{ "meta": { "generatedAt": "2026-01-09T00:00:00.000Z", "count": 1, "permalink": "/standards/laws", "release": { "id": "2026.01", "label": "2026.01", "date": "2026-01-09", "permalink": "/api" } }, "grants": [ { "schema_version": "1.3.0", "grant_id": "GRANT-2026-0142", "provenance": { "issued_by": "risk-governance-board", "issued_at": "2026-03-01T09:00:00Z", "basis_summary": "Fraud-hold policy 3.2 adopted with a measured 1.4% false-positive rate on the Q4 backtest; reversal path rehearsed in February." }, "scope": { "action_classes": [ "READ", "WRITE" ], "systems": [ "core-banking-holds" ], "populations": [ "retail accounts, excluding accounts flagged vulnerable" ], "limits": { "max_hold_days": 7, "max_holds_per_hour": 120, "max_hold_value_usd": 25000 } }, "issuing_authority": { "name": "Risk Governance Board", "role": "Delegating authority", "contact": "risk-governance@example.org" }, "grantee": { "id": "agent-risk-ops-v2", "type": "agent" }, "action_classes": [ "READ", "WRITE" ], "for_whom": "Retail banking customers, on behalf of the Fraud Operations desk", "evidence_basis": [ { "ref": "POL-FRAUD-HOLD-3.2", "summary": "Hold rules and thresholds for suspected account takeover.", "as_of": "2026-06-18T00:00:00Z" }, { "ref": "EVID-BACKTEST-2026Q1", "summary": "Q1 backtest: 1.4% false-positive rate, median release 31 hours.", "as_of": "2026-04-05T00:00:00Z" } ], "assumptions": [ "False-positive hold rate stays below 2% on the rolling 30-day window.", "The Risk Steward can release any hold within two hours of a challenge.", "Vulnerable-account flags are current within 24 hours." ], "review_conditions": [ "False-positive hold rate exceeds 2% on the rolling 30-day window.", "Any challenge decided against the system.", "Policy POL-FRAUD-HOLD-3.2 enters review_required or expires." ], "revocation_conditions": [ "Holds placed on accounts flagged vulnerable.", "Intervention reach time exceeds four hours in any incident.", "Withdrawal rehearsal fails." ], "correction_capacity": { "assessed_at": "2026-06-18T16:30:00Z", "detection": { "present": true, "evidence": "Model Risk Review recomputes the false-positive rate and release latency each month from the raw hold log rather than from the Fraud Operations dashboard; the 2026-06 recomputation put the rate on accounts flagged vulnerable at 11% against a 2% assumption. The qualifier is on the record: CHL-2026-0088 was reported from outside by the account's representative, not caught by the monitor, so detection is present but was not first.", "evaluator": "Model Risk Review (second line)", "independent_of_executor": true }, "challenge": { "present": true, "evidence": "CHL-2026-0088 was raised on 2026-06-10 by an affected account's representative through the channel REG-ACCOUNT-HOLDS-1 declares for the account_hold class, and was decided rather than left open." }, "standing": { "present": true, "evidence": "REG-ACCOUNT-HOLDS-1 admits affected_party, corrective_labor, representative, and oversight for the account_hold class, and both decision and grant may be challenged. CHL-2026-0088 was raised on the affected_party basis, from outside the operating team." }, "review": { "present": true, "evidence": "The Risk Steward on call answered inside the register's PT48H deadline (opened 2026-06-10T14:20Z, deadline 2026-06-12T14:20Z) and referred the grant to the Risk Governance Board, which decided REC-2026-0019 on 2026-06-18. Both the examiner and the clock are named in REG-ACCOUNT-HOLDS-1." }, "authority_to_modify": { "present": true, "evidence": "REC-2026-0019 narrowed the grant itself: populations now exclude accounts flagged vulnerable and max_hold_days fell from 14 to 7. The examiner changed the grant rather than recommending a change." }, "reversible_transitions": { "present": true, "evidence": "holds.release reversed every hold in the 2026-05-20 rehearsal and released the CHL-2026-0088 hold within two hours; measured median release is 31 hours (DEP-RISK-OPS-V2-2026-06)." }, "operable_after_correction": { "present": false, "evidence": "Not shown beyond 48 hours. DEP-RISK-OPS-V2-2026-06 records institutional reversibility as not feasible: withdrawal past 48 hours breaches the card-network fraud-loss SLA and the rules-engine fallback is not staffed to absorb it, with correction latency measured at 31 hours against that 48-hour margin. Capacity is counted only for reversal inside 48 hours, which is why max_hold_days is 7, and under §4.2 the grant may not be expanded until the fallback is staffed." } }, "mode": "unattended", "state": "allowed", "state_history": [ { "from": "none", "to": "allowed", "at": "2026-03-01T09:00:00Z", "reason": "issued", "evidence_ref": "POL-FRAUD-HOLD-3.2" }, { "from": "allowed", "to": "review_required", "at": "2026-06-11T10:00:00Z", "reason": "challenge", "evidence_ref": "CHL-2026-0088", "note": "Challenge opened by an affected party over a hold on a recently flagged vulnerable account." }, { "from": "review_required", "to": "allowed", "at": "2026-06-18T16:30:00Z", "reason": "challenge", "evidence_ref": "REC-2026-0019", "note": "Narrowed: populations now exclude accounts flagged vulnerable; max_hold_days reduced from 14 to 7." } ], "attestation": { "signed_by": "key:risk-governance-board-2026h1", "algorithm": "ed25519", "signature": "MEUCIQD8sV3rN0kQ2Jm5Fh7tX1wLpA6yKb9cUe4SgTn2HvZ0dQIgLxO0Q7mWc3KpR8dN2fYj5bHs1aVvT6xCu9eEi4QnA7k=", "signed_at": "2026-06-18T16:30:00Z", "payload_digest": "sha256:9f2c41ba7e03d58c6a1f0b8e47d29c53a6b1e7d40f92c8a3b6d5e1c7f0a49b82" }, "liability": { "accepted_by": { "name": "Meridian Retail Group", "role": "Operating institution", "contact": "legal@example.org" }, "instrument": "Automated Decision Liability Instrument ADM-2026-02, accepted at grant issue and reaffirmed at REC-2026-0019", "accepted_at": "2026-03-01T09:00:00Z", "carve_outs": [ "Liability capped at USD 2,000,000 per incident under ADM-2026-02 §7; the cap is recorded so the residual risk above it is visible before an incident rather than argued after one." ] }, "until": "2026-12-01T00:00:00Z", "renewal_basis": "A fresh backtest on the preceding quarter, the current dependency record, and a withdrawal rehearsal within the last 90 days.", "policy_refs": [ { "policy_id": "POL-FRAUD-HOLD-3.2", "version": "3.2.0" } ], "intervention_ref": "INT-RISK-STEWARD-1", "capability_catalog_ref": "CAT-RISK-OPS-V2-2026-07", "dependency_ref": "DEP-RISK-OPS-V2-2026-06" } ] }