CPS 230 for Superannuation Trustees: The Operational Risk Uplift RSE Licensees Underestimated

The assumption I keep meeting inside super funds is that CPS 230 is a banking standard that grazes them lightly. It is exactly backwards. A trustee that outsources administration, custody and unit pricing has moved most of its operational risk outside its own walls, and CPS 230 is written to follow it there.

APRA’s Prudential Standard CPS 230 Operational Risk Management came into effect on 1 July 2025. It is a cross-industry standard, and superannuation is squarely in scope: registrable superannuation entity (RSE) licensees sit alongside banks and insurers under the same obligations. For pre-existing service provider contracts there is a transitional window, with compliance required from the earlier of the next contract renewal or 1 July 2026, and non-significant institutions were given the same 1 July 2026 date to meet the business continuity and scenario-analysis requirements. That date is now the operative one for most funds, and it is closer than the work in front of them.

Why the standard bites super harder than most

A large bank runs a great deal of its critical processing in-house. A superannuation trustee, by contrast, typically operates one of the most outsourced models in regulated finance. The administrator runs member records, contributions, rollovers, benefit payments and unit pricing. The custodian holds the assets, settles trades and produces the investment accounting. Registry, insurance administration, and often the entire investment-operations middle office sit with third parties too. The trustee’s own staff may number in the low hundreds while the operation that actually delivers member outcomes runs across several external firms.

CPS 230 collapses the old comfort of that arrangement. It replaced the earlier outsourcing and business continuity standards, including SPS 231 and SPS 232 for superannuation, and it refuses the distinction those standards leaned on between risk you run and risk you have handed to a provider. The obligation to keep a critical operation within tolerance stays with the trustee regardless of who performs the work. An outsourced function is not an outsourced risk. That single sentence is the whole shift, and it is the one most funds have not yet internalised.

Critical operations run through other people’s systems

CPS 230 asks a trustee to identify its critical operations and set tolerance levels for each: the maximum period of disruption, the maximum extent of data loss, and the minimum service level the trustee will tolerate before member harm becomes unacceptable. For a super fund, the honest list of critical operations reads almost entirely as things it does not perform itself. Processing a contribution. Paying a death or disability benefit. Striking a daily unit price. Executing a member investment switch. Settling a trade. Each of those is a critical operation, and each of them lives inside an administrator’s or custodian’s platform.

This is where the uplift is genuinely hard. Setting a tolerance is not an internal exercise you can complete from your own runbooks. A tolerance for unit pricing is only real if the administrator’s recovery capability can actually meet it, and you can only know that by looking inside their process, their dependencies and their own recovery testing. Most trustees have never had that visibility, because the outsourcing contracts were written to service levels and penalties, not to disruption tolerances and evidence. Deriving a defensible tolerance and then proving your provider can hold it is the core of the work, and it is the same discipline whether the operation is yours or theirs. I have set out the mechanics of that in building the evidence for critical operations and tolerance levels; for super the difference is that almost every tolerance you set is one you cannot meet on your own.

The material service provider register is not a vendor list

CPS 230 requires a register of material service providers and a lift in how those arrangements are managed, monitored and evidenced. The temptation is to export the existing procurement or vendor-management spreadsheet, rename it, and call it done. That produces a list of suppliers. It does not produce what the standard is actually after, which is a mapping of which providers your critical operations depend on, what would happen to a member if that provider failed, and how you would know in time to act.

The gaps show up fast once you map dependencies rather than contracts. The administrator is obvious. Less obvious is the administrator’s own reliance on a cloud platform, a print-and-mail house, an identity provider, or a payments gateway that the trustee has never contracted with and cannot see. Under CPS 230 those fourth parties are not out of scope simply because you have no contract with them; if a critical operation depends on them, the trustee has to understand and manage that dependency. The register has to reach through the administrator to the things the administrator relies on. That is a materially different artefact from the vendor list, and the transitional detail of getting there is the subject of the material service provider register and the 1 July 2026 transition.

Evidence you do not hold and cannot fabricate

The quiet problem underneath all of this is evidentiary. CPS 230 is a standard that expects you to show, not assert. APRA will ask to see the tolerances, the dependency mapping, the results of business continuity and scenario testing, and evidence that your material providers can actually recover within the tolerances you have set. For an in-house operation you can produce that from your own systems. For an outsourced operation you can only produce it if your provider gives it to you, and most administration and custody contracts signed before CPS 230 give the trustee no right to that evidence, no access to the provider’s own testing, and no obligation on the provider to participate in the trustee’s scenario analysis.

That is why the 1 July 2026 date is a contracting deadline as much as a risk one. The evidence you will need in an APRA engagement has to be written into the arrangement before you can obtain it, which means the harder conversations are with providers whose contracts do not renew for years. Extracting SOC reports, control evidence and testing rights from material providers is a negotiation, not a request, and it is covered in getting assurance evidence from material providers. The trustees who left it until the contracts are near renewal have the least leverage at exactly the moment they need the most.

Where the work actually sits

The uplift RSE licensees underestimated is not a policy document; it is the reconstruction of visibility into an operating model they deliberately handed away. CPS 230 does not care that the administrator strikes the unit price or the custodian settles the trade. It holds the trustee to the outcome, and it asks for evidence the trustee has never had a reason to collect. As I argued when the standard landed, CPS 230 is a proof standard wearing a policy standard’s clothes — and a fund that owns almost none of its own processing has the most to prove and the least in hand to prove it with.

Map the administrator and custodian dependencies now, set the tolerances against what those providers can genuinely deliver, and treat every unrenewed contract as a gap in your own evidence. The trustee that assumed an outsourced function was an outsourced risk will discover, in its first supervisory conversation, that APRA never agreed to that trade.