What is a material service provider?
A third party you rely on to undertake a critical operation, or that exposes you to material operational risk. Identifying MSPs and keeping a register of them is a core CPS 230 requirement.
CPS 230 material service provider requirements
The service-provider pillar of CPS 230, in plain English.
What counts as a material service provider, what the MSP register and agreements must cover, and when you have to notify APRA.
What is a material service provider under CPS 230?
Under APRA's Prudential Standard CPS 230, a material service provider (MSP) is a third party you rely on to undertake a critical operation, or that exposes you to material operational risk. CPS 230 requires you to identify your MSPs, keep a register of them, and manage the risks they carry, including the risks from any fourth parties they in turn depend on.
This is the service-provider pillar of CPS 230. For the standard itself, read CPS 230 on APRA's website; for the wider standard see our CPS 230 overview.
A provider can be a third party, a related party or a connected entity. CPS 230 also names services whose providers count as material, unless an entity can justify otherwise:
- Banks and other ADIs: credit assessment, funding and liquidity management, and mortgage brokerage
- Insurers (general, life, private health): underwriting, claims management, insurance brokerage and reinsurance
- Superannuation trustees: fund administration, custodial services, investment management, and arrangements with promoters and financial planners
- Every entity: risk management, core technology services and internal audit
What the MSP requirements cover
CPS 230 sets out what you must do across the life of a material service provider arrangement:
- A service provider management policy covering how you identify MSPs and manage arrangements, including risks from fourth parties.
- A register of material service providers, kept current, with the material risks of each managed.
- Due diligence before entering or materially changing a material arrangement, including a selection process and an assessment of the provider.
- A formal, legally binding agreement for every material arrangement, setting out service levels, rights and responsibilities, data ownership and control, audit access, and liability.
- Ongoing risk management of each arrangement, including step-in and contagion risk.
- Monitoring, reporting and review against agreed service levels, with reporting to senior management.
- Notification to APRA within 20 business days of entering into or materially changing an agreement for a service a critical operation relies on, and prior notice of material offshoring.
- Internal audit and Board oversight of the service provider management policy and critical-operation outsourcing.
Link every supplier to the critical operation it relies on
Drova RunReady
RunReady maps each critical operation and the dependencies behind it, including the third parties it relies on, so you can see which material service providers each operation depends on.
The material service provider register
The register is the backbone of the MSP pillar. CPS 230 requires every APRA-regulated entity to keep a register of its material service providers and submit it to APRA every year. The first was due by 1 October 2025, and APRA's register template is its preferred way to submit.
CPS 230 does not set out the register's fields. APRA's practice guide, CPG 230, says a prudent entity would list:
- each material arrangement, and the person responsible for it inside the entity
- the critical operations each arrangement supports, or the material risk it connects to
- where an arrangement supports a critical operation, the fourth parties involved in delivering it, as far as reasonable steps allow
Keep it current as arrangements change, not only once a year. Since the April 2026 amendments, the template also lets you mark arrangements with exempt providers.
Notifying APRA
You must notify APRA as soon as possible, and no later than 20 business days, after entering into or materially changing an agreement for a service a critical operation relies on. You must also notify APRA before entering into a material offshoring arrangement, or when a significant change is proposed to one.
Material service providers: Key dates
- 1 July 2025. CPS 230 comes into force. New and materially changed arrangements must meet the service provider requirements from this date.
- 1 October 2025. First register of material service providers due to APRA, then every year after.
- 1 July 2026. Arrangements in place before 1 July 2025 come into scope, if not already renewed. The April 2026 amendments also apply: arrangements with government agencies, regulators, central banks, financial market exchanges, clearing and settlement facilities, payment systems and schemes, and financial messaging infrastructure are exempt from specified contractual requirements. Every other CPS 230 requirement still applies to them.
- Now. Every material arrangement is in scope. Keep the register current, run due diligence before you sign or change an arrangement, notify APRA on time, and report to the Board.
The dates for the whole standard, including business continuity, are in CPS 230 key dates.
MSPs are one pillar of CPS 230
Managing material service providers is the third pillar of CPS 230, alongside operational risk management and business continuity planning. The register and risk work you do here connects to your critical operations, impact tolerances and scenario testing.
RunReady is the operational resilience module of Drova's RunGood platform, so your service-provider records sit alongside the rest of your CPS 230 work rather than in a silo.
Take the guide with you
The full MSP compliance guide
All eight requirements plus policy, agreement and review-checklist templates, in a format you can share.
CPS 230 material service providers, answered
Which services make a provider material under CPS 230?
Unless an entity can justify otherwise: credit assessment, funding and liquidity management and mortgage brokerage for ADIs; underwriting, claims management, insurance brokerage and reinsurance for insurers; fund administration, custodial services, investment management and arrangements with promoters and financial planners for superannuation trustees; and risk management, core technology services and internal audit for every entity.
What is a fourth party?
A party that your service provider in turn relies on to deliver a service to you. CPS 230 requires your service provider management policy to address the risks from fourth parties too.
What must the MSP register contain?
CPS 230 requires the register but does not set its fields. CPG 230 says a prudent entity would list each material arrangement and the person responsible for it, the critical operations or material risks it connects to, and, where it supports a critical operation, the fourth parties involved as far as reasonable steps allow. The register goes to APRA every year and is kept current in between.
When must APRA be notified about a service provider?
Within 20 business days of entering into or materially changing an agreement for a service a critical operation relies on, and before entering a material offshoring arrangement.
What must a formal service provider agreement include?
At a minimum: the services and service levels; each party's rights and responsibilities, including ownership of assets, ownership and control of data, dispute resolution, audit access, liability and indemnity; notice of the provider's own material subcontractors, with the provider liable for their failures; force majeure and termination provisions; and APRA's right to access information and visit the provider.
When was the first MSP register due?
By 1 October 2025. It is submitted to APRA every year after that, and APRA's template is its preferred format.
Are any service providers exempt under CPS 230?
Partly. From 1 July 2026, arrangements with a set list of providers, such as regulators, central banks, exchanges, clearing and settlement facilities and payment systems, are exempt from specified contractual requirements. Every other CPS 230 requirement still applies. Details are on APRA's operational risk management page.
How does this relate to the rest of CPS 230?
Service provider management is the third pillar, alongside operational risk management and business continuity planning. CPS 230, explained covers the whole standard.
RunReady maps your critical operations to the suppliers behind them and tests what happens if one fails.
