Do sole traders need to comply with APRA CPS 230 (Operational Risk Management)?

Yes. Looking in the 3 industries it can reach and every size band, the engine's answer for a sole trader is: yes.

Do businesses with 1–5 employees need to comply with APRA CPS 230 (Operational Risk Management)?

Yes (1–5 employees, turnover $100K–$1M).

Who must comply with APRA CPS 230 (Operational Risk Management)?

What the obligation is

APRA-regulated entities must manage operational risk including a comprehensive third-party / outsourcing register from 1 July 2025.

CPS 230 (in force from 1 July 2025) replaces CPS 231 (outsourcing) and CPS 232 (business continuity). Requires APRA-regulated entities to identify critical operations, set tolerance levels for disruption, maintain a comprehensive register of material service providers, manage concentration risk, and conduct testing.

The applicability test

Applies when the business has APRA regulation.

How the regulator frames it: All APRA-regulated entities (ADIs, insurers, RSE licensees).

What triggers it: Being APRA-regulated.

Jurisdiction: Commonwealth law, so the test is the same in every state and territory.

Which industries are in or out

Outcome across the 35 industries Rules Mate maps (3 of 35: yes; 32 of 35: no).

Industry	Answer
Banks & ADIs	Yes
Superannuation trustees	Yes
Private health insurers	Yes
No	32 other industries

Business structure and size

Structure does not change the answer in the 3 industries it can reach: for every structure the answer is "yes".

Size does not change the answer in the 3 industries it can reach: at every size band the answer is "yes".

Worked examples

Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:

Pty Ltd company in banks & adis with 6–19 employees, turnover $1M–$3M: applies. ADI — APRA-regulated.
Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: does not apply. Requires APRA regulation.

Answers that bring it into scope

Starting from a small or large professional services company that does not otherwise meet the test, each of these single facts changes the engine's answer:

The business is regulated by APRA: it then applies (APRA-regulated).

What you must do, and when

When due: Continuous from 1 July 2025; pre-existing arrangements transition through 30 June 2026.
Frequency: Ongoing
Evidence to keep: Critical operations register, service provider register, tolerance levels, business continuity test results, board attestation.
In force from: 1 July 2025
Status: Current
Priority: Critical

Penalty for not complying

Maximum penalty: APRA directions, additional capital, licence conditions.

Audit or assurance level

Rules Mate has not yet classified the audit or assurance level for this obligation. Any audit, review or certification requirement is set by the regulator source listed below.

Dates in the compliance calendar

APRA CPS 230 Operational Risk in force: 1 July 2025 (one-off). Replaces CPS 231 + 232; material service providers register filings due.

Enforcement examples

APRA CPS 230 in force from 1 July 2025 (2025): APRA-regulated entities + their material service providers must demonstrate CPS 230 compliance + governance.

Obligations with the same applicability test

If this obligation applies to you, so do these 4: the engine uses the same rule for each.

What usually applies alongside it

Across the 1,890 business profiles Rules Mate evaluates, these obligations apply to most of the businesses this one applies to, and are far more common among them than among businesses generally:

Where it sits in the corpus

Rules Mate tracks 3 published obligations tagged "apra", 3 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 0 of those apply outright. This obligation is rated critical priority, and is an ongoing duty.

Regulator, legislation and tools

Regulated by Australian Prudential Regulation Authority.

APRA: Prudential regulator of banks (ADIs), insurers (general, life, private health), and superannuation funds. Sets and enforces CPS standards including CPS 234 (information security) and CPS 230 (operational risk).

Australian Prudential Regulation Authority

Banking Act 1959: Authorises APRA to regulate authorised deposit-taking institutions (banks, building societies, credit unions).

Insurance Act 1973: Prudential supervision of general insurers by APRA.

SIS Act: Federal supervision of superannuation.

Free tools that help with this obligation:

Run the compliance journeyAnswer a short questionnaire about your business and get the obligations that apply to you, with the reason each one applies.

Questions

Who must comply with APRA CPS 230 (Operational Risk Management)?: Applies when the business has APRA regulation.
Do sole traders need to comply with APRA CPS 230 (Operational Risk Management)?: Yes. Looking in the 3 industries it can reach and every size band, the engine's answer for a sole trader is: yes.
Do businesses with 1–5 employees need to comply with APRA CPS 230 (Operational Risk Management)?: Yes (1–5 employees, turnover $100K–$1M).
When is "Comply with APRA CPS 230 (Operational Risk Management)" due?: Continuous from 1 July 2025; pre-existing arrangements transition through 30 June 2026.

Sources

Computed by the Rules Mate applicability engine from the published obligation corpus; facts last checked 3 October 2026. Rules Mate is not a law firm and this is general information, not legal advice. Confirm your position with the regulator source or a qualified adviser before acting.