The Open Compliance Network

IThe structural problem

The sector’s growth is being taxed by a procurement process designed for a different era. A fintech seeking to integrate with a Tier 1 bank submits much the same package of security and compliance evidence to each institution separately, in different formats, on different timelines. The cycle runs 12 to 18 months, and it consumes scarce runway before a single dollar of commercial revenue is recognised.

This is not a risk‑management process. It is an administrative inheritance. The evidence is unambiguous:

These two barriers are not independent. Capital burns while procurement stalls. The 32% who name capital as their primary constraint are, in many cases, describing the downstream consequence of the 25% problem.

IIWhy the existing solutions have not worked

Top‑down attempts to solve this have stalled. The reason is architectural: they were regulator‑owned and disconnected from the actual procurement appetites of the banks they were trying to influence. A regulator can mandate disclosure. It cannot manufacture trust.

The Open Compliance Network is structurally different on three dimensions. It is industry‑led: the baseline is co‑authored by the banks’ own risk and security teams, so it reflects what banks actually need. It is peer‑vetted: validation sits with a rotating council of Associate Member security leads, so FinTech Australia convenes and governs but does not audit or certify, which keeps the liability off our books. And it is built on existing infrastructure: not a new regulatory regime, but a second layer on top of the CDR accreditation and Digital ID frameworks that already exist.

IIIThe architecture

The OCN operates as a tri‑layer assurance model. Each layer has a distinct owner and a distinct scope.

The insight is deceptively simple. Operational safety is not a competitive differentiator. A breach anywhere in the fintech ecosystem damages every institution’s digital‑banking reputation at once. Banks have no edge to defend in agreeing on a shared operational floor, and a shared interest in raising it. This is the same logic the ACCC accepted when it authorised banks to collaborate on scam‑prevention standards. That authorisation is the OCN’s legal foundation, not a loose analogy.

IVFrom documents to attributes

Current procurement is document‑based. A member sends a fifty‑page PDF; a bank analyst reads it, flags gaps, requests revisions, routes it through legal and risk; the cycle repeats for every institution. The OCN shifts this to attribute‑based querying.

Instead of asking “do you have a disaster‑recovery plan?”, a bank’s system queries a specific, dated attribute and receives a signed binary response:

VThe versioning problem

A static standard is a liability. ISO 27001 evolves; threat vectors change; insurance markets reprice. Any baseline that does not update becomes, within eighteen months, a false signal of safety. The OCN answers this with a versioned evidence system. An OCN‑26 attestation is valid for the 2026 baseline; when the council updates the standard, members get a 90‑day transition window to refresh their vault. Directory status updates automatically.

VIWhy the banks say yes

The OCN only works if banks participate. This is the load‑bearing assumption, and it deserves direct examination. There are three reasons to believe it holds.

The efficiency argument. Each Tier 1 procurement team processes hundreds of vendor submissions a year. Standardising the commodity 60% frees their most experienced risk analysts for the assessments that actually require judgment. This is resource optimisation, not altruism.

The legal argument. The ACCC’s 2024 scam‑prevention authorisation established that banks can co‑author shared safety baselines without tripping competition law. The OCN’s scope sits squarely inside that precedent.

The talent argument. The Associate‑in‑Residence model asks each participating bank for a single six‑month secondee to serve as Protocol Coordinator. In return, that person gets early sight of Australia’s highest‑growth fintechs. For an innovation lead at NAB or Westpac, that is deal‑flow, not a compliance chore.

VIIMember value: the evidence

The OCN is not a theoretical proposition. The member data already shows what happens when a structural barrier is removed.

WeMoney

Built directly on the CDR infrastructure FinTech Australia helped shape. Raised a $12M Series A at a $64.2M valuation in 2025, Mastercard‑backed; the platform saves users an average of $4,419 a year; three Finnies in 2025, including FinTech Organisation of the Year.

“CDR wasn’t just a policy win. For WeMoney, it became the product.”

Birchal

Holds 80% of Australia’s equity‑crowdfunding market: $347M raised across 489 campaigns, connecting 120,000+ investors to emerging ventures. That market depth would not exist without the regulatory clarity FinTech Australia’s advocacy produced.

Swyftx

Australia’s second‑largest digital‑assets brokerage, 1.5M+ clients across three countries, having acquired Easy Crypto in March 2025 and added 1.1M customers in a single move.

These outcomes share one upstream cause: policy infrastructure that lowered the cost of doing business. The OCN applies the same logic one layer up — to operational procurement.

VIIIExecution: the first 100 days

The OCN does not need a new budget line, a regulatory approval, or a multi‑year working group. It needs a decision.

IXThe strategic claim

Most industry bodies spend their time asking government to change. The OCN asks the industry to change itself. It does not wait for a new law or a ministerial mandate. It uses the relationships, the legal precedent, and the member infrastructure FinTech Australia already has, and turns them into a piece of national commercial infrastructure.

The sector reaches $13.6B today with roughly a one‑in‑five integration success rate. Lifting that rate is the single highest‑leverage move available to the body that convenes both sides of the table. That is the size of the opportunity sitting inside the procurement process of four banks.