CPS 230

Achieve CPS 230 compliance with Codekeeper

Meet APRA's July 2025 deadline and protect your operations from software disruption with our state-of-the-art escrow solutions for financial institutions.
Book a free demo
cps_230_hero_3x

When your systems fail under CPS 230, the clock starts ticking. Your organization faces immediate reporting obligations, regulatory scrutiny, and potential penalties.

APRA's CPS 230: What you need to know

What is CPS 230?

CPS 230 is the new APRA standard for operational risk management taking effect July 2025. It introduces stricter requirements for managing disruptions, business continuity, and third-party relationships across the financial sector.

Who needs to comply with CPS 230?

CPS 230 affects all APRA-regulated entities, including:
hand-coins
Banks and ADIs
building-2
Insurance companies
piggy-bank
Superannuation trustees
users-round-1
Financial groups

CPS 230 key requirements

APRA's CPS 230 requires financial institutions to implement these six key controls to ensure operational resilience:
1
Identify and control operational risks across all business functions.
2
Document critical operations with specific disruption tolerance levels.
3
Test business continuity under severe yet plausible scenarios.
4
Notify APRA of material incidents within 72 hours.
5
Maintain oversight of material service providers through formal agreements.
6
Create contingency plans for when service providers fail.

The software escrow — CPS 230 connection

Software escrow creates a direct pathway to CPS 230 compliance by securing your critical software assets when vendor relationships fail.
01
CPS 230 risk
Third-party service providers
Loss of access to critical software
Potential business disruption
APRA non-compliance
02
Software escrow solution
Secure source code repository
Legal framework for access
Verified recovery capabilities
Automated deposit management
03
Compliance outcome
Continuous operational resilience
Documented risk management
Evidence for APRA audits
Business continuity assurance
When APRA asks how you'll keep operations running if software vendors disappear, escrow gives you a ready answer. Without it, financial institutions lack access to source code, deployment instructions, and recovery procedures.

Let us help you with CPS 230 compliancy

Codekeeper brings together expertise in regulatory requirements and software protection with tailored solutions for APRA-regulated entities.
We see the challenges you face:
New operational risk standards with complex requirements
Regulatory deadlines with significant consequences
Uncertainty about documentation requirements
Continuous dependency on third-party software vendors
We've secured critical software assets for thousands of financial institutions globally. We can protect your operational resilience, too.
we_see_challenges_you_face

Codekeeper's complete solutions for CPS 230 requirements

Our escrow solutions directly satisfy CPS 230's operational resilience requirements while protecting your most critical software investments.
software escrow

Protection scope: On-premises software

Secures traditional on-premises systems with a legal framework that ensures continuous access to critical software assets.
Documents your control over third-party (and fourth-party) software risk
Establishes verifiable recovery capabilities for critical operations
Creates clear tolerance levels for software disruptions
Provides board-ready evidence of operational resilience
Learn more
how_it_works_software_escrow_3x
SAAS escrow

Protection scope: SaaS applications

Protects cloud-based applications with comprehensive deposits that include everything needed to maintain operations if SaaS providers fail.
Extends third-party risk management to cloud services
Guarantees business continuity for web-based critical operations
Addresses the growing migration to SaaS applications
Delivers documented compliance for modern technology stacks
Learn more
how_it_works_saas_escrow_3x
continuity escrow

Protection scope: SaaS applications

Takes over payments for supporting services and infrastructure to maintain critical operations when vendor relationships are disrupted.
Manages fourth-party risks from your vendor’s vendors as required by CPS 230
Reduces the likelihood of triggering 72-hour APRA notification
Creates operational continuity documentation for auditors
Supports board oversight of operational resilience
Learn more
continuity_escrow_1x
verification

Protection scope: Software and SaaS applications

Tests escrowed assets to confirm they're complete and usable, with clear documentation that satisfies regulatory expectations.
Validates recovery capabilities with evidence
Establishes realistic recovery timeframes for tolerance levels
Generates testing documentation required by CPS 230
Offers Software Resilience Certificates for compliance records
Learn more
how_it_works_continuity_escrow_3x-1

Get CPS 230 compliant in 4 simple steps

CPS 230 requires you to maintain access to critical software if vendors fail. Here's how to fulfill this requirement quickly:
1

Book your CPS 230 assessment call

Let us identify which of your software applications fall under APRA's material service provider requirements.

2

Choose your software protection level

Select basic escrow or add verification for complete CPS 230 evidence of operational resilience.

3

We'll handle everything else — from setup to implementation

Our team manages vendor onboarding, legal agreements, and deposit automation — no effort required from your team.

4

Get your Software Resilience Certificate

Receive formal documentation showing APRA that your critical software assets are protected against vendor disruption.

One call. One solution. Complete software continuity compliance for CPS 230.
Book a free demo

Codekeeper takes the complexity out of compliance

Over the years, we've helped thousands of financial institutions protect their critical software without drowning in technical details. Our solutions make regulatory requirements straightforward and manageable.
Airbus
Bayer
European parliament
General Motors
Intuit
Nestle
Pepsico
Pfizer

It's the final CPS 230 countdown

Files

July 2023

APRA releases the final version of CPS 230, along with draft supporting guidance
FileCheck2

July 2025

CPS 230 officially comes into effect for all APRA-regulated entities
FileInput

October 2025

Submit a complete Material Service Provider (MSP) register to APRA
FileBadge2-1

July 2026

Deadline for non-SFIs to comply with CPS 230's business continuity and scenario analysis requirements 
Transition period ends for pre-existing contractual arrangements with service providers

Missing these deadlines puts everything at risk

Failing to comply with CPS 230 by the deadlines exposes your organization to:
Regulatory enforcement actions
APRA can issue formal directions or restrict business activities.
Additional capital requirements
You may be forced to hold increased capital until compliance issues are remediated.
Enhanced supervision
Expect intrusive oversight with increased reporting obligations and regulatory scrutiny.
Reputational damage
Non-compliance becomes public, which can undermine stakeholder and customer confidence.
Business continuity failure
Without proper protections, vendor disruptions could shut down your critical operations.
Don't wait until it's too late. Secure your software continuity compliance now.
E-BOOK

APRA's CPS 230: Your Complete Operational Resilience Guide

Fill in the form below to get expert advice on meeting APRA's operational risk management requirements.
apra-cps-230
*E-book available only in English
Get your free CPS 230 compliance guide

How you benefit from CPS 230 compliance

Avoid regulatory penalties

Meet APRA's requirements before the July 2025 deadline to prevent enforcement actions, increased capital requirements, and enhanced supervision costs that could impact your bottom line.

Protect critical operations

Ensure business continuity for essential financial services. CPS 230 compliance means your critical operations continue even when key software vendors experience disruption.

Build stakeholder trust

Demonstrate to customers, partners, and shareholders that your institution takes operational resilience seriously. CPS 230 compliance signals organizational maturity and risk awareness.

Strengthen board governance

Provide your board with clear evidence of regulatory adherence. CPS 230 compliance creates documented control over third-party risk that satisfies governance requirements.
cps_cta_3x

Protect your critical operations before the deadline

Our compliance specialists will show you exactly how our escrow solutions meet CPS 230 requirements while safeguarding your operations from disruption.
Custom assessment of your specific compliance needs
Clear explanation of how escrow fulfills CPS 230
No technical jargon or complicated proposals
Actionable next steps you can implement immediately
Book a free demo
Frequently asked questions

Good questions to ask first.

What is the CPS 230?

CPS 230 is APRA's new operational risk management standard starting July 2025. It sets minimum requirements for operational risk management, business continuity, and third-party oversight. Under CPS 230, financial institutions must identify critical functions, set acceptable disruption periods, implement preventive controls, and maintain continuity plans.

What is the difference between operational resilience and business continuity?

Operational resilience goes beyond traditional business continuity. While continuity focuses on recovery after disruptions, resilience aims to prevent disruptions and maintain operations within set tolerance levels. Business continuity is just one part of resilience, which also includes risk assessment, preventive measures, and governance oversight. For software systems, resilience means having verified access to source code and configurations, not just recovery plans.

Why is software escrow important for CPS 230?

Software escrow directly supports CPS 230 compliance by protecting critical software assets and enabling recovery if vendors fail. The standard requires financial institutions to manage operational risk and third-party dependencies. Software escrow creates a secure repository of source code and data that enables business continuity during vendor disruptions.

Can Codekeeper help with CPS 230 compliance?

Yes. Codekeeper provides specialized solutions that address CPS 230 requirements. Our platform secures critical software assets while verifying they work when needed. We handle the legal arrangements for access rights, automate the deposit process, and provide compliance documentation including Software Resilience Certificates. Our approach covers both operational resilience and third-party risk aspects of CPS 230, giving you one solution for software continuity compliance.

Is CPS 230 replacing CPS 220?

No. CPS 230 works alongside CPS 220, not in place of it. While CPS 220 established the broad risk management framework for APRA-regulated entities, CPS 230 focuses specifically on operational risk and resilience.

What is the difference between CPS 230 and DORA?

CPS 230 and Europe's Digital Operational Resilience Act (DORA) both target operational resilience in financial services but differ in scope and approach. CPS 230 applies to APRA-regulated entities in Australia with a principles-based methodology. DORA covers EU financial entities with more specific requirements for ICT risk management.

More answers in the FAQ →

Let's build bulletproof software resilience together.

Book a demo