APRA CPS 230: The Material Service Provider Register and the 1 July 2026 Transition

CPS 230 has applied since July 2025. The part most firms have not finished is the part that was given a year’s grace, and that grace runs out on 1 July 2026: the material service provider register and the legacy contracts behind it.

The standard commenced for all APRA-regulated entities on 1 July 2025. When a standard commences, the natural reaction inside a firm is to treat the deadline as passed and move on. That is the trap here. APRA built a transitional bridge specifically for arrangements that were already in place when the standard began, and that bridge is what expires next. If your programme has quietly parked third-party remediation because “CPS 230 went live last year,” the register and the contracts are the work that is now actually due.

What the 1 July 2026 date actually covers

Two distinct transitional accommodations converge on this date, and it is worth being precise about both because they are frequently conflated.

The first concerns pre-existing service-provider contracts. For arrangements that were already on foot before the standard commenced, the CPS 230 requirements apply from the earlier of the contract’s next renewal date or 1 July 2026. In plain terms: a contract that renews before mid-2026 had to be brought into line at renewal; everything else has a hard stop on 1 July 2026 regardless of where it sits in its term. That is the accommodation that lets firms remediate a portfolio of legacy agreements over time rather than reopening every contract at once on day one.

The second concerns non-significant financial institutions, which were given an additional twelve months to 1 July 2026 on the business continuity and scenario-analysis requirements, remaining subject to the predecessor standards in the interim. Significant financial institutions had no such extension.

The common thread is that 1 July 2026 is not a second commencement date. It is the point at which the last accommodation falls away and every in-scope firm is expected to be fully operating the standard, including on its inherited third-party estate. Treating it as a soft target is the mistake.

The register is not a spreadsheet exercise

A material service provider, under CPS 230, is one the entity relies on to undertake a critical operation or that otherwise exposes it to material operational risk. The standard also deems certain classes material by default: for all regulated entities, that includes risk management, core technology services and internal audit; for ADIs, it extends to areas such as credit assessment, funding and liquidity management, and mortgage origination. You do not get to argue those out of scope.

APRA released a register template in October 2024 and has collected the register through its APRA Connect return. The point people miss is that the register is not an inventory of suppliers. It is a mapping. Each material provider has to be tied to the specific critical operation it supports, to a named internal owner, and to the significant downstream dependencies sitting behind it — the fourth parties your provider relies on to deliver to you. A list of vendor names with spend figures is not that. If the register cannot answer “which critical operation fails if this provider goes dark, and who owns that relationship,” it is not doing the job the standard asks of it.

This is where the register connects to the rest of the standard. The provider mapping only makes sense once your critical operations and tolerance levels are defined, because materiality is judged against them. Firms that tried to build the register before settling their critical-operations map ended up with a document that reads plausibly but cannot be defended when a supervisor asks how a given provider was classified.

Contract remediation is the slow part

Populating a register is weeks of work. Remediating the contracts behind it is months, because it depends on a counterparty agreeing to change terms. CPS 230 expects material service-provider agreements to address matters such as service scope and levels, the entity’s ability to continue meeting its regulatory obligations, notification of material subcontracting, business-continuity and incident cooperation, audit and access rights, and — critically — that nothing in the arrangement obstructs APRA’s ability to perform its functions. Many legacy contracts, particularly with large global technology vendors, contain none of this in the form the standard wants.

The negotiating reality is unglamorous. A hyperscaler or a core banking vendor will not rewrite its master agreement for one Australian customer; you are working within their standardised addenda, and the leverage is thin unless a renewal or a new workload is on the table. This is why the transitional runway existed at all, and why leaving it to the final quarter is dangerous. The firms in trouble now are the ones that scoped the register in 2025, saw how many agreements needed reopening, and let the negotiations drift. The clause set here is not exotic — it overlaps substantially with what other regimes now demand of service-provider contracts and the telemetry behind them — but overlap does not remediate the contract for you.

A register schema that carries remediation status

The most useful thing an engineering function can do is stop maintaining the register as a static return and hold it as data, with contract-remediation status as a first-class field. Then “how many material providers still have non-compliant contracts, and when do they renew” is a query, not a fire drill. A minimal shape:

-- Material service provider register with remediation tracking (CPS 230)
CREATE TABLE msp_register (
    provider_id           TEXT PRIMARY KEY,
    legal_entity_name     TEXT NOT NULL,
    service_description   TEXT NOT NULL,
    -- Why this provider is material: deemed class, or risk-based judgement
    materiality_basis     TEXT NOT NULL CHECK (materiality_basis IN
                          ('deemed_class','critical_operation','material_risk')),
    critical_operation_id TEXT REFERENCES critical_operation(operation_id),
    internal_owner        TEXT NOT NULL,          -- named accountable person
    -- Significant fourth parties this provider depends on to deliver
    key_subcontractors    TEXT,
    exempt_provider       BOOLEAN NOT NULL DEFAULT FALSE,  -- e.g. regulator, exchange
    contract_expiry       DATE,
    next_renewal_date     DATE,
    -- Remediation state drives the reporting; not a free-text note
    remediation_status    TEXT NOT NULL CHECK (remediation_status IN
                          ('not_started','in_negotiation','clauses_agreed','compliant')),
    remediation_due       DATE NOT NULL,          -- earlier of renewal or 2026-07-01
    last_reviewed         DATE NOT NULL
);

-- What is still outstanding, most urgent first
SELECT provider_id, legal_entity_name, remediation_status, remediation_due
FROM   msp_register
WHERE  remediation_status <> 'compliant'
  AND  exempt_provider = FALSE
ORDER  BY remediation_due ASC;

The exemption flag matters because APRA finalised targeted amendments in 2026 giving limited relief from certain contractual requirements for defined non-traditional providers — government agencies, regulators, central banks and financial market exchanges among them — with the amended treatment operating from 1 July 2026. Those providers still belong on the register; the relief is from specific contract terms, not from the mapping and oversight. Do not use the flag to quietly drop them.

What a supervisor will ask for

The evidentiary bar is concrete, and it is the same instinct that runs through the whole of CPS 230: show me, do not tell me. A current register that maps each material provider to a critical operation and an owner. The remediated contracts, or a dated plan for the handful still in negotiation with the reason each is delayed. Evidence that materiality was assessed against your critical operations, not assumed. And a board or committee that has seen the residual gaps, not a management assurance that everything is fine.

The register was the easy deliverable and most firms have one. The contracts are where the exposure sits, and the clock on them was always 1 July 2026. If the answer to “how many material providers are still on unremediated legacy terms” is a shrug, that is the position to fix before the accommodation is gone, not after.