On 30 April 2026, the Australian Prudential Regulation Authority (APRA) finalised targeted amendments to prudential standard CPS 230 Operational Risk Management, prudential practice guide CPG 230, and the corresponding Material Service Provider (MSP) Register template.

Summary

The amendments follow an earlier consultation that APRA conducted in light of industry feedback which highlighted certain challenges when applying the standard’s contractual obligations to arrangements with non-traditional service providers. The amendments, which come into effect on 1 July 2026, provide for limited exemptions from specific contractual requirements for material arrangements with certain categories of non-traditional service providers (NTSPs), like central banks and clearing and settlement facilities, where contractual compliance is not practicable. Categories of exempt service providers can be found in the attachment to CPS 230 and include Government agencies, Regulators, Central banks and Financial market exchanges. Updates to CPG 230 clarify APRA’s expectations for managing material arrangements with exempt service providers. An updated MSP Register template includes updated instructions and now accommodates arrangements with exempt service providers. APRA will issue an updated APRA Connect return for the 2026 submission in the coming weeks. 

Changes to APRA’s proposals

In light of the feedback to its consultation when finalising its amendments APRA made the following changes:

  • Exemption mechanism – APRA created a list of exempt service provider types in an attachment to CPS 230. APRA agrees that exemption by service provider type is more efficient and easier to manage over time. APRA will be able to adjust the list of exempt service providers over time and may provide additional exemptions on a case-by-case basis by written notice.
  • Categories of exempt providers – APRA has made minor adjustments to the illustrative list it consulted on. The final list is set out in an attachment to CPS 230. APRA has refined how exempt categories are defined but has not materially changed the scope.
  • Scope of exemption – CPS 230 requires regulated entities to manage their operational risks. APRA recognises risk management may look different for arrangements with exempt service providers given information asymmetry, market dynamics and structure. Updates to CPG 230 recognise that, for example, due diligence and selection processes may look different for an exempt service provider compared to other material service providers.
  • Standardised contract definition – APRA has clarified the standard to better reflect the intent of the exemption, which is to accommodate arrangements where there is an inability to negotiate.
  • Material service provider register – APRA has made a very minor change to the material service provider register template so that entities can classify arrangements as exempt.
  • Notifications – APRA has amended Table 1 of CPG 230 to replicate the requirements of paragraph 59(a) (paragraph 60(a) in the updated standard) of CPS 230. The language is now fully aligned.

Timing

As mentioned above the amendments come into effect on 1 July 2026.