APRA CPS 230 and third-party compliance

A new standard for Australian financial institutions is here. Is your third-party risk management strong enough for compliance?

[ Three Pillars of CPS 230 ]

A comprehensive framework for operational resilience

APRA's Prudential Standard CPS 230 is a regulatory requirement that aims to improve the resilience of financial institutions against disruptions. The new standard takes effect from July 1st, 2025.

How UpGuard can help you comply

UpGuard strengthens and simplifies CPS 230 compliance by helping you manage the third-party risks that threaten operational stability.

Detect risks instantly

Rely on around-the-clock monitoring to detect vendor risks in real time.

Assess more vendors

Accelerate vendor assessments with time-saving automations.

Reinforce your processes

Manage incidents and improve record keeping with end-to-end workflows.

Operational Risk Management

Establish an effective risk management framework

CPS 230 requires financial institutions to create a strong framework for managing operational risks.

You must identify critical operations, assess risks, and implement controls to prevent and respond to potential disruptions. As an institution, you must regularly update your risk profiles to reflect any changes in your operations or risk environment.

Use UpGuard to

  • Constantly monitor vendors and supply chains
  • Perform comprehensive vendor risk assessments
  • Identify fourth-parties automatically
  • Tier critical vendors on the disruption risk they pose
  • Automatically detect software vulnerabilities on any IP
  • Easily centralise vendor incident management policies
  • Quickly understand the impact of critical vendors
Operational Risk Management

Improve resiliency to new external threats

Institutions must develop a flexible and effective Business Continuity Plan (BCP) to efficiently respond to disruptions.

Your plan should be regularly updated and tested to ensure it remains effective against new threats. You are required to keep a complete register of all critical operations, including those managed by third parties, to maintain service continuity for customers.

Detect, document, and react to risks with confidence.

Use UpGuard to

  • Attain complete visibility of vendor cyber risks
  • Notify stakeholders about critical events
  • Access real-time vendor risk insights
Service Provider Management

Manage the inherent risks of service providers

With an increasing reliance on third and fourth-party service providers, CPS 230 emphasises the criticality of vendor and supplier risk management.

Your organisation must identify key service providers, assess risks, and develop strategies to reduce any negative impacts on operations. Ongoing monitoring and quick response to incidents are crucial for staying compliant with the standard.

UpGuard reduces the complexity of managing service providers and speeds up response times.

Use UpGuard to

  • Maintain a comprehensive vendor risk management program
  • Detect critical compliance gaps automatically
  • Automate third-party risk management
  • Generate custom APRA reporting workflows
  • Quickly create reports for monitored vendors
  • Automatically schedule reporting to stakeholders
  • Create records for regulatory audits and compliance reviews
eBook

Is Your Organisation Ready for APRA CPS 230?

Prepare for new regulations with our in-depth guide to CPS 230 and its requirements for third-party risk management.