Building something awesome.
★ TPRM Insights
7 min read · Regulatory Compliance · July 2026
APRA CPS 230 third-party risk management obligations became mandatory for all APRA-regulated banks, insurers, and superannuation trustees on 1 July 2025, and institutions are now well into a supervisory cycle where regulators are actively testing compliance rather than accepting policy documents at face value. The standard replaces a patchwork of outsourcing and business continuity guidance with a single operational resilience framework that treats a critical vendor's failure as the institution's own failure. For risk, compliance, and procurement leaders, CPS 230 is not a policy update — it is a structural change to how third parties are identified, classified, monitored, and exited.
★ Key Takeaways
APRA CPS 230, the Prudential Standard on Operational Risk Management, is the Australian Prudential Regulation Authority's binding standard that consolidates operational risk, business continuity management, and third-party risk into a single framework. It applies to every APRA-regulated entity — authorised deposit-taking institutions, general and life insurers, private health insurers, and superannuation trustees — and has been fully enforceable since 1 July 2025, after replacing CPS 231 (Outsourcing) and CPS 232 (Business Continuity Management).
The design choice that matters most for TPRM teams is that CPS 230 does not separate risk that originates inside the institution from risk that originates at a vendor. A critical third-party arrangement that fails must be brought back within the institution's pre-defined impact tolerance in the same way an internal system outage would be, or the institution is in breach of the standard. That single requirement is why third-party risk programmes have had to move out of annual questionnaires and static spreadsheets and into continuous, evidence-backed monitoring that can be produced on demand.
The standard also applies retrospectively: existing outsourcing arrangements signed before 1 July 2025 were required to be reassessed against CPS 230's criticality criteria during the transition period, and institutions that treated the deadline as a one-off compliance project rather than an operating model change are now the ones facing the most supervisory scrutiny.
CPS 230 requires every APRA-regulated entity to maintain a complete register of material service provider arrangements and to formally classify which of those arrangements support a critical operation. Critical third-party arrangements carry real regulatory weight: they trigger board-level visibility, deeper due diligence, and specific contractual controls that must be negotiated before the contract is signed, not retrofitted afterward.
Institutions must also build and test tripartite business continuity and exit plans for every critical arrangement — covering both a scenario where the vendor becomes temporarily unable to deliver and a scenario where the relationship must be exited entirely, including where a subcontractor or fourth party is the actual point of failure. APRA has been explicit that a vendor's ISO 27001 or SOC 2 certification is not an acceptable substitute for the institution's own continuity testing.
CPS 230 turns vendor due diligence from a point-in-time onboarding gate into a continuous obligation that persists for the life of the contract. Pre-contract due diligence now has to directly assess a vendor's own operational resilience — its business continuity capability, its subcontractor dependencies, and its ability to meet the institution's impact tolerances — rather than relying on financial health checks or security certifications alone.
This has real consequences for procurement timelines. Onboarding a critical vendor under CPS 230 typically takes longer because legal, risk, and technology teams all need to sign off on tripartite continuity arrangements before the contract is executed, and renewal cycles now carry the same scrutiny as new onboarding. It has also pushed institutions toward platforms that can score fourth-party concentration and subcontractor exposure automatically, because manually mapping a vendor's own vendor chain stops scaling past a handful of critical suppliers.
For smaller ADIs and mutual banks with limited in-house risk headcount, this shift has been the single biggest driver of TPRM technology investment in 2026, simply because continuous fourth-party mapping is not something a two-person risk team can maintain manually alongside everything else on their plate.
Non-compliance with CPS 230 exposes an APRA-regulated institution to formal supervisory action, ranging from directions to remediate identified gaps to increased capital or liquidity requirements, and in serious cases, restrictions on new business activity. APRA has signalled through its 2025–2026 supervisory cycle that it is actively reviewing registers of critical operations and testing whether institutions can produce live evidence of tripartite continuity testing, not just a policy document asserting the testing happened.
The practical risk sits alongside the regulatory one. An institution that cannot demonstrate it has stress-tested a critical vendor's failure mode is the same institution that will be caught flat-footed when that vendor actually fails. Supervisory letters issued so far have focused less on paperwork completeness and more on whether risk teams can walk a critical-arrangement failure scenario through to resolution end to end, on request and without weeks of preparation.
APRA's Prudential Practice Guide CPG 230 gives worked examples of what "sufficient evidence" looks like, and institutions that have mapped their own evidence trail against it before an actual review tend to fare far better than those treating the guide as optional reading.
CPS 230 has made continuous third-party oversight a regulatory floor, not a competitive advantage, for every APRA-regulated bank, insurer, and superannuation fund. Institutions still running vendor risk through annual questionnaires and static spreadsheets will struggle to produce the register, criticality classification, and continuity evidence APRA now expects on demand.
Crest was built for exactly this shift: a single platform that maintains your third-party register, flags critical arrangements automatically, and keeps continuous monitoring evidence audit-ready, so your team spends less time assembling proof for a supervisory review and more time managing the risk itself. If your TPRM programme can't answer "show me the evidence" in real time, it's worth seeing what a continuous, AI-powered approach looks like — schedule a demo with Crest.
★ Frequently Asked Questions
APRA CPS 230 is the Prudential Standard on Operational Risk Management issued by the Australian Prudential Regulation Authority. It requires APRA-regulated banks, insurers, and superannuation trustees to manage operational risk, business continuity, and third-party risk as a single integrated framework, and it has been in effect since 1 July 2025.
CPS 230 applies to all APRA-regulated entities, including authorised deposit-taking institutions (banks and credit unions), general and life insurers, private health insurers, and superannuation trustees. It does not apply directly to third-party vendors, but those vendors are subject to the contractual obligations the regulated entity must impose on them.
A critical third-party arrangement is a vendor relationship that supports a critical operation — a business function whose disruption beyond the institution's tolerance would threaten its ability to meet obligations to depositors, policyholders, members, or other stakeholders. Institutions must formally classify and register these arrangements, with board oversight.
CPS 231 (Outsourcing) treated vendor risk as a distinct, separate discipline from internal operational risk. CPS 230 replaces that separation by folding third-party risk, business continuity, and operational risk management into one prudential standard, meaning a critical vendor failure is now governed by the same tolerance limits as an internal system failure.
APRA expects institutions to test business continuity and exit plans for every critical third-party arrangement at least annually, and more frequently where the arrangement supports a high-impact critical operation. Testing must produce evidence xe2x80x94 such as test logs, remediation actions, and sign-off records xe2x80x94 that can be shown to APRA on request.
Non-compliant institutions can face APRA supervisory action ranging from formal directions to remediate gaps, additional capital or liquidity requirements, to restrictions on growth or new business activity in serious cases. APRA has indicated it will actively test compliance during its 2025xe2x80x932026 supervisory cycle rather than rely on self-attestation.
★ See Crest in Action
Intelligence over information. Control over chaos. Insight over effort.
Published by the Crest Editorial Team · crest.digital
Crest Perspective
Risk programmes that treat third-party governance as a compliance checkbox are consistently underprepared when a material vendor incident occurs. The programmes that withstand regulatory scrutiny are those where risk tiering is documented, escalation paths are tested before they are needed, and the board receives accurate, timely information about the organisation’s most critical vendor dependencies.
AI-powered TPRM, compliance automation and GRC intelligence for enterprise teams.
Request a Demo →Ready to get started?
Bring structure, automation, and continuous intelligence to your GRC Process — without adding headcount.
★ Schedule a Demo