CPS 230 and Customer Communications

Control, resilience and the opportunities surrounding CPS 230.

APRA's CPS 230 standard on Operational Risk Management took effect on 1 July 2025, marking a major shift in how regulated organisations manage resilience and third-party dependencies.

While most entities are now working within the new framework, the practical work of embedding CPS 230 is just beginning.

Many are reassessing how their customer communication and document-management processes align with the requirements for control, oversight and supplier management.

Some transitional relief remains in place until 1 July 2026, particularly for smaller financial institutions and legacy service-provider contracts. This next phase is where organisations move from compliance planning to real operational change.

Communications are part of critical operations

For many organisations, customer communication sits on the edge of operational control. Documents and messages are often produced by third-party providers, with limited visibility into timelines, approvals or the status of key updates.

That can create real challenges under CPS 230. When communications are handled externally, organisations may not have the clear oversight, auditability or control the new framework expects. And when incidents happen, from a system outage to a compliance breach, it is the ability to communicate quickly, accurately and consistently that determines whether customers stay informed and confident.

The risk with material suppliers

CPS 230 places strong emphasis on managing material service providers that could disrupt critical operations if they fail. For many regulated entities, print and mail houses and outbound digital delivery partners fall into this category.

If these suppliers experience delays, errors or outages, the operational and reputational impact can be significant. Yet in many cases, organisations have little real-time insight into supplier performance or the ability to step in and respond.

Bringing control back in-house

That is why a growing number of organisations are bringing their document composition and communication management capabilities in-house. Doing so delivers clear operational benefits and can unlock substantial cost savings.

By taking ownership of composition, teams can:

• Gain greater control over delivery timelines, change management and compliance oversight
• Improve visibility of supplier performance and operational risk
• Improve commercial terms with print and mail partners through less composition requirement, consolidated volumes and competitive tendering
• Reduce ongoing transactional costs by rationalising content and eliminating duplicate or manual processes
• Increase agility to manage or change suppliers at the flick of a switch (print ready PDFs) without the delays and costs associated with external change requests

At Cadence, we are helping organisations map their current communication environments against CPS 230 expectations. This includes identifying critical dependencies, simplifying governance and designing operating models that give business owners control without adding complexity. In many cases, these reviews have not only strengthened resilience but delivered measurable cost efficiencies and improved supplier performance.

Resilience and efficiency can go hand in hand

CPS 230 is not just another compliance exercise. It is an opportunity to modernise how customer communications are managed, strengthening resilience while improving commercial outcomes.

The organisations that use this period to consolidate control over their communications will not only meet APRA's expectations but also gain something more valuable: clarity, confidence and cost efficiency in the systems that connect them with customers every day.