What CRS does

Compliance & Risk Services Pty Ltd (trading as CRS) is a Melbourne-headquartered, privately held Australian company that delivers governance, risk, and compliance (GRC) solutions to financial institutions. Its flagship product, CRS-Certus, is a cloud-based, modular SaaS platform covering risk registers, controls and self-assessment, obligations tracking, incident and complaints management, comprehensive registers (breach, gifts, conflicts, related-party, etc.), customisable email alerts, a policies-and-procedures library with user acknowledgement, and flexible PDF/XLS reporting, built on contemporary web technology with encrypted offsite backups. The platform is designed in-house by a retained programming team working alongside experienced risk and compliance practitioners, and supports ISO 31000, ISO 19600, and APRA SPS 220 standards.

The company generates revenue across three streams: subscription-based licensing of CRS-Certus, professional consulting (risk workshops, controls building, regulatory obligation and policy documentation), and ongoing outsourced compliance management. Its go-to-market is sales-led and enterprise-focused, targeting Australian Financial Services Licensees, APRA-regulated entities (superannuation funds, insurers, banks), Australian Credit licensees, and AUSTRAC reporting entities with services spanning AFS/RSE licence applications, AML/CTF programs, compliance reviews, managed investment scheme registrations, PDS drafting and due diligence, MDA contracts, and external compliance committee placements.

CRS is a small operation (firmographic headcount band of 1-10) claiming over 200 clients globally and more than a decade of operating history, with credibility reinforced by practitioner engagements as topic experts under ASIC enforceable undertakings and in litigation and ASX disciplinary reviews. It is founder/management owned, with no disclosed institutional investment, M&A activity, or external funding. The company also produces ongoing regulatory thought-leadership content through articles authored by named practitioners (Edo Catak, Vicki Guo, Christina Barlow, Gerald O'Byrne). Note: the firmographic founding year (1990) conflicts with the company-history-derived estimate (~2014); the discrepancy is unresolved in the source data.

Name

CRS

Legal name

Compliance & Risk Services Pty Ltd

Website

https://crscertus.com.au

Company type

Private

Founded year

2014

Operating status

Operating

Headcount range

1–10 employees

Short description

Melbourne-based provider of the CRS-Certus cloud GRC SaaS platform and compliance consultancy services, serving Australian financial institutions including AFS Licensees, APRA-regulated entities, Australian Credit licensees, and AUSTRAC reporting entities.

Ownership category

akta.pro rank

Headquarters

HQ city

Melbourne

HQ country

Australia

HQ region

Oceania

Offices2 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales, Infrastructure

Revenue model

1. CRS-Certus SaaS Subscription: Software-as-a-service subscription model for the CRS-Certus compliance and risk management platform. Users select and customise modules to suit their business needs.
2. Consulting Services: Professional consulting services for operationalising risk and compliance management systems, risk workshops, control building, regulatory obligation documentation, policy and procedure documentation.
3. Outsourced Compliance Management: Ongoing outsourced compliance management services for financial institutions including AFS Licensees, APRA regulated entities, Australian Credit licensees and AUSTRAC reporting entities.

Pricing tiers

Go-to-market motion2 records

Distribution channels1 record

Marketing channels3 records

Core offering

CRS sells CRS-Certus, a web-based governance, risk, and compliance (GRC) SaaS platform for financial institutions, providing customisable risk registers, obligations tracking, controls documentation and self-assessment, incident and complaints management, comprehensive registers, email alerts, policies and procedures library, and flexible reporting. Alongside the software, CRS separately delivers consulting and outsourced compliance management services covering operationalisation of risk and compliance systems, risk workshops, controls building, regulatory obligation documentation, and ongoing outsourced compliance for AFS Licensees, APRA regulated entities, Australian Credit licensees and AUSTRAC reporting entities.

Product overview

CRS offers CRS-Certus as its core cloud-based software platform for governance, risk, and compliance management, supplemented by consultancy and outsourced management services. The CRS-Certus platform is modular, allowing users to select and customise components including risk management, obligations tracking, controls documentation, assessments, incident management, complaints handling, registers, alerts, policies & procedures, and reporting. The consultancy services complement the software by providing implementation support, risk workshops, and ongoing outsourced compliance management.

Differentiator

Problem solved

Functional benefit

Brands

• CRS-Certus: Cloud-based risk and compliance management software platform providing risk registers, controls management, obligations tracking, incident/complaints management, and regulatory reporting for financial institutions.

Products and services

• CRS-Certus Web-based, cloud-delivered governance, risk, and compliance (GRC) SaaS platform providing a centralised system for managing risk registers, regulatory obligations, controls documentation and self-assessment, incidents, complaints, comprehensive registers (breach, gifts, conflicts of interest, related party, etc.), email alerts, policies and procedures library, and flexible reporting to PDF and XLS(X). Supports global standards ISO 31000, ISO 19600 and APRA SPS 220. Sold to Australian financial institutions via subscription.
• Consultancy and Outsourced Management Services Advisory and ongoing outsourced management services that operationalise risk and compliance management systems for Australian financial institutions. Includes risk workshops, controls building, regulatory obligation documentation, incident/complaints reporting implementation, policy and procedure documentation, outsourced compliance management, AML/CTF program management, independent AML/CTF reviews, AFS Licence applications and variations, RSE licence applications, compliance reviews, MDA contracts, Product Disclosure Statements, and responsible manager training. Sold separately from the CRS-Certus software.

Named customers4 records

Segments1 record

Ideal customer profiles1 record

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature10 records

Scale indicators3 records

Recent moves4 records

Expansion highlights4 records

Broad incumbents

• NAVEX Global: NAVEX Global sells enterprise risk, compliance, and ethics & whistleblowing software to financial institutions. Comparable on incident, complaints, and policy management modules, with much broader multinational footprint.
• Diligent (Galvanize/ACL): Diligent offers governance, risk, and compliance software used by banks, insurers, and superannuation funds. Its GRC platform competes with CRS-Certus for the same Australian regulated-entity buyer, but Diligent sells globally with a far larger suite.
• ServiceNow GRC: ServiceNow's GRC module is embedded inside its enterprise platform and increasingly adopted by large Australian banks and insurers. Competes for the same compliance buyer with vastly broader workflow and integration capabilities.
• SAP GRC: SAP's governance, risk, and compliance suite is widely used by large APRA-regulated banks and insurers. Overlaps with CRS on controls and risk management but is packaged as part of SAP's enterprise suite rather than as a standalone niche platform.
• Wolters Kluwer TeamMate: Wolters Kluwer's TeamMate is an established audit, risk, and compliance suite widely used by financial institutions. It overlaps with CRS-Certus on controls, risk, and audit workflows, but as part of a much broader global portfolio rather than an Australian-focused niche.

Direct peers

• MetricStream: MetricStream provides GRC and operational risk software with deep traction in banking and financial services, including risk register, controls, and regulatory compliance workflows. Highly comparable to CRS-Certus in feature scope and target buyer, though MetricStream serves global tier-1 banks.
• Resolver (now part of Kroll): Resolver offers integrated risk, compliance, and incident management software with strong financial services adoption. Closely mirrors CRS-Certus on incident/complaints workflows and risk register functionality.
• Riskonnect: Riskonnect provides integrated risk management and compliance software used by financial institutions. Closely matches CRS-Certus's risk register, incident, and controls self-assessment features at a comparable mid-market price point.

Emerging players

• Vanta: Vanta automates compliance evidence collection for frameworks like ISO 27001 and SOC 2 and has begun expanding into broader GRC. Adjacent overlap with CRS's controls and obligations management for Australian regulated entities, though focused primarily on technology and SaaS companies.
• LogicGate Risk Cloud: LogicGate offers a no-code GRC platform with risk, compliance, and policy workflows. Comparable in product configurability to CRS-Certus but with stronger North American footprint and integrations marketplace.

Market position

Strengths4 records

Weaknesses5 records

Competitive moat4 records

Key risks6 records

Key highlights6 records

Customer concentration

Revenue estimate

Valuation estimate

Number of profiles

Profiles4 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about CRS