Australian Prudential Regulation Authority

Established in 1998, the Australian Prudential Regulation Authority (“APRA”) is a statutory authority and the primary prudential regulator of the Australian financial services industry. It is responsible for supervising over 2,000 FSIs, including banks, credit unions, building societies, general insurance and reinsurance companies, life insurance, private health insurance, and most members of the superannuation industry.
APRA’s core mission is to establish and enforce prudential standards that ensure FSIs operate in a safe and sound manner. By requiring firms to maintain adequate capital, manage operational risks, and protect information security, APRA promotes the stability and resilience of the Australian financial system, ensuring that FSIs can meet their financial promises to depositors, policyholders, and fund members under all reasonable circumstances.

For more information about industry specific guidelines visit APRA.

The primary APRA standards relevant to an FSI’s use of Cloudflare are:

• CPS 230 (Operational Risk Management): Effective July 1, 2025, this standard replaces CPS 231 (Outsourcing) and CPS 232 (Business Continuity). It requires FSIs to manage operational risks, maintain critical operations during disruptions, and manage risks arising from service providers.
• CPS 234 (Information Security): This standard requires FSIs to maintain information security capabilities commensurate with the size and extent of threats to their information assets.

No, Cloudflare is not an APRA-regulated entity. While we provide robust security controls and technical transparency, the responsibility for determining whether the use of Cloudflare services meets specific APRA regulatory requirements rests solely with the FSI.

Under Prudential Standard CPS 230 (Operational Risk Management) (“CPS 230”), the responsibility for designating a “material service provider” lies with the FSI. While APRA maintains a public register of regulated financial institutions, Cloudflare recognizes that these FSIs often classify our services as “material” under CPS 230 due to our role in protecting their critical operations.

Cloudflare provides the relevant corporate and service details to assist customers in completing their APRA Material Service Provider Register submissions. For additional questions or concerns about corporate and service details, Cloudflare customers should contact their account team.

Yes, APRA outlines specific key contractual provisions that must be included in the contract between third-party services providers and FSIs. These ensure relevant third-party risks are addressed, and can be properly managed by FSIs. These include data security and confidentiality, audit and information rights, termination rights, regulatory access, and more.

Many of the contractual requirements under CPS 230 are already set out in Cloudflare's standard terms, and additional terms supplementing the standard terms are set out in a Regulatory Exhibit, which is available upon request. Cloudflare’s APRA mapping document outlines these contractual requirements and how Cloudflare’s contractual terms align with and support these requirements. Upon request, Cloudflare will work in good faith with customers to ensure contract alignment before the next renewal date of the contract or July 1, 2026.

For additional questions or concerns about individual contracts, Cloudflare customers should contact their account team.

Under CPS 230, the ultimate responsibility for ensuring regulatory compliance rests solely with the FSI. While cloud service providers such as Cloudflare play a role in supporting the operational resilience of the financial sector, APRA’s framework dictates that the FSIs board and senior management maintain non-delegable accountability for the entity’s operational risk and service provider arrangements.

Cloudflare facilitates customer compliance with CPS 230 by making available independent audit documentation, including SOC 2 Type II and ISO 27001. The provision of such documentation is intended to support the customer's own obligation to conduct due diligence and assess the operational risks associated with their service provider arrangements.

Visit the Cloudflare Trust Hub for a full list of compliance resources.

Compliance is a partnership:

• Cloudflare’s Responsibility: Security of the network. Cloudflare is responsible for the physical security of its data centers, the integrity of its software, and the resilience of its global edge network.
• Customer Responsibility: Security in the network. The customer is responsible for configuring Cloudflare services correctly (e.g., setting WAF rules, managing access via Cloudflare Access) and ensuring their overall risk management framework aligns with APRA expectations.

CPS 234 requires entities to have an information security capability that protects assets from threats. Cloudflare supports this by:

• Protection: Provides Web Application Firewall (WAF), DDoS mitigation, and Bot Management to defend against external threats.
• Detection: Offers real-time logging and security analytics that can be integrated with an FSI’s Security Operations Center (SOC).
• Response: Maintains a global incident response team and provides automated tools to mitigate attacks in seconds.
• Assurance: Provides independent third-party audit documentation (SOC, ISO, PCI DSS, IRAP PROTECTED) that validate the effectiveness of Cloudflare’s security controls.
• Contractual commitments and Data Processing Addendum (DPA): To support governance, data security, and compliance.
• Transparency into sub-processing arrangements: To support customers as they assess supply chain dependencies.

For information on how Cloudflare supports FSIs in ensuring security, resiliency, sovereignty and regulatory compliance with redundancy for key security controls and by keeping transactions within regions, visit the Cloudflare Banking & Financial Services page.

No, APRA does not "approve" specific vendors or cloud services. Instead, APRA expects FSIs to perform their own due diligence, risk assessment, and ongoing monitoring of their service providers.

Cloudflare operates data centers in multiple cities across Australia (including Sydney, Melbourne, Perth, Brisbane, and Adelaide). For customers with specific data residency requirements, Cloudflare’s Data Localization Suite allows FSIs to:

• Control where their traffic is inspected.
• Restrict where their logs are stored.
• Ensure that SSL/TLS keys are only held in specific geographic regions.

Yes, to support customer’s compliance with APRA’s governance requirements, Cloudflare offers a two-tiered assurance model, set out in the standard terms and Regulatory Exhibit, addressing (i) the provision to customer of self-service access to independent audit documentation as set out in the section below, and (ii) Cloudflare’s requirement to not impede APRA’s fulfilment of its duties as a prudential regulator.

Cloudflare provides self-service access to our latest ISO 27001, ISO 27701, SOC 2 Type II and IRAP PROTECTED documentation through our Trust Hub. These resources are intended to assist firms in independently assessing the risks and materiality of outsourcing arrangements in line with the APRA rules.

For detailed instructions on how to access compliance documentation within the Cloudflare Dashboard, see this guide on our Developer Docs site.