APRA withdraws cloud outsourcing paper

It will be replaced with a new standard which introduces formal supervisory oversight.

Australian Prudential Regulation Authority (APRA) has rescinded its 2018 Information Paper on outsourcing involving cloud computing services, citing the upcoming Prudential Standard CPS 230 Operational Risk Management.

CPS 230, set to take effect on 1 July, will replace existing standards on outsourcing and business continuity management. 

It introduces formal supervisory oversight for entities using cloud service providers. 

The withdrawal of the paper follows industry feedback and aims to reduce regulatory burden whilst clarifying expectations for managing material service provider arrangements.  

Separately, APRA has ceased the collection of “ARF 923.0 Covid-19 Capital and Credit” data, with the final submission covering the period ending 31 January. 

The data collection was introduced in 2020 to help banks support customers during the pandemic. 

The decision aligns with APRA’s ongoing review of ad hoc data collections and follows similar cessations in 2023 and 2024.