Service Provider (Outsourcing) Policy Template (APRA & ASIC | AFSL)

This Service Provider (Outsourcing) Policy template is designed for APRA‑regulated and ASIC‑regulated financial services entities that outsource material operational functions and need a formal, board‑approved policy that stands up to CPS 230 scrutiny. It is best suited to:

• ADIs (banks, credit unions, building societies);
• Insurers (general, life and private health);
• RSE licensees and superannuation trustees;
• Other prudentially regulated entities subject to CPS 230 Operational Risk Management; and
• AFSL holders and related entities that rely on external service providers for critical operations.

The template is structured to:

• Make it clear that outsourcing does not outsource accountability for prudential or conduct obligations;
• Define critical operations, material business activities and material service provider arrangements;
• Set out roles and responsibilities for the Board, CEO/senior management, Operational Risk / Compliance, business units and Internal Audit;
• Walk through the full outsourcing lifecycle – identification, materiality assessment, due diligence, approval, monitoring, BCP testing and exit/termination;
• Embed APRA’s expectations on offshoring (including prior consultation and enhanced due diligence);
• Articulate the organisation’s risk appetite, limits and concentration risk settings for outsourcing;
• Summarise regulatory reporting and notification requirements to APRA in a practical table; and
• Provide document control, review and maintenance sections, plus clear definitions for key CPS 230 / outsourcing terms.

  The policy has been drafted with CPS 230, SPS/HPS 231, the Corporations Act, ASIC Regulatory Guides 104 and 259, the Privacy Act and the ACL in mind, so you can adapt it confidently across different licence types. You receive an editable Word document with placeholders for your company name, governance bodies and licence details, so it can be tailored quickly to your own outsourcing framework.