APRA CPS 230 requires every Australian bank, insurer, and superannuation fund to maintain a Material Service Provider register, ensure all vendor contracts include 7 mandatory clauses, and submit annual compliance evidence to APRA. VendorAuditly generates a one-click CPS 230 Evidence Pack — the only SMB-priced tool that does this, at 25× less than Gatekeeper.
CPS 230 creates compliance obligations on both sides of the banking vendor relationship. VendorAuditly serves both — but the most urgent buyer is Mode B.
If you are an APRA-regulated entity, CPS 230 requires you to maintain a documented Material Service Provider register, review every vendor contract for the 7 mandatory clauses, and submit to APRA annually. You need a tool that builds and exports this register in APRA’s required format.
If you supply an APRA-regulated bank, insurer, or super fund, your client now has a legal obligation to certify you as a compliant service provider — or drop you. Fintechs are already being dropped. You need a CPS 230 Supplier Readiness Pack: a structured document you complete once and share with every banking client that asks.
Curium CEO (Insurtech Australia board member): “Some underwriting agencies are being told — not that there’s anything wrong with them — but that [APRA-regulated entities] don’t want to handle smaller underwriting agencies.” The compliance burden of certifying non-compliant vendors is leading regulated entities to drop SMBs. A Supplier Readiness Pack is now a commercial survival document.
CPS 230 replaced CPS 231 (Outsourcing) and CPS 232 (Business Continuity) from 1 July 2025. It is a cross-industry standard applying to all ~300+ APRA-regulated entities across banking, insurance, and superannuation.
A vendor is material if the entity relies on it to undertake a critical operation, OR the arrangement exposes the entity to material operational risk. Either criterion alone is sufficient. Mandatory categories — risk management, core technology, internal audit — are automatically material for all entity types regardless of size.
~300+ APRA entities in direct scopeEvery material arrangement must include: service scope & SLAs, rights & liabilities, legal & compliance obligations, subcontracting notice/consent, subcontractor liability, force majeure, and termination & exit rights. APRA access rights for documentation and on-site visits must also be included. Missing any clause is a reportable non-compliance.
Deadline: 1 July 2026 for pre-existing contractsAPRA requires a formal register submission annually using the April 2026 official template (11 fields per vendor). The register must trace each vendor to a specific critical operation with tolerance levels. First submission was October 2025 — the next is October 2026. APRA checks for linkage between critical operations and the MSPs that support them.
APRA’s April 2026 AI governance letter requires regulated entities to map their full AI supply chain including foundation models embedded within vendor products. Many AI vendors now meet the MSP threshold. Five additional contract clauses are required for AI vendors: model update notices, data handling change notices, AI incident triggers, termination/portability, and AI audit rights.
Boards must approve the service provider management policy, business continuity plan and tolerance levels, and receive periodic risk and performance reporting on MSPs. APRA supervisors expect a board-level evidence trail — not just policies. Auditors trace controls end-to-end from policy through to evidence artefacts.
Every material service provider agreement must contain all 7 of these clause areas. APRA supervisors check for completeness. Missing any clause in a material arrangement is a non-compliance finding. Pre-existing contracts must be remediated by 1 July 2026.
Defined services with measurable performance standards. Establishes what is in scope, expected service levels, and how performance is measured and reported.
Covers data ownership and control, dispute resolution, indemnity, and rights for the regulated entity (and APRA) to conduct audits and on-site visits at the service provider.
Ensures the regulated entity can continue meeting its prudential and legal obligations regardless of vendor circumstances. Must survive insolvency, regulatory change, and operational failure of the vendor.
The service provider must notify and obtain consent before engaging material subcontractors (fourth parties). The regulated entity must maintain visibility into the fourth-party risk chain.
The service provider remains liable for failures by their own subcontractors. The regulated entity must not be left exposed by fourth-party failures that the direct vendor allows to pass through.
Protections for unforeseen disruptions, linked to business continuity obligations and APRA’s tolerance level requirements. Must define what constitutes force majeure and what obligations continue regardless.
Must cover full termination rights, partial termination, data portability, data return and deletion, exit assistance, and transition timelines. Allows the regulated entity to exit without operational disruption.
Required for any vendor using AI in service delivery (APRA April 2026 AI governance letter): model update notices, data handling change notices, AI incident triggers, AI termination/portability rights addressing model lock-in, and AI audit/inspection rights covering AI system behaviour.
VendorAuditly is the only SMB-priced tool with a built-in APRA CPS 230 Evidence Pack. No enterprise contract, no implementation project, no $1,245/month Gatekeeper subscription.
Walk through the CPS 230 Para 36 materiality test vendor by vendor. Select the critical operation each vendor supports (payments, claims, fund administration, core technology). VendorAuditly saves the materiality rationale for each vendor — the documented basis APRA requires when you can’t classify a vendor as material.
For each material service provider, track which of the 7 mandatory clause areas are present, partial, or missing. The RAG status dashboard shows your clause compliance across all MSPs at a glance. AI-flagged vendors automatically surface the additional 5 AI clause requirements from the April 2026 APRA AI governance letter.
Generate a complete, APRA-submission-ready evidence pack in a single click. The 6-page PDF contains everything an APRA supervisor or internal auditor expects to see: MSP register with materiality classifications, contract clause compliance status, AI vendor supply chain map, fourth-party dependency register, and a board-level statement of compliance with signature block.
Send CPS 230-aligned questionnaires to your material service providers to capture sub-contractor disclosures, BCP capabilities, and security control evidence. Questionnaire responses are timestamped and stored per vendor, providing the due diligence evidence trail APRA supervisors look for.
VendorAuditly is the only vendor risk tool with evidence packs for DORA, NIS2, APRA CPS 230, SOC2, ISO 27001, and HIPAA — all at $49/month. If you operate across jurisdictions — UK, EU, US, and Australia — you can generate regulatory evidence for all of them from a single vendor register, without switching tools.
APRA’s April 2026 AI governance letter permanently expanded CPS 230 scope. Any vendor delivering AI-enabled services — even if they call themselves a “data platform” or “analytics tool” — may now be a Material Service Provider.
Any vendor that uses OpenAI, Anthropic, Google Gemini, Microsoft Copilot, AWS Bedrock, or any foundation model in their service delivery is now subject to additional CPS 230 contract requirements. This includes “non-AI” vendors that have added AI features to their products. APRA found this opacity to be the biggest identified gap in supervised entities — “AI embedded in vendor platforms with opaque upstream dependencies.”
Ask every vendor: “Do any components of your service use AI or foundation models?”When multiple vendors in your MSP register all use OpenAI, a single OpenAI outage becomes a systemic concentration risk across your critical operations. APRA requires regulated entities to actively manage this concentration and — where substitution from an AI provider is not credible — document the fact and name compensating controls. This is now an APRA examination question.
APRA expects: a full map of AI vendors and their foundation model dependencies, concentration risk assessment across the AI supply chain, upgraded contracts with the 5 AI-specific clauses, tested substitution/fallback plans for AI providers, and documented compensating controls where substitution is not credible. The VendorAuditly AI vendor section in the CPS 230 Evidence Pack captures and evidences all of this.
Gatekeeper is the cheapest named CPS 230 tool with real features. Every other option is enterprise-only with no public pricing. VendorAuditly generates the same MSP register and evidence pack at $49/month — the only SMB option in the market.
The 25× price gap is structural: enterprise tools are built for compliance teams at large regulated entities. VendorAuditly is built for the ops manager or COO at a 20–200 person company who needs to prove compliance without hiring a consultant. Compare all vendor risk management software →
MSP register, 7-clause compliance tracker, AI vendor map, and one-click evidence pack — at $49/month. 25× cheaper than Gatekeeper.
No credit card required. Set up in under an hour.