The 2026 CPS 230 Amendments: Why Non-Traditional Service Providers Got a Narrow Exemption
A Targeted Fix for a Practical Friction Point
When APRA designed CPS 230, one requirement proved particularly awkward in practice: forcing regulated entities to impose full contractual obligations on service providers whose terms are not negotiated in the ordinary commercial sense. Central banks, financial market exchanges, clearing and settlement facilities, payment system operators and financial messaging infrastructures often provide access on standardised terms or without a formal bilateral agreement. Requiring a bank or insurer to renegotiate those arrangements as if they were ordinary vendor contracts risked creating friction without improving resilience.
APRA’s final targeted amendments, released on 30 April 2026 and effective 1 July 2026, respond to that tension. The amendments introduce a limited exemption from specified contractual requirements in CPS 230 for material arrangements with listed categories of non-traditional service providers, where contractual compliance is not practicable. The relief is deliberately narrow: it applies only to the specified contractual requirements, while all other CPS 230 obligations—including active risk management and monitoring—continue to apply.
How the Exemption Actually Works
The exemption is structured around two conditions. First, the service provider must fall within a category listed in the Attachment to CPS 230, which includes government agencies, regulators, central banks, exchanges, clearing and settlement operators, payment system operators and financial messaging infrastructures. Second, the arrangement must either use standardised terms or not be documented in a formal agreement.
APRA has also updated the Material Service Provider Register Template to allow entities to classify exempt arrangements, and it retains the ability to grant exemptions for additional providers by written notice where appropriate. Importantly, the regulator has signalled that the scope of exemptions is expected to narrow over time as domestic and international operational resilience practices mature, rather than expand. That forward guidance matters: the exemption is a transitional accommodation, not a permanent carve-out from third-party risk discipline.
Why the Industry Pushed for a Provider-Type Approach
During consultation, most submissions favoured exemption by provider type rather than APRA designating individual providers case by case. The concern was that a bespoke designation process would create unintended inclusions and exclusions, require frequent updates and generate uncertainty for both entities and providers. APRA agreed that a provider-type list is more administratively efficient and easier to manage over time, and it worked with industry and peer regulators to define the exempt categories with clear perimeters.
Some submissions argued for a broader list—including cloud infrastructure, communications providers and digital wallet providers—but APRA declined to go that far. The final position preserves the core objective: where a bespoke contract is possible, entities are still expected to have a CPS 230-compliant agreement in place. The exemption is confined to situations where the market structure genuinely makes contractual compliance impracticable, not where it is merely inconvenient.
The Practical Implications for Regulated Entities
For banks, insurers and super funds, the amendments reduce a source of legal friction but do not reduce the underlying risk. Entities must still identify which arrangements qualify for exemption, document the basis for that classification, and ensure that operational risk arising from reliance on those providers is actively managed. The register remains the central evidence artefact: exempt arrangements must be classified correctly, and the annual submission to APRA must reflect the entity’s actual dependency map.
