Identity controls that satisfy APRA auditors and protect customer data.
We work with 2 of the top 10 ASX-listed organisations and a number of other financial services institutions. We deliver IAM and PAM programmes that meet APRA CPS 234 requirements and hold up under regulatory scrutiny.
In 2024, financial services became the most breached industry globally, surpassing healthcare, which held the top position from 2018 to 2023.
2024 Annual Data Breach Report/Identity Theft Resource Center (ITRC)
The compliance obligations that drive IAM in financial services.
Australian financial services organisations face layered regulatory obligations where identity and access management is a primary control domain.
- APRA CPS 234 (Information Security): identity and access management are central to CPS 234 compliance requirements
- APRA CPG 234 guidance on privileged access and identity lifecycle management
- ASIC Regulatory Guide 255 on operational resilience and third-party risk
- PCI DSS v4.0 for card data environments: strong MFA, privileged access controls, and audit logging
- AUSTRAC AML/CTF requirements for access controls over transaction monitoring systems
Identity complexity in enterprise financial services.
Enterprise financial services environments are more complex than the vendor documentation describes. We have seen this across engagements with major Australian banks.
- Strict MFA requirements for all privileged access, particularly to core banking systems
- Segregation of duties across trading, operations, settlements, and compliance functions
- Third-party vendor and contractor access to production and near-production systems
- Core banking system privileged access: most core banking platforms have limited native IAM capability
- Customer identity (CIAM) for digital banking channels and mobile applications
- Regulatory audit trails demonstrating the effectiveness of access controls over time
- APRA notification and remediation requirements when material information security incidents are identified
Our most common financial services engagements.
These services address the core identity and privilege obligations facing APRA-regulated institutions.
Conditional Access Review
Identity Maturity Assessment
See the work delivered
Comparable engagements we have delivered. Client names are withheld; the work is not.
View all case studiesDefining the Digital Identity Blueprint for a Major Australian Bank
A well-established Australian community bank undergoing a significant digital transformation engaged Modern 42 to architect its future-state identity capability, ensuring its digital ecosystem could securely serve customers, employees and partners.
Comprehensive Entra Security Review and Ongoing Partnership with a Global Financial Services Group
A global financial services group operating across multiple international markets engaged Modern 42 for an independent security review of its Microsoft Entra environment. What began as a focused assessment has since evolved into a strategic, ongoing partnership.
Financial services IAM questions.
Can you work under NDA and keep our engagement confidential?
How does your work help us respond to an APRA CPS 234 finding?
Do you have experience with core banking system privileged access?
Confidential engagements. Proven at scale.
We routinely work under strict NDA with APRA-regulated institutions. Our engagements are designed for confidentiality, and we do not name our banking clients publicly. The results speak through regulatory outcomes, not press releases.
Other sectors we work in.
Let’s talk about your privileged access
No pitch decks. No pressure. Just a straightforward conversation about your PAM environment, where the gaps are, and how to close them.
- Assess your current privileged access controls
- Identify credential exposure and governance gaps
- Get a practical path to Essential Eight alignment, no strings attached
Free 30 min discussion
No commitment required
Book a time that works for you. We’ll come prepared with initial observations about your PAM maturity and common privilege escalation risks.