Skip to content

HOMOLOGATION_CHECKLIST.md

Latest commit

 

History

History
85 lines (65 loc) · 3.98 KB

HOMOLOGATION_CHECKLIST.md

File metadata and controls

85 lines (65 loc) · 3.98 KB
Raw

Homologation Checklist — CreditAI

Credit decision platform compliant with F1–F5 compliance phases.
Regulatory note: Banco de Portugal does not homologate software; the institution must demonstrate compliance in SREP/inspections with this evidence package.

F1 — Compliant Core (GDPR, Art. 22, human review, CRC)

[x] Deterministic pipeline with PIPELINE_* audit [x] Scoring engine by segment + approved registry [x] Human review + override + minimum ReviewDurationMs [x] Append only audit + hash chain [x] GDPR consents in intake + CONSENT_RECORDED [x] Art. 22 — consumer escalation + FinalizeDecision gate [x] CRC query in pipeline (dev stub; Production BPnet configurable) [x] Tests: F1ComplianceTests, CreditProcessCompletionTests

F2 — Model Risk Management

[x] ModelRegistryService — Draft / Approved / Retired [x] ModelPromotionGate — AUC, Gini, Brier, PSI, fairness, backtest [x] Versioned model cards in ml/model_cards/ + CreditAI.MrmGate gate [x] Backtesting + challenger + drift (ModelDriftMonitor) [x] ONNX scoring + LLM/scoring separation (ADR 001) [x] MRM gate in azure pipelines.yml CI [x] Tests: F2CompletionTests, ModelPromotionGateTests, OnnxScoringTests

F3 — AML + solvency

[x] Sanctions/PEP screening (World Check stub/HTTP) [x] Sanctions match blocks pipeline + AML_SANCTIONS_BLOCKED [x] PEP / HIGH risk → EDD without blocking if sanctions clear [x] FIU reporting + goAML XML export [x] Solvency: DSTI, LTI, stress test (+200 bps) [x] Open banking feeds verified income [x] CRC monthly reporting (POST /api/regulatory/crc/monthly report) [x] Tests: PipelineAmlSolvencyTests, F3CompletionTests, CrcMonthlyReportTests

F4 — Multi segment + AI narrative

[x] Consumer / SME / Corporate scoring with approved models [x] INarrativeWriter separated from IScoringEngine (architecture tests) [x] Numeric grounding — narrative persisted only if NarrativeGrounded = true [x] On-prem OpenAI-compatible LLM (Llm:*) with deterministic fallback [x] Yapily open banking (Consumer/SME) [x] Conditional manual entry when integration fails (ManualDataEntryPolicy) [x] Tests: F4CompletionTests, NarrativeGroundingTests, ManualDataEntryTests

F5 — Post disbursement monitoring

[x] Early warning indicators (EWI) + batch runner [x] Watchlist + human review escalation [x] Supervisor export (GET /api/regulatory/supervisor export) [x] CIRBE stub export (GET /api/regulatory/cirbe export) [x] Risk dashboard (GET /api/risk dashboard/kpis) [x] Tests: F5CompletionTests, SupervisorExportTests, EarlyWarningMonitoringTests

GDPR / EU AI Act (documentation)

[x] Draft DPIA — [compliance/dpia credit scoring.md](compliance/dpia credit scoring.md) [x] ROPA — compliance/ropa.md [x] Art. 22 explainability — GET /api/explanations/by request/{id} [ ] DPIA approved and signed by DPO [ ] EU AI Act registration (when applicable)

Homologation Execution (evidence)

[x] Automated tests — dotnet test CreditAI.sln (115 passed, 3 skipped without Docker — 2026 06 04) [x] MRM gate — docs/dossier/02 model risk/mrm gate *.log [ ] Manual/UI E2E scenarios 1–12 — see E2E_HOMOLOGATION.md §Execution Log [x] Base dossier in docs/dossier/ via scripts/generate homologation evidence.ps1 [ ] Pen test — SECURITY_PEN_TEST_CHECKLIST.md → dossier/10 security/

Operational

[x] Health check GET /health [x] ReDoc (Development) — /redoc [x] OpenAPI — /openapi/v1.json [x] Secrets outside repository (.env.example, production Key Vault) [x] CI pipeline — azure pipelines.yml [ ] Azure / on prem deploy documented and executed in homologation environment [ ] Production credentials: BPnet CRC, World Check, Yapily, FIU, CIRBE

Homologation date: __________ Compliance responsible: __________ Technical responsible: __________