Australia, Hong Kong and the United Kingdom now all require firms to identify their critical operations, set tolerances for disruption, and manage the third parties those operations depend on. The direction is the same. The detail that drives work is not.
Where they agree
All three place responsibility on the regulated firm rather than on its providers, and none accepts outsourcing as a transfer of accountability. All three expect a register of the arrangements a critical operation depends on.
Where they diverge
The notification obligation is the clearest split. APRA requires notification within 20 business days of a new or materially changed arrangement, running from signing. The HKMA operates a prior-notice regime: notification 30 days before the arrangement takes effect. A group running both has to satisfy the earlier of the two, which in practice means the Hong Kong timetable governs.
Fourth parties are the second. CPS 230 brings sub-providers into scope where a critical operation depends on them. The UK proposals go further still for designated critical third parties, asking whether a firm could stay within tolerance if one were unavailable for a week.
What we are seeing
Most groups we work with built their register around contracts. The register these regimes ask for is built around operations, and the difference is not cosmetic: a contract-shaped register cannot answer the question a supervisor now asks.
This is commentary, not legal advice.