Spaces:
Running
Running
File size: 6,393 Bytes
a6a5d8e | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 | # Vertical Governance Policy: Financial Services — SOX / Dodd-Frank / SR 11-7
# Doctrine v6 | R3 Adversarial Receipts
# Last revised: 2025-07
schema_version: "1.0.0"
vertical: financial
regime: SOX/Dodd-Frank/SR11-7
effective_date: "2025-07-01"
jurisdiction: US-Federal
meta:
title: "Financial AI Governance Policy — SOX/Dodd-Frank/SR 11-7 Alignment"
description: >
Maps Sarbanes-Oxley Act, Dodd-Frank Wall Street Reform, and Federal Reserve
SR 11-7 Model Risk Management guidance to Doctrine v6 Λ-axes for AI systems
used in credit, trading, fraud detection, and financial reporting.
authority: "Pub. L. 107-204 (SOX); Pub. L. 111-203 (Dodd-Frank); SR 11-7 (Fed, OCC, FDIC)"
receipt_chain_required: true
merkle_root_algorithm: SHA3-256
regulatory_clauses:
- clause_id: SOX-302
title: "Corporate Responsibility for Financial Reports"
citation: "Pub. L. 107-204 § 302; 17 CFR § 240.13a-15"
full_ref: "SOX § 302 — CEO/CFO certification of financial statements; 17 C.F.R. § 240.13a-15 controls and procedures"
lambda_axes:
- axis: Λ2
label: Accountability
weight: 1.0
enforcement: mandatory
rationale: >
AI systems generating financial figures or reports must produce
signed receipts traceable to named human principals (CEO/CFO
accountability chain).
- axis: Λ7
label: Auditability
weight: 0.95
enforcement: mandatory
- clause_id: SOX-404
title: "Management Assessment of Internal Controls"
citation: "Pub. L. 107-204 § 404; 17 CFR § 240.13a-15(f)"
full_ref: "SOX § 404 — Annual assessment of internal controls over financial reporting (ICFR)"
lambda_axes:
- axis: Λ7
label: Auditability
weight: 1.0
enforcement: mandatory
rationale: >
AI model controls must be documented in ICFR scope; Merkle DAG
receipts serve as tamper-evident control evidence.
- axis: Λ1
label: Transparency
weight: 0.88
enforcement: mandatory
- clause_id: SR11-7-MRM
title: "Model Risk Management — Validation"
citation: "Federal Reserve SR 11-7 (Apr 2011); OCC 2011-12"
full_ref: "SR 11-7 Guidance on Model Risk Management §§ III.C (Validation), III.D (Ongoing Monitoring)"
lambda_axes:
- axis: Λ8
label: Robustness
weight: 0.95
enforcement: mandatory
rationale: >
Independent model validation must test adversarial robustness;
receipt chain must capture validation epoch, validator ID, and
test-set hash.
- axis: Λ9
label: Explainability
weight: 0.90
enforcement: mandatory
rationale: >
Model outputs affecting credit decisions require explanations
satisfying adverse action notice requirements (ECOA/FCRA).
- clause_id: DODD-FRANK-1033
title: "Consumer Financial Data Rights"
citation: "Pub. L. 111-203 § 1033; 12 CFR § 1033.201"
full_ref: "Dodd-Frank § 1033 / CFPB Rule 1033 — Consumer right to access covered data"
lambda_axes:
- axis: Λ3
label: Privacy
weight: 0.90
enforcement: mandatory
- axis: Λ10
label: Sovereignty
weight: 0.85
enforcement: mandatory
rationale: >
AI systems must honour data portability requests; receipt chain
logs each export event with consumer-authorised scope token.
- clause_id: DODD-FRANK-619
title: "Volcker Rule — Proprietary Trading Prohibition"
citation: "Pub. L. 111-203 § 619; 12 CFR § 44 (OCC), § 248 (Fed)"
full_ref: "Volcker Rule 12 C.F.R. § 248.3 — Prohibition on proprietary trading"
lambda_axes:
- axis: Λ4
label: Fairness
weight: 0.75
enforcement: mandatory
rationale: >
AI trading algorithms must be receipt-tagged to distinguish permitted
market-making from prohibited proprietary positions.
- axis: Λ2
label: Accountability
weight: 0.88
enforcement: mandatory
- clause_id: FINRA-4370
title: "Business Continuity Plans and Emergency Contact Information"
citation: "FINRA Rule 4370; SEC Rule 17a-4"
full_ref: "FINRA Rule 4370 — Business Continuity and Contingency Plans; 17 C.F.R. § 240.17a-4 record retention"
lambda_axes:
- axis: Λ5
label: Safety
weight: 0.85
enforcement: mandatory
- axis: Λ6
label: Security
weight: 0.80
enforcement: mandatory
rationale: >
AI trading and reporting systems must have verified fallback nodes;
receipt chain must survive primary node failure with quorum 2-of-3.
- clause_id: ECOA-FCRA-ADVERSE
title: "Adverse Action Notices — Credit Decisions"
citation: "15 USC § 1681m; 12 CFR § 202.9 (Reg B)"
full_ref: "ECOA 15 U.S.C. § 1681m(a) — Adverse action notice requirements; Reg B 12 C.F.R. § 202.9"
lambda_axes:
- axis: Λ9
label: Explainability
weight: 1.0
enforcement: mandatory
rationale: >
AI credit models must produce machine-readable reason codes per
CFPB guidance; explanation receipt must accompany each denial.
- axis: Λ4
label: Fairness
weight: 0.92
enforcement: mandatory
- clause_id: SOX-802
title: "Criminal Penalties for Altering Documents"
citation: "Pub. L. 107-204 § 802; 18 USC § 1519"
full_ref: "SOX § 802 — 18 U.S.C. § 1519 destruction/alteration of records; 20-year imprisonment"
lambda_axes:
- axis: Λ7
label: Auditability
weight: 1.0
enforcement: mandatory
rationale: >
Receipt chain immutability is a legal requirement; SHA3-256 Merkle
DAG nodes must be append-only with cryptographic proof of non-alteration.
- axis: Λ6
label: Security
weight: 0.95
enforcement: mandatory
compliance_thresholds:
minimum_lambda_coverage: 7
mandatory_axes: [Λ2, Λ7, Λ9]
receipt_retention_days: 2555 # 7 years SOX record retention
max_decision_latency_ms: 500
model_validation_cycle_days: 365
receipt_chain:
algorithm: SHA3-256
chaining: merkle_dag
quorum: 2-of-3
nodes: [primary, secondary, regulatory-archive]
|