APRA Prudential Standard CPS 230 applies to APRA-regulated entities, including authorised deposit-taking institutions (ADIs), general insurers, life insurers, private health insurers and registrable superannuation entity (RSE) licensees. It does not apply solely because an organisation holds an Australian Financial Services Licence (AFSL) or Australian Credit Licence (ACL).
Expanded Answer
CPS 230 is a prudential standard issued by APRA and forms part of Australia’s prudential regulatory framework. It applies to entities supervised by APRA, requiring them to establish and maintain an operational risk management framework, identify and protect critical operations, oversee material service providers and maintain operational resilience. The standard is directed at prudentially regulated entities rather than all financial services businesses.
The entities required to comply with CPS 230 include banks, building societies, credit unions and other authorised deposit-taking institutions (ADIs), general insurers, life insurers, private health insurers and registrable superannuation entity (RSE) licensees. Organisations that are regulated by both APRA and ASIC must comply with both APRA’s prudential standards and their ASIC licensing obligations. Businesses that hold only an AFSL or ACL are not brought within CPS 230 unless they are also subject to APRA supervision.
Applies to: Authorised deposit-taking institutions (ADIs), general insurers, life insurers, private health insurers and RSE licensees regulated by APRA.
Does not apply solely because: an organisation holds an AFSL or ACL without being regulated by APRA.
Why it matters
Understanding whether CPS 230 applies helps organisations implement the correct governance and operational risk framework. It also avoids confusing APRA’s prudential obligations with ASIC’s licensing obligations, which apply under different regulatory regimes.
Unsure how this applies to you?
Get a clear answer in a 15-minute call with a compliance specialist. Book your call
Practical guidance
- Confirm whether your organisation is prudentially regulated by APRA before assessing CPS 230 obligations.
- Identify all regulatory obligations where your organisation is supervised by both APRA and ASIC.
- Review operational risk governance and resilience arrangements if your organisation falls within the scope of CPS 230.
Further reading
APRA CPS 230 explained for financial services businesses