CPS 230 is APRA’s new operational risk standard for banks, insurers and superannuation funds. It starts on 1 July 2025, with limited relief to 1 July 2026 for some non-SFIs on business continuity and scenario analysis. Financial institutions must now take a more proactive and structured approach to managing cybersecurity and operational risks.
For CIOs, CTOs, and Heads of Technology, this isn’t just another compliance box to tick. It’s a strategic opportunity to future-proof your organisation, protect customer trust, and align IT investments with long-term resilience. Here’s what actually changes, and how to get audit-ready on time. APRA+handbook
What Is CPS 230 (APRA’s operational risk standard)?
Its objective is to ensure APRA-regulated entities are resilient to operational risks and disruptions, whether from internal systems, people, processes, or external events.
Key Requirements:
- Risk Management: Identify, assess, and control operational risks with robust internal frameworks.
- Business Continuity: Maintain critical operations during disruptions with a credible Business Continuity Plan; implementing a cadence for testing it.
- Service Provider Oversight: Formal agreements and monitoring of third-party providers.
- Governance & Accountability: Boards must oversee operational risk, continuity, and outsourcing.
- Incident Management: Escalate and report significant incidents to APRA within 72 hours.
Key CPS 230 definitions
- Critical operations: Business services you must sustain during disruption.
- Tolerance levels: Maximum disruption your board deems acceptable.
- Material service provider: Third party whose failure would materially impact critical operations.
- Incident notification window: Notify APRA promptly; operationally plan for 72 hours.
- Renewal timing: Pre-existing third-party contracts → earlier of contract renewal or 1 July 2026.
Who Must Comply with CPS 230 in Australia?
CPS 230 applies to all APRA-regulated entities, including:
- Authorised Deposit-taking Institutions (ADIs) – banks, credit unions, building societies
- General Insurers, Insurance Holding Companies and Category C Insurers, and non-operating holding companies.
- Life Insurance Companies – including friendly societies and foreign life insurers
- Private Health Insurers
- Registrable Superannuation Entity (RSE) Licensees – superannuation funds and trustees
- Smaller entities (non-significant financial institutions or non-SFIs) have until 1 July 2026 to meet certain requirements like business continuity and scenario analysis.
See our CPS 230 operational risk requirements guidance
The Cost of CPS 230 Non-Compliance
Failure to meet CPS 230 requirements can result in:
- Revenue Loss: Disruptions to core operations can cost thousands or millions, depending on timing and severity.
- Reputational Damage: Downtime and data breaches erode customer trust and loyalty; and often attract unwanted news and media attention, amplifying the impact and long-term brand damage.
- Regulatory Penalties: APRA has signaled increased enforcement from 2025 onward.
- Operational Vulnerability: Without continuous monitoring, growing businesses may face new risks they’re unprepared for.
Learn more about cybersecurity for financial services
Cybersecurity & CPS 230: Where MSPs Make the Difference
Cybersecurity is a cornerstone of operational resilience. Managed Service Providers (MSPs) with financial sector expertise can help institutions meet CPS 230 requirements while strengthening their overall security posture.
Threat Monitoring
- 24/7 SOC, system and network monitoring
- Real-time threat detection and alerting
- Security Information and Event Management (SIEM)
Explore our managed cyber security approach
Incident Response
- Rapid containment and remediation in hours, not days for Priority 1 (P1/P1+) incidents, critical outages, breaches, or service failures that demand immediate action. P1+ events carry greater severity and potential regulatory impact.
- Forensic analysis and reporting
- Support for APRA breach notification requirements
Third-Party Risk Management
- Vendor risk assessments
- Contractual SLAs and compliance tracking
- Ongoing monitoring of outsourced service providers
Business Continuity and Disaster Recovery Planning
- Disaster recovery strategy and testing
- Best-in-class RPO and RTO, backup and restore capabilities
- Scenario analysis and continuity documentation
Further reading:
Business continuity planning roadmap
Is your financial services business CPS 230 ready?
Talk to our experts to book a Free Cyber Risk Assessment Report to uncover any gaps in governance, business continuity and third-party oversight.
