"use strict";
/**
 * AU ASIC RG 274 — Product Design and Distribution Obligations (DDO)
 *
 * Primary statutes: Corporations Act 2001 (Cth) Part 7.8A (ss.994A-994L),
 * inserted by Treasury Laws Amendment (Design and Distribution Obligations and
 * Product Intervention Powers) Act 2019; effective 5 October 2021. Backed by
 * RG 274 (October 2021, updated 2023).
 *
 * Entities covered:
 *   - Issuers: Entities issuing financial products (investments, insurance,
 *     managed funds, debentures, retirement products, credit cards, home loans).
 *   - Distributors: Entities distributing financial products including digital
 *     platforms, comparison sites, AI recommendation engines.
 *
 * AI relevance: AI systems recommending, comparing, distributing, or facilitating
 * purchase of financial products = distributors within scope. ASIC 2024-2025
 * corporate plan identifies DDO as priority area with focus on digital + AI
 * recommendation systems.
 *
 * Key AI obligations:
 *   - s.994B: Issuers maintain TMD per retail product describing target consumer
 *     class and distribution conditions.
 *   - s.994E: AI recommendation engines must screen consumers against TMD and
 *     decline out-of-target distributions. Dark-pattern AI steering consumers
 *     toward unsuitable products = ASIC enforcement focus.
 *   - s.994F: Significant dealings outside target market reported to issuer
 *     within 10 business days.
 *   - Record-keeping: AI screening logs and TMD match results retained 7 years.
 *
 * Cross-pack interactions:
 *   - au-asic-rg-274 + au-asic-rg-271: DDO + IDR linked. Out-of-target
 *     distributions generate complaints through IDR. IDR complaint data is a DDO
 *     outcome monitoring signal; significant spikes = TMD review trigger.
 *   - au-asic-rg-274 + au-privacy-act: TMD screening involves collection and use
 *     of PI. APP 3 purpose limitation; APP 5 notification covers TMD use.
 *   - au-asic-rg-274 + au-cdr: CDR data cannot be used for TMD screening without
 *     CDR consent covering that purpose. PS 6 use limitation applies.
 *
 * Authority: Australian Securities and Investments Commission (ASIC)
 * Sovereignty: Australian Federal
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.AU_ASIC_RG274_PACK = exports.AU_ASIC_RG274_CATEGORY_CLASSIFIERS = void 0;
exports.AU_ASIC_RG274_CATEGORY_CLASSIFIERS = {
    AU_DDO_RETAIL_CLIENT: {
        references: ['RG 274; Corporations Act s.994E — retail client distribution obligation'],
        classifier: (input) => {
            if (/\b(?:retail\s+client.*(?:ddo|tmd|financial\s+product\s+distribution)|ddo.*retail\s+client|target\s+market.*(?:retail|consumer|client).*(?:ai|recommendation|distribute))/i.test(input))
                return true;
            return false;
        },
    },
    AU_DDO_TMD_MATCH: {
        references: ['Corporations Act s.994B/994E — target market determination assessment'],
        classifier: (input) => {
            if (/\b(?:tmd\s+(?:screening|match|assessment|check)|target\s+market\s+determination.*(?:ai|screen|assess|match)|consumer\s+profile.*tmd)/i.test(input))
                return true;
            return false;
        },
    },
    AU_DDO_OUT_OF_TARGET: {
        references: ['Corporations Act s.994E — distribution inconsistent with TMD not permitted'],
        classifier: (input) => {
            // Compound form: "out-of-target" / "out_of_target" etc.
            if (/\b(?:out[_\-\s]?of[_\-\s]?target.*(?:distribution|recommendation|tmd)|distribution\s+(?:inconsistent|outside)\s+(?:with\s+)?(?:tmd|target\s+market)|tmd.*(?:mismatch|out\s+of\s+scope))/i.test(input))
                return true;
            // Natural-language form: "outside the target market" / "outside target market"
            // as used in ASIC RG 274.62 and s.994F regulatory text.
            if (/\boutside\s+(?:the\s+)?target\s+market\b/i.test(input))
                return true;
            return false;
        },
    },
    AU_DDO_SIGNIFICANT_DEALING: {
        references: ['Corporations Act s.994F — significant dealings reported to issuer within 10 BD'],
        classifier: (input) => {
            if (/\b(?:significant\s+dealing.*(?:ddo|tmd|out[_\-\s]?of[_\-\s]?target)|s\.?994[Ff].*report|significant\s+out[_\-\s]?of[_\-\s]?target\s+distribution)/i.test(input))
                return true;
            return false;
        },
    },
    AU_DDO_TMD_REVIEW_DUE: {
        references: ['RG 274 — TMD review period elapsed or trigger event met'],
        classifier: (input) => {
            if (/\b(?:tmd\s+review\s+(?:due|overdue|triggered|period\s+elapsed)|target\s+market\s+determination.*review\s+(?:due|trigger))/i.test(input))
                return true;
            return false;
        },
    },
    AU_DDO_ISSUER_REPORT: {
        references: ['Corporations Act s.994F — reporting obligation to issuer triggered'],
        classifier: (input) => {
            if (/\b(?:issuer\s+report.*(?:ddo|10\s*(?:business\s+)?days?)|ddo.*reporting.*issuer|s\.?994[Ff]\s+report\s+(?:required|due|triggered))/i.test(input))
                return true;
            return false;
        },
    },
};
exports.AU_ASIC_RG274_PACK = {
    categoryClassifiers: exports.AU_ASIC_RG274_CATEGORY_CLASSIFIERS,
    /**
     * P3.5: Retail client distributions are subject-keyed — each distribution
     * event carries a consumer identifier + TMD match result to satisfy 7-year
     * record-keeping and ASIC surveillance obligations.
     * Significant-dealing and TMD-review categories are aggregate/non-subject-keyed.
     */
    subjectKeyedCategories: [
        'AU_DDO_RETAIL_CLIENT',
        'AU_DDO_TMD_MATCH',
        'AU_DDO_OUT_OF_TARGET',
        'AU_DDO_ISSUER_REPORT',
    ],
    id: 'au-asic-rg-274',
    name: 'AU ASIC RG 274 — Product Design and Distribution Obligations (DDO)',
    version: '1.0.0',
    description: 'ASIC RG 274 DDO compliance for AI systems acting as financial product distributors or issuers. Enforces TMD screening of consumers before distribution (s.994E), block on out-of-target distributions, 10-business-day significant dealing report to issuer (s.994F), TMD review alerting, and 7-year distribution log retention with TMD match results per transaction.',
    authority: 'Australian Securities and Investments Commission (ASIC)',
    industries: [
        'banking', 'insurance', 'investment-management', 'fintech',
        'credit', 'payments', 'financial-advice', 'superannuation',
    ],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'TMD screening enforcement before each distribution; out-of-target block; significant dealing 10-BD reporting gate',
            reference: 'Corporations Act s.994E (TMD screen); s.994F (reporting)',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: '7-year retention for TMD versions, distribution logs with TMD match, significant dealing reports, complaint records',
            reference: 'RG 274 record-keeping requirements',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Classify retail client distributions, TMD match results, out-of-target distributions, significant dealings',
            reference: 'Corporations Act s.994B/994E/994F',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Significant dealing report approval workflow (10-BD deadline); TMD review approval gate',
            reference: 'Corporations Act s.994F',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Out-of-target event stream; significant-dealing counter; TMD review due events',
            reference: 'RG 274',
        },
    ],
    moduleConfig: {
        'data-classifier': {
            enabledCategories: [
                'AU_DDO_RETAIL_CLIENT',
                'AU_DDO_TMD_MATCH',
                'AU_DDO_OUT_OF_TARGET',
                'AU_DDO_SIGNIFICANT_DEALING',
                'AU_DDO_TMD_REVIEW_DUE',
                'AU_DDO_ISSUER_REPORT',
            ],
            ddoOutOfTargetBlockEnabled: true,
            ddoTmdScreeningLoggingActive: true,
            ddoSignificantDealingReportSla: 10,
            ddoTmdReviewAlertEnabled: true,
            ddoRetailClientLoggingActive: true,
        },
        'governance-runtime': {
            ddoOutOfTargetBlockEnabled: true,
            ddoTmdScreeningLoggingActive: true,
            ddoSignificantDealingReportSla: 10,
            ddoTmdReviewAlertEnabled: true,
            ddoRetailClientLoggingActive: true,
        },
        'approval-queue': {
            significantDealingReportApprovalRequired: true,
            tmdReviewApprovalRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: [
            'TMD-SCREENING-CAPABLE',
            'DISTRIBUTION-LOG-7Y-RETENTION',
            'SIGNIFICANT-DEALING-DETECTION',
        ],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: [
            'AU_DDO_RETAIL_CLIENT',
            'AU_DDO_TMD_MATCH',
            'AU_DDO_OUT_OF_TARGET',
            'AU_DDO_SIGNIFICANT_DEALING',
            'AU_DDO_TMD_REVIEW_DUE',
            'AU_DDO_ISSUER_REPORT',
        ],
        categoryActions: {
            AU_DDO_RETAIL_CLIENT: 'LOG',
            AU_DDO_TMD_MATCH: 'LOG',
            AU_DDO_OUT_OF_TARGET: 'BLOCK',
            AU_DDO_SIGNIFICANT_DEALING: 'REQUIRE_APPROVAL',
            AU_DDO_TMD_REVIEW_DUE: 'WARN',
            AU_DDO_ISSUER_REPORT: 'REQUIRE_APPROVAL',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        sovereignty: ['AU'],
        auditLogRetentionDays: 2555, // 7 years
        sessionRetentionDays: 2555,
        incidentRetentionDays: 2555,
        reference: 'RG 274 — TMD versions 7y from expiry; distribution logs 7y; significant dealing reports 7y',
    },
    incidentPolicy: {
        // s.994F (significant dealings): distributor must report to issuer within 10 business days.
        // 10 BD * 24h = 240h. This is the primary DDO notification window.
        notificationDeadlineHours: 240,
        // s.912D (significant breach): AFS licensee must notify ASIC within 30 calendar days
        // of becoming aware of a significant breach or likely significant breach. 30 * 24 = 720h.
        breachReportingDeadlineHours: 720, // s.912D significant breach report to ASIC
        reference: 'Corporations Act s.994F — significant dealings to issuer within 10 BD (240h); s.912D — significant breach to ASIC within 30 days (720h)',
        requiredRecipients: ['issuer', 'asic-breach-notification'],
        formalNotificationRequired: false,
    },
    validators: [
        {
            id: 'au-ddo-out-of-target-block',
            description: 'Distribution of financial product to consumer outside TMD blocked at point of recommendation',
            reference: 'Corporations Act s.994E',
            check: 'au_ddo_out_of_target_block_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'au-ddo-tmd-screening-log',
            description: 'TMD screening result logged per distribution event with consumer profile and TMD reference',
            reference: 'Corporations Act s.994B/994E; RG 274',
            check: 'au_ddo_tmd_screening_log_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'au-ddo-significant-dealing-report',
            description: 'Significant dealing outside target market reported to issuer within 10 business days',
            reference: 'Corporations Act s.994F',
            check: 'au_ddo_significant_dealing_report_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'au-ddo-tmd-review-alert',
            description: 'TMD review alert generated when review period expires or trigger event occurs',
            reference: 'RG 274',
            check: 'au_ddo_tmd_review_alert_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'au-ddo-retail-client-log',
            description: 'All retail-client AI-driven distributions logged with consumer identifier',
            reference: 'RG 274',
            check: 'au_ddo_retail_client_log_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=au-asic-rg-274.js.map