The CPS 230 remediation programme was tracking well. Internal systems were documented. Process controls were mapped. Then the Head of Procurement received a call from the risk team: the third-party arrangements were in scope too.
CPS 230 came into force on 1 July 2025 with clear requirements for how carriers manage their own operational resilience. What received less attention in many initial compliance programmes is the equally clear requirement that extends those obligations downstream. Carriers are required to ensure their material third-party arrangements - those supporting critical operations - can maintain service delivery under disruption. The standard's supply-chain provisions extend the obligation to every partner delivering a critical operation on the carrier's behalf. That requirement does not stop at the carrier's own perimeter. And the compliance exposure for any gap sits with the carrier, not the vendor.
A material service arrangement under CPS 230 is, in practical terms, any arrangement where the service provider supports a critical operation and the carrier could not readily replicate that service internally at short notice. Most BPO relationships in ANZ life insurance - claims processing, policy administration, customer service - meet that test.
The compliance implication is that contractual SLA commitments alone do not satisfy the requirement. APRA expects carriers to assess whether material providers have the operational resilience credentials to deliver on those commitments under real pressure: documented and tested business continuity plans, operational controls that are audit-ready, and demonstrated capacity to maintain the critical function when the pressure is not hypothetical.
A vendor who performs well in normal conditions but has no independently verified BCP is not a CPS 230-compatible arrangement. The carrier holds that compliance gap.
The instinct in procurement is to assess vendors on performance - cost, SLA attainment, contract compliance. CPS 230 requires a different frame. Vendor governance is now a regulatory function with direct consequences for the carrier's compliance attestation.
If the carrier's CPS 230 position depends on a third party who cannot provide evidence of their own operational resilience, the carrier's audit file has a structural gap. APRA is not asking for contractual commitments from the vendor. It is asking for evidence the vendor can deliver on those commitments when the situation requires it.
A partner who cannot demonstrate CPS 230-compatible governance is not just an operational risk. It is a compliance liability that the carrier carries into every future examination.
The assessment conversation with material providers now needs to cover ground that previous vendor reviews did not reach.
Does the partner have a documented and tested BCP? ISO 22301 is the recognised international standard - a partner who can evidence an independently audited continuity framework provides a stronger starting point than generic crisis documentation.
Can the partner evidence audit-ready operational controls? Passing a carrier's own audit process demonstrates credibility that SLA reporting does not.
Does the partner have the platform knowledge to maintain operations without a post-activation ramp period? A continuity plan that depends on training after activation is documentation, not resilience.
Transitional arrangements for pre-existing material third-party contracts expire on 1 July 2026. Carriers with long-standing BPO relationships not yet reviewed against CPS 230 criteria have a defined window. It is not advisory.
ISSI operates as a warm second source on the platforms ANZ carriers already run. Because platform fluency on CyberLife, wmA, and Ingenium already exists, there is no ramp period before load can be carried. ISO 22301-class business continuity protocols and audit-passed credentials are the governance documentation a CPS 230 third-party assessment requires. If the vendor governance review is live in your organisation, it is worth thirty minutes.
Sources: APRA Quarterly Life Insurance Performance Statistics (2025); APRA Quarterly Insurance Performance Statistics (September 2025)
