Security & Compliance

What a bank CISO should read before a sandbox.

Start here: Executive summary — production hardening · Integration & Conformance · VAPT engagement brief

last-verified: extraction metrics · noisy soft gate 2026-07-26-noisy (in-sample) + STIX suppress-while-advisory

Integration & conformance (pilot-ready)

Published, versioned contracts for ingest and FMS alert egress. Alerts are independently signature-verifiable offline with the gateway public key (verify-alert.mjs). A conformance simulator validates schema + pilot invariants and emulates bank-like FMS responses. STIX 2.1 egress is lint-gated in CI against the real formatter; a drift guard fails the build if the published canonical bytes diverge from buildGatewaySignPayload.

Details and commands: Integration & Conformance.

Measured extraction accuracy

Lead with noisy / adversarial conditions — not clean-text 100%s. Full write-up: Extraction tiers and package EXTRACTION_METRICS.md.

Corpus	n	Gate	Honest summary
Clean Tier-1 (2026-07-11)	37	Hard: P≥0.90 R≥0.85 account+BIC	Regression floor on clean labeled text — expected near-perfect; not production OCR accuracy
Noisy / adversarial (2026-07-26-noisy)	21	Soft: P≥0.85 R≥0.80 account+BIC	In-sample, post-fix — ~14/15 account outputs correct; 1 wrong account (line-wrap truncation); 2 misses. BIC: no errors observed on 19 samples (coverage still thin)

Wrong account ≠ miss. A truncated lookalike account is the wrongful-freeze shape if anyone auto-acted — which is why alerts stay advisory / MONITOR, and why actionable requires three independent institutions on the same account.

Not gated / not claimed: NER model bumps, image→OCR end-to-end, holdout out-of-sample estimate (two-corpus discipline is the follow-up). URLs: not meaningfully measured on noisy (n=1).

DuitNow QR: many QR slips have no recipient account by design. We score null as correct and do not invent accounts from DuitNow refs.

Documents

Artifact	Status
Integration & Conformance	Shipped — schemas, offline verify, simulator, STIX CI
DPIA	Draft 0.1
Data flow diagrams	Draft 0.1
RMiT control mapping	Paragraph-cited (BNM/RH/PD 028-98); not a certification
Retention & erasure runbook	Draft stub
KEK rotate-and-rewrap	Draft stub
Phase B0 foundations	Locked
Phase B1–B4 runtime	Shipped
Executive summary	Hardening sprint status
VAPT engagement brief	Draft 0.1 — ready for provider RFP
Advisory contract	Shipped
Independent VAPT letter	Not yet — brief scoped; letter after engagement

Claims we do not make (yet)

• “BNM-compliant” / “RMiT-certified” — mapping exists for CISO review; FI acceptance + VAPT still required
• Absolute “zero PII egress” — alias policy may allow clear/hash; NRIC/phone are stripped
• “Sub-second automated federation” — gateway ingest is measured (load-test report: p99 64 ms @ 100 req/s, memory topology); multi-replica Redis/Postgres/outbox soak and on-device OCR still pending
• Cross-bank corroboration — schema-forbidden until Phase C legal basis
• That anonymous public / WhatsApp triage drives bank blocklists — ADV-005 quarantines public_triage until partner corroboration or analyst promotion

Trust model (pilot)

Signed alerts are advisory. Automated freeze requires corroboration ≥ 3 and non-advisory disposition — unreachable with a single partner in Phase A.

Public / WhatsApp reports: Public triage cannot reach bank FMS today because the ingest door is closed — not because a runtime source_tier / triage_quarantine check refuses it. Quarantine writers and the four checkpoints are specified and gated to ship before any public ingest opens — see advisory contract · source tier (ADV-005).

Abuse / fairness: Not collecting victim PII ≠ accepting unauthenticated bank-affecting reports. Partner JWT authenticates the channel; the closed public ingest door contains the crowd today. Distinct-tenant corroboration is in the schema design; the live alert path still clamps corroboration_count to 1 (Phase A). Open residuals (flooding, promotion controls, appeals) are named in abuse resistance.