CPS 230 and Offshore Teams in the Philippines: EOR Vendor Risk Guide for Australian Financial Services Firms

Author: Phil Murphy
Published: August 17, 2026

Australian banks, insurers and superannuation businesses can use an Employer of Record (EOR) to employ dedicated team members in the Philippines. However, an EOR does not transfer the Australian organisation’s operational-risk, continuity or regulatory responsibilities.

Under the current version of APRA Prudential Standard CPS 230, an APRA-regulated entity must manage operational risks, maintain critical operations through disruption and control risks arising from service providers.

An EOR arrangement is not automatically a material service-provider arrangement. The Australian organisation must assess whether it relies on the provider to support a critical operation or whether the arrangement creates material operational risk.

Important: This guide provides general information and is not legal or regulatory advice. APRA-regulated organisations should confirm their CPS 230 classification, contract and notification requirements with their legal, risk and compliance advisers.

TL;DR: What CPS 230 Means for Philippines EOR Arrangements

• CPS 230 applies directly to APRA-regulated organisations, not every business holding an Australian Financial Services Licence.
• A Philippines EOR is not automatically a material service provider.
• Materiality depends on the work performed, the critical operations supported, the systems and data accessed, concentration risk and the effect of provider failure.
• If the arrangement is material and services or relevant personnel are located in the Philippines, it may be a material offshoring arrangement.
• The EOR can support Philippine employment, payroll, HR administration and local compliance, but the Australian organisation retains responsibility for operational risk.
• Material arrangements need appropriate due diligence, a compliant written agreement, regular monitoring, continuity planning and an orderly exit plan.
• APRA must be notified before entering a material offshoring arrangement.
• The arrangement should be assessed before workers receive access to critical systems or customer information.

Does CPS 230 Apply to Your Australian Financial Services Business?

CPS 230 applies directly to APRA-regulated entities, including:

An AFSL alone does not make a business subject to CPS 230. However, a non-APRA-regulated firm may still need similar controls because of licensee requirements, agreements with an APRA-regulated client, privacy obligations or internal risk policies.

For the broader licensing context, see AFSL Compliance and Philippines Teams.

Is a Philippines EOR a Material Service Provider Under CPS 230?

Not automatically.

Under CPS 230, a material service provider is a provider that an APRA-regulated entity relies on to undertake a critical operation or whose arrangement exposes the entity to material operational risk.

The assessment should consider the whole operating model, not merely the fact that the workers are employed through an EOR.

Situations Requiring a Closer Materiality Assessment

The final classification belongs to the APRA-regulated organisation. An EOR should provide evidence for the assessment but should not make the regulatory decision for the client.

What Does an EOR Change—and What Remains With the Australian Firm?

An EOR provides the local employment structure. It does not become responsible for the Australian organisation’s prudential obligations.

For a broader explanation of the employment model, read Employer of Record for Australian Financial Services Companies Hiring in the Philippines.

Eight Steps for Assessing a Philippines EOR Under CPS 230

1. Map the Complete Service

Document what the EOR and the Philippines-based employees will actually do.

The map should identify:

• the employing entity;
• the employees and roles covered;
• the Australian business processes they support;
• systems, applications and data they can access;
• where employees, devices and data are located;
• payroll, HR, IT, facilities and other providers involved;
• subcontractors and fourth parties;
• Australian managers responsible for supervision;
• operational dependencies between the EOR and the client.

Do not describe the arrangement only as “EOR services”. Separate the employment and payroll service from the operational work performed by the offshore team.

2. Connect the Team to Critical Operations

CPS 230 defines critical operations by the potential effect of a disruption on customers or the financial system.

APRA identifies minimum critical operations that include:

• payments, deposit-taking, custody, settlement and clearing for ADIs;
• claims processing for insurers;
• investment management and fund administration for superannuation licensees;
• customer enquiries and supporting systems and infrastructure for all APRA-regulated entities.

Determine whether the offshore team performs, supports, reviews or enables any part of these operations.

3. Assess Materiality

Ask what would happen if the EOR arrangement failed for one day, one week or one month.

Consider:

• whether the critical operation could continue;
• how quickly the team could be transferred or replaced;
• the number and importance of workers covered;
• access to customer, financial or operational data;
• dependence on a single office, network or provider;
• country and regional risks;
• payroll failure and employee-retention risk;
• the availability of trained backup staff;
• the time required to establish an alternative employment arrangement;
• financial, customer, compliance and reputational consequences.

Record both the decision and the evidence used. If the provider is not classified as material, retain the reasoning and review it when the team, scope or access changes.

4. Complete Provider Due Diligence

Before entering or materially changing a material arrangement, CPS 230 requires appropriate due diligence and an assessment of financial and non-financial risks.

For a Philippines EOR, request evidence covering:

• identity and registration of the Philippine employing entity;
• financial stability and insurance;
• Philippine employment and payroll capability;
• payroll approval and checking controls;
• SSS, PhilHealth, Pag-IBIG and tax-administration processes;
• information-security controls;
• employee screening and confidentiality procedures;
• incident identification and escalation;
• business-continuity and disaster-recovery plans;
• continuity-test results;
• data and personnel locations;
• subcontractors and fourth parties;
• service levels and performance reporting;
• complaints and issue-management processes;
• termination, employee-transfer and data-return procedures.

Use the Philippines EOR Due-Diligence Checklist and Scorecard to organise the initial review.

5. Review the EOR Agreement Against CPS 230

A material arrangement must be supported by a legally binding agreement. The contract should clearly address the following areas.

Standard EOR terms may not contain every provision required for a material CPS 230 arrangement. Complete the gap assessment before signing, not after the offshore team is operational.

6. Design the Operational Controls

The contract should be supported by working controls.

Depending on the role, these may include:

• role-based and least-privilege system access;
• multifactor authentication;
• controlled devices and approved software;
• restrictions on local downloads and removable media;
• maker–checker approval for financial or payroll actions;
• documented advice and decision-making boundaries;
• quality reviews and Australian sign-off;
• activity logging and audit trails;
• secure employee onboarding;
• immediate access removal during offboarding;
• incident and near-miss escalation;
• periodic permission reviews;
• confidentiality and data-handling training;
• documented fallback procedures.

CPS 230 works alongside other obligations. Where information-security risks are involved, review CPS 234 Information Security and the organisation’s cyber-risk framework.

7. Test Continuity and Exit Arrangements

A business-continuity plan should address realistic failures affecting the Philippines operation.

Test scenarios may include:

• extended loss of internet or electricity;
• typhoon, flooding, earthquake or transport disruption;
• office or secure-site unavailability;
• loss of a payroll or HR platform;
• cyber incident or compromised device;
• sudden loss of key personnel;
• failure of a subcontractor;
• delayed payroll funding;
• unavailability of the EOR;
• urgent transfer to another provider or local entity.

The test should establish whether the Australian organisation can keep each critical operation within its approved maximum disruption period, data-loss tolerance and minimum service level.

APRA’s CPG 230 guidance also suggests that regulated entities confirm whether material providers maintain robust continuity testing and consider joint testing where appropriate.

8. Notify, Register and Monitor

If the arrangement is material, the Australian organisation may need to:

• include the provider and material arrangements in its service-provider register;
• submit its material service-provider register to APRA annually;
• notify APRA before entering a material offshoring arrangement;
• notify APRA when a significant change to that offshoring arrangement is proposed;
• notify APRA within 20 business days after entering or materially changing an agreement for a service relied upon to undertake a critical operation;
• monitor service levels, controls and contractual compliance;
• provide regular reporting to senior management;
• have internal audit review a proposed material arrangement involving the outsourcing of a critical operation.

A material offshoring arrangement can exist even when the provider is incorporated in Australia if the service, relevant personnel or operational delivery is physically located outside Australia.

CPS 230 Notification Timeframes

Where an incident falls under both CPS 230 and CPS 234, APRA states that a single notification can be sufficient, with the earliest applicable timeframe used.

Philippines-Specific Risks to Include

Offshore Data Access

Offshore access to customer or employee information requires a clear privacy assessment.

Australian Privacy Principle 8 may apply when personal information is disclosed to an overseas recipient. The OAIC’s APP 8 guidance generally expects reasonable steps to be taken to protect the information and explains that the Australian entity may remain accountable for an overseas recipient’s handling of it.

Not every remote-access arrangement is necessarily a cross-border disclosure. The outcome can depend on whether the Australian organisation retains effective control over how the information is handled. Obtain privacy advice for the specific operating model.

Philippine Data-Protection Requirements

The Philippine Data Privacy Act of 2012 requires reasonable organisational, physical and technical safeguards. Where personal-data processing is subcontracted, appropriate protections and responsibilities should be documented.

The due-diligence review should examine actual controls, not merely a general statement that the provider is “privacy compliant”.

Geographic and Infrastructure Risk

Assess:

• office and employee locations;
• exposure to common natural hazards;
• power and telecommunications redundancy;
• secure alternative work locations;
• backup equipment;
• remote-work security;
• critical staff concentration;
• recovery arrangements across different locations.

Employee and Payroll Continuity

Because the EOR is the legal employer, a provider failure can affect employee confidence, payroll, benefits, employment records and retention.

The exit plan should cover:

• access to payroll and employment records;
• transfer of leave and benefit information;
• employee communications;
• final and first payroll responsibility;
• HMO or insurance continuity;
• new employment documentation;
• statutory records;
• system-access continuity;
• lawful transfer or re-employment arrangements.

Questions to Ask a Philippines EOR

1. Which Philippine legal entity will employ our team?
2. Which services are delivered directly, and which involve subcontractors?
3. Where will employees, systems, devices, records and support personnel be located?
4. Which fourth parties are necessary to deliver payroll, HR, facilities, security or technology services?
5. What service levels will apply to payroll, onboarding, incidents and offboarding?
6. What evidence can you provide of security and privacy controls?
7. How quickly will you notify us of an incident or material service disruption?
8. What continuity scenarios have you tested?
9. How will services continue if your main office, payroll system or key personnel become unavailable?
10. Can you support client audit requests and provide control evidence?
11. Will the agreement provide the access and cooperation APRA requires?
12. What information will be available for our material service-provider register?
13. How will employees, payroll records, benefits and data be transferred if we exit?
14. How often will we receive performance, control and compliance reports?
15. How will significant changes to locations, subcontractors or delivery methods be communicated?

Warning Signs During EOR Due Diligence

Investigate further if a provider:

• claims that using its EOR service automatically makes the client CPS 230 compliant;
• cannot identify the Philippine employing entity;
• cannot explain where people and data will be located;
• refuses to disclose important subcontractors or fourth parties;
• provides only general statements about security and continuity;
• has no documented incident-escalation process;
• cannot produce continuity-test evidence;
• offers no measurable service levels;
• does not provide access to payroll and employment records;
• cannot support APRA access provisions for a material arrangement;
• restricts employee transfer or operational exit;
• has unclear data ownership, return or deletion terms.

How SOS Can Support an APRA-Regulated Organisation

Smart Outsourcing Solution provides the Philippine employment layer for dedicated offshore teams.

Depending on the agreed scope, SOS can help with:

• Philippine employment agreements;
• payroll and statutory employment administration;
• onboarding and local HR coordination;
• benefits administration;
• employee records and payroll reporting;
• contractor-to-employee transition planning;
• provider due-diligence information;
• service-level and escalation planning;
• employee communication;
• structured offboarding or provider transition support.

SOS does not replace the Australian organisation’s Board, risk, legal, compliance, internal-audit or operational-management responsibilities.

The client remains responsible for:

• deciding whether the arrangement is material;
• identifying critical operations;
• setting disruption tolerances;
• controlling regulated work;
• managing client-data access;
• approving the complete continuity plan;
• submitting APRA notifications;
• meeting CPS 230, CPS 234, privacy and licence obligations.

For related controls, read Data, Security and Employment Compliance for Australian Finance Teams in the Philippines.

Frequently Asked Questions

Does CPS 230 Apply to Every AFSL Holder?

No. CPS 230 applies directly to APRA-regulated organisations. An AFSL holder that is not also APRA-regulated is generally not directly covered by CPS 230, although licence conditions, client contracts, privacy requirements or internal policies may impose related obligations.

Is Every Philippines EOR a Material Service Provider?

No. The regulated organisation must assess whether it relies on the EOR arrangement to undertake a critical operation or whether the arrangement creates material operational risk.

Does APRA Need to Be Notified Whenever a Philippines Employee Is Hired?

Not necessarily. The relevant CPS 230 requirement concerns material offshoring arrangements and certain agreements supporting critical operations. Individual hiring changes within an existing approved arrangement should be assessed against the organisation’s material-change criteria.

Can an EOR Take Responsibility for CPS 230 Compliance?

No. An EOR can support the controls, evidence and contractual arrangements, but the APRA-regulated organisation retains responsibility for meeting its prudential obligations.

Does APP 8 Always Apply When a Philippines Employee Accesses Australian Data?

Not automatically. APP 8 generally applies to cross-border disclosure of personal information. Whether controlled remote access is treated as use or disclosure depends on the specific arrangement. The organisation should document the assessment and obtain privacy advice where needed.

Can APRA Access an Offshore EOR Provider?

For a material arrangement, CPS 230 requires the formal agreement to allow APRA access to relevant documentation, data and information, provide a right to conduct an on-site visit and prevent the provider from impeding APRA’s duties.

How Often Should an EOR Arrangement Be Reviewed?

Material arrangements should be monitored regularly in proportion to their nature and use. Review service levels, control effectiveness and contractual compliance, and repeat the risk assessment after significant changes to team size, work, systems, data, locations or subcontractors.

What Happens If the EOR Arrangement Is Not Material?

The organisation should document why it reached that decision and retain appropriate controls for employment, privacy, security, payroll and continuity. A non-material arrangement can become material as the offshore team grows or begins supporting more important operations.

Planning a Philippines Team for an APRA-Regulated Business?

Assess CPS 230 requirements before finalising the provider agreement or granting access to critical systems.

Smart Outsourcing Solution can help you define the Philippine employment scope, provide EOR due-diligence information and plan onboarding, payroll, employee support and future transition requirements.

Speak with a Philippines EOR specialist about building an offshore team with clearer employment, payroll and operational controls.