The Australian Prudential Regulation Authority (APRA) has confirmed two further steps to simplify the prudential framework.
First, APRA has today rescinded the 2018 Information Paper "Outsourcing Involving Cloud Computing Services" in light of Prudential Standard CPS 230 Operational Risk Management (CPS 230).
CPS 230 comes into effect 1 July 2025 (replacing existing standards 231 Outsourcing and 232 Business Continuity Management) and includes formal supervisory coverage for entities with cloud service provider arrangements.
Based on industry feedback, the withdrawal of the information paper aims to reduce regulatory burden and improve clarity about the expected approach for material service provider arrangements.
APRA regulated entities will be expected to comply with CPS 230 requirements when using cloud services to appropriately manage associated risks and ensure operational resilience.
Second, APRA has today ceased the collection of "ARF 923.0 Covid-19 Capital and Credit" with the last submission being the period ending 31 January 2025. This collection was initiated in 2020 as part of measures to help banks support customers impacted by COVID-19. The decision was part of APRA's regular review of its ad hoc data collection, and follows a number of cessations in 2023 and 2024.
Chair John Lonsdale emphasised APRA's ongoing objective of making its regulatory framework clearer to understand, simpler to navigate, and more adaptable to environmental change.
"APRA consistently seeks to reduce complexity where it is safe to do so. We are committed to lowering regulatory burden and streamlining our prudential architecture while preserving the strengths of our regulated industries," Mr Lonsdale said.
APRA will continue to consider opportunities to sharpen and simplify the prudential framework, building upon its work for a modern prudential architecture.
