CPS 230 and offshore teams: What changed when the transition ended

This article was contributed by the team at Satellite Office, which builds dedicated offshore teams in the Philippines for Australian businesses.

The Cross-industry Prudential Standard (CPS) 230 transition period ended on 1 July 2026, and many Australian financial firms haven’t yet worked through what that means for their offshore teams.

APRA’s Prudential Standard CPS 230 Operational Risk Management took effect on 1 July 2025. But for service provider contracts already in place, the requirements didn’t apply until the contract renewed or 1 July 2026, whichever came first. That grace period is now over.

For offshore arrangements, this is where the gap tends to show. Many were set up years ago, renewed automatically, and never properly mapped to a register, a materiality assessment or an oversight process. They can no longer sit outside the standard.

So the useful question is a practical one: if your register, notifications and oversight are now expected to be in place, what does that look like day to day for the teams you run offshore? That’s what this article covers.

Note: This article is about operational readiness, not legal advice. What CPS 230 requires of your entity is a matter for your compliance, risk and legal advisers, and the standard itself is the authority.

Key takeaways

• Offshore arrangements signed before CPS 230 commenced are now fully in scope, unless they were already brought in at renewal.
• If an offshore team supports a critical operation, it likely belongs on your material service provider register, which goes to APRA every year.
• Material offshoring arrangements must be notified to APRA before you sign, not after.
• Internal audit must review proposed outsourcing of critical operations.
• Using an Australian-registered provider doesn’t change anything if the work is done offshore.

Do offshore teams count as material service providers under CPS 230?

The register is the part that catches most people out. CPS 230 requires APRA-regulated entities to keep a register of their material service providers and manage the risks of relying on them (paragraph 49).

A provider is material if you rely on it for a critical operation, or if it exposes you to material operational risk.

This register isn’t a document that lives in a folder and gets refreshed when someone remembers. It’s submitted to APRA every year (paragraph 51). The standard also sets a starting point for what counts as material (paragraph 50).

For every APRA-regulated entity, providers of risk management, core technology services and internal audit are treated as material unless you can justify otherwise.

Some sectors have extra categories:

• Authorised deposit-taking institutions (ADIs), such as banks, credit unions and building societies: credit assessment, funding and liquidity management, and mortgage brokerage
• Insurers: underwriting, claims management, insurance brokerage and reinsurance
• RSE licensees, the trustees of superannuation funds: fund administration, custody, investment management, and arrangements with promoters and financial planners

This is where offshore teams often get caught. Many sit inside core technology services, and some support risk or internal audit functions. If your offshore team has been treated as a staffing decision rather than a service provider arrangement, that’s the most common gap, and the first one to fix.

When do you need to notify APRA about an offshore arrangement?

Offshoring has its own notification step, and it runs before you sign. CPS 230 has two notification rules, and their timing is different (paragraph 59).

After you sign. If you enter into or materially change an agreement for a service you rely on for a critical operation, you must notify APRA as soon as possible, and within 20 business days.

Before you sign. For any material offshoring arrangement, you must notify APRA before entering into it, or before making a significant change to it. This includes cases where the data or people involved in delivering the service will be located offshore.

The second rule is the one that trips up procurement teams. If your process assumes notification happens after signing, you’ll miss the offshoring step entirely. For offshoring, notification is a gate, not a follow-up.

Does using an Australian provider change anything?

No. What matters is where the work is done, not where the provider is registered. If a provider is incorporated in Australia but its team works offshore, the arrangement is still offshoring.

The reverse also applies: a foreign-incorporated provider doing the work in Australia isn’t offshoring (footnote 16).

Internal audit’s role under CPS 230

The function must review any proposed material arrangement that outsources a critical operation, and report regularly to the Board or Board Audit Committee on whether those arrangements comply with your service provider management policy (paragraph 60).

In practice, internal audit needs to see the proposal early, with the operational detail included. A one-page business case covering headcount and savings won’t give them enough to review.

It’s also worth remembering that CPS 230 doesn’t replace CPS 234 Information Security. Both apply, and offshore teams with access to your systems and data need to meet both.

What does CPS 230 readiness look like for an offshore team

Strip out the interpretation, and a ready arrangement tends to have the same handful of characteristics, whoever delivers it:

• It’s described as a service, not a headcount. What operation does the team support, and is that operation critical?
• Data location is documented, not assumed. Where the people sit, where the data sits, and which systems they access.
• Access is role-based and reviewed regularly, with joiners, movers and leavers handled the same way as onshore staff.
• Someone inside your business owns it. Not just a relationship manager at the provider.
• Fourth parties are visible. Your service provider management policy should cover the parties your material service providers rely on to deliver critical operations.
• Disruption has been tested, not just described. You know what happens if the site, the connection or the provider goes down.

None of this is new. It’s the same discipline a well-run onshore team already has. The difference now is that you need to be able to show it.

Bringing an existing offshore arrangement into line with CPS 230

For arrangements that predate the transition and are now fully in scope, a reasonable order of work looks like this:

1. Classify it first. Does it support a critical operation, or expose you to material operational risk? That answer shapes everything else.
2. Add it to the register. If it’s material, it belongs on the register submitted to APRA each year, with complete details rather than a placeholder.
3. Map the people and the data. Document exactly where the work is done and what’s accessed from there.
4. Check upcoming changes for notification. Any significant change to an offshore arrangement needs APRA notification before it happens, not after.
5. Brief internal audit. Give them what they need to review the arrangement against your policy, and add it to their reporting cycle.
6. Confirm the judgement calls with your advisers. Materiality and notification decisions are exactly the ones to take advice on rather than settle internally.

If you’re building a new offshore team rather than fixing an existing one, the steps are the same, just earlier. Deciding materiality and data location before the contract is drafted is far cheaper than working it out afterwards.

What CPS 230 means if you supply an APRA-regulated firm

CPS 230 applies directly only to APRA-regulated entities, but its reach extends down the supply chain, because those entities must manage the risks of their material service providers and of the parties those providers rely on.

Banks must treat mortgage brokerage as material by default, and insurers must do the same for insurance brokerage, so brokers, aggregators and non-bank lenders working for a bank may already sit on a register that goes to APRA every year.

If your offshore team handles loan applications, client data or settlement support on that work, it may count as a fourth party, and lenders are expected to know about it: contracts with material providers must require notice of material subcontractors, and the provider stays liable for their failures.

In practice, this usually arrives as a questionnaire asking where your offshore staff are located, what data they can access, how access is controlled, what happens if the site goes down, and who owns the arrangement.

Brokers and lenders who can answer those questions quickly, with the evidence to back them up, will find themselves easier partners for lenders working through their own obligations.

Where this leaves offshore capacity

None of this argues against running work offshore. CPS 230 doesn’t prohibit offshoring. It requires offshoring to be identified, governed, notified and overseen.

Firms that already run their offshore team as a genuine part of the business, with named owners, documented processes and real oversight, will have most of the evidence CPS 230 expects.

Firms that treated offshore as an informal extension of a department have more work ahead. In other words, the standard rewards operational maturity, not location.

Providers that build dedicated offshore teams for Australian financial services companies, with defined roles, documented processes and auditable access controls, tend to make that evidence easier to produce, because the operating detail already exists rather than having to be reconstructed.

The transition period is over, but the next step isn’t a policy rewrite. It’s an inventory: what arrangements you have, which are material, where the work is actually done, and whether you can show your workings.