Do private health insurers need to comply with APRA CPS 230 (Operational Risk Management)?
A computed answer from the Rules Mate applicability engine, with the exact condition, the outcome for every structure and size, and the primary source.
Short answer: Yes
Yes. This obligation applies to private health insurers whatever their structure or size. The deciding fact: Private health insurer — APRA-regulated.
The obligation in brief
Comply with APRA CPS 230 (Operational Risk Management). CPS 230 (in force from 1 July 2025) replaces CPS 231 (outsourcing) and CPS 232 (business continuity). Requires APRA-regulated entities to identify critical operations, set tolerance levels for disruption, maintain a comprehensive register of material service providers, manage concentration risk, and conduct testing.
Trigger: Being APRA-regulated.
Why private health insurers get a different answer
Rules Mate runs its applicability engine across 9 business structures and 6 size bands for each of the 35 industries it maps. For 32 of those industries the answer for "Comply with APRA CPS 230 (Operational Risk Management)" is no. Private health insurers is one of the 3 where the answer is different: yes.
The deciding fact for private health insurers: Private health insurer — APRA-regulated.
About the industry: Insurers regulated by APRA under the Private Health Insurance Act.
Compare a professional services (general) business with 6–19 employees structured as a Pty Ltd company: the obligation does not apply (Requires APRA regulation).
Answer by business structure and size
Each cell is the engine's outcome for a business in private health insurers with that structure and size, assuming it sells to consumers and small businesses and holds customer contact details. "Check" means the obligation turns on a fact the industry does not settle.
| Structure | No employees | 1–5 employees | 6–19 employees | 20–99 employees | 100–499 employees | 500+ employees |
|---|---|---|---|---|---|---|
| Sole trader | Yes | Yes | Yes | Yes | Yes | Yes |
| Partnership | Yes | Yes | Yes | Yes | Yes | Yes |
| Trust | Yes | Yes | Yes | Yes | Yes | Yes |
| Pty Ltd company | Yes | Yes | Yes | Yes | Yes | Yes |
| Public company | Yes | Yes | Yes | Yes | Yes | Yes |
| Not-for-profit (unregistered) | Yes | Yes | Yes | Yes | Yes | Yes |
| Registered charity | Yes | Yes | Yes | Yes | Yes | Yes |
| Super fund | Yes | Yes | Yes | Yes | Yes | Yes |
| Foreign company | Yes | Yes | Yes | Yes | Yes | Yes |
What the obligation requires
- When due
- Continuous from 1 July 2025; pre-existing arrangements transition through 30 June 2026.
- Evidence to keep
- Critical operations register, service provider register, tolerance levels, business continuity test results, board attestation.
- Maximum penalty
- APRA directions, additional capital, licence conditions
- Regulator
- APRA
- Jurisdiction
- Commonwealth (national)
Other obligations where private health insurers differ from the norm
- Comply with APRA CPS 234 (Information Security): Yes
- Comply with Design and Distribution Obligations (DDO): Yes
- Comply with Financial Accountability Regime (FAR) accountability obligations: Yes
- Design and Distribution Obligations (DDO) — RG 274: Yes
- FAR deferred remuneration arrangements (40% deferral 4 years): Yes
- Comply with Private Health Insurance Act 2007 + APRA rules: Yes
Other industries with a non-default answer
Questions
- Do private health insurers need to comply with APRA CPS 230 (Operational Risk Management)?
- Yes. This obligation applies to private health insurers whatever their structure or size. The deciding fact: Private health insurer — APRA-regulated.
- Is the answer the same for every industry?
- No. For 32 of the 35 industries Rules Mate maps, the answer is no. Private health insurers is one of 3 industries with a different answer.
Related
Sources
- APRA: official source
- Banking Act 1959
- Insurance Act 1973
- Superannuation Industry (Supervision) Act 1993
- APRA guidance
Computed by the Rules Mate applicability engine from the published obligation corpus; facts last checked 3 October 2026. Rules Mate is not a law firm and this is general information, not legal advice. Confirm your position with the regulator source or a qualified adviser before acting.