APRA CPS 230 Operational Risk Management sets requirements for operational risk, for keeping critical operations going through a disruption, and for service providers. The service provider requirements cover third parties, material arrangements, and audit access. An AI vendor comes under those requirements when an APRA-regulated entity relies on it for a critical operation, or when the arrangement exposes the entity to material operational risk.
In Australia, Prudential Standard CPS 230 Operational Risk Management applies to authorised deposit-taking institutions, general insurers, life companies (including friendly societies and eligible foreign life insurance companies), private health insurers, and superannuation trustees (RSE licensees). It also applies to the non-operating holding companies and Level 2 insurance group parent entities named in the standard. For a foreign ADI, a Category C insurer, or an eligible foreign life insurance company, the obligations apply to the Australian branch operations.
CPS 230 first commenced on 1 July 2025. The version in force on 1 July 2025 was superseded on 30 June 2026. For a service provider contract already in place, it applied the requirements from the earlier of the contract's next renewal date or 1 July 2026. The current standard commenced on 1 July 2026.
This article summarises APRA's published standard. Check your obligations with your compliance or legal team.
What CPS 230 requires
CPS 230 does not mention AI. An APRA-regulated entity must identify, assess and manage its operational risks, with effective internal controls, monitoring and remediation. It must be able to keep delivering its critical operations within tolerance levels through severe disruptions, and it needs a credible business continuity plan to do that. It must manage the risks associated with service providers, with a service provider management policy, formal agreements, and monitoring.
The entity must not rely on a service provider unless it can still meet its prudential obligations in full and manage the risks that come with the provider.
Operational risk is inherent in all products, activities, processes and systems. The risks an entity must manage include legal risk, regulatory risk, compliance risk, conduct risk, technology risk, data risk, and change management risk. An AI system the entity uses in a product, activity, process, or system is part of that operational risk. As part of business and strategic planning, the entity must assess how its decisions affect its operational risk profile, including the impact of new products, services, geographies and technologies. Introducing an AI system is covered by that assessment.
The entity must maintain information and IT capability for its current and projected business requirements, and to support its critical operations and risk management. In managing technology risk, it must monitor the age and health of its information assets and meet Prudential Standard CPS 234 Information Security.
The Board is ultimately accountable for oversight of operational risk management. That accountability includes business continuity and the management of service provider arrangements. The Board approves the service provider management policy and reviews risk and performance reporting on material service providers. When the Board is making a decision that could affect the resilience of critical operations, senior management must give the Board clear information on the expected impact.
Critical operations
Critical operations are processes undertaken by the entity or its service provider which, if disrupted beyond tolerance levels, would have a material adverse impact on its depositors, policyholders, beneficiaries or other customers, or its role in the financial system.
Unless it can justify otherwise, the entity must classify at least these business operations as critical operations:
- for an ADI: payments, deposit-taking and management, custody, settlements and clearing
- for a general, life, or private health insurer: claims processing
- for an RSE licensee: investment management and fund administration
- for every APRA-regulated entity: customer enquiries, and the systems and infrastructure needed to support critical operations
APRA may require an entity, or a class of entities, to classify another business operation as a critical operation.
For each critical operation, the entity sets tolerance levels for the maximum period of time it would tolerate a disruption, the maximum extent of data loss it would accept from a disruption, and the minimum service levels it would maintain while operating under alternative arrangements during a disruption. The business continuity plan must set out how the entity would keep its critical operations within those tolerance levels through disruptions, including disaster recovery planning for critical information assets. Testing has to cover all critical operations and include an annual business continuity exercise. The scenarios include disruptions to services provided by material service providers, and scenarios where contingency arrangements are required.
The entity must identify and document the processes and resources needed to deliver critical operations. That record includes people, technology, information, facilities and service providers, the interdependencies across them, and the associated risks, obligations, key data and controls. An AI system used to deliver a critical operation belongs in that record. So does a vendor the entity relies on for the operation.
Material service providers and audit access
A material service provider is a provider the entity relies on to undertake a critical operation, or a provider that exposes the entity to material operational risk. A material arrangement is an arrangement the entity relies on to undertake a critical operation, or one that exposes the entity to material operational risk. The provider may be a third party, a related party, or a connected entity.
Unless the entity can justify otherwise, it must classify a provider of these services as a material service provider:
- for an ADI: credit assessment, funding and liquidity management, and mortgage brokerage
- for a general, life, or private health insurer: underwriting, claims management, insurance brokerage, and reinsurance
- for an RSE licensee: fund administration, custodial services, investment management, and arrangements with promoters and financial planners
- for every APRA-regulated entity: risk management, core technology services, and internal audit
An AI vendor is a material service provider when the entity relies on it to undertake a critical operation, or when the vendor exposes the entity to material operational risk. A provider of core technology services is on the minimum list for every APRA-regulated entity, unless the entity can justify leaving that provider off the list.
The entity keeps a register of its material service providers and submits the register to APRA once a year. APRA may require an entity to classify a particular provider, type of provider, or arrangement as material.
A fourth party is a party that a service provider relies on in delivering services to the entity. The service provider management policy has to cover how the entity will identify material service providers and manage the arrangements, including the material risks. The policy includes the approach to entering into, monitoring, substituting and exiting agreements with material service providers, the approach to the risks of those providers, and the approach to fourth parties that material service providers rely on to deliver a critical operation. Where an AI vendor uses another firm's model, or another host, to deliver a critical operation, that other firm is a fourth party.
Before entering into a material arrangement, or materially modifying one, the entity must do appropriate due diligence. The due diligence includes a selection process and an assessment of whether the provider can provide the service on an ongoing basis. The entity must also assess the financial and non-financial risks of relying on the provider, including risks from geographic location or from concentration of the provider or of the parties the provider relies on.
For every material arrangement, the entity must have a formal legally binding agreement. At a minimum, the agreement must:
- specify the services covered and the associated service levels
- set out the rights, responsibilities and expectations of each party, including ownership of assets, ownership and control of data, dispute resolution, audit access, liability and indemnity
- include provisions so the entity can meet its legal and compliance obligations
- require the provider to notify the entity of its use of other material service providers that it materially relies on, through subcontracting or other arrangements
- require the provider to be liable for any failure by a subcontractor
- include a force majeure provision indicating which parts of the contract would continue in a force majeure event
- include termination provisions, including the right to terminate the whole arrangement or parts of it. For an RSE licensee, the termination provisions must allow termination where continuing the arrangement would be inconsistent with the duty to act in the best financial interests of beneficiaries
The agreement must also allow APRA access to documentation, data and any other information related to the service, allow APRA to conduct an on-site visit to the service provider, and record that the provider will not impede APRA in its work as prudential regulator.
CPS 230 requires the agreement to deal with audit access. It does not define the scope or the frequency of that access. Separate from the contract clause, the entity's internal audit function must review any proposed material arrangement that involves outsourcing a critical operation. Internal audit must regularly report to the Board, or to the Board Audit Committee, on whether those arrangements comply with the service provider management policy.
For each material arrangement, the entity must identify and manage risks that could affect the provider's ability to keep providing the service, and risks to the entity from the arrangement, such as step-in risk or contagion risk. The entity must be able to execute its business continuity plan if needed, and to conduct an orderly exit from the arrangement if needed.
Paragraph 57 of the current standard exempts a material arrangement from the formal agreement requirements in paragraphs 53 and 54, from the orderly exit requirement in paragraph 55(d), and from the monitoring of service levels and of compliance with the agreement in paragraphs 59(a) and 59(c). The exemption applies only when the provider falls within a category in the Attachment to CPS 230, and the arrangement uses standardised terms or is not documented in a formal agreement. Standardised terms, for this paragraph, are terms prepared by the provider where the entity has no, or substantially no, ability to negotiate or amend the rights and obligations CPS 230 covers. The Attachment lists government agencies, regulators, central banks, financial market exchanges, operators of clearing and settlement facilities, operators of payment systems and schemes, and financial messaging infrastructures. APRA may grant a written exemption in other cases under paragraph 58. The rest of CPS 230 still applies. A software or AI vendor is not in that Attachment.
Notification and monitoring
The entity must notify APRA as soon as possible, and not more than 20 business days after it enters into or materially changes an agreement for a service it relies on to undertake a critical operation.
It must notify APRA before entering into any material offshoring arrangement, and when a significant change to the arrangement is proposed, including where data or personnel relevant to the service will be located offshore. A material offshoring arrangement is a material arrangement where the service is undertaken outside Australia. The service is still offshore when the provider is incorporated in Australia but the service is performed outside Australia. A service performed in Australia is not an offshoring arrangement only because the provider is incorporated overseas.
Senior management must receive reporting on material arrangements that matches the nature and use of the service. The monitoring includes a regular assessment of performance against the agreed service levels, the effectiveness of the controls used to manage the risks of using the provider, and whether both parties are complying with the agreement.
Operational risk incidents and near misses must be identified, escalated, recorded and addressed in a timely manner. The entity must notify APRA as soon as possible, and not later than 72 hours after becoming aware of an operational risk incident it determines to be likely to have a material financial impact, or a material impact on its ability to maintain its critical operations. If a critical operation is disrupted outside tolerance, the entity must notify APRA as soon as possible, and not later than 24 hours afterwards. That notice covers the nature of the disruption, the action taken, the likely impact on the entity's business operations, and the timeframe for returning to normal operations.
What a software supplier should have ready
CPS 230 applies to the APRA-regulated entity. Selling that entity an AI system does not make the supplier an APRA-regulated entity.
When the entity relies on the system for a critical operation, or the arrangement exposes the entity to material operational risk, it has to put the clauses above into a formal agreement, unless paragraph 57 or a written exemption under paragraph 58 applies. A supplier building that system into the entity's operations should be ready to provide:
- the services and the service levels
- who owns the assets, and who owns and controls the data
- dispute resolution, audit access, liability and indemnity
- which other providers the supplier materially relies on to deliver the service, with the supplier liable for a subcontractor's failure
- which parts of the contract continue in a force majeure event, and the entity's right to terminate all or part of the arrangement
- agreement that APRA can have documentation, data and other information about the service, can conduct an on-site visit, and will not be impeded
- where the service is performed, and where the data and the personnel relevant to the service are located, including any place outside Australia
- the dependencies the entity needs if it has to execute its business continuity plan without the supplier, and if it has to exit the arrangement in an orderly way
Before the contract is signed, or materially modified, the entity's due diligence has to test whether the supplier can keep providing the service, and the risks of geographic location and concentration.
Where the service handles personal information, the Privacy Act and the Australian Privacy Principles apply to that handling. That obligation is separate from CPS 230. The CPS 230 agreement still has to set out ownership and control of data, and include provisions so the entity can meet its legal and compliance obligations.
Who an agent can act for, a log of what it did, and the steps when something goes wrong are set out on AI Agent Governance & Security. Building the agent is AI agent development. Putting a model into a workflow the team already runs is AI enablement.
