APRA CPS 230: operational resilience, critical operations and the 24-hour, 72-hour and 20-day notices

Where it stands now. CPS 230 Operational Risk Management first took effect on 1 July 2025 for all APRA-regulated entities. Pre-existing contracts with service providers had to comply from the earlier of their next renewal or 1 July 2026. On 30 April 2026 APRA finalised targeted amendments, and the updated CPS 230 and its guidance, CPG 230, commenced on 1 July 2026. The main change is a limited exemption from some contract requirements for material arrangements with certain kinds of provider where contract compliance is not practicable.

The three things it asks for. An entity must manage its operational risks with controls that work, keep its critical operations within tolerance levels through severe disruptions, and manage the risks of using service providers. The board approves the business continuity plan (BCP), the tolerance levels and the service provider management policy, and reviews the results of BCP exercises and reporting on material providers. Senior management runs the day-to-day framework.

Critical operations. These are processes, run by the entity or a provider, whose disruption beyond tolerance would materially harm customers or the entity's role in the financial system. Unless an entity can justify otherwise it must treat these as critical: for banks (ADIs), payments, deposit-taking and management, custody, settlements and clearing; for insurers, claims processing; for super trustees, investment management and fund administration; and for everyone, customer enquiries and the systems and infrastructure that support critical operations. The entity keeps a register of them.

Tolerance levels. For each critical operation the entity sets three limits: the longest disruption it would tolerate, the most data it would accept losing, and the minimum service it would keep running on fallback arrangements. APRA can require an entity to change its limits, or set them itself where it sees heightened risk. Breaches of tolerance go to the board with a remediation plan.

The business continuity plan. The BCP must hold the register of critical operations and tolerances, the triggers that activate it, the actions that keep each operation within tolerance, the dependencies and resources those actions need, and a communications plan, including disaster recovery for critical information assets. The entity needs a systematic program of BCP exercises that covers every critical operation, includes an annual business continuity exercise, and uses a range of severe but plausible scenarios, including the failure of a material service provider. Internal audit periodically tells the board whether the plan is credible.

Material service providers. These are providers the entity relies on to run a critical operation, or that expose it to material operational risk; related parties count. At a minimum, unless justified otherwise, that includes credit assessment, funding and liquidity management and mortgage broking for banks; underwriting, claims management, insurance broking and reinsurance for insurers; fund administration, custody and investment management for super trustees; and, for everyone, risk management, core technology services and internal audit. The entity must keep a register of them and send it to APRA every year, using APRA's register template. It must also manage the risk from fourth parties that a material provider relies on to deliver a critical operation.

The three notices. First, an operational risk incident likely to have a material financial impact, or a material impact on the ability to keep critical operations running: tell APRA as soon as possible and no later than 72 hours after becoming aware. Second, a disruption that takes a critical operation outside tolerance: no later than 24 hours, covering what happened, what has been done, the likely impact and when normal service should return. Third, a new or materially changed agreement for a service the entity relies on to run a critical operation: as soon as possible and no more than 20 business days after, with notice before any material offshoring arrangement or significant offshore change. APRA has online forms for each.

How it fits with CPS 234 and other duties. An information security incident already notified under CPS 234 does not have to be notified again under CPS 230. But a cyber incident that also pushes a critical operation outside tolerance still needs the separate 24-hour disruption notice. The same event may also trigger the Privacy Act's notifiable data breach scheme, a SOCI Act incident report if the entity runs a critical infrastructure asset, and a ransomware payment report, each with its own clock and recipient.

What to do. Map each critical operation to the systems, people, data and providers it needs, and write all three tolerance limits down in numbers. Run your ransomware and cloud-outage tabletop exercises against those limits, not just against recovery time objectives. Add a CPS 230 branch to the incident playbook: one question about material impact (72 hours) and one about tolerance (24 hours), with the time of awareness recorded. Treat supplier contract changes as reportable events, and keep the register of material service providers up to date between annual submissions.