Inside the CPS 230 Material Service Provider Register: The New Map of Third-Party Dependency

From Vendor Lists to a Regulatory Dependency Map

Most financial institutions already keep a vendor register. CPS 230 demands something more consequential: a regulatory register of material service providers that is submitted to APRA and kept current. The distinction is not semantic. A conventional procurement list records contractual relationships. The CPS 230 register records dependency: which third parties, related entities or connected entities an institution relies on to perform a critical operation, or which expose it to material operational risk.

That reliance-based test is the engine of the register. A provider is material if a disruption at that provider would stop a critical operation, or would expose the entity to material operational risk—whether through a single arrangement or several. APRA also sets a default list of services that are presumed material unless the entity can justify otherwise: risk management, core technology services and internal audit for every entity; credit assessment, funding and liquidity management, and mortgage brokerage for authorised deposit-taking institutions; underwriting, claims management, insurance brokerage and reinsurance for insurers; and fund administration, custody, investment management, and arrangements with promoters and financial planners for superannuation trustees.

Why “Fourth Parties” Are Now Part of the Picture

One of the more demanding features of CPS 230 is its treatment of fourth parties—the providers that a material service provider itself relies on to deliver its service. The entity’s service provider management policy must cover the fourth parties behind critical operations, and contracts must oblige the material provider to notify the entity when it relies on other material providers. This extends the resilience lens beyond the direct contractual relationship and into the supply chain that actually sustains the critical operation.

For institutions with heavy reliance on cloud infrastructure, custody chains or outsourced administration, that requirement can expose concentration risk that was previously invisible at the board level. The register becomes not just a compliance artefact but a strategic tool: it shows where dependency is concentrated, where substitutability is low and where exit planning may be insufficient.

Exemptions, Standardised Terms and the 2026 Update

The 2026 amendments add nuance to the register. The updated standard allows entities to classify exempt arrangements in the Material Service Provider Register Template, covering listed provider types such as government agencies, regulators, central banks, exchanges and payment system operators where standardised terms are used or no formal agreement exists. Those arrangements still belong in the dependency map; they are simply subject to a narrower set of contractual requirements.

APRA’s guidance also asks entities that decide a presumptively material service is not material for them to document the reasons, have an accountable person approve them, and review the determination at least annually. That documentation discipline is designed to prevent the register from becoming a box-ticking exercise. The register is only useful if it reflects genuine operational dependency, not procurement convenience.

The Assurance and Accountability Layer

The register also connects to the assurance expectations that have come to the fore since CPS 230 went live. Deloitte Australia notes that material service providers to APRA-regulated entities must establish assurance programmes validating the robustness of the processes and controls underpinning their clients’ critical operations. For the regulated entity, that means the register should be corroborated by evidence: contract clauses that secure audit and access rights, business continuity obligations, subcontracting controls and exit planning where negotiations fall short.