Ask an Expert: What will the impact of CPS 230 be on service providers?

The impact of CPS 230 on service providers depends on their classification by APRA or insurers as "in scope." This applies if they perform a "critical operation" for the insurer or have a "material agreement" with the insurer.

Who is "in scope"?

APRA defines "in scope" service providers as those who:

• Handle claims under their own AFS license (e.g., third-party claims administrators).
• Provide systems or infrastructure supporting critical operations (e.g., core technology).
• Perform critical or material functions, such as underwriting (primarily agencies).

Other suppliers may be classified as "in scope" at the insurer's discretion, based on the following factors:

1. Does the insurer’s customer base rely heavily on the service provider?
2. Is the service critical to the insurer's operations?
3. What would the impact on customers and the insurer be if the service fails?
4. Is there a viable substitute for the service to minimize disruptions?

Service providers with potential failures that could significantly impact customers or insurers are likely to fall within CPS 230’s scope.

Obligations for "in Scope" providers

If classified as "in scope," insurers may require service providers to:

• Develop a Business Continuity Plan addressing critical operational failures and disruptions
• Implement a robust Operational Risk Management framework
• Maintain ongoing compliance with all relevant laws and regulations
• Agree to additional contractual obligations, including risk management, liability for service failure, and access to data for audits or APRA inquiries.

Best practices to prepare for CPS 230

To prepare for the potential impact of CPS 230, service providers should:

• Contact insurers to clarify if they are considered "in scope"
• Create a Risk Management framework addressing critical risks and their impact on insurers and customers
• Review and update Business Continuity Plans to ensure all employees understand their roles during disruptions.
• Assess and improve compliance processes, if necessary.

Early engagement with insurers ensures greater negotiation power when discussing contractual obligations and liability. Preparing proactively strengthens partnerships and reduces compliance risks.

Attributable to Tetiana George – CEO & Founder, Curium.

Have a question? Ask an Expert here