Australia unveils new standards for banks, insurers’ operational risk management

The new standard will take effect on 1 July 2025.

The Australian Prudential Regulation Authority (APRA) has released its new prudential standard, Prudential Standard CPS 230 Operational Risk Management (CPS 230) aimed at ensuring that banks, insurers, and superannuation trusteed can manage operational risks and disruptions.

The new standard will commence on 1 July 2025.

APRA chair John Lonsdale said the finalisation of CPS 230 will strengthen the management of operational risk across APRA’s regulated population. 

“Disruptions to financial services can cause a major detrimental impact to the people who rely on them to pay bills, recover from financial loss or support themselves in retirement,” he said in the statement announcing the new standards.

“The need for APRA’s new standard has been demonstrated by a number of recent operational risk control failures and disruptions, including material cyber breaches. This new standard will ensure that regulated entities set and test controls and maintain robust business continuity plans to respond if disruptions do occur,” Londsdale added.

ALSO READ: Australian banks face elevated risk of credit losses: S&P

CPS 230 provides a new foundation for APRA-regulated entities to: strengthen operational risk management through new requirements to address identified weaknesses in existing controls; improve business continuity planning to ensure they are positioned to respond to severe disruptions; and enhance third-party risk management by ensuring risks from material service providers are appropriately managed.  

Industry consultation for the new standards commenced on July 2022.

“We expect regulated entities to be proactive in preparing for implementation, rather than waiting until the last minute to get ready to meet the new requirements. There will be a transition phase for existing contractual arrangements with material service providers for entities that need some flexibility,” Lonsdale said.