Lending Compliance Complete Guide

The frameworks Cloudcase aligns to, the controls embedded across every lending journey, and the evidence your regulators will ask for.

Compliance built into workflow, not bolted on as a quarterly remediation exercise.

Audit retention

7+ years

Policy enforcement

Real-time, embedded

Frameworks

APRA · ASIC · AUSTRAC

Data centres

Sydney + Melbourne

Architecture

Single-tenant

Certifications

ISO 27001 · SOC 2 Type II

Frameworks aligned

Ten regulatory frameworks and certifications, embedded as controls, evidenced as audit trail.

APRA

CPS 230

Operational risk

Aligned

APRA

CPS 231

Outsourcing

Aligned

APRA

CPS 234

Information security

Aligned

APRA

CPG 235

Data risk

Aligned

ASIC

NCCP Act

Responsible lending

Embedded

ASIC

RG 209

Reasonable inquiries

Embedded

AUSTRAC

AML/CTF

Customer identification

Real-time

AUSTRAC

AML/CTF

Suspicious matter reporting

Real-time

ISO

27001 — Info-sec management

Certified

SOC

SOC 2 Type II

Trust services criteria

Certified

Control families

124 controls across four families, every one mapped to a policy, evidenced in workflow.

Responsible Lending

27 — controls in this family

• —

  Income verification procedures

• —

  Expense assessment methodology

• —

  Serviceability calculations

• —

  Hardship indicators

• —

  Purpose verification

Credit Assessment

34 — controls in this family

• —

  Credit policy documentation

• —

  Delegated Lending Authority

• —

  Exception management

• —

  Credit bureau integration

• —

  Scorecard governance

Customer Identification

21 — controls in this family

• —

  100-point identification

• —

  Electronic verification

• —

  Sanctions screening

• —

  PEP screening

• —

  Beneficial ownership

Information Security

42 — controls in this family

• —

  Encryption at rest + transit

• —

  Role-based access controls

• —

  Pen testing · annual

• —

  Incident response · 24/7

• —

  Vendor due diligence

The audit trail your regulator will ask for

Every input, rule, override, and outcome, captured automatically, retrievable in seconds.

audit_trail · application APP-7421 · 47 events · evidentiary chain intact

14:22:01.204

app.created

mobile_app

channel=customer-portal · device=iOS 17.4

14:22:18.621

idv.requested

system

provider=FrankieOne · document=AU_DRIVERS_LICENCE

14:22:24.118

idv.verified

system

confidence=0.96 · biometric=PASS · liveness=PASS

14:22:31.408

cdr.connected

applicant_456

institutions=3 · income=$98,400 PA verified

14:22:55.918

aml.screened

system

sanctions=clean · PEP=no · adverse_media=none

14:23:02.221

rules.evaluated

system

47/47 policies passed · 2.4s · multivariant_v8

14:23:02.890

decision.approved

system

tier=2 · rate=6.49% · amount=$35,000 · term=60m

14:23:18.044

docs.generated

system

contract_v12 · disclosures · responsible_lending_pdf

Data sovereignty

Bank-grade controls, in Australian data centres, with single-tenant isolation.

Australian data centres

Sydney + Melbourne. Customer data never leaves AU.

Single-tenant

Dedicated database + compute per customer. No co-mingling.

ISO 27001

Information security management system, independently certified.

SOC 2 Type II

Trust services criteria, independently audited annually.

Go deeper in this series

In-depth guides in the lending compliance cluster.

Built-in, not bolted-on