APRA
CPS 234
Information security
Your AI vendors, models and data stores become information assets. Each one needs classified data, tested controls and a clear owner before it goes live.
What we build in
Asset registerControl testingVendor review
Financial services · Sydney
We help Australian banks, lenders, wealth managers, funds and fintechs ship AI that is built to pass APRA, ASIC and AUSTRAC review, not stall in it. Built in Surry Hills, delivered onsite across the CBD, North Sydney and Parramatta.
Why financial services teams call us
"Our complaints team works from spreadsheets. RG 271 timeframes are tight and we cannot spot systemic issues fast enough."
"Suspicious matter reports take us eleven days to draft. The deadline is three business days."
"Our customer assistant was blocked at design review because nobody could say where the data goes."
Regulation map
Information security
Your AI vendors, models and data stores become information assets. Each one needs classified data, tested controls and a clear owner before it goes live.
Operational risk management
A model provider can become a material service provider. You need to know what fails if it goes down, how you would cope, and how fast you recover.
Internal dispute resolution
Complaints have firm response timeframes and systemic issues must be found and reported. AI can help triage, but every response stays traceable.
Anti-money laundering and counter-terrorism financing
Suspicious matter reports are due within three business days. AI can draft them and rank alerts, but a trained officer decides and submits.
Essential Eight maturity model
Not mandated by APRA, but it is now the cyber baseline boards, insurers and enterprise clients ask for. We target Maturity Level Two and map every strategy to your CPS 234 controls.
Australian Privacy Principles
Personal information needs a lawful purpose and safe handling. New transparency rules for automated decisions start in December 2026.
This is a design guide, not legal advice. Your compliance and legal teams make the final call. We give them the evidence to make it quickly.
Essential Eight
APRA does not mandate the Essential Eight, but it is the baseline your board, your cyber insurer and your enterprise clients now ask about. We map each strategy to your CPS 234 controls, target Maturity Level Two by default, and hand your risk team the evidence.
Bars show our default target, Maturity Level Two. ASD is consulting on a broader Essentials series to follow the Essential Eight; the current model stays in force until it lands, and we track both.
Use cases
Ranges are typical of what we see once a workload is in production. Your baseline decides your number, so we measure it first.
Agents read each complaint, classify it, start the RG 271 clock and flag patterns that look systemic, so your team handles judgement, not sorting.
Transaction alerts ranked by risk, with a pre-drafted SMR narrative and evidence pack for the analyst to check and submit.
Call and email review across every interaction instead of a small sample, with flagged language and a risk score your compliance team can trace.
Explainable models that help assessors decide faster, with versioned policy, bias testing and reasons a customer can understand.
Regulatory and board reporting on open-source Superset and ClickHouse, governed and hosted in Australia, without per-seat fees.
An AI-readiness and technology addendum for sponsors buying or growing a financial services business.
How we keep it compliant
Every build follows the same path. Data stays onshore, a person signs off on decisions that touch a customer, and every step leaves a record.
Ways to engage
Two weeks: one workload taken to an evaluated prototype, with the CPS 234 and CPS 230 evidence your risk team will ask for.
from A$10K
Get a proposalSix to ten weeks: the workload in production in your cloud, Sydney region, with evals, audit trail and human review wired in.
from A$50K
Get a proposalA squad that works alongside your engineers and risk partners, two to four days a week, with quarterly outcomes.
from A$12K/mo
Get a proposalQuestions
Yes. We host models and data in the Sydney region and document every data flow, so your CPS 234 asset register is accurate from day one.
There is no AI approval process. CPS 234 and CPS 230 still apply, and some service provider arrangements need to be notified. We prepare that evidence with you.
Claude, GPT and open-weight models, chosen per workload on accuracy, cost and where they can be hosted. We do not resell any vendor.
Not on its own. We design for AI to prepare and recommend, and for a named person to decide on anything that affects a customer.
No. We build the controls and the evidence. Your compliance and legal teams make the call, faster.
Start a conversation
A few lines is enough. A senior person reads every message and replies with a next step, not a sales sequence.
We reply within one business day.