APRA CPS 231
Definition
APRA CPS 231
APRA CPS 231 was the Australian prudential standard on outsourcing, requiring regulated entities to manage the risks of material business activities performed for them by somebody else. The standard has been revoked, replaced by a wider operational risk regime.
For two decades this was the reference point for outsourcing in Australian financial services.
Entities classified activities as material or not, signed binding agreements, notified the regulator and consulted before sending material work offshore.
Then the framework was consolidated — and a document that shaped a generation of Australian outsourcing contracts stopped applying.
Key takeaways
- CPS 231 was superseded on 30 June 2025 and no longer applies.
- Its successor consolidates outsourcing and business continuity into one operational risk standard.
- The materiality concept survives, renamed around material service providers.
- Contracts written to the old standard still needed updating under a transition arrangement.
How it works
The old standard had a clear shape. It required an entity to manage risks from outsourced business activities, to maintain appropriate outsourcing policies and have legally binding outsourcing agreements, and it applied only to material business activities.
Two obligations defined the regulator relationship — entities notified the regulator within twenty business days of entering a material outsourcing agreement, and consulted before entering offshore arrangements involving material business activities.
The replacement changed the frame rather than the philosophy. CPS 230 was in effect from July 1, 2025, and replaces five existing standards, including CPS 231 Outsourcing and CPS 232 Business Continuity.
| Old concept | What replaced it |
|---|---|
| Material business activity | Material service provider, tied to critical operations |
| Outsourcing policy | Service provider management policy |
| Notification within twenty business days | Annual register submission to the regulator |
| Consultation before offshoring | Managed within the wider operational risk framework |
| Outsourcing agreements | Formal legally binding agreements with material providers |
Transition was handled generously. Entities with pre-existing agreements with material service providers did not have to update them until 1 July 2026, which is why old clause sets survived into recent contracts.
That overlap is why contracts from 2025 and 2026 read inconsistently. Two vocabularies were effectively live at once, and drafting teams reached for whichever one they knew.
The reason the standard still matters is historical rather than current — contracts drafted between 2002 and 2025 carry its vocabulary, and reading them requires knowing what those words meant.
Examples
The standard’s residue is visible across Australian outsourcing contracts written before 2025. The examples below all turn on scope, which is where these regimes usually bite.
A superannuation fund’s administration contract still references material business activities throughout. The term no longer maps to a live standard, and renewal is the moment to retranslate it.
A general insurer notified the regulator within twenty business days for years. That mechanic has gone, replaced by an annual register, and the internal process had to be rebuilt accordingly.
A bank consulted the regulator before moving material work to Manila. The consultation step no longer stands alone, though offshore concentration remains a supervisory interest.
A life insurer’s provider inventory was built around the old materiality test. Rebuilding it around critical operations changed which providers appeared on it. Several long-standing suppliers dropped off the list, and two that had never been assessed appeared on it.
Related terms
Australian prudential vocabulary changed substantially in 2025, and old and new terms now circulate together. The terms below are frequently substituted for one another, usually by accident.
- Regulated outsourcing: supervised sector outsourcing generally, of which this was one instance.
- Banking outsourcing: the sector practice the standard applied to.
- Insurance outsourcing: the other major regulated population it covered.
- Business continuity plan (BCP): the subject of the companion standard also replaced.
- Vendor management outsourcing: the programme that maintains registers and reviews.
- Compliance outsourcing: contracting the compliance function rather than an operational one.
- Risk outsourcing: moving risk work out without moving the prudential obligation.
FAQ
Is CPS 231 still in force?
No. It was superseded on 30 June 2025, and the successor standard took effect the following day.
What replaced it?
An operational risk management standard that consolidated five previous standards, including the outsourcing and business continuity standards.
Does materiality still matter?
Yes, in a different form. The concept now attaches to material service providers defined by their link to critical operations.
Do we still notify within twenty business days?
No. The notification mechanic was replaced by an annual submission of a register of material service providers.
What happened to old contracts?
Pre-existing agreements with material service providers had until 1 July 2026 to be brought into line with the new standard.
Why does an obsolete standard still get cited?
Because two decades of Australian contracts were drafted under it, and many of them still carry its language today.
Browse verified partners in the Outsource Accelerator directory and keep partners who can supply the register entries you owe.
Independent
