CPS 230 does not apply to you. Your investors will apply it anyway.

Somewhere in the last year, a contract variation probably arrived from a superannuation trustee you manage money for. It wanted incident notification measured in hours, audit and access rights, business continuity commitments and a standing flow of information about your operations. That was CPS 230 arriving at your door, by contract rather than by regulation.

The mechanism

APRA's Prudential Standard CPS 230 Operational Risk Management commenced on 1 July 2025, with a revised version in force from 1 July 2026. It binds APRA-regulated entities: banks, insurers and superannuation trustees. A standalone private credit manager holding an AFSL is none of those things, and CPS 230 imposes no direct obligation on it.

But the standard reaches further than its addressees. For a superannuation trustee, investment management is a critical operation, and an investment manager is presumptively a material service provider. The trustee must maintain a register of those providers and submit it to APRA annually, conduct due diligence on them, and (this is the part that lands on your desk) embed specified terms in the management agreement itself.

The clocks are the sharp edge

Under the current standard, a trustee must notify APRA within 24 hours of a disruption to a critical operation outside tolerance, and within 72 hours of becoming aware of a material operational risk incident. Those are the trustee's clocks, and the trustee can only meet them if its managers report upstream faster still. So management agreements now routinely oblige the manager to give notice in hours, with structured content, about incidents the manager might once have handled quietly.

CPS 234 works the same way on the information security side, and has since 2019: 72 hours for material incidents (including incidents that only potentially affect the trustee's interests) and 10 business days for control weaknesses that cannot be promptly remediated. When your systems hold a trustee's information assets, its CPS 234 obligations attach to them, and its assurance programme reaches into your control environment.

What a manager actually has to be able to produce

The pattern across register submissions, due diligence cycles and the FSC's fund manager due diligence questionnaire is consistent. A trustee will ask for:

• Incident records with timestamps, plus evidence they would have met the notice periods in the IMA
• Business continuity evidence, which means the test results (including scenarios where you are the disruption) rather than the plan document
• Control attestations: security certifications or reports (ISO 27001, SOC 2 Type II), an Essential Eight position, penetration tests
• Sub-provider visibility: who your critical suppliers are, because their risk is now the trustee's risk too
• Register data: the operational information the trustee needs for its own annual APRA submission

None of it is exotic, but all of it is scattered across your ticketing system, your identity provider, your cloud accounts, your BCP documents and your administrators. Doing the work is the easy part. Proving it, on a trustee's timetable, every cycle, is the grind.