Do banks and ADIs need to comply with APRA CPS 230 (Operational Risk Management)?
A computed answer from the Rules Mate applicability engine, with the exact condition, the outcome for every structure and size, and the primary source.
Short answer: Yes
Yes. This obligation applies to banks and ADIs whatever their structure or size. The deciding fact: ADI — APRA-regulated.
The obligation in brief
Comply with APRA CPS 230 (Operational Risk Management). CPS 230 (in force from 1 July 2025) replaces CPS 231 (outsourcing) and CPS 232 (business continuity). Requires APRA-regulated entities to identify critical operations, set tolerance levels for disruption, maintain a comprehensive register of material service providers, manage concentration risk, and conduct testing.
Trigger: Being APRA-regulated.
Why banks & adis get a different answer
Rules Mate runs its applicability engine across 9 business structures and 6 size bands for each of the 35 industries it maps. For 32 of those industries the answer for "Comply with APRA CPS 230 (Operational Risk Management)" is no. Banks & ADIs is one of the 3 where the answer is different: yes.
The deciding fact for banks and ADIs: ADI — APRA-regulated.
About the industry: Authorised deposit-taking institutions regulated by APRA under the Banking Act 1959.
Compare a professional services (general) business with 6–19 employees structured as a Pty Ltd company: the obligation does not apply (Requires APRA regulation).
Answer by business structure and size
Each cell is the engine's outcome for a business in banks & adis with that structure and size, assuming it sells to consumers and small businesses and holds customer contact details. "Check" means the obligation turns on a fact the industry does not settle.
| Structure | No employees | 1–5 employees | 6–19 employees | 20–99 employees | 100–499 employees | 500+ employees |
|---|---|---|---|---|---|---|
| Sole trader | Yes | Yes | Yes | Yes | Yes | Yes |
| Partnership | Yes | Yes | Yes | Yes | Yes | Yes |
| Trust | Yes | Yes | Yes | Yes | Yes | Yes |
| Pty Ltd company | Yes | Yes | Yes | Yes | Yes | Yes |
| Public company | Yes | Yes | Yes | Yes | Yes | Yes |
| Not-for-profit (unregistered) | Yes | Yes | Yes | Yes | Yes | Yes |
| Registered charity | Yes | Yes | Yes | Yes | Yes | Yes |
| Super fund | Yes | Yes | Yes | Yes | Yes | Yes |
| Foreign company | Yes | Yes | Yes | Yes | Yes | Yes |
What the obligation requires
- When due
- Continuous from 1 July 2025; pre-existing arrangements transition through 30 June 2026.
- Evidence to keep
- Critical operations register, service provider register, tolerance levels, business continuity test results, board attestation.
- Maximum penalty
- APRA directions, additional capital, licence conditions
- Regulator
- APRA
- Jurisdiction
- Commonwealth (national)
Other obligations where banks & adis differ from the norm
- Comply with APRA CPS 220 (Risk Management): Yes
- Comply with APRA CPS 234 (Information Security): Yes
- Comply with Australian sanctions law + screening (DFAT): Yes
- Comply with Design and Distribution Obligations (DDO): Yes
- Comply with Financial Accountability Regime (FAR) accountability obligations: Yes
- Comply with NCCP responsible lending obligations: Yes
- All 32 answers for banks & adis
Other industries with a non-default answer
Questions
- Do banks and ADIs need to comply with APRA CPS 230 (Operational Risk Management)?
- Yes. This obligation applies to banks and ADIs whatever their structure or size. The deciding fact: ADI — APRA-regulated.
- Is the answer the same for every industry?
- No. For 32 of the 35 industries Rules Mate maps, the answer is no. Banks & ADIs is one of 3 industries with a different answer.
Related
Sources
- APRA: official source
- Banking Act 1959
- Insurance Act 1973
- Superannuation Industry (Supervision) Act 1993
- APRA guidance
Computed by the Rules Mate applicability engine from the published obligation corpus; facts last checked 3 October 2026. Rules Mate is not a law firm and this is general information, not legal advice. Confirm your position with the regulator source or a qualified adviser before acting.