CPS 230 Offshoring: Notify APRA Before, Not After

A common line in vendor paperwork says an APRA-regulated entity has "20 business days to notify APRA" about a new outsourcing arrangement. For offshoring, that is wrong, and the mistake matters because the right answer changes when the conversation with APRA has to happen.

CPS 230 is APRA's operational risk standard. It applies to APRA-regulated entities: authorised deposit-taking institutions, general, life and private health insurers, and RSE licensees, the trustees of super funds (para 2). It first took effect on 1 July 2025. A revised version released on 30 April 2026 took effect on 1 July 2026 and renumbered some paragraphs. The references below are to the current version. In the 2023 version, each notice paragraph was one lower.

Two notices, two clocks

Paragraph 60 contains two separate obligations, and they run on different clocks.

Law. Paragraph 60(a) requires notice "as soon as possible and not more than 20 business days after entering into or materially changing an agreement for the provision of a service on which the entity relies to undertake a critical operation". That is the 20 business days people remember, and it runs after the event.

Law. Paragraph 60(b) requires notice "prior to entering into any material offshoring arrangement, or when there is a significant change proposed to the arrangement, including in circumstances where data or personnel relevant to the service being provided will be located offshore". That one runs before the event. If a material arrangement involves offshoring, APRA hears about it before the contract is signed, not within a month of it.

Notice is not permission. CPS 230 does not prohibit offshoring. But a notice that must precede signing belongs early in procurement, which is where most firms do not look for it.

Offshoring is about where the work happens

Law. Footnote 16 defines the term by the location of the service, not the nationality of the provider. Offshoring "includes arrangements where the service provider is incorporated in Australia, but the physical location of the service being provided is undertaken outside Australia". It "does not include arrangements where the physical location of a service is performed within Australia, but the service provider is not incorporated in Australia."

Two consequences follow. A foreign company running a service in an Australian region is not offshoring for this purpose. An Australian company whose support team, processing or data sits overseas can be. The contract counterparty's address tells you very little. What you need to know is where the work is done and where the data relevant to it sits.

Which arrangements are material

Law. Paragraph 48 defines material service providers as "those on which the entity relies to undertake a critical operation or that expose it to material operational risk". Paragraph 49 then lists services that must be treated as material "unless it can justify otherwise". For every APRA-regulated entity, that includes "risk management, core technology services and internal audit" (para 49(d)). For an RSE licensee it also includes "fund administration, custodial services, investment management and arrangements with promoters and financial planners" (para 49(c)).

For the fund managers and advisers who serve super funds, paragraph 49(c) is the line to notice. CPS 230 is addressed to the trustee, and the trustee must treat an investment management mandate or a financial planner arrangement as material unless it can justify otherwise. That is our reading of why these firms feel CPS 230 through their clients' due diligence, even though the standard is not addressed to them.

What a material agreement must contain

Law. Before entering a material arrangement, the entity must assess risks "including risks associated with geographic location or concentration of the service provider(s) or parties the service provider relies on in providing the service" (para 52(b)). The agreement must address matters "including in relation to the ownership of assets, ownership and control of data, dispute resolution, audit access, liability and indemnity" (para 53(b)), and must "allow APRA access to documentation, data and any other information related to the provision of the service" (para 54(a)).

The July 2026 revision added exemptions for arrangements on standardised terms with a listed set of providers, such as government agencies, regulators, central banks, exchanges, clearing and settlement operators, payment systems and financial messaging infrastructures (para 57). Cloud and AI vendors are not on that list.

Guidance. APRA's practice guide, CPG 230 (para 55), says a prudent entity would assess the risks of a provider in another jurisdiction, including "impediments, legal and technical, to APRA being able to fulfil its duties, including timely access to information in a usable form". CPG 230 says of itself that practice guides "do not themselves create enforceable requirements". It is still how APRA explains what it expects.

Where AI changes the analysis

Guidance. APRA rescinded its 2018 information paper on cloud outsourcing on 19 February 2025 and said entities "will be expected to comply with CPS 230 requirements when using cloud services". Material that still cites the 2018 paper is out of date.

An AI system adds a location that procurement often misses: the model endpoint, the address the system sends text to for the model to process. A tool can be hosted in an Australian region and still send each request to a model running elsewhere. Under paragraph 60(b), what matters is whether "data or personnel relevant to the service being provided will be located offshore". Whether that makes a given arrangement a material offshoring arrangement is a judgement the entity has to make and document. The endpoint is part of the facts it has to know first.

The same applies to support. If a vendor's engineers can reach your environment from another country, that is personnel relevant to the service located offshore.

Law. None of this moves accountability. "The Board of an APRA-regulated entity is ultimately accountable for oversight of an entity's operational risk management. This includes business continuity and the management of service provider arrangements" (para 19).

Questions for the procurement file

Ask every AI vendor, before the contract rather than after it, to state in writing where the service is physically performed, which model endpoints the system calls and in which regions, and from where its staff can access your environment. BackPro deploys into the customer's own cloud account, and we name the endpoints and access for each deployment. Being in your own account does not settle paragraph 60(b) by itself. The endpoint and the support access still have to be known.

Our whitepaper, Where the data sits, sets CPS 230 beside the Privacy Act and the licensee obligations. For the wider question of whether any Australian law requires financial data to stay onshore, see our answer to that question.

The practical change is one of timing. A paragraph 60(b) notice has to exist before signing, so the three facts it depends on have to be in the file before the contract is drafted.