Governance Frame

Research

← All briefings

CPS 230 at the Contract Deadline: Governing Material Service Providers, Fourth Parties, and Exit Risk

54aac838-9094-4de5-ac24-993672505cbc

Executive Summary: CPS 230 is no longer primarily a policy-drafting exercise. By 1 July 2026, APRA-regulated entities must treat material service provider (MSP) arrangements as governed operational dependencies: identified, diligence-tested, contractually controlled where required, monitored for fourth-party concentration, and exit-ready where the standard still requires it. Limited exemptions for specified nontraditional providers disapply particular contractual and related monitoring/exit paragraphs—they do not erase ongoing operational-risk management, MSP-register, or BCP duties. Boards need evidence that shows which arrangements are uplifted, which rely on exemptions, what residual risk remains, and who owns remediation.

I. Exposure Vector

Consider an illustrative APRA-regulated entity approaching the July 2026 contract transition.

Critical operations depend on cloud infrastructure, core processing, payments connectivity, and specialist professional services. The MSP register lists vendors. Several evergreen contracts pre-date CPS 230. Fourth-party concentration sits behind a single hyperscaler and a shared claims platform. Exit plans exist as slideware.

The governance questions are concrete:

  • Which arrangements are material because they support critical operations or create material operational risk?
  • Which arrangements still lack required contractual protections—such as service levels, data ownership and control, audit access, subcontracting notification, force-majeure provisions, termination rights, and APRA access—and which lack credible continuity or orderly-exit capability?
  • Where contractual uplift is impracticable, does a recognised exemption apply—and what alternative oversight remains?
  • Can the entity substitute or exit without breaching tolerance for critical operations?
  • What evidence would a supervisor expect to see on 1 July 2026: uplifted agreements, documented gaps with interim controls, remediation that is appropriately approved under the entity’s governance framework and visible to the Board where material, and a current MSP register?

APRA released final targeted amendments to CPS 230, CPG 230, and the MSP Register template on 30 April 2026. The updated standard and guidance commence on 1 July 2026. The amendments introduce limited exemptions from specified requirements for material arrangements with certain categories of service providers where contractual compliance is not practicable; categories appear in the attachment to CPS 230. Updates to CPG 230 clarify expectations for managing material arrangements with exempt providers. [1][6]

CPS 230 commenced for APRA-regulated entities on 1 July 2025. Non-significant financial institutions received transitional relief until 1 July 2026 for specified business-continuity and scenario-analysis requirements. Separately, pre-existing service-provider arrangements were subject to the earlier of their next renewal date or 1 July 2026. [1][3][5][8]

The institutional problem is therefore not “having a vendor list.” It is whether contract rights, fourth-party visibility, substitution capacity, and exit readiness are governed as operational resilience controls—and whether exemption reliance is documented where the attachment criteria are met.

II. Quantitative Context

CPS 230 itself does not contain a universal fixed-dollar penalty schedule. Its immediate consequences are principally prudential and supervisory, including mandated reviews, remediation programs, additional capital requirements, licence conditions, and other action available to APRA under the governing legislation. The economic signal is operational and supervisory: prolonged inability to sustain critical operations, forced remediation under scrutiny, and concentration risk that cannot be exited on acceptable terms.

Economic / operational signalWhat it demonstrates
Loss of a non-substitutable MSP supporting a critical operationDirect threat to continuity tolerances and customer outcomes
Evergreen contract without audit, notification, termination rights, or APRA accessWeak leverage when an incident, insolvency, or service failure occurs
Undocumented fourth-party chain behind an MSPBlind concentration and delayed incident response
Board pack that lists vendors without residual-risk ownershipGovernance theatre under supervisory challenge

A defensible board quantitative narrative should separate:

  • arrangements fully uplifted;
  • arrangements on a dated remediation path with interim controls;
  • exempt nontraditional arrangements with alternative oversight;
  • residual concentration and exit risk expressed as operational impact (time-to-restore, customers affected, regulatory notification triggers)—not as a single false-precision dollar figure.

III. What Modern GRC Must Enforce

Three legal-operational distinctions

Arrangement typeContractual postureContinuing governance duties
Ordinary material arrangementMeet CPS 230 agreement requirements (service levels, data ownership/control, audit access, legal-compliance provisions, subcontracting notification and liability, force majeure, termination rights, and APRA access as applicable), together with demonstrated BCP execution and orderly-exit capabilityDiligence before enter/modify; ongoing monitoring against agreed service levels and agreement compliance; MSP register; incident and tolerance-breach processes
Exempt nontraditional provider (attachment category + standardised / non-negotiable terms, or no formal agreement)Specified paragraphs are disapplied—including formal minimum terms (para 53), APRA access provisions (para 54), the orderly-exit obligation in para 55(d), and monitoring against agreed service levels / agreement compliance in paras 59(a) and 59(c) where those applyAssess materiality; manage financial and non-financial risk; include the arrangement in critical-operation mapping, relevant BCPs and the MSP register; monitor available information, incidents and any service levels that exist; reduce residual risk where practicable
Incomplete uplift at deadlineDocument gap, interim controls, remediation owner and date; escalate under the entity’s governance frameworkDo not treat silence as compliance; supervisors distinguish managed gaps from undiscovered ones

Exemption conditions are narrow: the provider must fall within an attachment category (government agencies; regulators; central banks; financial-market exchanges; operators of clearing and settlement facilities; operators of payment systems and schemes; financial-messaging infrastructures), and the arrangement must use standardised terms the entity has little or no ability to negotiate—or have no formal agreement. APRA may grant additional exemptions by written notice. [1][6][7]

Control-system requirements

Failure modeControl-system requirement
MSP register is a static spreadsheetMaintain a current register aligned to critical operations, including exempt-provider fields where the 2026 template requires them [1]
“Material” decided by contract value aloneAssess whether the arrangement is relied on for a critical operation or exposes the entity to material operational risk
Fourth parties invisibleMap critical subcontractors supporting material arrangements; require notification of subcontracting where contractual rights exist; CPS 230 expects the service-provider management policy to address fourth-party risk for critical operations [1][2]
Exit plan untestedFor non-exempt arrangements, ensure an approach to substitution and orderly exit. A credible exit assessment would normally address exit triggers, data disposition, alternative providers, dependencies, and the time needed to restore the supported critical operation
Diligence treated as onboarding-onlyReassess on material change; retain evidence of financial and non-financial risk assessment
Exemption used as a blanket waiverApply only where attachment category and standardised-terms (or no formal agreement) conditions are met; retain rationale and alternative controls per CPG 230 expectations [1][2][7]

Board evidence pack (examination-ready)

A prudent examination-readiness pack would ordinarily include:

  • Inventory of material arrangements mapped to critical operations
  • Contract uplift status: complete / in progress / exempt / gap-with-interim-controls
  • Fourth-party and concentration view for highest-dependency chains
  • Exit and substitution assessments for non-substitutable MSPs (capability-focused; exit-assistance clauses may help but are not the sole CPS 230 metric)
  • Named owners, dates, and residual-risk acceptance for open items
  • Remediation that is appropriately approved under the entity’s governance framework and visible to the Board where material
  • MSP register submission posture consistent with APRA’s current MSP Register template and the applicable APRA Connect return instructions once issued or confirmed [1]

Operators consolidating this evidence often need a single governed workspace that preserves arrangement status, diligence artifacts, and board attestation history without overwriting prior states—so residual risk remains reconstructable after the deadline.

IV. Verification Protocol

  1. Confirm against APRA’s operational risk management page that final targeted amendments to CPS 230 and CPG 230 were released 30 April 2026 and commence 1 July 2026. [1]
  2. Confirm that limited exemptions apply only to attachment categories meeting the standardised-terms (or no formal agreement) conditions—not to all difficult vendors. [1][6][7]
  3. Confirm transitional logic for pre-existing contracts: earlier of next renewal or 1 July 2026; and separately that non-SFIs had additional BCP/scenario-analysis relief to 1 July 2026. [3][5][8]
  4. Do not conflate CPS 230 with AUSTRAC AML/CTF Tranche 2, DORA, or the EU AI Act; those are separate regimes.
  5. Reject any claim that an exemption removes all MSP governance duties—register, materiality assessment, BCP inclusion, and proportionate diligence remain.
  6. Test whether the entity can produce, for each critical MSP: contract evidence or exemption rationale, diligence record, monitoring evidence appropriate to the arrangement type, and exit/substitution posture where still required.

Key Takeaways

  • 1 July 2026 is both an amendments-commencement date and, for many entities, the end of the pre-existing MSP contract transition—and the date from which CPS 230’s BCP/scenario-analysis transitional relief for non-SFIs also ends.
  • Contract uplift, exemption use, and residual-risk acceptance are three different governance states—and must be evidenced separately.
  • Explicit contract clauses, entity-level continuity/exit capability, duties specifically disapplied for exempt arrangements, and prudent examination-readiness practice are not interchangeable.
  • Fourth-party visibility and exit readiness are resilience controls, not legal niceties.

V. Sources & Citations