What is a material service provider?
A third party you rely on to undertake a critical operation, or that exposes you to material operational risk. Identifying MSPs and keeping a register of them is a core CPS 230 requirement.
CPS 230 material service provider requirements
The service-provider pillar of CPS 230, in plain English.
What counts as a material service provider, what the MSP register and agreements must cover, and when you have to notify APRA.
What is a material service provider under CPS 230?
Under APRA's Prudential Standard CPS 230, a material service provider (MSP) is a third party you rely on to undertake a critical operation, or that exposes you to material operational risk. CPS 230 requires you to identify your MSPs, keep a register of them, and manage the risks they carry, including the risks from any fourth parties they in turn depend on.
This is the service-provider pillar of CPS 230. For the standard itself, read CPS 230 on APRA's website; for the wider standard see our CPS 230 overview.
What the MSP requirements cover
CPS 230 sets out what you must do across the life of a material service provider arrangement:
- A service provider management policy covering how you identify MSPs and manage arrangements, including risks from fourth parties.
- A register of material service providers, kept current, with the material risks of each managed.
- Due diligence before entering or materially changing a material arrangement, including a selection process and an assessment of the provider.
- A formal, legally binding agreement for every material arrangement, setting out service levels, rights and responsibilities, data ownership and control, audit access, and liability.
- Ongoing risk management of each arrangement, including step-in and contagion risk.
- Monitoring, reporting and review against agreed service levels, with reporting to senior management.
- Notification to APRA within 20 business days of entering into or materially changing an agreement for a service a critical operation relies on, and prior notice of material offshoring.
- Internal audit and Board oversight of the service provider management policy and critical-operation outsourcing.
Manage your MSP register in one place
Drova RunReady
Keep the material service provider register, contracts, due diligence and APRA notifications together, linked to your critical operations.
The material service provider register
The register is the backbone of the MSP pillar. It records the providers you rely on for critical operations or that expose you to material operational risk, the services they provide, the material risks of each, and the fourth parties behind them. APRA-regulated entities submit the register to APRA annually, and keep it current as arrangements change.
With RunReady: maintain the register, link each provider to the critical operations it supports, manage contracts and due diligence, and keep the evidence ready for APRA.
Notifying APRA
You must notify APRA as soon as possible, and no later than 20 business days, after entering into or materially changing an agreement for a service a critical operation relies on. You must also notify APRA before entering into a material offshoring arrangement, or when a significant change is proposed to one.
CPS 230: where entities are now
In force since 1 July 2025. The MSP requirements apply to APRA-regulated entities under CPS 230.
Transitional arrangements have ended. APRA gave non-significant institutions a further year (to 1 July 2026) for some provisions; that period has now passed, so the standard applies in full.
Now. Managing material service providers is business as usual: keep the register current, run due diligence and monitoring, notify APRA on time, and report to the Board.
MSPs are one pillar of CPS 230
Managing material service providers is the third pillar of CPS 230, alongside operational risk management and business continuity planning. The register and risk work you do here connects to your critical operations, impact tolerances and scenario testing.
RunReady is the operational resilience module of Drova's RunGood platform, so your service-provider records sit alongside the rest of your CPS 230 work rather than in a silo.
Take the guide with you
The full MSP compliance guide
All eight requirements plus policy, agreement and review-checklist templates, in a format you can share.
CPS 230 material service providers, answered
What is a fourth party?
A party that your service provider in turn relies on to deliver a service to you. CPS 230 requires your service provider management policy to address the risks from fourth parties too.
What must the MSP register contain?
Your material service providers, the services they provide, the material risks of each, and the fourth parties behind them. The register is submitted to APRA annually and kept current.
When must APRA be notified about a service provider?
Within 20 business days of entering into or materially changing an agreement for a service a critical operation relies on, and before entering a material offshoring arrangement.
What must a formal service provider agreement include?
At a minimum: the services and service levels, the rights and responsibilities of each party, data ownership and control, audit access, and liability and indemnity.
How does this relate to the rest of CPS 230?
Service provider management is the third pillar. See the full CPS 230 overview for operational risk management and business continuity planning.
RunReady keeps your MSP register, contracts, due diligence and APRA notifications in one place.
