Article
How to classify material service providers in a super fund
A worked fund administration example: trace member transactions, test recovery evidence and record a defensible CPS 230 classification.
Contrata editorial team ·
An administrator says its platform can recover. Your fund holds a copy of the member data. Neither statement, on its own, shows that contributions will be allocated correctly or benefit instructions processed during a disruption.
For a super fund reviewing a material service provider classification, that gap is a useful place to start. Follow the service through to the member outcome, identify who performs each step, and ask what evidence supports the recovery assumptions.
This article is for teams working for an APRA-regulated registrable superannuation entity (RSE) licensee. CPS 230 applies to the licensee in respect of its business operations. A supplier does not become directly subject to CPS 230 merely by providing services to a fund. The legal requirements below refer to the standard in force from 1 July 2026; the worked example and review method are illustrative.
Start with the superannuation categories
CPS 230’s prescribed categories set a starting point for classification. For RSE licensees, providers of fund administration, custodial services and investment management, along with arrangements with promoters and financial planners, must be classified as material unless the licensee can justify otherwise. Risk management, core technology services and internal audit are prescribed across all APRA-regulated entities. These are minimum categories, not an exhaustive supplier list.
The wider materiality test in paragraph 48 has two routes: reliance on the provider to undertake a critical operation, or exposure to material operational risk. Either can make a provider material. Multiple arrangements with one provider can also create material reliance even when an individual arrangement appears limited. Related parties and connected entities are within scope.
A small invoice or investment mandate is therefore not a classification exemption. Nor does every technology contract automatically qualify as core technology. Record what the service does, the relevant category and the consequences of its failure.
If the fund proposes an exception to a prescribed provider category, keep the justification separate from the general risk score. In its guidance on maintaining a register of material service providers, APRA expects documented reasons, approval by an Accountable person and review at least annually. That is guidance on exclusions, not a rule requiring the Board to approve every supplier classification.
Follow a member transaction through the service
Use one contribution and one benefit instruction to walk through an outsourced administration arrangement. Bring together the fund's operations owner, risk team and people who understand the administrator's service. Trace receipt, validation, processing, exceptions, reconciliation and the resulting member record.
Write down the legal service provider, the agreement and services covered, the affected fund or member cohort, and the fund's process owner. Add the movement of data, money and instructions. A payment message, the money it relates to and the member record are different things; a map that combines them can conceal an unresolved hand-off.
Under CPS 230’s critical-operation requirements, RSE licensees must treat investment management and fund administration as critical operations unless they can justify otherwise. Customer enquiries and the systems and infrastructure supporting critical operations are also prescribed for all APRA-regulated entities. Map the actual operation and its dependencies against the fund's register rather than treating a supplier name as the operation.
For this review, keep three linked records:
- Operation: the member service the fund must maintain and its approved tolerance levels.
- Arrangement: the contracted service, its scope, dependencies and materiality assessment.
- Provider: the legal entity and the combined reliance created by its arrangements with the fund.
Record fourth parties against the relevant service dependency. If the administrator subcontracts a gateway, show that relationship accurately. If the fund also contracts directly with the gateway, assess that direct arrangement separately. A fourth-party entry does not, by itself, establish a direct contract.
As CPG 230 explains when discussing material agreements, a material provider can have arrangements that are not individually material. The guide also addresses risk across cohorts of providers: a cohort can create material aggregate risk without every member of the cohort becoming a material service provider. Document both the individual decision and the concentration concern.
Ask for evidence of usable recovery
Suppose an administrator maintains member records, allocates contributions and processes benefit instructions. Its processing platform and a subcontracted gateway support the service. The fund receives data exports, but it has not demonstrated that it can perform the work independently from those exports.
The administrator supplies a test report showing technical recovery. The report does not demonstrate reconciliation of interrupted transactions or clearance of the fund's processing backlog. This is a hypothetical example, not a finding about a named provider.
The classification should reflect the administration category and the fund's actual reliance. On these facts, the proposed decision is to classify the administrator as material and assess the administration arrangement as material. Record the recovery gaps as actions with owners. Waiting for a better test report would leave an acknowledged dependency out of the record.
Ask the operations owner and administrator to demonstrate what happens to the contribution and benefit instruction through disruption and recovery. Check whether exported data is usable, who has the authority and access to act, how duplicates or missing transactions are detected, and how exceptions are resolved. Identify who reconciles the restored records and what capacity is available to clear accumulated work.
A supplier's recovery time is only one input. The fund's tolerance levels under paragraph 37 cover disruption duration, data loss and the minimum service maintained under alternative arrangements. Use the fund's approved tolerances and service design to set the test criteria; there is no universal number of hours that fits every administration service.
A tested workaround does not automatically make a provider non-material. Reassess the applicable categories and both materiality routes. Reliable recovery evidence may support the control assessment while the provider remains material.
Test the work after the platform returns
Technical restoration is one recovery milestone. For the example above, the fund still needs evidence that records reconcile, instructions can be processed, outstanding work can be cleared and the member service can return to normal.
The sequence below is a suggested review aid. Some activities may run together or in a different order for a particular service. Assess performance against the fund's approved tolerances throughout the disruption and recovery, not just at the final step. Paragraph 42 of CPS 230 requires a systematic BCP testing program that covers critical operations and includes an annual business continuity exercise.
Illustrative recovery review
From restored platform to member service
Restore
Confirm the platform and required data are available.
Reconcile
Identify missing, duplicated or inconsistent transactions.
Process
Demonstrate contribution and benefit instruction handling.
Clear backlog
Check the capacity and controls for accumulated work.
Confirm service
Verify the member service has returned to normal.
Change the evidence request for custody and investment management
The same assessment structure works for other prescribed categories, but the evidence request must follow the service.
| Service | Trace the work | Evidence to examine |
|---|---|---|
| Fund administration | Contributions, benefit instructions, member records and exception queues. | Usable data access, transaction reconciliation, processing capacity and backlog clearance. |
| Custodial services | Holdings and cash records, settlement instructions, exceptions and transfers. | Reconciliation responsibilities, access to records, disrupted settlement handling and transfer dependencies. |
| Investment management | Mandate instructions, dealing, reporting, valuation inputs and coordination with custody. | Access to mandate and transaction records, alternative dealing arrangements, reporting dependencies and hand-offs to the custodian. |
These are suggested enquiries, not an exhaustive APRA checklist. Assess the actual mandate and service design. A provider's category, the critical-operation reliance and any material operational risk all belong in the decision record; annual spend alone answers none of them.
Make a separate decision on SuperStream relief
A gateway in the dependency map raises another question: does a particular material arrangement qualify for the limited exemptions introduced in July 2026?
The current CPS 230 Attachment includes superannuation clearing houses listed on the ATO's SuperStream Product register. It also includes qualifying gateway providers that route SuperStream messages within the Superannuation Transaction Network and have signed an application under a Memorandum of Understanding with the Gateway Network Governance Body Ltd. Check the precise category against the provider rather than assuming all services labelled “SuperStream” qualify.
Category membership is only part of the assessment. Paragraph 57 also requires a material arrangement on standardised contractual terms, or one for which no formal agreement exists. The definition concerns provider-prepared terms where the entity has no, or substantially no, ability to negotiate or amend the rights and obligations addressing matters covered by CPS 230. The exemptions cover paragraphs 53, 54, 55(d), 59(a) and 59(c), not all service-provider obligations. Paragraph 58 provides a separate route for a written APRA exemption.
For a direct gateway arrangement, retain the category evidence, contractual basis, relevant provisions and reviewer. If the gateway is subcontracted by the administrator, record it as a dependency and examine the administrator's arrangement on its own facts. Do not extend a gateway's eligibility to an administrator or custodian without a separate basis.
Relief does not establish resilience or remove the need to assess materiality. APRA's updated guidance addresses continued management of material arrangements with exempt providers. Where practicable, it expects relief to be targeted to the specific provisions that cannot reasonably be satisfied. The updated register accommodates exempt arrangements.
Leave a record the next reviewer can use
For the administrator example, a useful record would contain:
- The operation, provider legal entity, arrangement scope and affected fund or member cohort.
- The administration category and the facts supporting each materiality conclusion, including combined reliance where relevant.
- Links to the dated agreement, dependency map, data-export specification and test report, with their scope and limitations.
- Open actions for usable data access, reconciliation ownership, backlog capacity and gateway dependency evidence, each with an owner and due date.
- The decision-maker, decision date, next review and events that should trigger an earlier review, such as a service migration or a changed subcontractor.
- Any separate relief assessment and the evidence supporting it.
Keep the assessment record linked to the material service provider register. APRA's 2026 Material Service Provider Register template is available under that heading on its operational risk management page, with updated instructions and provision for exempt arrangements. Use the current official template for the register; the worked record here is supporting assessment material, not a substitute. Paragraph 50 of CPS 230 requires annual submission of the register.
The next review should be able to distinguish what the provider asserted, what the fund tested and what remains unresolved. If an AI tool helps draft an assessment response, retain its source documents and have the responsible reviewer check the reasoning, contradictions and missing evidence before accepting it.
After classification, use the register-maintenance workflow to keep arrangement records current and the administrator exit exercise to test a specific continuity assumption.
Contrata's third-party risk management software brings together collaborative due diligence, AI-assisted assessment responses, provider monitoring, stakeholder follow-ups and flexible reporting. The fund's reviewers remain responsible for classification, evidence evaluation and decisions on risk.