APRA's CPS 230 addresses operational risk and continuity across critical operations and service arrangements. Regulated institutions must connect governance, disruption tolerances, continuity planning and provider controls, with notification of material incidents and disruptions.
TL;DR:
- Institutions must keep critical operations running through severe disruption.
- Boards approve continuity plans and tolerances; management tests controls and dependencies.
- Outsourcing retains prudential responsibility and can trigger APRA incident notification.
Summary
Resilience across critical operations
CPS 230 applies to APRA-regulated entities and requires an approach proportionate to their size, business mix and complexity. Its central aim is to keep critical operations within defined tolerance levels through severe disruptions. For an authorised deposit-taking institution, payments, deposit-taking, custody, settlements and clearing are normally classified as critical unless the entity can justify otherwise. The focus is the end-to-end operation and customer impact, rather than the availability of a single technical component.
Governance and measurable tolerances
Boards oversee operational risk and approve the business-continuity plan and tolerances for critical operations. Tolerances cover the maximum disruption period, acceptable data loss and minimum service under alternative arrangements. Management must identify the people, technology, information, facilities and service providers needed to deliver those operations and understand their interdependencies. This links resilience decisions with business processes and obligations, instead of leaving continuity as a stand-alone recovery document.
Testing, incidents and remediation
The standard requires controls to be monitored, reviewed and tested, with weaknesses remediated and retained in the risk profile until resolved. Business-continuity testing covers critical operations and severe but plausible scenarios, including service-provider disruption. Incidents and near misses must be identified, escalated and addressed. APRA notification requirements depend on the type and materiality of the event, including disruptions outside tolerance, so they should not be collapsed into one universal incident deadline.
Service providers remain part of the responsibility
CPS 230 requires a service-provider management policy, formal arrangements and monitoring for material providers. An entity must not rely on a provider unless it can still meet its prudential obligations and manage the risks. The current APRA publication is the standard in force from 1 July 2026. For a bank’s payment chain, outsourcing a processor or infrastructure service therefore changes the dependency map but does not remove the regulated entity’s accountability for keeping its critical operations resilient.
Keywords
- CPS 230
- APRA
- operational risk
- critical operations
- disruption tolerances
- business continuity
- supplier dependencies
- board oversight
- incident notification
- outsourcing controls