Here are three sentences from the Reserve Bank, written three years apart.
- October 2023. Cyber-attacks “have a higher potential than other types of incidents to be systemic”. [1]
- April 2025. The concentration of dependencies “can also increase the probability of an incident having a system-wide impact”. [2]
- October 2026. “The likelihood that operational incidents become systemic is increasing.” [3]
Potential. Then probability. Now likelihood, and it’s rising.
Central banks pick these words carefully, and that’s a conditional turning into a declarative inside three years. It happened in the publication the Bank uses to say what could destabilise the financial system.
The subject isn’t new. The grammar is.
Worth being clear about what hasn’t changed, because it’s easy to oversell this.
The Bank has been writing about operational and cyber risk for eight years. A box on cyber risk in October 2018. Another on building resilience to cyber risks in April 2022. A full focus topic, Operational Risk in a Digital World, in October 2023. [4][5][1] So the Bank noticing your supplier list isn’t the news here.
What’s moved is how hard the Bank is willing to put it, and how recently.
Go back only to March 2026. Operational and cyber risk turn up across that edition as a real but secondary theme, behind market volatility and geopolitics. The Review flags “Growing operational complexity and interconnectedness across the financial system is increasing” and mentions “an outage at a major financial institution or a service provider used by many financial institutions”. [6] Useful, and hedged, and not a focus topic.
Six months later it’s a focus topic of its own, with a declarative sentence about likelihood rising. [3][7]
Six months ago this was a paragraph. Now it’s a chapter, and the verb changed.
Two things in the October edition that weren’t in any of the others
The first is a word that hasn’t appeared before. Asked which vulnerabilities matter most, the Bank answers: “The two most important are (i) concentration and lack of substitutability and (ii) complex and opaque interconnections.” [3]
Substitutability. Not whether you depend on a provider, but whether anyone else could do the job. Read the 2023 and April 2025 pieces and you’ll find concentration covered at length, cloud providers named as a small group globally, third-party dependencies described as “increasingly concentrated”. [1][2] Neither one asks whether the provider could be replaced.
The second is a number. “Some of the largest regulated entities in Australia have around 150 service providers supporting critical operations”. And on where they sit: “Many of these are located overseas and outside of the Australian regulatory perimeter.” [3]
We wrote about that 150 in September. The count hasn’t moved. What’s moved is that the central bank is now using it in a chapter about systemic risk, where before there was no figure at all, just “an increasing and interconnected range of parties”. [1]
So why does a central bank’s verb matter to you?
Fair question. The Reserve Bank doesn’t write prudential standards and can’t fine you. APRA does both.
It matters because they sit at the same table. The Council of Financial Regulators is APRA, ASIC, Treasury and the Reserve Bank, and language in the Financial Stability Review is rarely freelance. It’s usually either downstream of work already underway or upstream of work about to be.
In this case you don’t have to guess which, because APRA has published its plan.
APRA has already run this as a stress test
On 30 June, APRA published the findings of its first System Risk Stress Test. Four major banks and six large super funds, modelling bank liquidity pressure beyond anything in the past 50 years and member withdrawals well above COVID levels. [8]
Buried in the scenario design is the line worth your attention. The scenario included an operational disruption at a material service provider. [8]
The findings name common dependencies on major service providers as a vulnerability, alongside concentration risk and mismatched behavioural assumptions. APRA’s Chair said the findings “reinforce the importance of the work we are doing on material service provider arrangements”. [8]
So this isn’t a thought experiment anyone is working up to. Ten of the largest institutions in the country have already been put through a scenario where a shared provider goes down, and the regulator has already published what it learned.
What APRA says it’s doing next, in its own words
The Corporate Plan for 2026-27 is specific, and most of it lands inside twelve months. [9]
APRA says it will increase its focus on how entities manage risks from material service providers, including common technology platforms. It says it will “formalise our data collection for material service providers” this year, to strengthen oversight of common dependencies.
It will run thematic reviews of operational and technology risk at general insurers and specialist payment providers, building on work already done with super trustees and private health insurers.
It will launch a new system risk stress test in 2026-27.
It expects entities to be regularly testing business continuity plans “under a range of severe but plausible operational disruptions”, and it will test crisis preparedness itself through simulations, desktop exercises and fire drills.
And with the other CFR agencies it’s working on contingency arrangements for significant payments disruptions.
Now put the formalised collection next to the Bank’s sentence about substitutability.
Once the collection is formal, APRA sees the whole industry’s dependencies. You see your own column.
That asymmetry is the practical argument for doing the work now. Not because anyone’s in trouble, but because it’s a poor look to learn the shape of your own concentration from a regulator who worked it out from everybody else’s returns.
The thing nobody here is saying out loud yet
One more sentence, from the Council of Financial Regulators after its September meeting: “Critical third parties to the financial sector remain a key systemic vulnerability.” The Council also said it had discussed progress on closing the gaps in regulatory oversight of them. [10]
In the United Kingdom, that same sentence already ended somewhere specific. On 10 July this year HM Treasury made its first designations of Critical Third Parties, naming four global cloud and technology providers. From 13 July the Bank of England, the PRA and the FCA began overseeing them directly, on the basis that “disruption or failure could affect multiple firms or markets at the same time”. [11]
Be careful what you do with that. There is no Australian consultation, no exposure draft, no bill and no date. We’re not predicting one and nobody should write a business case on it. What’s on the record is narrower and still worth knowing: four Australian regulators have jointly named the same gap another country has now closed, and said they’re working on it.
And here’s the part that doesn’t change either way
The UK announcement is explicit about what the regime does not do.
The critical third parties regime “adds to, rather than replaces, existing duties: regulated firms remain responsible for managing their own third-party arrangements”. [11]
Even in the version where the big providers get supervised directly, your obligation is identical to what it is today. The same thing is true under CPS 230 right now. Whatever the provider is obliged to do, the regulated entity still owns the resilience of its critical operations, and the board still signs.
We made this point about AI vendors a fortnight ago and it generalises: an obligation placed on your supplier subtracts nothing from you.
Where BayRisk lands on this
The reading we’d push back on is the comfortable one. That a central bank hardening its language is a signal more regulation is coming, and that there’s time until it does.
Look at the dates. The data collection is this year. The stress test is this year. The thematic reviews are this year. The business continuity expectation isn’t coming, it’s current. None of it waits on a new law, and none of it needs a consultation to close.
There’s a second reason not to wait, and it’s the more interesting one. The question the Bank has put at the centre of this, whether a provider could be replaced, isn’t a line in any prudential standard. That means nobody can sell you a template for it and no checklist arrives in the post. It has to be worked out from your own operations, your own tolerances and your own contracts.
That’s discovery, not construction. We’re not going to tell you to re-architect anything, because that isn’t what we do and it isn’t what any of this asks for. It’s finding out what’s true, deciding what matters most, and being able to show it before someone asks.
A register was the answer to “who do we depend on”. Nobody has written the standard for “who could we do without”.
What’s worth having ready
None of these need a project. They need somebody to go and find out.
- Which of your critical operations has no second path, at any price, inside the tolerance you’ve already published.
- Which of your providers would also show up on your competitors’ returns, because that’s the view APRA is about to have and you aren’t.
- When you last ran a shared-provider outage as an exercise rather than described it on a form. APRA has now run one at ten institutions.
- Whether your material service provider data is in a shape that survives being collected formally, rather than assembled for a deadline.
If you’re not sure which of your providers you could actually do without, that’s worth working out on your own timeline rather than on the morning you find out. Happy to talk it through: hello@bayrisk.com.au.
References
- Reserve Bank of Australia, Financial Stability Review, October 2023, Focus Topic 5.5, “Operational Risk in a Digital World”. https://www.rba.gov.au/publications/fsr/2023/oct/focus-topic-operational-risk-in-a-digital-world.html
- Reserve Bank of Australia, Financial Stability Review, April 2025, Focus Topic 4.2, “Looking at Digitalisation through a Financial Stability Lens”. https://www.rba.gov.au/publications/fsr/2025/apr/focus-topic-looking-at-digitalisation-through-a-financial-stability-lens.html
- Reserve Bank of Australia, Financial Stability Review, October 2026, Focus Topic 4.1, “Operational Risk and Financial Stability”. https://www.rba.gov.au/publications/fsr/2026/oct/focus-topic-operational-risk-and-financial-stability.html
- Reserve Bank of Australia, Financial Stability Review, October 2018, “Box D: Cyber Risk”. https://www.rba.gov.au/publications/fsr/2018/oct/box-d.html
- Reserve Bank of Australia, Financial Stability Review, April 2022, “Box C: Building Resilience to Cyber Risks”. https://www.rba.gov.au/publications/fsr/2022/apr/box-c-building-resilience-to-cyber-risks.html
- Reserve Bank of Australia, Financial Stability Review, March 2026, Financial Stability Assessment. https://www.rba.gov.au/publications/fsr/2026/mar/financial-stability-assessment.html
- Reserve Bank of Australia, “Release of Financial Stability Review”, media release 26-28, 1 October 2026. https://www.rba.gov.au/media-releases/2026/mr-26-28.html
- Australian Prudential Regulation Authority, “APRA publishes findings of inaugural System Risk Stress Test”, 30 June 2026. https://www.apra.gov.au/news-and-publications/apra-publishes-findings-inaugural-system-risk-stress-test
- Australian Prudential Regulation Authority, Corporate Plan 2026-27, “Our strategic objectives”. https://www.apra.gov.au/apra-corporate-plan-2026-27/our-strategic-objectives
- Council of Financial Regulators, media release 2026-05, 3 September 2026. https://cfr.gov.au/news/2026/mr-26-05.html
- Bank of England, “UK financial regulators to begin overseeing Critical Third Parties announced by HM Treasury”, 10 July 2026. https://www.bankofengland.co.uk/news/2026/july/uk-financial-regulators-to-begin-overseeing-critical-third-parties-announced-by-hmt