The Australian Prudential Regulation Authority (APRA) has confirmed two further measures to simplify its prudential framework, withdrawing a cloud outsourcing information paper and ceasing an ad hoc COVID-19-related banking data collection. APRA has rescinded its 2018 Information Paper “Outsourcing Involving Cloud Computing Services”, citing Prudential Standard CPS 230 Operational Risk Management, which will provide formal supervisory coverage for entities with cloud service provider arrangements. The withdrawal follows industry feedback and is intended to reduce regulatory burden and improve clarity on expectations for material service provider arrangements, with APRA-regulated entities expected to meet CPS 230 requirements when using cloud services to manage associated risks and support operational resilience. Separately, APRA has stopped collecting “ARF 923.0 Covid-19 Capital and Credit”, with the final submission covering the period ending 31 January 2025, following a regular review of ad hoc data collections and earlier cessations in 2023 and 2024. CPS 230 comes into effect on 1 July 2025, replacing Prudential Standard CPS 231 Outsourcing and Prudential Standard CPS 232 Business Continuity Management.
Australian Prudential Regulation Authority 2025-02-19
Australian Prudential Regulation Authority rescinds cloud outsourcing guidance ahead of CPS 230 and ends ARF 923.0 Covid-19 reporting
The Australian Prudential Regulation Authority (APRA) has withdrawn its 2018 cloud outsourcing information paper and ceased COVID-19-related banking data collection to simplify its prudential framework. These changes align with the upcoming implementation of Prudential Standard CPS 230 Operational Risk Management on 1 July 2025, replacing existing standards and providing formal supervisory coverage for cloud service arrangements.