Banking, Insurance and Life Insurance (prudential standards) determination No. 1 of 2011 - Prudential Standard CPS 231 - Outsourcing

Administered by Department of the Treasury

Legislation au F2011L01920 Not in force Legislative Instrument

Legislation content

Banking, Insurance and Life Insurance (prudential standards) determination No. 1 of 2011

EXPLANATORY STATEMENT

Prepared by the Australian Prudential Regulation Authority

Banking Act 1959, section 11AF

Insurance Act 1973, section 32

Life Insurance Act 1995, section 230A

APRA may, in writing, revoke a prudential standard that applies to an APRA-regulated institution under:

  • subsection 11AF(3) of the Banking Act 1959 (Banking Act), in relation to authorised deposit-taking institutions (ADIs) and authorised non-operating holding companies (authorised banking NOHCs);
  • subsection 32(4) of the Insurance Act 1973 (Insurance Act), in relation to general insurers and authorised non-operating holding companies (authorised insurance NOHCs); and
  • subsection 230A(5) of the Life Insurance Act 1995 (Life Insurance Act), in relation to life companies (including friendly societies) and registered non-operating holding companies (registered life NOHCs).

APRA may, in writing, determine a prudential standard that applies to an APRA-regulated institution under:

  • subsection 11AF(1) of the Banking Act, in relation to ADIs and authorised banking NOHCs;
  • subsection 32(1) of the Insurance Act, in relation to general insurers and authorised insurance NOHCs; and
  • subsection 230A(1) of the Life Insurance Act, in relation to life companies (including friendly societies) and registered life NOHCs.  
  1.    Background

APRA has powers under the Banking Act, Insurance Act and Life Insurance Act to determine prudential standards that apply to ADIs and authorised banking NOHCs, general insurers and authorised insurance NOHCs, and life companies and registered life NOHCs.

APRA's policy is to issue prudential standards that apply across the banking, general insurance and life insurance industries that are broadly consistent in their requirements. Specifically, APRA considers that the risks arising from outsourcing, the management of business continuity, governance and the fitness and propriety of responsible persons are similar regardless of the industry within which the regulated institution operates.

To date, APRA has issued three individual prudential standards covering outsourcing requirements in relation to each APRA-regulated industry. The content of these standards is nearly identical and requires outsourcing arrangements involving material business activities entered into by a regulated institution to be subject to appropriate due diligence, approval and ongoing monitoring. The prudential standards are as follows:

  • Prudential Standard APS 231 Outsourcing (APS 231) applying to ADIs;
  • Prudential Standard GPS 231 Outsourcing (GPS 231) applying to general insurers; and
  • Prudential Standard LPS 231 Outsourcing (LPS 231) applying to life companies.

In line with its publicly stated desire to supervise regulated institutions operating in different industries in a consistent manner, APRA is consolidating the requirements contained in these three industry-specific prudential standards into a single prudential standard with cross-industry application. The requirements currently contained in APS 231, GPS 231 and LPS 231 are consolidated into a new prudential standard, Prudential Standard CPS 231 Outsourcing (CPS 231).

2.      Purpose of the instrument

This instrument revokes APS 231, GPS 231 and LPS 231 and replaces them with a new prudential standard, CPS 231. CPS 231 must be complied with by ADIs and authorised banking NOHCs, general insurers and authorised insurance NOHCs, and life companies (including friendly societies) and registered life NOHCs.

CPS 231 aims to ensure that all outsourcing arrangements involving material business activities entered into by a regulated institution are subject to appropriate due diligence, approval and ongoing monitoring. All risks arising from outsourcing material business activities must be appropriately managed to ensure that the regulated institution is able to meet its financial and service obligations to its depositors and/or policyholders.

3.      Operation of the instrument

The key differences between CPS 231 and the industry-specific prudential standards it replaces include that CPS 231:

  • applies to all APRA-regulated institutions in the banking, general insurance and life insurance industries, rather than operating via separate, although nearly identical, standards applying to different regulated institutions in individual industries;
  • contains requirements for Level 2 insurance groups to comply with certain outsourcing requirements that were previously contained in  Prudential Standard GPS 221 Risk Management: Level 2 Insurance Groups;
  • requires the Board of the Head of a Level 2 banking group to develop an outsourcing policy that covers a group approach to outsourcing material business activities;
  • extends application of the standard to include registered life NOHCs;
  • clarifies application of the standard to foreign branches;
  • clarifies the role and obligations of the Board (or equivalent) in complying with the standard; and
  • contains a number of minor amendments to clarify or harmonise the existing obligations. These minor amendments do not alter the substance of these obligations.

4.      Consultation

In December 2010, APRA publicly consulted on CPS 231 as part of a broader consultation package on its initiative to harmonise certain prudential standards across regulated industries. APRA received a small number of submissions that were generally supportive of the approach and has implemented specific feedback received, where appropriate, in CPS 231.

5.      Regulation Impact Statement

A Regulation Impact Statement for the changes described in this Explanatory Statement was not required. 

 

Overview

The Banking, Insurance and Life Insurance (Prudential Standards) Determination No. 1 of 2011 was enacted to streamline the regulatory requirements for outsourcing in the banking, insurance, and life insurance industries, thereby addressing the fragmented and repetitive nature of the existing standards. This instrument, developed by the Australian Prudential Regulation Authority (APRA), revokes the previous industry-specific prudential standards for outsourcing and replaces them with a unified standard, Prudential Standard CPS 231 Outsourcing (CPS 231). This consolidation aims to ensure consistent regulatory oversight across different sectors, thereby mitigating risks associated with outsourcing material business activities. The policy objective is to harmonise the requirements across the regulated industries, ensuring that all institutions are subject to the same stringent standards for due diligence, approval, and ongoing monitoring of outsourcing arrangements.

Scope and Application

The Banking, Insurance and Life Insurance (Prudential Standards) Determination No. 1 of 2011 consolidates the outsourcing requirements for APRA-regulated institutions across the banking, general insurance, and life insurance industries into a single prudential standard, Prudential Standard CPS 231 Outsourcing. This determination applies to authorised deposit-taking institutions and authorised non-operating holding companies under the Banking Act 1959, general insurers and authorised non-operating holding companies under the Insurance Act 1973, and life companies (including friendly societies) and registered non-operating holding companies under the Life Insurance Act 1995. The aim of this consolidation is to ensure a consistent approach to the management of outsourcing risks across different industries, requiring all APRA-regulated institutions to subject their outsourcing arrangements involving material business activities to appropriate due diligence, approval, and ongoing monitoring. The standard also includes requirements for Level 2 insurance groups and clarifies the roles and obligations of Boards in complying with the standard. APRA consulted on the proposed standard in December 2010, and minor amendments were incorporated based on feedback received.

Key Provisions

The main operative sections of the Banking, Insurance and Life Insurance (prudential standards) determination No. 1 of 2011 (the "Determination") establish the scope and application of the new Prudential Standard CPS 231 Outsourcing (CPS 231), which replaces the previous industry-specific prudential standards APS 231, GPS 231 and LPS 231. The Determination revokes the previous standards and mandates that CPS 231 must be complied with by authorised deposit-taking institutions (ADIs), authorised non-operating holding companies (authorised banking NOHCs), general insurers, authorised insurance NOHCs, life companies (including friendly societies) and registered life NOHCs (sections 1-2). CPS 231 aims to ensure that all outsourcing arrangements involving material business activities entered into by a regulated institution are subject to appropriate due diligence, approval and ongoing monitoring (section 3). The Determination also clarifies the application of the standard to foreign branches and the role and obligations of the Board (or equivalent) in complying with the standard (section 4). The Determination imposes obligations on the parties it governs to comply with the consolidated requirements of CPS 231. This includes conducting appropriate due diligence, obtaining approval and engaging in ongoing monitoring of outsourcing arrangements involving material business activities (section 3). The Board of the Head of a Level 2 banking group is required to develop an outsourcing policy that covers a group approach to outsourcing material business activities (section 4). Additionally, Level 2 insurance groups must comply with certain outsourcing requirements previously contained in Prudential Standard GPS 221 Risk Management: Level 2 Insurance Groups (section 4). The Determination also extends the application of the standard to include registered life NOHCs (section 4). The Determination outlines the potential civil and criminal consequences for breach of the prudential standards. While the Determination itself does not specify maximum penalties, breaches of the Banking Act 1959, Insurance Act 1973 and Life Insurance Act 1995, under which APRA exercises its powers, can result in significant penalties. For example, under section 911A of the Corporations Act 2001, a person who contravenes a prudential standard may be subject to a civil penalty of up to $210,000 for a corporation and up to $42,000 for an individual. Additionally, under section 137 of the Criminal Code Act 1995, a person who engages in conduct that constitutes a breach of a prudential standard may be subject to criminal penalties, including fines and imprisonment.

Legal classification tags

Area of Law
Banking & Finance Law
Insurance Law
Instrument
Regulation
Concepts
Repeal & Amendment
Regulatory Standards
Enforcement Powers
Licensing & Registration

Interactions

Authorises

All Versions

Sourced from the Federal Register of Legislation at 26 August 2026. For the latest information on Australian Government law please go to https://www.legislation.gov.au.