Financial Services
Run a fund ASIC could look at tomorrow
ASIC published its ten principles for private credit and made poor practice a 2026 enforcement priority. AUSTRAC's reformed regime commenced 31 March 2026. Your super fund investors are pushing CPS 230 terms into your IMA. Gwenda evidences all three from the systems you already run.
AFSL, AML/CTF and the evidence your investors' due diligence demands
Built for fund managers and non-bank lenders. Gwenda reads your registry, loan systems, screening tools and identity stack to evidence your licence obligations, your reformed AML/CTF program and the security posture investors diligence.
Discovery
What Gwenda finds, and where it finds it
Every finding names the system it came from. That is what makes it evidence rather than an assertion.
Who can authorise a payment, and whether it takes two
Payment authorisation workflow and user entitlements across your fund administration and banking platforms, which is the segregation-of-duties evidence every ODD review asks for first. Read from your fund administrator, Allvue, banking portals.
Whether screening is actually running
Sanctions, PEP and adverse media screening coverage against your live investor and borrower registers, including entities that never made it into the screening tool. Read from World-Check, ComplyAdvantage, FrankieOne.
CDD files that are complete, and the ones that are not
Customer due diligence and beneficial ownership records matched against what the reformed Act requires, with the gaps identified before AUSTRAC or an auditor finds them. Read from First AML, FrankieOne, greenID.
Board oversight you can point to
AML/CTF program approvals, conflicts register reviews and valuation committee minutes, read from your board platform with dates attached. Read from Diligent, BoardPro.
Who holds privileged access to the loan book
Standing administrative access, MFA enforcement and its exclusions across the systems holding investor and borrower data. Read from Microsoft Entra ID, Okta.
Incident clocks already running
Security and operational incidents with timestamps, measured against the 30-day reportable situations clock, the 72-hour windows in your IMAs, and the OAIC's breach assessment period. Read from Jira, ServiceNow, your SIEM.
Training and accountability currency
AML/CTF awareness training completion, responsible manager records and personnel due diligence, matched against your current staff list. Read from your LMS, Employment Hero, ELMO.
The benchmark
The Gwenda gold standard for financial services
The position a well-run Australian fund manager holds continuously. Licence obligations carry evidence, the AML/CTF program matches the Act as reformed on 31 March 2026, security posture sits at the level institutional investors diligence, and the CPS 230 and CPS 234 flow-down obligations in your management agreements are demonstrably met. Drawn from the legislation, ASIC's private credit principles, APRA's standards and what allocators actually request.
- Licence obligations
- The s912A general obligations mapped to named owners and living evidence, covering adequate resources, organisational competence, risk management systems and conflicts arrangements that reflect ASIC's December 2025 conflicts guidance.
- Financial crime
- An AML/CTF program in the reformed two-part structure (ML/TF risk assessment plus policies), with governing-body oversight recorded, a designated compliance officer, screening operating, and CDD complete across investors and borrowers.
- Breach and incident readiness
- Reportable situations assessed and lodged inside ASIC's 30-day clock, notifiable data breaches inside the OAIC's assessment window, ransomware payments reported within 72 hours, and the incident notice obligations in your IMAs met.
- Investor-grade security
- The artefacts operational due diligence requests (Essential Eight maturity, ISO 27001 or SOC 2 Type II, penetration tests, tested backups) kept current and assembled before the questionnaire arrives.
- APRA flow-down readiness
- The material-service-provider obligations that CPS 230 and CPS 234 push into your management agreements (notification clocks, BCP evidence, control attestations and register data), demonstrable on request.
- Valuation and conflicts governance
- Independent valuation cadence met, committee minutes recorded, and conflicts registers current. ASIC's surveillance and APRA's SPS 530 flow-down both examine exactly this ground.
Illustrative figures. Yours are measured from your own systems.
How it works
The same four moves, applied to your obligations.
- 01
Connect
Point Gwenda at the systems you already run: identity, cloud, endpoints, code, HR, rostering, ticketing.
- 02
Discover
Gwenda reads those applications and works out which controls you already have in place.
- 03
Benchmark
Your posture is scored against Gwenda's gold standard for your industry.
- 04
Remediate
Every gap arrives already owned, with the specific action that closes it and the evidence that will prove it is done.
Outcomes
What changes for you
An ODD pack that already exists
When a super fund's operational due diligence questionnaire arrives, the security, governance and BCP evidence is already assembled, with dates and sources attached, so nobody spends three weeks reconstructing it.
An AML/CTF program that matches the reformed Act
Risk assessment, policies, officer designation, board oversight and evaluation records in the post-31 March 2026 structure, with the operating evidence to show the program actually runs.
CPS 230 obligations you can attest to
The notification, continuity and audit-access terms in your management agreements backed by live evidence, so a trustee's register submission and due diligence cycle stop being a quarterly scramble.
Breach decisions made with facts in hand
When something goes wrong, you already know which systems, whose data and what exposure. That is most of a reportable-situation or breach assessment done before the clock bites.
One control set, counted four ways
MFA evidenced once satisfies the Essential Eight, ISO 27001, SOC 2 and every investor questionnaire that asks. The overlap is mapped so nothing is evidenced twice.
Integrations
Where the evidence comes from
Read-only connections to the systems you already run.
Apex Group
Unit registry: investor register, holder identification numbers, unit holdings, application and redemption
Allvue Systems
Deal pipeline and credit approval workflow records
Salesforce Financial Services Cloud
Investor and prospect records including wholesale/sophisticated investor classification flags and certificate
FrankieOne
Per-customer KYC verification results with the data sources used and match confidence
Diligent
Board and committee papers, agendas, minutes and resolutions with version history
Microsoft Entra ID
Privileged role assignments
Amazon Web Services
IAM roles, policies and root account MFA
Wiz
Cloud misconfiguration and exposure findings
Microsoft Sentinel
Connected data sources and coverage gaps
Veeam
Backup job success and failure history
Citco
Fund accounting and general ledger records, capital account statements, waterfall and carried interest
Solvas (Alter Domus)
Loan-level position, cashflow and accrual records for the collateral pool
Private credit stopped being lightly examined in 2025. ASIC's REP 820 surveillance, its ten principles for private credit done well, and the naming of poor private credit practice as a 2026 enforcement priority all landed within a fortnight of each other, followed by a mid-2026 warning about 30 June valuations. On the other flank, AUSTRAC's reformed regime commenced, and superannuation trustees began pushing CPS 230 terms into every management agreement they hold.
None of this created new work, exactly. It raised the standard of proof for work funds were already claiming to do. A conflicts policy used to settle the question; now it takes a conflicts register with dated reviews. The same shift hits AML/CTF, where a program document counts for little without screening coverage and CDD completeness behind it.
The Cyber Security module pairs naturally with this one: the Essential Eight maturity, access control and backup evidence it discovers is the same evidence your investors' due diligence and your trustees' CPS 234 assessments request. One discovery pass feeds both.
Questions we get asked
We're wholesale-only. Doesn't that reduce what applies?
Less than most managers expect. Wholesale status narrows disclosure and takes you outside internal dispute resolution, but the s912A general obligations apply in full, the AML/CTF Act has no wholesale exemption at all, and ASIC's private credit surveillance expressly covered wholesale funds. Institutional investors then add their own layer on top.
We're not APRA-regulated. Why do CPS 230 and CPS 234 keep appearing in our contracts?
Because your superannuation investors are. An investment manager to an RSE licensee is presumptively a material service provider under CPS 230, and the trustee cannot lawfully retain you without pushing specified terms into the IMA (notification clocks, audit access, continuity evidence). The obligation is contractual rather than prudential, but it is no less binding for that.
What changed with the AML/CTF reforms?
The reformed regime commenced on 31 March 2026. The Part A/Part B program structure was repealed in favour of an ML/TF risk assessment plus AML/CTF policies, board oversight became a statutory duty, and the first annual compliance report under the new regime covers 1 July 2026 to 30 June 2027. An established fund received no deferral; the deferral was for newly captured sectors.
Does Gwenda replace our compliance consultant or external counsel?
No. It replaces the weeks they spend chasing evidence before they can advise. The judgement calls (significance assessments, program design, regulatory strategy) stay human. What changes is that the people making them start from facts instead of a request list.
What will our investors' operational due diligence actually ask for?
The recurring set (often via the FSC's fund manager due diligence questionnaire or an ILPA-style DDQ) is security certification or attestation such as SOC 2 Type II or ISO 27001, an Essential Eight position, penetration test results, BCP test evidence, segregation of duties, and valuation governance. Gwenda keeps that pack current continuously.
See what Gwenda finds in your financial services posture.
Thirty minutes, your systems or ours. We'll show you what it discovers and where you sit against the gold standard.