Claims

APRA CPS 230: What It Means for Claims Operations

ClaimsGateway

16 Oct 26

•

min read

APRA's CPS 230 is the operational risk standard for regulated insurers, in force since 1 July 2025. For insurers, claims processing is treated as a critical operation, so it needs tolerance levels and a tested continuity plan. TPAs, outsourced claims managers and claims platform vendors can all be material service providers the insurer must manage.

This article is general information, not legal or compliance advice. Check the current text of the code, standard or legislation, and take advice for your situation.

Key takeaways

According to APRA, CPS 230 commenced on 1 July 2025, with older service provider arrangements caught at the earlier of renewal or 1 July 2026.
According to Norton Rose Fulbright, insurers must classify claims processing as a critical operation unless they can justify otherwise.
A critical operation needs set tolerance levels for disruption, and APRA must be told if one is breached.
Insurers keep a register of material service providers, and a TPA running their claims will usually be on it.

What is APRA CPS 230?

CPS 230 is APRA's prudential standard on operational risk management. It requires regulated entities to manage operational risk, maintain the critical operations their customers rely on through disruption, and manage the risks of using service providers. It replaced APRA's earlier separate standards on outsourcing and business continuity.

According to APRA, the standard commenced on 1 July 2025. For service provider arrangements that already existed, its requirements apply from the earlier of the next contract renewal or 1 July 2026. So by now, most insurers' claims arrangements are inside the standard, or about to be.

CPS 230 is cross-industry, applying to banks, insurers and superannuation trustees alike. For general insurers the most immediate effect falls on claims, because claims is where a disruption reaches policyholders fastest.

Is claims a critical operation under CPS 230?

Yes, for insurers it is treated as one. A critical operation is a process that would materially harm customers or the entity's role in the financial system if disrupted beyond tolerance. According to Norton Rose Fulbright, insurers must classify claims processing as a critical operation unless they can justify otherwise.

That classification brings obligations with it. The insurer must identify the people, technology, information and service providers the claims operation depends on. It must set tolerance levels for how much disruption it will accept, typically measured in time and data loss. In addition, it must keep a business continuity plan that shows how claims would continue through a severe but plausible disruption.

Customer enquiries are commonly classified alongside claims processing. For a claims team, the phone lines, inboxes and portals claimants use to ask about progress are therefore part of the same critical operation. They are not a separate concern.

Who counts as a material service provider in claims?

A material service provider is one the entity relies on for a critical operation, or one that exposes it to material operational risk. In claims, that commonly includes TPAs, outsourced claims managers and loss adjusters on large panels. It can also include payments providers and the vendors whose platforms run the claims process.

According to APRA, entities must keep a register of material service providers and submit it to APRA. They must also notify APRA of new or changed material arrangements, and of offshoring. The arrangement itself needs a formal agreement covering the services, performance, notification of incidents, audit access and how the arrangement would end.

A TPA running an insurer's claims is therefore usually a material service provider, even though CPS 230 does not bind the TPA directly. The TPA claims software list covers how that shapes a TPA's own choice of system.

What do tolerance levels mean for claims in practice?

A tolerance level is the most disruption an insurer will accept to a critical operation before it is breached. For claims, that might be the longest time new claims can go unlodged, or claimants go without updates, during an outage. Breaching a tolerance level must be reported to APRA.

Setting a tolerance forces practical questions. How long could the insurer take claims by phone if the claims platform were down? Could a TPA keep paying urgent claims if its system failed? And what data would be lost if the last backup were the only one available?

The answers depend partly on the claims technology. Tested recovery and a full record of each claim make the tolerance easier to meet. They also make it easier to evidence. The CPS 234 explainer covers the security side of the same systems.

What should an insurer ask a claims platform provider?

Ask how the provider supports the insurer's own CPS 230 obligations. Where is the platform hosted, and how does it recover from an outage? How quickly does it notify incidents, and what audit access does it allow? Finally, which certification does it hold, and how is data returned at exit? Evidence matters more than assurance.

A provider's security certification is a useful starting point. For example, ClaimsGateway (claimsgateway.com) states that its operating entity maintains an ISO/IEC 27001 certified information security management system. It also states that the platform is hosted on Microsoft Azure in Sydney. The security and compliance page lists those facts.

Certification is not the whole answer, however. CPS 230 obligations sit with the insurer, so it still needs contract terms on notification, continuity and exit, and its own testing. For organisations weighing software against outsourcing altogether, the software versus outsourcing comparison sets out how CPS 230 affects each route.

Frequently asked questions

When did CPS 230 commence?

According to APRA, CPS 230 commenced on 1 July 2025. For service provider arrangements already in place before then, its requirements apply from the earlier of the next contract renewal date or 1 July 2026. New arrangements made after commencement have been covered from the start.

Is claims handling a critical operation under CPS 230?

For insurers, yes. According to Norton Rose Fulbright, insurers must classify claims processing as a critical operation unless they can justify otherwise, along with the systems and people that support it. That means claims needs tolerance levels for disruption and a tested business continuity plan.

Is a TPA a material service provider?

Usually, yes. A TPA that runs an insurer's claims supports a critical operation, which makes it a material service provider in most cases. The insurer must then list it on its register, have a formal agreement covering the matters CPS 230 requires, and notify APRA of new or changed arrangements.

What replaced CPS 231 and CPS 232?

CPS 230 replaced them. APRA's earlier standards CPS 231, on outsourcing, and CPS 232, on business continuity management, were folded into the single operational risk standard. The new standard widens the focus from outsourcing alone to all material service providers, and adds critical operations and tolerance levels.

Does CPS 230 apply to software providers?

Not directly, because CPS 230 binds APRA-regulated entities. However, a software provider whose platform supports a critical operation, such as claims processing, is usually a material service provider. So the insurer manages it under CPS 230, and passes its requirements to the provider through the contract.

About the author

ClaimsGateway builds cloud claims management software for insurers, underwriting agencies, brokers, TPAs and self-insured organisations in Australia and New Zealand. Every regulator figure in this article links to its source, and every vendor fact was checked on the vendor's own site on the date shown.