Financial services
Stone Leaf Capital
Staff, investors and the board work from one portal inside the licence perimeter.
The board signs resolutions and minutes in the portal under e-signature.
Financial services
Systems built around the licence.
We build the operating systems an AFSL holder runs on, and the security posture its investors diligence.
Some of the financial services systems we build and run.
Property
Bold Property Group
Off-market deal sourcing and the AML/CTF program run from one staff app.
Every PEP match waits for a person’s approval before the client proceeds.
Product screens shown with sample data.
Financial services
The obligations in play.
Licence conditions, investor money and ASIC reporting.
Corporations Act, s 912A
AFSL general obligations include adequate risk-management systems, an obligation ASIC has already taken to court over cyber failures.
Corporations Act, s 286
Financial records must be kept for seven years, in a form that lets them be conveniently audited.
AML/CTF Act 2006
Many licensees are reporting entities: programs, customer identification and transaction reporting.
Privacy Act 1988 and the APPs
Client personal and financial information under the APPs, with the Notifiable Data Breaches scheme behind it.
APRA CPS 234
Where a firm is APRA-regulated, information-security capability becomes a board-owned obligation.
Threat picture
What the sector is facing.
Notifiable data breaches, 2025
157of 1,205 notifications
Second only to health service providers in 2025.
OAIC, Notifiable Data Breaches statistics for 2025, published 6 Jul 2026 
High severity
High severity
Threat intelligence
Binance hot wallets drained through a signed EIP-7702 delegation
What we do
What you carry, and what we do about it.
ASIC expects a licensee to show who did what, and when, years after the event.
We design operating portals around the licence perimeter, with compliance audit logs that capture actor, action and before-and-after state on every change. Product and platform engineering
Investor due diligence now includes security questionnaires.
A posture assessment maps where you stand against recognised controls, and a vCISO retainer gives you a named security lead whose answers stand up. vCISO and posture assessment
Operational resilience sits inside the general obligations: could the firm keep operating, and recover, through an incident?
Incident readiness built before you need it: a response plan written for your team, a tabletop exercise that tests it, and backup recovery proven by a restore. Incident readiness
Services
The services that apply.
- vCISOSecurity leadership on a monthly retainer, from risk register to board briefing.
- Penetration testingNetworks, web apps, cloud and AI systems, with a report and a re-test.
- Incident responseContainment, root cause and Notifiable Data Breaches support.
- Software engineeringWeb, mobile and platform builds, run in production.
Questions, answered.
What does an AFSL holder need from its systems?
Records that exist, are attributable and can be retrieved years later. Section 286 of the Corporations Act requires financial records to be kept for seven years, and the general obligations in section 912A include adequate risk-management systems. We design operating portals around the licence perimeter, with compliance audit logs that capture actor, action and before-and-after state on every change.
Can you help us answer investor security due diligence?
Yes. A posture assessment maps where you stand against recognised controls, and a vCISO retainer gives you a named security lead whose answers stand up.
How do we show we could keep operating through an incident?
With incident readiness built before it is needed: a response plan written for your team, a tabletop exercise that tests it, and backup recovery proven by a restore.
Industries
Other sectors we work in.
Property
Practice systems, deal sourcing and AML/CTF screening for valuers and buyer’s agents.
Government
Prequalified for councils and agencies, with the Essential Eight held on our own estate.
Professional services
Testing, tenancy hardening and managed ICT for advisory and accounting firms.
