Flip 360 Commission Platform
Private & Confidential
CoSai · PMO Blueprint · Prepared for Mathew Punter

How CoSai will run Flip 360 to 100% benefits realisation in 90 days.

This is the framework that turns the engagement into a delivery system. Four parallel workstreams. Four stage gates. One weekly operating rhythm. Every deliverable named. Every accountability owned. Every risk listed before it bites. No surprises, no theatre, no expanding-scope drift — a working PMO from day one, built to the same discipline applied to ASX-listed transformation programs, scaled to the rhythm of a founder-led fintech.

DocumentPMO Blueprint v1.0
Prepared byCarla Oliver, CoSai CFO Services
Prepared forMathew Punter, Founder, Flip 360
Date21 May 2026
Engagement term1 Jun → 31 Aug 2026 (90 days)
StatusDraft · ready for review

What’s in this blueprint

Four workstreams

Every dollar of CoSai fee and every Genspark credit lands in one of these four streams. Each has a single accountable owner, a defined CoSai PMO role, named deliverables, and an exit criterion that decides whether we’ve actually finished it — not whether we’ve just talked about it.

WS1

Platform & Architecture

Owner: Mathew Punter (Founder/CTO) PMO: CoSai oversight

Harden the commission ERP from prototype to production. Stripe Connect live, D1 schema frozen, chain-of-custody anchored, idempotent settlement proven, observability in place.

  • Production Stripe Connect onboarding flow (KYC, payouts, application_fee_amount)
  • D1 schema frozen with migration discipline (no breaking changes after gate 2)
  • Chain-of-custody anchored hourly to external notary (Certificate Transparency-style)
  • Idempotent webhook handler proven with duplicate-event test harness
  • Observability stack: structured logs, error rate dashboard, payout SLA dashboard
  • Security review: OWASP top 10, dependency audit, secret rotation discipline

100 test payouts settle successfully under simulated load (10x peak). Zero double-charges in chaos test (1000 duplicate webhooks). Disaster recovery tested.

WS2

Member Acquisition & Sprint G

Owner: Mathew + CoSai jointly PMO: CoSai drives

Validate willingness-to-pay with paying members in a controlled cohort. Prove the funnel converts at the assumed rates before we ask an investor for capital.

  • Founding-member cohort: 30 paying members across 3 communities (Sunshine Coast, Brisbane, Gold Coast)
  • Conversion funnel instrumented: landing → application → vet → onboard → paid
  • Member NPS measured at week 4 and week 12
  • First 100 real referrals in chain by gate 3 — not test data
  • First $10K of real commissions settled by gate 4 — the proof point for the investor pack
  • Content library: 12 pieces (LinkedIn, email, member-pack PDFs)

30 paying members, 100 real referrals in chain, $10K real commissions settled, NPS ≥ +30. Funnel CAC measured and within assumption range.

WS3

Compliance, Tax & Legal

Owner: CoSai (Carla) PMO: CoSai owns

Lock down every regulatory question before an investor or AUSTRAC asks it. Standard checklist of an ASX-listed-grade compliance posture, applied to a privately-held members’ platform.

  • RCTI mechanism in place with ATO-compliant written agreements (member terms)
  • Privacy Act 1988 APP 1–13 register with data-flow diagram and retention policy
  • AML/CTF designated business assessment (low-risk classification confirmed)
  • AUSTRAC threshold-reporting hooks ready (even if below threshold)
  • Australian Consumer Law review of member terms
  • Membership Agreement, Privacy Policy, Terms of Use — reviewed by external counsel
  • Insurance: Professional Indemnity ($5M), Cyber ($2M), Public Liability ($20M)

External counsel sign-off on member contract stack. PI/Cyber/PL insurance bound. AUSTRAC self-assessment complete with low-risk determination on file.

WS4

Investor Readiness

Owner: CoSai + Mathew PMO: CoSai drafts, Mathew owns the narrative

Produce a pitch deck and data room that a serious early-stage investor would expect from a fintech with $1M ARR ambition. Make the ask defensible on numbers, not vibes.

  • Investor pitch deck (Sequoia template, 14 slides)
  • Data room: incorporation, cap table, IP register, employment contracts, customer contracts
  • Three financial scenarios stress-tested: Local Club, Regional Network, National Institution
  • KPI dashboard live in the ERP for any investor to view in real time (read-only investor login)
  • Reference call list: 5 founding members willing to take an investor call
  • Term-sheet preparedness: founder fully briefed on standard SAFE / pre-seed terms

Pitch deck reviewed by 2 independent fintech operators. Data room walkable in 20 minutes. KPI dashboard live with real numbers, not mocks. Founder ready to take warm intros.

RACI — who does what

No ambiguity. For every recurring activity, exactly one person is Accountable (A). The activities a Founder owns are founder activities; the activities a PMO owns are PMO activities; the two columns don’t blur.

Activity Mathew (Founder) Carla / CoSai (PMO) Partners*
Product roadmap & technical direction A/R C I
Sprint planning, ceremonies, ceremonies C A/R I
Founding-member acquisition (funnel & pitch) R A C
Member vetting & onboarding C A/R I
Commercial terms (Rate Card, fees, pricing) A R I
Compliance posture (Privacy, AML/CTF, ATO) I A/R I
External counsel engagement & contract review A R I
Insurance procurement A R I
Investor pitch deck & narrative A R C
Data room curation C A/R I
Stripe Connect production setup & KYC A/R C I
D1 schema & migration discipline A/R I I
Chain-of-custody / notary anchoring A/R C I
KPI dashboard build (admin + investor view) R A I
Stage-gate review chair & sign-off A R C
A Accountable (the buck stops) R Responsible (does the work) C Consulted (input invited) I Informed (kept in the loop) * Partners = external counsel, insurer, Stripe AU rep, founding-member advisors

Four stage gates

A stage gate is not a status check. It’s a pass/fail decision — the engagement either advances or it doesn’t. Gates exist to make "we’re behind" visible early, not after the money’s spent. If a gate fails, we don’t push through with theatre — we stop, fix, and re-gate.

G1

Foundation

End of week 2 (~14 June 2026)

Engagement formally kicked off. Workstreams stood up. Risk register live. Governance cadence running.

Pass criteria
  • CoSai engagement signed and Invoice #001 paid
  • All four workstreams have a one-page charter
  • RAID log live in the ERP, populated with day-1 risks
  • Weekly cadence in calendar: 30-min Tue stand-up, 60-min Fri Steerco
  • Founding-member target list: 100 names sourced across 3 communities
What "fail" means

If any of the above isn’t in place, gate fails — we don’t spend the next two weeks pretending to be a project.

G2

Platform Lockdown

End of week 5 (~5 July 2026)

Schema frozen. Stripe Connect live in production. Compliance posture documented. Member contracts at external counsel.

Pass criteria
  • D1 schema frozen — no more breaking migrations after this date
  • Stripe Connect live with at least 3 real test payouts settled to real bank accounts
  • Privacy Act register complete, data-flow diagram signed off
  • AML/CTF designated business assessment filed (low-risk determination)
  • Member contracts at external counsel for review
  • First 5 founding members signed and paying
What "fail" means

Schema not frozen → every dollar built after this gate sits on shifting ground. Hard stop. Founder + Carla unblock the schema issue before any further build.

G3

Real Transactions

End of week 9 (~2 August 2026)

100 real referrals in the chain. 20 founding members live. Funnel CAC measured. Compliance posture externally signed off.

Pass criteria
  • 20 founding members live (paying or in the free founder cohort with paid-conversion date locked)
  • 100 real referrals in the chain — not test data
  • First real commission settled and RCTI raised
  • External counsel sign-off on member contract stack
  • Insurance bound (PI / Cyber / Public Liability)
  • Funnel CAC measured against assumption
What "fail" means

If real referrals aren’t flowing by gate 3, the product-market-fit hypothesis fails. We pivot or stop — we don’t escalate spend.

G4

Investor-Ready

End of week 13 (~31 August 2026)

30 paying members. $10K real commissions settled. Pitch deck reviewed by 2 fintech operators. Data room walkable. Investor KPI dashboard live.

Pass criteria
  • 30 paying members across 3 communities
  • $10K of real commissions settled through the platform
  • Pitch deck v1 + reviewed by 2 independent fintech operators
  • Data room organised and walkable in 20 minutes
  • Investor read-only KPI dashboard live in production
  • 5 founding members on the reference-call list
  • Founder ready to take warm investor intros
What "fail" means

Gate 4 is the off-ramp to the investor conversation. If gate 4 doesn’t pass cleanly, we don’t take warm intros — we extend, fix, and re-gate. Reputation in the investor market is non-recoverable.

Operating cadence

The rhythm. Light enough to not be a tax. Heavy enough that nothing falls through. Every meeting on this list has a defined output — a decision, a re-baseline, a sign-off. Meetings without output get removed.

Frequency When Meeting Attendees Purpose & output
Daily Async Stand-up note M + C Two lines each: what I did yesterday, what I’m doing today, anything I’m blocked on. Posted in the shared channel by 09:30.
Weekly Tue 11:00 (30m) Working session M + C Live work session on the week’s highest-leverage item. Not a status meeting — a doing meeting.
Weekly Fri 14:00 (60m) Steerco M + C Workstream traffic-lights, RAID review, gate progress, the one decision needed before next week. Minuted into the ERP.
Fortnightly Wed 10:00 (45m) Stage-gate review M + C + advisors invited at gates 3, 4 Formal sign-off or fail of the gate. Either we’re past the gate, or we know exactly what’s blocking and who owns the unblock.
Monthly Last Fri (90m) Benefits review M + C Re-baseline the benefits register against actuals. Decide whether we’re still on the assumption curve. If not — what changes?
On demand As required Founder-only working session M Mathew owns the product. CoSai gets out of the way when deep founder work needs uninterrupted time.

13-week sprint plan

One row per phase. Each column is a workstream. Read across to see what’s landing in parallel. Read down to see what each workstream looks like over time. This is the wall chart on the back of CoSai’s door for 90 days.

Weeks Phase WS1 Platform WS2 Members WS3 Compliance WS4 Investor
Wk 1-2 Foundation Stripe Connect test mode live Founding-member target list (100 names) External counsel engaged, Privacy register started Pitch-deck outline + KPI dashboard scope
Wk 3-5 Platform Lockdown Schema freeze, Stripe live, first payouts First 5 founding members signed AML self-assessment, member terms drafted Pitch deck v0, data room skeleton
Wk 6-9 Real Transactions Idempotency hardening, observability 20 members live, 100 referrals in chain External counsel review complete, insurance bound KPI dashboard live, scenarios stress-tested
Wk 10-13 Investor-Ready Performance / security / DR proven 30 members, $10K settled, NPS measured Compliance evidence pack assembled Pitch deck reviewed, reference list, founder ready

RAID log — day-1 view

Risks, Assumptions, Issues, Dependencies — named before kick-off, not discovered at gate 3. Severity is honest: a Critical assumption is one that, if it breaks, the engagement re-baselines or stops. Mitigations are concrete, not aspirational. The log is live in the ERP from day 1 and updated weekly at Steerco.

Type Title Severity Owner Mitigation
Risk Founding-member acquisition slower than assumed High CoSai Three-community parallel approach (SC, BNE, GC). Pre-launch waitlist target 200 names. Founder-rate price anchor for first 30.
Risk Stripe Connect KYC delays for some members (rural, no ID) Medium Mathew Pre-screen ABN + Medicare in onboarding form. Stripe Identity as fallback. Manual escalation channel agreed with Stripe AU.
Risk D1 schema needs late-stage breaking migration Medium Mathew Gate 2 schema freeze with explicit sign-off. Any change after gate 2 requires Steerco approval and migration runbook.
Risk Regulator (AUSTRAC) reclassifies platform as DCE / reporting entity Low CoSai Designated business self-assessment in workstream 3. External counsel confirms low-risk. No fiat-to-crypto rail, no custody of member funds beyond settlement window.
Assumption Members will pay $1,200 annual fee in founding cohort Critical Both Validated by gate 3 (first 20 paying members) or hypothesis fails.
Assumption Stripe Connect AU supports application_fee_amount on AUD Critical Mathew Confirmed in Stripe docs and verified in test mode pre-engagement. Re-confirmed in gate 2 with live test payouts.
Assumption Member NPS at week 4 ≥ +30 High CoSai NPS survey instrumented at week 4 and week 12. Below +30 triggers funnel-and-product review.
Issue Two compliance frameworks (Privacy + AML) to stand up in parallel Medium CoSai External counsel briefed for parallel review, not sequential. Compress 6-week serial path to 3-week parallel path.
Dependency External counsel engagement letter signed by week 1 High CoSai Counsel shortlist in CoSai network. Engagement letter pre-drafted before kick-off.
Dependency Mathew available for 12 hrs/week minimum High Mathew Calendar block agreed at gate 1. If actual <8 hrs/week sustained, engagement re-baselines.

Benefits register

The "so what". For each benefit, the target outcome and the measurable that proves it. We re-baseline this register every month at the Benefits Review meeting. If the actuals diverge from the target, we don’t spin — we decide what changes.

Benefit Target outcome Measurable proof
Production-grade ERP in 90 days Live, settling real commissions, no hand-coded patches ≥ 100 real referrals in chain, ≥ $10K settled
Compliance posture defensible to a regulator External counsel sign-off, AUSTRAC low-risk on file All four documents signed off by gate 3
Paying founding cohort 30 paying members across 3 communities ARR run-rate ≥ $36K by gate 4
Investor-ready raise package Deck + data room + KPI dashboard Reviewed by 2 fintech operators, walked in <20 minutes
Founder freed to do founder work Compliance + investor admin off founder’s plate Founder hours on non-product work ≤ 20% by gate 3
Membership stack at full IP ownership 100% IP assigned to Flip 360 on full fee payment IP assignment deed executed at gate 4
This blueprint is editable.

If a workstream needs adjusting, a gate criterion needs tightening, or a risk you see isn’t listed — say so. The blueprint is the working document for the 90 days, not a deliverable to be signed off and shelved.

Sign the engagement Read the EA Blueprint Open the Business Case