APRA's CPS 230 Is Now Fully in Force. Operational Resilience Is No Longer Optional.

APRA’s Prudential Standard CPS 230 on operational risk management now applies in full to every regulated bank, insurer and superannuation fund in Australia, and the grace period is over. Since 1 July 2026, all its requirements apply across the industry, including those that were subject to transitional arrangements for smaller institutions (APRA). For technology and risk leaders in financial services, operational resilience has moved from a stated aspiration to a standard they must be able to prove they meet.

What CPS 230 actually demands

CPS 230 is built around a straightforward but demanding proposition: a regulated firm must be able to keep delivering its critical operations through severe disruptions, and must be able to show it. That breaks into a few core obligations.

Identify critical operations and set tolerances. Firms must know which of their operations are critical, meaning their failure would materially harm customers or the firm’s viability, and define the tolerance levels for how much disruption to those operations is acceptable. This forces a level of clarity that many organisations have never actually committed to on paper.

Maintain a credible business continuity capability. It is not enough to have a business continuity plan in a drawer. Firms must be able to continue delivering critical operations within their tolerance levels through severe but plausible disruptions, which implies testing and evidence, not just documentation.

Manage material service providers. Firms must identify the service providers their critical operations depend on, manage the risks those relationships create, and maintain appropriate contractual and oversight arrangements. Contracts with material service providers were expected to be updated by the earlier of their next renewal or 1 July 2026.

The service provider problem is the hard one

Of these, third party risk is where most firms find the standard bites hardest, and it echoes a theme that runs across enterprise risk generally: you are exposed through the providers you depend on, and increasingly through the providers they depend on.

CPS 230 pushes firms to understand not just their direct material service providers but the concentration and dependency risks beneath them. If several of your critical operations ultimately rely on the same underlying cloud platform or payments provider, that concentration is a resilience risk whether or not it appears on any single contract. Fourth-party dependency, the providers your providers rely on, is precisely the visibility most firms lack, and it is exactly what a serious operational resilience regime requires them to grapple with.

The standard is really asking a simple question that is surprisingly hard to answer: if a critical supplier failed tomorrow, could you keep serving customers within the tolerances you have set? Most firms cannot yet prove the answer is yes.

Why evidence is the real challenge

The gap for most firms is not intent. It is evidence. It is one thing to assert that critical operations are resilient and service providers are managed. It is another to demonstrate it continuously, to a regulator, with current testing, mapped dependencies and live oversight.

This is the same shift visible across resilience regulation worldwide: from having a policy to proving, on an ongoing basis, that controls actually work. A business continuity plan that has never been tested against a realistic scenario, a service provider register that is a year out of date, or tolerances that exist on paper but have never been validated will not satisfy the standard, and more importantly will not protect the firm when something actually breaks.

What financial services leaders should do

For firms that have reached the deadline without full confidence, the priorities are clear.

1. Confirm your critical operations and tolerances are real, agreed at the right level, and genuinely reflect what would harm customers or the firm.
2. Test business continuity against severe but plausible scenarios, and keep the evidence, rather than relying on untested plans.
3. Map material service providers and their dependencies, including the fourth-party concentration risks that sit beneath your direct contracts.
4. Make oversight continuous. Service provider risk and resilience should be monitored and reported as business as usual, not reviewed once a year.
5. Close the evidence gap. Build the ability to demonstrate compliance on demand, because under CPS 230 the ability to show resilience is part of the obligation.

Firms that treat this as an ongoing operational discipline, rather than a one off compliance project completed at the deadline, will be the ones that both satisfy APRA and actually withstand disruption.

Where Jaykan fits

Jaykan helps financial services organisations meet operational resilience obligations like CPS 230 in substance, not just on paper, combining third and fourth-party risk visibility, business continuity and resilience testing with the IT consulting and assurance needed to evidence it continuously. We help firms move from documented intentions to demonstrable resilience.

If you are not fully confident you could prove CPS 230 compliance today, a complimentary, senior led assessment will benchmark your operational resilience and service provider oversight and give you a prioritised plan to close the gaps.

Frequently asked questions

What is APRA CPS 230?

CPS 230 is the Australian Prudential Regulation Authority's Prudential Standard for Operational Risk Management. It requires APRA-regulated entities, including banks, insurers and superannuation funds, to manage operational risk, maintain critical operations through disruptions, and manage the risks from their material service providers. The standard is now in force in full.

Who does CPS 230 apply to?

It applies to APRA-regulated entities across banking, insurance and superannuation. Since 1 July 2026, all its requirements apply across the industry, including those that were previously subject to transitional arrangements for smaller institutions. It also reaches indirectly to the service providers those entities depend on.

What does CPS 230 require around service providers?

Firms must identify their material service providers, manage the risks those providers pose to critical operations, and maintain appropriate contractual and oversight arrangements. This increasingly includes understanding fourth-party dependencies, the providers your providers rely on, which many firms have limited visibility of.

What is the hardest part of CPS 230 compliance?

For most firms it is producing evidence, being able to demonstrate on an ongoing basis that critical operations can be maintained within defined tolerances and that service provider risks are actively managed, rather than relying on documents that describe intentions but are not tested or current.