APRA to consult on targeted changes to CPS 230 for non-traditional service providers

The Australian Prudential Regulation Authority (APRA) will consult on targeted amendments to CPS 230 Operational Risk Management (CPS 230) by the end of 2025. This follows industry feedback highlighting challenges when applying the new standard’s contractual obligations to arrangements with non-traditional service providers (NTSPs).

NTSPs are providers that are typically market-mandated, such as stock exchanges, payment schemes or clearing and settlement facilities. Arrangements with these providers often lack formal contracts or rely on standardised, non-negotiable terms.

APRA recognises initial difficulties faced by regulated entities in implementing the new standard and appreciates the industry’s effort to identify pragmatic solutions.

The proposed amendments will clarify APRA’s expectations for arrangements with NTSPs, particularly around contract uplift and service level monitoring. The changes aim to streamline processes for regulated entities and alleviate regulatory burden, while ensuring a practical prudential framework that enhances resilience across the financial system. All other risk obligations under CPS 230 will remain unchanged.

APRA will run an accelerated policy process, including a one-month consultation period, to finalise the targeted changes before 1 July 2026, ensuring a smooth transition and regulatory balance.