Selling compliance software to a bank, an insurer or a Commonwealth agency used to be a product conversation. It is now an infrastructure conversation first. Before anyone looks at your rule engine or your reporting workflow, someone in third-party risk wants to know where the data sits, which company owns the operating entity, and what happens when a foreign court asks for a copy.
That shift is not a matter of taste. It follows a run of Australian obligations that all landed inside four years, and each one pushes accountability back down the supply chain to you.
The four obligations that changed the questions
The Hosting Certification Framework. Released in March 2021 to operationalise the 2019 Whole-of-Government Hosting Strategy, the Framework applies to Australian Government customers procuring hosting for sensitive data, whole-of-government systems and systems rated at PROTECTED. Requirements apply to new contracts and to extensions of existing contracts from 30 June 2022. There are three levels: Strategic, Assured and Uncertified. Strategic is the highest level of assurance and is only available to service providers that allow the government to specify ownership and control conditions. Assured relies on financial penalties that protect the Commonwealth against a change of ownership or control. The Framework currently applies to data centre providers and cloud service providers, and it sits underneath the Protective Security Policy Framework and the Information Security Manual.
If your platform hosts agency data, your hosting supplier’s certification level becomes your certification level in the eyes of the buyer.
APRA CPS 230. Prudential Standard CPS 230 Operational Risk Management has been in force since 1 July 2025 for banks, insurers and superannuation trustees. Regulated entities had to submit a material service provider register to APRA, and existing service provider contracts had to meet the standard from the next renewal date, with 1 July 2026 as the backstop. If you are material to a regulated entity’s critical operations, you are now named on a register that a prudential regulator reads.
The SOCI Act amendments. Amendments that commenced on 20 December 2024 clarified that a data storage system holding business critical data can be treated as part of a primary critical infrastructure asset where the responsible entity owns or operates it, uses it in connection with the asset, and a hazard to the storage system carries material risk of a relevant impact on the asset. Register information, critical infrastructure risk management programmes and notification obligations extend to those systems. A compliance data store is exactly the kind of system that gets pulled in.
AML/CTF reform. Australia’s reformed AML/CTF regime is being implemented in stages from 31 March 2026, with enrolment opening for newly regulated sectors on the same date. That widens the population of businesses buying transaction monitoring, screening and reporting technology, and it widens the population of buyers who have never run a third-party infrastructure assessment before and will lean hard on yours.
Jurisdiction is a corporate structure question
The most common failure in a vendor response is answering a jurisdiction question with a map. “Data is stored in Sydney” answers residency. It does not answer sovereignty.
Sovereignty is decided by three things: which legal entity operates the service, which entity ultimately owns that operator, and where the control plane sits. A region in Sydney operated by a locally incorporated subsidiary of a foreign parent is still reachable through the parent. Support and engineering access from offshore is still offshore access. Billing in a foreign currency through a foreign entity is a signal that the contracting party is not the one on your letterhead.
Write your answer as a chain: the contracting entity, its ACN, its ultimate parent, the entities that can technically access production, and the countries those staff sit in. Buyers with mature third-party risk functions ask for exactly that chain. The ones that do not ask yet will next cycle.
The evidence pack to have on file before the request for tender opens
Panels score what you can produce, not what you assert. Assemble these once and reuse them:
- A certification scope statement, not just a certificate. An ISO 27001 certificate is a page. The Statement of Applicability and the scope boundary are what tells an assessor whether the certified scope actually covers the service you are selling. Vendors get marked down for a certificate whose scope covers head office and excludes the production platform.
- An IRAP assessment report. IRAP is the mechanism referenced in the PSPF and the ISM for independent evaluation of a system against ISM controls. For systems handling government data at OFFICIAL and above, an assessment report is what turns a claim into evidence. The Essential Eight is a baseline of mitigation strategies, not a substitute for an ISM control assessment.
- Named facilities and named regions. “Australian data centres” is not evidence. Facility operator, city and region code are. Amaze publishes its Australian regions as Sydney (ap-syd-2) and Melbourne (ap-mel-1), because a buyer’s risk register needs a value to record.
- A documented process for law enforcement and government access requests. Who receives the request, who reviews it, when and how you notify the customer, and what you will refuse. Buyers ask what happens when a foreign authority makes the request. If you have never written the answer down, you will improvise it badly under time pressure.
- Data flow and retention mapping. Where data enters, where it is processed, where backups and replicas land, how long each copy persists, and what happens at contract end. Replicas are where sovereignty claims quietly break, because the primary is onshore and the disaster recovery copy is not.
- Subcontractor disclosure. Every fourth party in the chain: infrastructure, observability, log shipping, ticketing, email delivery. CPS 230 and SOCI both push accountability down the chain, so the buyer needs the list.
The procurement tailwind you should be using
Updated Commonwealth Procurement Rules released in October 2025 require non-corporate Commonwealth entities to prioritise Australian businesses for procurements below the relevant thresholds, and raised the goods and services threshold for those entities from $80,000 to $125,000. If you are an Australian-incorporated vendor running on Australian-operated infrastructure, that is a structural advantage, and it only converts if your response documents the ownership chain clearly enough for an evaluator to score it.
The market is growing into that advantage. One published sizing puts the Australian regtech market at around USD 0.87 billion in 2025, reaching USD 1.65 billion by 2032, at roughly 9.6 per cent compound growth. Treat the figure as directional. The direction is more buyers, more obligations, and more questions about your stack.
Where this leaves your infrastructure decision
Most regtech vendors did not choose their hosting for compliance reasons. They chose it for developer velocity in year one and then inherited the consequences in year four, when the first CPS 230 assessment arrived and the answers had to be written down.
Amaze operates as an Australian company under Australian law, with no foreign parent entity and no CLOUD Act exposure, and is ISO 27001 certified. Compute, inference and storage stay in Australia, in Sydney and Melbourne, with AUD-denominated pricing. For a vendor whose buyers all ask the same six questions, the value is that the answers are short and the evidence already exists.
Related reading: Data residency and compliance in the age of AI and How sovereign data centres support AI compliance.
Frequently asked questions
Does my regtech platform need its own Hosting Certification Framework certification? The Framework applies to data centre providers and cloud service providers, so it is your hosting supplier that holds the certification, not your software business. What matters in a tender is that you can name the certified provider and the certification level, and show that the systems holding agency data actually run there.
Is ISO 27001 enough to satisfy a government or APRA-regulated buyer? On its own, no. ISO 27001 demonstrates an information security management system, and assessors read the scope statement to see what it covers. Government buyers handling data at OFFICIAL and above generally want an IRAP assessment against ISM controls as well, and APRA-regulated buyers want evidence mapped to their own CPS 230 obligations.
Does hosting in a hyperscaler’s Sydney region satisfy Australian data sovereignty? It satisfies data residency for the data at rest in that region. It does not settle who can compel disclosure, because that depends on the operating entity’s corporate ownership and the jurisdiction of its parent, not on the location of the racks. Buyers increasingly ask the ownership question separately.
What is the single most common gap in vendor security questionnaires? Replication and backup. Vendors answer the primary region question correctly and then discover that a disaster recovery copy, a log pipeline or a managed monitoring service sends data offshore. Map every copy of the data, including the ones a third-party tool creates on your behalf.
