AUSTRALIA HUBPrudential
APRA
Australian Prudential Regulation Authority
CPS 234 · CPS 230 · 22 control touchpoints
Who it applies to
Banks, insurers, superannuation funds and private health insurers.
Key instruments
- 01CPS 234 Information Security — board accountable, 72-hour material incident notification
- 02CPS 230 Operational Risk Management — effective 1 July 2025
- 03CPS 220 Risk Management — board-approved risk appetite statement
- 04CPG 235 Managing Data Risk — data quality lifecycle guidance
Compliance calendar
- CPS 230 effective — 1 Jul 2025
- CPS 230 pre-existing contracts transition — 1 Jul 2026
- Tripartite cyber assessments — ongoing cycle
Penalty framework
Directions powers, licence conditions, capital overlays and disqualification of accountable persons under FAR.
Need the full control catalogue?
Templates, applicability matrices and board-paper skeletons for APRA.