Banking, Insurance, Life Insurance, Health Insurance and Superannuation (prudential standard) determination No. 1 of 2026
EXPLANATORY STATEMENT
Prepared by the Australian Prudential Regulation Authority (APRA)
Banking Act 1959, section 11AF
Insurance Act 1973, section 32
Life Insurance Act 1995, section 230A
Private Health Insurance (Prudential Supervision) Act 2015, section 92
Superannuation Industry (Supervision) Act 1993, section 34C
Under subsection 11AF(1) of the Banking Act 1959 (Banking Act), subsection 32(1) of the Insurance Act 1973 (Insurance Act), subsection 230A(1) of the Life Insurance Act 1995 (Life Insurance Act), subsection 92(1) of the Private Health Insurance (Prudential Supervision) Act 2015 (PHIPS Act), and subsection 34C of the Superannuation Industry (Supervision) Act 1993 (SIS Act), APRA has the power to determine standards (prudential standards), in writing, in relation to prudential matters to be complied with by:
- all authorised deposit-taking institutions (ADIs) and authorised non-operating holding companies (authorised NOHCs) and subsidiaries of ADIs and authorised banking NOHCs;
- all general insurers and authorised insurance NOHCs, and subsidiaries of general insurers and authorised insurance NOHCs;
- all life companies, including friendly societies and registered life NOHCs, and subsidiaries of life companies and registered life NOHCs;
- all private health insurers; and
- all RSE licensees and connected entities of RSE licensees.
Under subsection 11AF(3) of the Banking Act, subsection 32(4) of the Insurance Act, subsection 230A(5) of the Life Insurance Act, subsection 92(5) of the PHIPS Act, and subsection 34C(6) of the SIS Act, APRA may, in writing, vary or revoke a prudential standard.
On 23 April 2026, APRA made Banking, Insurance, Life Insurance, Health Insurance and Superannuation (prudential standard) determination No. 1 of 2026 (the instrument), which revokes Prudential Standard CPS 230 Operational Risk Management made under Banking, Insurance, Life Insurance, Health Insurance and Superannuation (prudential standard) variation No. 1 of 2024 (the previous CPS 230) and determines a new Prudential Standard CPS 230 Operational Risk Management (the new CPS 230).
The instrument commences on 1 July 2026.
- Background
APRA’s mandate is to ensure the safety and soundness of prudentially regulated financial institutions so that they can meet their financial promises to depositors, policyholders, and fund members within a stable, efficient, and competitive financial system. APRA carries out this mandate through a multi-layered prudential framework that encompasses licensing and supervision of institutions.
APRA regularly reviews its prudential framework and amends its prudential requirements as a result of a number of factors, including:
- international developments;
- changes in financial market conditions;
- changes in risk management practices, in response to identified weaknesses in the prudential framework; and
- to reduce potential negative impacts of emerging industry issues.
The previous CPS 230 was a legally binding prudential standard that came into effect on 1 July 2025. CPS 230 was designed to:
- strengthen the operational risk management of APRA-regulated entities;
- improve business continuity planning to ensure APRA-regulated entities can effectively respond to severe business disruptions and maintain critical operations and minimise material adverse impacts on depositors, policyholders, beneficiaries or other customers or an entity’s role in the financial system; and
- strengthen the management of third parties whom the regulated entity relies upon in providing critical operations.
- Purpose and operation of the instrument
The purpose of the instrument is to revoke the previous CPS 230 and replace it with the new CPS 230.
The previous CPS 230 and the new CPS 230 require APRA-regulated entities to manage the operational risks of material service provider arrangements by maintaining formal agreements with specified risk management provisions.
The new CPS 230 amends the previous CPS 230 to reflect industry feedback that entities may be unable to comply with these requirements when engaging non-traditional service providers. This is because arrangements with those providers are often market-mandated and rely on standardised non-negotiable terms, or are not documented in a formal written agreement. The new CPS 230 introduces a limited carve out from certain contractual obligations for eligible material arrangements with non-traditional service providers, while preserving the broader operational risk management, continuity and service provider risk management requirements in the previous CPS 230.
Details of the new prudential standard
A description of the provisions of the new CPS 230 is set out in Attachment A to this Explanatory Statement.
Exercise of discretion by APRA
Under subsection 11AF(3) of Banking Act, subsection 32(4) of the Insurance Act, subsection 230A(5) of the Life Insurance Act, subsection 92(5) of the PHIPS Act, and subsection 34C(6) of the SIS Act, a prudential standard may provide for APRA to exercise powers and discretions under the standard, including (but not limited to) discretions to approve, impose, adjust or exclude specific prudential requirements in relation to one or more specified regulated entities or authorised NOHCs.
APRA’s prudential standards include powers that may be exercised by APRA that involve an element of discretion and that may affect the interests of the entities to which the prudential standards apply. These powers include a power to adjust or exclude a provision of the prudential standard.
The need to apply discretion is driven by entity-specific issues and circumstances that are not adequately addressed by the generally applicable provisions of the prudential standards. For example, adjustment or exclusion of a provision may be necessary to obtain a better prudential outcome than would be the case if the prudential requirement were applied unaltered to a particular regulated entity.
When exercising its discretion, APRA considers a wide range of factors, including the considerations set out in the Banking Act, Insurance Act, Life Insurance Act, PHIPS Act, SIS Act, and the Australian Prudential Regulation Authority Act 1998.
The exercise of APRA's powers is governed by a robust decision-making framework which is documented in APRA's internal policies. This framework supports APRA in fulfilling its mandate by limiting decision making to those senior APRA officers with the appropriate experience and skill to exercise prudent judgement. The framework also requires decision makers to seek advice from internal technical experts.
The power is also exercised following discussion with the relevant regulated entity about its appropriateness and the impact it may have on the entity.
Review of decisions
Decisions made by APRA exercising powers in prudential standards are not themselves subject to merits review. This is because these decisions are preliminary decisions that may facilitate or lead to substantive decisions which are subject to merits review.
Under the Banking Act, Insurance Act, Life Insurance Act, PHIPS Act and SIS Act a breach of a prudential standard is a breach of the enabling legislation, as each enabling Act provides that regulated entities must comply with requirements of a standard. However, there are no penalties prescribed for breach of the prudential standards under any of these Acts. Instead, an entity’s breach of the enabling legislation is grounds for APRA to make further, substantive decisions under the relevant enabling legislation in relation to the entity. Those decisions may include the decision:
- to issue a direction to the regulated entity, including a direction to comply with the whole or part of a prudential standard (section 11CA of the Banking Act, section 104 of the Insurance Act, section 230B of the Life Insurance Act and section 131D of the SIS Act) and a direction to comply with all or specified obligations, which includes prudential standards (section 96 of the PHIPS Act);
- to impose conditions on the entity’s registration (sections 9AA and 11AAA of the Banking Act, sections 13 and 19 of the Insurance Act, sections 22 and 28B of the Life Insurance Act, section 15 of the PHIPS Act and section 29EA of the SIS Act);
- to conduct an investigation into the regulated entity (section 61 of the Banking Act, section 52 of the Insurance Act, section 137 of the Life Insurance Act, section 130 of the PHIPS Act and section 263 of the SIS Act); and
- to revoke an authority to carry on banking business (section 9A of the Banking Act), a banking non-operating holding company (NOHC) authorisation (section 11AB of the Banking Act), an authority to carry on insurance business if APRA is satisfied that the insurer has no liabilities in respect of insurance business carried on by it in Australia (section 15 of the Insurance Act), an insurance NOHC authorisation (section 21 of the Insurance Act), a life company’s registration under section 21 if APRA is satisfied that the company has no liabilities in respect of life insurance business carried on by it in Australia (section 26 of the Life Insurance Act), a registered NOHC’s registration under section 28A (section 28C of the Life Insurance Act), or to cancel the RSE licence of an RSE licensee (section 29G of the SIS Act).
The decisions of APRA to give a direction or impose a condition are subject to merits review (section 11CA of the Banking Act, section 104 of the Insurance Act, section 236 of the Life Insurance Act, section 168 of the PHIPS Act and section 10 of the SIS Act). Before exercising such a power, APRA will give an affected body corporate an opportunity to comment on the whether the exercise is warranted or not.
All decisions to revoke authorisations/registrations/licences under the Banking Act, Insurance Act, Life Insurance Act and SIS Act are subject to merits review, unless specifically excluded by the enabling legislation.
Revocation of an authorisation to carry on banking business or a banking NOHC authorisation is subject to merits review unless:
- APRA has determined that access to natural justice and merits review is contrary to the national interest or contrary to the interests of depositors with the body corporate; or
- (in the case of authorised deposit-taking institutions (ADIs) only) the authority is an authority that is to cease to have effect on a day specified in the authority (subsection 9A(8) of the Banking Act).
Revocation of an authorisation to carry on insurance business or an insurance NOHC authorisation is subject to merits review (sections 15 and 21 of the Insurance Act).
Revocation of a life company registration or a life NOHC registration is subject to merits review (section 236 of the Life Insurance Act).
Revocation of the RSE licence of an RSE licensee is subject to merits review (section 10 of the SIS Act).
The situation in relation to cancellation of registration under the PHIPS Act is different to the other enabling legislation.
Consultation
From 10 December 2025 to 30 January 2026, APRA publicly consulted on targeted amendments to CPS 230 to better accommodate material arrangements with non-traditional service providers. The consultation responded to feedback that some entities may be unable to comply with certain contractual obligations in CPS 230, where arrangements are market-mandated and rely on standardised non-negotiable terms or are not documented in a formal written agreement. The pervious CPS 230 took effect on 1 July 2025, with the relevant contractual requirements for pre-existing arrangements applying from the earlier of the next contract renewal date or 1 July 2026.
APRA received 24 submissions and engaged with international regulators, domestic regulators, regulated entities, service providers and industry associations during the consultation period. Respondents were generally supportive of APRA’s objective but raised concerns with the proposed exemption mechanism (which considered exempting only individually named providers) and preferred an approach based on provider categories. In response, APRA revised the design of the amendments to adopt clearly defined categories of exempt non-traditional service providers. Minor refinements were also made to the types of service providers captured by the carve out, the definition of ‘standardised terms’, and the accompanying Material Service Provider register.
The final amendments were developed for release in April 2026, ahead of the 1 July 2026 compliance deadline. They introduce a limited carve out from specified contractual obligations for eligible material arrangements with non-traditional service providers, while preserving the broader operational risk, continuity and service provider risk management requirements in the previous CPS 230.
APRA is satisfied that the consultation undertaken was appropriate and reasonably practicable.
- Documents incorporated by reference
Under section 14(1)(a) of the Legislation Act 2003, the standard incorporates by reference as in force from time to time:
- Acts of Parliament and associated delegated laws;
- Prudential Standards determined by APRA under:
- subsection 11AF(1) of the Banking Act;
- subsection 32(1) of the Insurance Act;
- subsection 230A(1) of the Life Insurance Act;
- subsection 92(1) of the PHIPS Act; and
- subsection 34C(1) of the SIS Act.
These documents may be freely obtained on the Federal Register of Legislation at www.legislation.gov.au .
- Impact Analysis
The Office of Impact Analysis confirmed that a Regulation Impact Statement was not required.
- Statement of compatibility prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011
A statement of compatibility prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011 is provided at Attachment B to this Explanatory Statement.
ATTACHMENT A
Details of the new prudential standard
The key requirements of the new CPS 230 are set out below.
Authority, application, commencement, interpretation and definitions
Paragraphs 1 to 9 are the machinery provisions relating to the legal authority under which the instrument is made, the regulated entities that are required to comply with the standard, the commencement date, interpretation, and definitions used in the prudential standard.
Adjustments and exclusions
Paragraph 10 relies on subsection 11AF(2) of the Banking Act, subsection 32(3D) of the Insurance Act, subsection 230A(4) of the Life Insurance Act, subsection 92(4) of the PHIPS Act and subsection 34C(5) of the SIS Act, and provides for APRA to adjust or exclude a specific prudential requirement in the standard in relation to one or more specified regulated entity.
Key principles
Paragraphs 11-14 set out overarching principles intended to guide APRA-regulated entities in the implementation of, and complying with, CPS 230. They are foundational principles on which CPS 230 is based.
Risk management framework
Paragraphs 15-18 set out specific requirements for the management of operational risk in the context of an entity’s broader risk management framework requirements outlined in Prudential Standard CPS 220 Risk Management and Prudential Standard SPS 220 Risk Management.
Roles and responsibilities
Paragraphs 19-22 provide clarity to entities in setting out the responsibilities of the Board and of senior management for managing operational risk, business continuity of critical operations to minimise the possibility of disruptions and minimise the impacts on customers and to ensure the use of service providers is appropriately managed.
Operational risk management
Paragraphs 23-32 set out specific matters that an APRA-regulated entity is required to address to ensure that it understands the operational risks that arise in the conduct of its business; that there are systems in place to monitor and manage operational risks; the regulated entity has identified and documented the resources needed to deliver critical operations; operational risks are appropriately mitigated; and operational risk incidents are identified and escalated in a timely manner, including reporting incidents with potential material financial impacts or material impacts on critical operations to APRA.
Business continuity
Paragraphs 33-45 deal with business continuity which is a fundamental aspect of CPS 230. These provisions require an APRA-regulated entity to identify its critical operations, being those which if disrupted beyond tolerance levels determined by the entity, would have a material adverse impact on customers or the entity’s role in the financial system. Essentially, this requires a regulated entity to consider the impact of disruptions on customers as the key determinant in their criticality. APRA-regulated entities are required to take actions to both minimise the likelihood of such disruptions as well as having plans in place to deal with disruptions should they occur and to return to pre-disruption operations as soon as is practical.
Management of service provider arrangements
Paragraphs 46-61 set out matters an APRA-regulated entity is required to address in relation to the use of service providers. The regulated entity must have a service provider management policy and ensure that material arrangements meet certain requirements around due diligence and the need to have a legal agreement that covers specific matters. Material arrangements are those where an APRA-regulated entity is reliant on a service provider to undertake a critical operation or that expose the APRA-regulated entity to material operational risk. Such arrangements have the potential to adversely impact customers should the arrangement not be appropriately managed and monitored. There is a limited carve out from certain contractual obligations for eligible material arrangements with non-traditional service providers (listed in the Attachment to CPS 230) where those arrangements rely on standardised terms or are not documented in a formal agreement.
ATTACHMENT B
Statement of Compatibility with Human Rights
Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.
Banking, Insurance, Life Insurance, Health Insurance and Superannuation (prudential standard) determination No. 1 of 2026
The legislative instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011 (HRPS Act).
Overview of the Legislative Instrument
The purpose of the legislative instrument is to revoke Prudential Standard CPS 230 Operational Risk Management (CPS 230) and replace it with a new version of CPS 230 to incorporate a limited carve out from specified contractual level obligations for eligible material arrangements with non-traditional service providers where those arrangements rely on standardised terms or are not documented in a formal agreement.
CPS 230 sets out requirements to ensure that APRA-regulated entities are resilient to operational risks and disruptions and that risks arising from the use of service providers are managed appropriately.
CPS 230 seeks to ensure that APRA-regulated entities:
- identify and manage their operational risks;
- are able to continue to deliver critical operations to customers through severe disruptions; and
- have a comprehensive policy for managing risks from the use of service providers, and for the ongoing monitoring of such arrangements.
Human rights implications
APRA has assessed the legislative instrument and is of the view that it does not engage any of the applicable rights or freedoms recognised or declared in the international instruments listed in section 3 of the HRPS Act.
Conclusion
Accordingly, in APRA’s assessment, the legislative instrument is compatible with human rights as it does not raise any human rights issues.