider relies on. This due diligence still applies where para 57 or 58 exempts an arrangement from paras 53 and 54, limb (d) of para 55 and limbs (a) and (c) of para 59. | KC-07 S7 Approval |
| APRA CPS 230 para 53 (formal agreement contents) | For every material arrangement the entity must hold a formal, legally binding agreement that at least: (a) defines the services and their service levels; (b) sets each party's rights, duties and expectations, including asset ownership, data ownership and control, dispute resolution, audit access, indemnity and liability; (c) lets the entity satisfy its legal and compliance obligations; (d) obliges the provider to notify the entity when it materially relies on other material service providers through subcontracting or similar to deliver the service; (e) makes the provider responsible for any subcontractor's failure; (f) contains a force majeure clause stating which parts survive a force majeure event; and (g) gives termination rights over the whole arrangement or parts of it, and for an RSE licensee a right to terminate where continuing would breach the best financial interests duty (SIS Act s 52(2)(c)). Para 57 can exempt the arrangement (Attachment category provider on standardised terms or no formal agreement), and APRA can exempt it in writing under para 58. | KC-07 S3 Which clauses are missing? |
| APRA CPS 230 para 54 (APRA access clauses) | The formal agreement must also provide that (a) APRA can access documentation, data and other information about the service; (b) APRA may visit the provider on site; and (c) the provider undertakes not to obstruct APRA in performing its prudential regulator duties. Para 57 can exempt the arrangement (Attachment category provider on standardised terms or no formal agreement), and APRA can exempt it in writing under para 58. | KC-07 S3 Which clauses are missing? |
| APRA CPS 230 para 57 (Attachment category exemption) | New in the July 2026 issue. For a material arrangement, the entity is relieved of paras 53 and 54, limb (d) of para 55 and limbs (a) and (c) of para 59 where both conditions hold: (a) the provider falls within a category in the Attachment; and (b) the arrangement is on standardised terms (terms drawn up by the provider that the entity has no or almost no power to negotiate or change on matters this standard covers) or is not recorded in a formal agreement. Attachment categories, in summary: government agencies (public bodies administering legislation or delivering public functions, but not government business enterprises); regulators (statutory bodies supervising or enforcing compliance in the financial system); central banks; financial market exchanges (licensed market operators under Corporations Act Part 7.2 and equivalently regulated overseas exchanges); operators of clearing and settlement facilities (licensed under Part 7.3 or equivalent overseas, including superannuation clearing houses on the ATO SuperStream Product register); operators of formally recognised payment systems and schemes under an established oversight framework; and financial messaging infrastructures (including SuperStream gateway operators that have signed an application under the Gateway Network Governance Body MoU). Every other requirement keeps applying, including para 52 due diligence, para 55(a) to (c) and para 59(b). Under para 58 APRA can also, by written notice, exempt an arrangement that fails condition (a) or (b) from the same paragraphs. | KC-07 S2 Does the para 57 exemption apply? |
| APRA CPS 230 para 59 (monitoring material arrangements) | The entity must monitor its material arrangements and make sure senior management gets reporting on them proportionate to the nature and use of the service. Monitoring must include regular assessment of (a) performance against agreed service levels; (b) how effective the controls over the provider risks are; and (c) whether both parties comply with the agreement. For limbs (a) and (c) only: Para 57 can exempt the arrangement (Attachment category provider on standardised terms or no formal agreement), and APRA can exempt it in writing under para 58. | KC-05 S6 The provider afterwards |
| APRA CPS 230 para 60 (notify APRA: critical operations and offshoring) | Clocks: (a) as soon as possible and within 20 business days of signing, or materially changing, an agreement for a service the entity relies on to carry out a critical operation; and (b) before entering into any material offshoring arrangement, or when a significant change to such an arrangement is proposed, including where personnel or data used for the service will sit offshore. A material offshoring arrangement is a material arrangement whose service is performed outside Australia, even if the provider is Australian-incorporated; a foreign-incorporated provider performing the service in Australia is not offshoring. | KC-07 S4 Offshoring: what does APRA need, and when? |
| APRA CPS 230 para 61 (internal audit review of proposed arrangements) | Internal audit must review any proposed material arrangement that would outsource a critical operation, and must give regular reports to the Board (or its audit committee) on whether such arrangements comply with the service provider management policy. | KC-07 S6 Internal audit |