The Open Compliance Network

IThe structural problem

The sector’s growth is being taxed by a procurement process designed for a different era. A fintech seeking to integrate with a Tier 1 bank submits much the same package of security and compliance evidence to each institution separately, in different formats, on different timelines. The cycle runs 12 to 18 months, and it burns an estimated $200–250k in runway for a Series B scale‑up before a single dollar of commercial revenue is recognised. Capital access and integration friction are not separate problems; one causes the other.

This is not a risk‑management process. It is an administrative inheritance. The evidence is unambiguous:

These two barriers are not independent. Capital burns while procurement stalls. The 32% who name capital as their primary constraint are, in many cases, describing the downstream consequence of the 25% problem.

IIWhy the existing solutions have not worked

Top‑down attempts to solve this have stalled. The reason is architectural: they were regulator‑owned and disconnected from the actual procurement appetites of the banks they were trying to influence. A regulator can mandate disclosure. It cannot manufacture trust.

And the OCN is not CDR with a different name. CDR governs how data is accessed and shared. The OCN governs whether a fintech is operationally safe to integrate with — business continuity, insurance, incident response, key‑person risk. These are the specific questions where bank procurement stalls after CDR accreditation is confirmed. The OCN picks up exactly where CDR stops.

The Open Compliance Network is structurally different on three dimensions. It is industry‑led: the baseline is co‑authored by the banks’ own risk and security teams, so it reflects what banks actually need. It is peer‑vetted: validation sits with a rotating council of Associate Member security leads, so FinTech Australia convenes and governs but does not audit or certify, which keeps the liability off our books. And it is built on existing infrastructure: not a new regulatory regime, but a second layer on top of the CDR accreditation and Digital ID frameworks that already exist.

IIIThe architecture

The OCN operates as a tri‑layer assurance model. Each layer has a distinct owner and a distinct scope.

The insight is deceptively simple. Operational safety is not a competitive differentiator. A breach anywhere in the fintech ecosystem damages every institution’s digital‑banking reputation at once. Banks have no edge to defend in agreeing on a shared operational floor, and a shared interest in raising it. This is the same logic the ACCC accepted when it authorised banks to collaborate on scam‑prevention standards. That authorisation is the OCN’s legal foundation, not a loose analogy.

IVFrom documents to attributes

Current procurement is document‑based. A member sends a fifty‑page PDF; a bank analyst reads it, flags gaps, requests revisions, routes it through legal and risk; the cycle repeats for every institution. The OCN shifts this to attribute‑based querying.

Instead of asking “do you have a disaster‑recovery plan?”, a bank’s system queries a specific, dated attribute and receives a signed binary response:

VThe versioning problem

A static standard is a liability. ISO 27001 evolves; threat vectors change; insurance markets reprice. Any baseline that does not update becomes, within eighteen months, a false signal of safety. The OCN answers this with a versioned evidence system. An OCN‑26 attestation is valid for the 2026 baseline; when the council updates the standard, members get a 90‑day transition window to refresh their vault. Directory status updates automatically.

VIWhy the banks say yes

The OCN only works if banks participate. This is the load‑bearing assumption, and it deserves direct examination. There are three reasons to believe it holds.

The efficiency argument. Each Tier 1 procurement team processes hundreds of vendor submissions a year. Standardising the commodity 60% frees their most experienced risk analysts for the assessments that actually require judgment. This is resource optimisation, not altruism.

The legal argument. The ACCC’s 2024 scam‑prevention authorisation established that banks can co‑author shared safety baselines without tripping competition law. The OCN’s scope sits squarely inside that precedent.

The deal‑flow argument. The Associate‑in‑Residence model asks each participating bank for a single six‑month secondee to serve as Protocol Coordinator. In exchange, that person gains direct visibility into Australia’s highest‑growth fintech pipeline before those companies reach market or approach a competing institution. For an innovation lead at NAB or Westpac, this is not a compliance exercise — it is structured early access to potential acquisition targets, partnership candidates, and technology vendors, before the rest of the market sees them.

VIIMember value: the evidence

The OCN is not a theoretical proposition. The member data already shows what happens when a structural barrier is removed.

WeMoney

Built directly on the CDR infrastructure FinTech Australia helped shape. Raised a $12M Series A at a $64.2M valuation in 2025, Mastercard‑backed; the platform saves users an average of $4,419 a year; three Finnies in 2025, including FinTech Organisation of the Year.

“CDR wasn’t just a policy win. For WeMoney, it became the product.”

Birchal

Holds 80% of Australia’s equity‑crowdfunding market: $347M raised across 489 campaigns, connecting 120,000+ investors to emerging ventures. That market depth would not exist without the regulatory clarity FinTech Australia’s advocacy produced.

Swyftx

Australia’s second‑largest digital‑assets brokerage, 1.5M+ clients across three countries, having acquired Easy Crypto in March 2025 and added 1.1M customers in a single move.

These outcomes share one upstream cause: policy infrastructure that lowered the cost of doing business. The OCN applies the same logic one layer up — to operational procurement.

VIIIExecution: the first 90 days

The OCN does not need a new budget line, a regulatory approval, or a multi‑year working group. It needs a decision.

IXThe strategic claim

Most industry bodies spend their time asking government to change. The OCN asks the industry to change itself. It does not wait for a new law or a ministerial mandate. It uses the relationships, the legal precedent, and the member infrastructure FinTech Australia already has, and turns them into a piece of national commercial infrastructure.

A note on liability. The OCN is an evidence‑standardisation protocol — not an audit, an endorsement, or a guarantee. If a member experiences a breach after completing the OCN baseline, that is a bank risk decision and a member operational failure. FinTech Australia’s role is to standardise the evidence format and convene the peer review, not to warrant the outcome. This distinction must be written into the OCN participation agreement from day one.

What happens next. This memo requires one decision: convene the Interim Peer‑Vetting Council — one Big 4 bank, one challenger, one RegTech founder — on a 90‑day mandate to define the minimum evidence set and recruit the pilot cohort. Everything else follows from that room.

The sector reaches $13.6B today with roughly a one‑in‑five integration success rate. The OCN’s conservative projection — doubling that rate over three years — contributes an estimated $4–6B in accelerated GDP and positions Australia as the most commercially integrated digital‑finance ecosystem in the APAC region. That is the size of the opportunity sitting inside the procurement process of four banks.