On 1 July 2025, APRA's Prudential Standard CPS 230 Operational Risk Management came into force across Australia's banking, insurance and superannuation sectors. It replaced five existing standards — including the separate outsourcing and business continuity frameworks that had governed operational risk for years — and introduced a fundamentally different set of expectations about how regulated entities identify, manage and recover from operational disruptions.
For banks specifically, CPS 230 represents the most consequential change to operational risk regulation in over a decade. Not because the individual requirements are radically unfamiliar — most banks already had business continuity plans, vendor management frameworks and risk registers — but because CPS 230 raises the bar on what "good" looks like across all of them simultaneously, and connects them into a single, coherent framework with board-level accountability and APRA oversight that has real teeth.
APRA Member Therese McCarthy Hockey put it plainly when the standard commenced: in an environment where one crashed server or ransomware attack could leave millions without access to essential banking services, effective operational risk management is vital for financial stability and community wellbeing. CPS 230, she said, requires entities to have "an entirely new mindset about where the boundaries of responsibility sit."
That phrase — where the boundaries of responsibility sit — is the key to understanding what CPS 230 actually demands. Because for most banks, the boundaries of their operational capability extend far beyond their own walls. They run through cloud providers, payment processors, technology platforms, data centres, telecommunications networks, printing and distribution services, physical security contractors, facilities management firms, and dozens of other third and fourth parties whose performance directly determines whether critical banking services stay available.
This is, at its core, a supply chain problem. And it needs supply chain thinking to solve properly.
What CPS 230 actually requires
Before getting into the supply chain implications, it's worth grounding the discussion in what the standard actually requires. CPS 230 is built around three pillars:
Operational risk management. Banks must maintain a comprehensive framework for identifying, assessing, managing and monitoring operational risks — including those arising from inadequate or failed internal processes, systems, people, or external events. This isn't new in concept, but CPS 230 is more prescriptive about expectations: risk appetite must be clearly defined, internal controls must be in place and tested, risk incidents must be reported to APRA within 72 hours if they're likely to have a material impact, and the board must actively oversee and challenge the entity's operational risk profile.
Business continuity. Banks must identify their critical operations — those essential functions that, if disrupted, could materially affect customers, financial markets or the broader economy — and set tolerance levels for how much disruption is acceptable. Business continuity plans must be maintained, tested through scenario exercises, and designed to ensure the bank can continue to deliver critical operations within those tolerance levels even during severe disruptions. The shift here is important: CPS 230 moves beyond recovery (how quickly can you get back to normal?) to resilience (can you keep operating through the disruption?).
Service provider management. Banks must identify their material service providers — any third party whose failure or disruption could affect a critical operation or expose the bank to material operational risk. For each material service provider, the bank must conduct due diligence, establish formal agreements with clear performance and resilience requirements, maintain ongoing monitoring, and develop contingency plans for service failure. Critically, CPS 230 extends this requirement down the supply chain to fourth parties — organisations engaged by the bank's service providers — requiring banks to seek assurance that their providers are managing these downstream risks appropriately.
Banks must submit a register of material service providers to APRA by 1 October 2025. Pre-existing contracts have a transitional period, with CPS 230 requirements applying from the earlier of the next contract renewal or 1 July 2026.
Why this is fundamentally a supply chain challenge
The language of CPS 230 is regulatory — risk frameworks, tolerance levels, prudential obligations. But the substance of what it requires banks to do is operational, and much of it maps directly onto supply chain management disciplines.
Consider what a bank actually needs to deliver to comply:
End-to-end mapping of critical operations. CPS 230 requires banks to have a complete understanding of their critical operations and the resources — people, processes, technology, facilities and third parties — that support them. This is, in effect, a supply chain mapping exercise. It requires the bank to trace every critical service back through its dependencies, identifying which systems, which teams, which locations and which external parties are involved in delivering it. Most banks have this information scattered across IT asset registers, vendor management systems, business continuity plans and procurement databases — but few have it integrated into a single, end-to-end view that shows how disruption in one node propagates through to customer-facing services.
Third and fourth party risk visibility. The expansion from "outsourcing" (under the old CPS 231) to "material service providers" (under CPS 230) is a deliberate broadening of scope. It recognises that modern banks depend on a complex web of service relationships — not just the traditional outsourced functions, but cloud infrastructure, software platforms, data feeds, payment networks, identity verification services, and dozens of other inputs that aren't "outsourcing" in the traditional sense but are every bit as critical.
Managing this web of dependencies — understanding who provides what, where the concentration risks are, what happens if a provider fails, and how fourth parties further down the chain might create cascading disruptions — is a supply chain management problem. It requires the same disciplines of supplier mapping, risk assessment, performance monitoring, and contingency planning that any complex, mission-critical supply chain demands.
Resilience testing and scenario analysis. CPS 230 requires banks to test their business continuity plans through scenario exercises — including scenarios involving cyberattacks, major third-party failures, data breaches and supply chain disruptions. These exercises must assess whether critical operations can actually continue within tolerance levels, not just whether recovery plans exist on paper.
This is operationally analogous to supply chain stress testing — modelling what happens when a key supplier fails, when a distribution node goes offline, or when a logistics corridor is disrupted. It requires understanding interdependencies, identifying single points of failure, and validating that contingency arrangements actually work under realistic conditions.
For government and defence agencies and other organisations that manage critical infrastructure, this kind of supply chain resilience thinking is well established. For banks, CPS 230 is bringing it into the regulatory mainstream.
Where banks are finding this hardest
Now that CPS 230 is in force, the practical challenges are becoming clearer. Several areas are proving particularly difficult for banks — and they're the areas where supply chain expertise is most relevant.
Material service provider identification and tiering
Many banks have hundreds or thousands of third-party relationships. Determining which ones are "material" under CPS 230 requires a structured assessment of each provider's role relative to critical operations — not just their contract value or the function they nominally support. A small technology firm providing a niche data feed that underpins a critical payment process may be more "material" than a large outsourced function that supports a non-critical activity.
This requires cross-functional collaboration between procurement, IT, operations, risk and business units — and a methodology for assessing materiality that's consistent, defensible and practical to apply at scale. Many banks have found their existing vendor management systems inadequate for this purpose, because they were designed around procurement categories and contract management rather than operational dependency mapping.
This is where procurement disciplines intersect with operational risk management. Getting the material service provider register right isn't just a compliance exercise — it's the foundation for all subsequent third-party risk management activity under CPS 230.
Fourth-party visibility
CPS 230 requires banks to look beyond their direct service providers to the organisations that those providers depend on — the fourth parties. In practice, this means understanding, for example, which cloud platform your technology vendor runs on, which sub-processors your data analytics provider uses, or which telecommunications carrier your managed services provider relies on for network connectivity.
Most banks have limited visibility at this level. Their contracts with direct providers may not include adequate information rights, and many service providers are reluctant to disclose their own supply chain arrangements in detail. Yet CPS 230 requires banks to seek assurance that material service providers have the capability to manage these downstream risks.
Building fourth-party visibility is a supply chain transparency challenge — one that requires contractual provisions, information sharing frameworks, and ongoing monitoring mechanisms. It's the same kind of supply chain mapping and tier-n visibility work that manufacturing and defence supply chains have been tackling for years, applied to the services supply chain that underpins banking operations.
Business continuity that goes beyond recovery
The traditional approach to business continuity in banking has been largely focused on recovery — how quickly can systems be restored, data recovered, and operations resumed after an incident? CPS 230 shifts the emphasis toward continuity through disruption — maintaining critical operations within tolerance levels even while the disruption is ongoing.
This requires a different kind of planning. It's not enough to have a disaster recovery site and a call tree. Banks need to understand which services are truly critical (and which can be temporarily degraded or suspended), what the minimum viable operating model looks like for each critical service, how dependencies between services create cascading failure risks, and what manual or alternative processes can sustain operations while primary systems are unavailable.
This is planning and operations work — designing operating models that are resilient by design rather than reliant on recovery after failure. It requires the same kind of scenario modelling, capacity planning and contingency design that applies to any supply chain where continuity of service is non-negotiable.
Governance and board accountability
CPS 230 places explicit obligations on bank boards: approving tolerance levels for disruptions to critical operations, reviewing risk and performance reporting on material service providers, and considering operational risk implications before making strategic decisions such as mergers, acquisitions or technology platform changes.
For boards to discharge these obligations meaningfully, they need clear, concise reporting that translates operational complexity into decision-relevant information. This means dashboards and reports that show the current state of critical operation resilience, material service provider performance against agreed standards, concentration risks across the third-party portfolio, results and insights from scenario testing exercises, and emerging risks from the service provider landscape.
Building the reporting and governance infrastructure to support board oversight is an organisational design challenge — one that requires clarity about roles, responsibilities, information flows and decision rights across the three lines of defence.
Concentration risk: the elephant in the room
One of the most significant systemic risks that CPS 230 surfaces is concentration — the degree to which multiple banks (and other financial institutions) depend on the same small number of critical service providers.
The most obvious example is cloud infrastructure. A small number of global hyperscale providers — AWS, Microsoft Azure, Google Cloud — underpin a significant and growing proportion of banking technology. If a single cloud provider experienced a sustained outage affecting its Australian region, the impact could cascade across multiple banks simultaneously, affecting payment systems, internet banking, lending platforms and customer communications.
CPS 230 doesn't prohibit this concentration, but it does require each bank to understand its implications, set tolerance levels for disruption, and have contingency plans. In practice, this means banks need to assess whether their critical operations would survive a prolonged outage of their primary cloud provider, whether multi-cloud or hybrid strategies provide genuine resilience (rather than just architectural complexity), and how concentration in other service categories — payment networks, telecommunications, identity verification — creates correlated failure risks.
This is a supply chain resilience challenge that parallels concentration risk in physical supply chains — where dependence on a single supplier, single geography or single transport corridor creates vulnerability to correlated disruption.
What this means for banks' service providers
CPS 230 doesn't directly regulate service providers — but it profoundly affects them. Banks are now contractually required to impose resilience expectations on their material service providers, including requirements around business continuity capabilities, incident reporting and notification timelines, sub-contracting and fourth-party transparency, audit and information rights, and exit and transition planning.
For organisations that provide services to banks — whether in technology, operations, facilities, logistics or professional services — CPS 230 effectively makes them part of the regulatory ecosystem. Failure to meet the resilience expectations embedded in bank contracts can have commercial and reputational consequences.
Service providers that proactively demonstrate their operational resilience — through mature business continuity planning, transparent supply chain practices, and robust incident management — will be better positioned commercially than those that treat CPS 230 requirements as an unwelcome contractual burden.
Beyond compliance: the operational opportunity
The banks that approach CPS 230 purely as a compliance obligation will produce policy documents, populate registers, and run tick-box scenario exercises. They'll meet the letter of the standard without fundamentally improving their operational resilience.
The banks that approach it as an operational transformation opportunity will do something more valuable: they'll build a genuinely integrated understanding of how their operational supply chain works — from internal processes through to third and fourth parties — and use that understanding to make better decisions about where to invest in resilience, where to reduce concentration risk, and where to simplify complexity that creates unnecessary vulnerability.
This is the difference between compliance and capability. CPS 230 sets a regulatory floor. The operational benefits of doing it well — reduced incidents, faster response, lower insurance costs, stronger customer trust, better commercial outcomes with service providers — extend far beyond that floor.
How Trace Consultants can help
At Trace Consultants, we bring supply chain expertise to operational challenges — including the service provider management, operational mapping, resilience planning and governance requirements that CPS 230 demands of banks.
We work at the intersection of supply chain strategy, procurement, operations and risk — which is exactly where CPS 230 compliance lives in practice.
Critical operation and supply chain mapping. We help banks map their critical operations end-to-end, identifying the people, processes, technology, facilities and third parties that support each service. This is strategy and network design work applied to the operational supply chain — creating the visibility foundation that everything else in CPS 230 depends on.
Material service provider assessment and tiering. We design and apply structured methodologies for assessing which service providers are material, how they should be tiered, and what management requirements apply to each tier. Our procurement expertise ensures that these assessments reflect operational dependency, not just contract value.
Third and fourth party risk management frameworks. We help banks design the policies, processes and systems for ongoing monitoring of material service providers — including fourth-party visibility, performance measurement, and escalation procedures. This draws on our experience managing complex, multi-tier supply chains across government and private sector contexts.
Business continuity and resilience planning. We support banks in designing business continuity plans that go beyond recovery to genuine operational resilience — including minimum viable operating models, scenario analysis, and contingency arrangements for critical service provider failure. Our planning and operations teams bring practical experience in designing operations that can absorb disruption, not just recover from it.
Governance, reporting and organisational design. We help banks design the organisational structures, reporting frameworks and governance arrangements that support board oversight of operational resilience — ensuring that information flows are clear, decision rights are defined, and the three lines of defence work as intended.
Service provider contract and exit strategy. We support banks in designing service provider agreements that embed CPS 230 requirements, and in developing exit and transition plans for material arrangements that reduce lock-in risk and ensure continuity. Our project and change management capability supports execution of complex service transitions.
Technology enablement. We help banks select and implement technology platforms for operational risk management, service provider monitoring and resilience reporting — ensuring that tools support rather than substitute for sound operational processes.
The clock is ticking
CPS 230 is live. The material service provider register is due to APRA by 1 October 2025. Pre-existing service provider contracts must comply by the earlier of their next renewal date or 1 July 2026. APRA has made clear that it expects regulated entities to demonstrate genuine capability, not just documentation.
For banks still working through implementation, the priority now is to close the gaps between policy and operational reality — to move from frameworks on paper to systems, processes and capabilities that actually work when tested. For banks that have met the initial compliance deadlines, the challenge is sustaining and maturing those capabilities over time, as the operational landscape continues to evolve.
Either way, the banks that treat CPS 230 as a catalyst for building genuine operational supply chain resilience — not just a regulatory hurdle to clear — will be the ones best positioned for whatever disruption comes next.
If your organisation is navigating CPS 230 implementation or looking to strengthen the operational supply chain that underpins your critical banking services, we'd welcome the conversation.
