Identify what is critical for operating
Each region has the same requirement to name the services whose failure causes material harm
- Critical operations under CPS 230, OR-2, and RBI guidelines
- Critical business services under the MAS Guidelines
APAC Operational Resilience Regulations
Across APAC, operational resilience rules now carry real weight: Australia’s CPS 230 applies in full and Hong Kong’s OR-2 implementation window has closed. Each market sets its own vocabulary and deadlines, but all expect evidence of operational resilience.
Which operational resilience regulations apply in APAC?
Six markets account for most of the regulatory load carried by financial institutions in APAC. Australia’s APRA and Hong Kong’s HKMA now enforce binding resilience requirements, Singapore’s MAS governs through supervisory assessments and mandated audit cycles, and India’s RBI has issued its own operational resilience guidance.
| Market | Regulator | Instrument for regulation | Current status | Core obligation |
|---|---|---|---|---|
| Australia | APRA | CPS 230 Operational Risk Management; CPG 230 practice guide | In force as of July 1st, 2025. Transition was closed and amendments commenced on July 1st 2026. | Identifies critical operations, establishes board-approved tolerance levels, maintains a material service provider register, and then notifies APRA of tolerance breaches |
| Hong Kong | HKMA | SPM module OR-2 Operational Resilience; revised TM-G-2 Business Continuity Planning | Issued May 31st, 2022. Framework due on May 31 2023. Full implementation was due on May 31st, 2026. | Establishes an operational resilience framework, identifies critical operations and tolerances, maps interconnections, and conducts scenario testing |
| Singapore | MAS | Guidelines on Business Continuity Management; Technology Risk Management Guidelines | BCM Guidelines issued on June 6th, 2022. Compliance issued on June 6th, 2023. First BCM due June 6th, 2024. TRM Guidelines issued January 18th, 2021. | Service-centric recovery of critical business services, identifies end-to-end dependency, determines service recovery time objectives, mandates a crisis management structure |
| India | RBI | Guidance Note on Operational Risk Management and Operational Resilience | Guidance issued April 30th, 2024. | Three pillars and 17 principles; ICT risk management, third-party and intragroup dependency management, response and recovery planning |
| Japan | FSA | Supervisory guidance on operational resilience; Analytical Report on IT Resilience in the Financial Sector | Report published on July 30th, 2026. | Treats IT and cyber risk as top management risks; reports on system failures; governance and third-party risk management |
| Malaysia | BNM | Risk Management in Technology (RMiT); National Cyber Security Act 2024 | Enforced. | Technology risk management, incident reporting, critical infrastructure obligations |
Where APAC regions operational resilience requirements overlap
Regardless of how each region decides to explain their regulatory framework, each of them share the same five core obligations.
Set disruption tolerances
The following each expect tolerances to reflect harm to customers and markets, rather than simply system availability
- Board-approved tolerance levels under CPS 230
- Tolerance for disruption under OR-2
- Service recovery time objectives under MAS
Map dependencies
All of these regions agree that dependencies should be mapped end-to-end
- Interconnections and interdependencies under OR-2
- End-to-end dependency identification under MAS
- Material service provider registers under CPS 230
- Dependency management under the RBI guidance
Perform relevant scenario testing
Scenario testing is a shared requirement, with the following verbiage
- Scenario testing under OR-2
- Scenario analysis under CPS 230
- Periodic BCP testing of recovery strategies under MAS
- Tested response and recovery plans under RBI
Govern and evidence resilience
Board accountability is expected throughout, plus jurisdiction-specific artefacts
- The MSP register and 24-hour notification in Australia
- The BCM audit cycle in Singapore
- Mandated crisis management structure under MAS
How Fusion supports operational resilience compliance across APAC regions
Enterprise resilience, or comprehensive preparation in the face of a disruption, is a decision problem. Most large organizations cannot answer the four most important questions that must be answered at decision speed when disruption hits:
01What is impacted and how?
02What happens next?
03What is the financial exposure?
04What should be prioritized first?
Global firms that encounter multi-jurisdiction disruptions only serve to highlight the need for a system to oversee compliance requirements. When the same critical service is described one way for APRA, another for the HKMA and a third for MAS, an organization can end up with three partial pictures and no single account it can defend under examination. Additionally, if global firms share critical processes and assets to support services, a disruption to any one region could impact the others as well. Fusion is purpose-built to answer these questions, regardless of region or regulatory requirements.
Regulatory Requirements under APAC
| REGULATORY REQUIREMENT | HOW FUSION MEETS DORA REGULATORY REQUIREMENTS |
|---|---|
| Identify critical operations and business services(check criticality measures against each regulator's specific language) | Model critical services and trace each one to its full dependency chain, so the same service definition supports a CPS 230 critical operations list, an OR-2 mapping exercise and a MAS critical business service inventory. |
| Set and evidence tolerances | Hold board-approved tolerance levels against each critical service and show whether testing and live events stayed within them. |
| Manage material service provider dependency | Maintain provider relationships as part of the dependency model rather than as a separate register, including intragroup and fourth-party exposure. |
| Perform scenario testing | Scenario Testing models disruption against the dependency model and produces evidence of what would be affected and for how long. |
| Sequence recovery and evidence it | Recovery Optimization sequences recovery against service criticality and dependency order, producing a defensible account of prioritisation. |
| Respond and report under notification deadlines | Trace a disruption signal to the affected services at decision speed, so notification obligations such as CPS 230’s 24-hour requirement can be met with an accurate impact scope. |
FAQs
CPS 230 is Prudential Standard CPS 230 Operational Risk Management, issued by the Australian Prudential Regulation Authority. It sets minimum requirements for how APRA-regulated entities manage operational risk, maintain business continuity, and oversee material service providers. It commenced on 1 July 2025 and has applied in full since 1 July 2026.
CPS 230 commenced on 1 July 2025. Pre-existing material service provider contracts had until the earlier of their next renewal or 1 July 2026 to comply. That transition closed on 1 July 2026, the same date APRA’s targeted amendments took effect, so the standard now applies in full to all arrangements
CPS 230 revoked and replaced five prudential standards on 1 July 2025: CPS 231, SPS 231 and HPS 231 on outsourcing, and CPS 232 and SPS 232 on business continuity management. It consolidates outsourcing, business continuity and operational risk into a single standard. CPS 234 Information Security was not replaced and continues to apply.
CPS 234 Information Security governs the protection of information assets — security capability, controls, testing and incident notification. CPS 230 governs operational risk and resilience — keeping critical operations running within tolerance, managing material service providers, and maintaining business continuity. They overlap on third-party arrangements and incident handling, and evidence gathered for one can often support the other, but they are separate standards with separate obligations.
A critical operation is a process or activity whose disruption would have a material adverse effect on depositors, policyholders, beneficiaries or the stability of the financial system. Entities identify their critical operations, set board-approved tolerance levels for each, and notify APRA within 24 hours where a disruption falls outside tolerance.
Module OR-2 of the HKMA Supervisory Policy Manual was issued on 31 May 2022. Authorised institutions had until 31 May 2023 to develop an operational resilience framework and until 31 May 2026 to implement it and become operationally resilient. Both deadlines have passed, and supervisory focus has moved to whether mapping and testing are being sustained.
The MAS BCM Guidelines are guidelines rather than a legally binding notice, but MAS assesses financial institutions on how well they have adopted them as part of ordinary supervision, with particular attention to the business continuity of critical business services. In practice they set the standard against which an institution’s business continuity program is judged.
DORA is a single binding regulation applying uniformly across the European Union, with prescriptive requirements for ICT risk management, incident reporting, resilience testing, third-party risk and information sharing. APAC has no equivalent single instrument. Each market sets its own expectations, ranging from a binding prudential standard in Australia to supervisory guidelines in Singapore and Japan. The underlying disciplines are closely aligned; critical services, tolerances, dependency mapping, scenario testing, but the deadlines, definitions and reporting formats differ by jurisdiction.