The seven days before 1 July

A week out from a deadline, the honest question is not what is left to do. It is what can still be done in the time that remains, and what cannot.

CPS 230 applies to non-significant institutions from 1 July. For those entities, the deferred requirements, business continuity planning and scenario analysis, commence on that date. A framework that does not exist on 23 June will not exist, in any real form, on 1 July. So the final week is not the week to design one. Trying to is how teams spend their last days producing a document that looks finished and holds nothing. The framework you have is the framework you take into the deadline. The useful work now is narrower, and most of it sits in two places.

The first is the register. The material service provider register is the artefact that can be seen from outside. It is the list APRA can ask for, and the one that says, in a single view, whether the entity knows which arrangements its critical operations depend on. The targeted amendments finalised on 30 April changed the register template. An entry made against the old template, or one that misclassifies an arrangement, is a visible miss on the first day, not a hidden one. The register is finishable in a week. It rewards the time more than anything else on the list.

The second is contracts. The standard applies to a pre-existing service provider arrangement from the earlier of the contract's next renewal or 1 July. That word earlier matters. An arrangement renewing in July is in scope now, not later. The work is not to renegotiate every contract this week. It is to know which arrangements reach the trigger first, and to have the required terms ready so a renewal does not stall against a clause no one drafted.

What cannot be fixed in a week is the thing teams reach for first: a new policy, a fresh framework, a control that has never been tested. The resilience the standard asks for is demonstrated, not declared. A business continuity plan written on 30 June and never exercised is a plan in name. Better to take an honest, partly built position into 1 July and keep working than to dress an empty one as complete. The deadline is not the finish. It is the date from which the entity is held to what it has.

So the week's question, for an institution or a vendor serving one: is the register true, and are the contracts that renew first ready. Everything else can keep moving after the date.

CPS 230, APRA's operational risk management standard, applies to significant financial institutions from 1 July 2025 and to non-significant financial institutions from 1 July 2026. For non-SFIs, the requirements deferred by twelve months, business continuity planning and scenario analysis, commence on 1 July 2026. Where a regulated entity has a pre-existing arrangement with a service provider, the standard applies to that arrangement from the earlier of the contract's next renewal or 1 July 2026. On 30 April 2026, APRA finalised targeted amendments to CPS 230 and CPG 230, with limited exemptions from specific contractual requirements for material arrangements with certain non-traditional service providers, and an updated material service provider register template. APRA has said it will issue an updated APRA Connect return for the 2026 submission.

If you serve a regulated entity, assume a client is finalising their material service provider register this week. Make yourself easy to place on it. Confirm which of your services are material to a critical operation, have your CPS 230 contract terms ready for the next renewal so it does not stall, and give the client a named contact for incident notification and assurance. The vendor who is register-ready closes a gap the client cannot close alone.

A register filled in once and never reconciled against the arrangements that actually run. The 30 April amendments changed the template and added exempt categories. A register built on the old one, or one that records an arrangement in the wrong category, reads as a control that was completed rather than maintained. That is the entry that draws the first question after 1 July, because it is the one that can be checked from the outside without asking anyone inside.

My view: The last week separates the teams who built something from the teams who wrote something. If your register is honest and your first renewals are ready, you are fine, even unfinished. If you are still drafting a policy nobody has tested, the deadline will find it. Stop building. Start reconciling.

If this was useful, the free Quick Check reads one critical operation against what CPS 230 expects, register and contracts included, in about ten minutes.