/**
 * FINRA Broker-Dealer Supervision and Records Compliance Pack
 *
 * Covers the cohesive FINRA broker-dealer supervisory framework:
 *   - FINRA Rule 3110 (Supervision): Written Supervisory Procedures (WSPs),
 *     principal review of correspondence, branch office inspections
 *   - FINRA Rule 3120 (Supervisory Control System): annual certification,
 *     testing and verification of WSPs
 *   - FINRA Rule 4511 (General Requirements -- Books and Records):
 *     WORM-compliant storage, format integrity for required records
 *   - FINRA Rule 4512 (Customer Account Information): essential customer
 *     data capture and maintenance obligations
 *   - FINRA Rule 4530 (Reporting Requirements): 30-day reporting for
 *     most reportable events; immediate for specified serious events
 *
 * Regulatory hierarchy:
 *   - FINRA is a FINRA-registered self-regulatory organization (SRO)
 *     under the Securities Exchange Act of 1934 §15A.
 *   - FINRA Rules are approved by and supervised by the SEC. When
 *     FINRA and SEC rules conflict, SEC rules (including Exchange Act
 *     Rules 17a-3 / 17a-4) take precedence.
 *   - AI systems deployed in broker-dealer workflows that touch order
 *     management, surveillance, customer communication, or supervisory
 *     review fall within Rule 3110's supervisory obligation scope.
 *
 * Current state (2026):
 *   - FINRA Regulatory Notice 24-09 (March 2024): guidance on AI use
 *     in broker-dealer operations, including supervisory obligation to
 *     test and verify AI-assisted surveillance and review outputs.
 *   - FINRA Exam Priorities (2025): AI/ML supervisory controls,
 *     electronic communication surveillance, and records completeness
 *     remain priority areas.
 *   - Rule 4511/4512 records: AI-generated outputs that constitute
 *     "books and records" must satisfy WORM-compliant storage per
 *     Exchange Act Rule 17a-4(f).
 *   - Pairs with: BSA/AML (suspicious activity), CFPB (customer
 *     communications), MiFID II (EU cross-border equivalence for
 *     investment firms).
 *
 * @connexum/ai-governance
 */
/**
 * FINRA broker-dealer category classifiers.
 * Covers customer financial information, supervisory communications,
 * complaint records, and broker-dealer specific identifiers.
 */
export const FINRA_3110_CATEGORY_CLASSIFIERS = {
    FINANCIAL_CUSTOMER_INFO: {
        references: ['FINRA Rule 4512 -- customer account information requirements'],
        classifier: (input) => {
            // Account numbers
            if (/\b(?:account\s*(?:number|#|id|no\.?))[:\s]*[A-Z0-9\-]{6,20}\b/i.test(input))
                return true;
            // Tax identification / SSN in financial context
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            // CRD / IARD registration numbers
            if (/\b(?:CRD|IARD)\s*(?:number|#|no\.?)?[:\s]*\d{5,10}\b/i.test(input))
                return true;
            // FINRA registration identifiers
            if (/\b(?:representative|registered\s+rep|broker)[:\s]+[A-Z][a-z]+ [A-Z][a-z]+/i.test(input))
                return true;
            return false;
        },
    },
    BROKER_DEALER_COMMUNICATIONS: {
        references: ['FINRA Rule 3110(b) -- review of correspondence and internal communications'],
        classifier: (input) => {
            // Correspondence and communication markers
            if (/\b(?:investment\s+recommendation|securities\s+recommendation|buy|sell|hold)\s+(?:XYZ|[A-Z]{1,5}|\$[A-Z]{1,5})\b/.test(input))
                return true;
            // Research reports
            if (/\b(?:research\s+report|analyst\s+report|price\s+target|earnings\s+estimate)\b/i.test(input))
                return true;
            // Retail communications
            if (/\b(?:retail\s+communication|advertisement|sales\s+literature|seminar\s+material)\b/i.test(input))
                return true;
            return false;
        },
    },
    SUPERVISORY_RECORDS: {
        references: ['FINRA Rule 3110 -- supervisory procedures; Rule 3120 -- supervisory control system'],
        classifier: (input) => {
            if (/\b(?:written\s+supervisory\s+procedure|WSP|supervisory\s+control|branch\s+office\s+inspection)\b/i.test(input))
                return true;
            if (/\b(?:principal\s+review|supervisor\s+approval|compliance\s+review|annual\s+certification)\b/i.test(input))
                return true;
            return false;
        },
    },
    COMPLAINT_RECORDS: {
        references: ['FINRA Rule 4513 -- records of written customer complaints; Rule 4530 -- reporting requirements'],
        classifier: (input) => {
            if (/\b(?:customer\s+complaint|written\s+complaint|Form\s+U4|Form\s+U5|4530\s+report)\b/i.test(input))
                return true;
            if (/\b(?:arbitration|FINRA\s+dispute|customer\s+dispute|regulatory\s+action)\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['FINRA Rule 4512 -- essential customer data; Reg S-P customer privacy'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['FINRA Rule 3110 -- system access controls; exchange act cybersecurity obligations'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const FINRA_3110_PACK = {
    categoryClassifiers: FINRA_3110_CATEGORY_CLASSIFIERS,
    id: 'finra-3110',
    aliases: ['FS-07'],
    name: 'FINRA Broker-Dealer Supervision and Records',
    version: '1.0.0',
    description: 'FINRA Rules 3110 (Supervision), 3120 (Supervisory Control System), 4511 (Books and Records), and 4512 (Customer Account Information) compliance for AI systems deployed in broker-dealer operations. Covers written supervisory procedures, principal review of communications, branch office inspections, WORM-compliant records retention, and Rule 4530 incident reporting obligations.',
    authority: 'FINRA (Financial Industry Regulatory Authority) -- SRO under Securities Exchange Act of 1934 §15A',
    industries: ['broker-dealer', 'investment-banking', 'securities', 'wealth-management', 'trading', 'fintech', 'capital-markets'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Written Supervisory Procedures enforcement; principal review gate; supervisory control system activation',
            reference: 'FINRA Rule 3110(a) -- establishment and maintenance of supervisory system; Rule 3120(a) -- supervisory control policies',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident, WORM-compliant books and records for broker-dealer operations; append-only audit trail for supervisory reviews',
            reference: 'FINRA Rule 4511 -- general requirements for books and records; Exchange Act Rule 17a-4(f) -- WORM-compliant electronic storage',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Detect and classify financial customer information, broker-dealer communications subject to principal review, complaint records, and supervisory documentation',
            reference: 'FINRA Rule 4512 -- customer account information; Rule 3110(b) -- review of correspondence',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Principal review gate for AI-assisted customer communications, research reports, and supervisory decision outputs before transmission or filing',
            reference: 'FINRA Rule 3110(b) -- principal review of correspondence and communications with the public',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Rule 4530 reporting event detection; regulatory event monitoring; supervisory incident logging with timestamps',
            reference: 'FINRA Rule 4530 -- reporting requirements for specified events; Rule 4511 -- time-stamp requirements for records',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Third-party AI vendor oversight; supervisory responsibility for vendor systems used in broker-dealer operations does not transfer',
            reference: 'FINRA Rule 3110 -- supervisory responsibility for associated persons AND third-party vendors; RN 24-09 AI guidance',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Per-customer account isolation; preserve state across supervisory review workflows; annual WSP certification tracking',
            reference: 'FINRA Rule 4512 -- customer account record maintenance; Rule 3120 -- annual certification process',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Annual supervisory control certification; WSP testing-and-verification documentation; designated principal on file',
            reference: 'FINRA Rule 3120(a) -- annual certification by a senior principal; Rule 3110(a) -- designation of supervisors',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Unique agent identity for broker-dealer audit trail; access control for customer account information and supervisory records',
            reference: 'FINRA Rule 4511 -- records must identify the persons who created or modified them; Exchange Act Rule 17a-4',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Surveillance for manipulative, abusive, or suspicious patterns in AI-assisted trading and communications',
            reference: 'FINRA Rule 3110(d) -- internal inspections; RN 24-09 AI supervisory controls; Rule 4530 event triggers',
        },
    ],
    moduleConfig: {
        'audit-integrity': {
            wormCompliantRequired: true,
            appendOnlyAuditTrailRequired: true,
            sixYearRetentionRequired: true,
            timestampNtpRequired: true,
        },
        'governance-runtime': {
            wspEnforcementRequired: true,
            principalReviewRequired: true,
            supervisoryControlSystemRequired: true,
            annualWspCertificationRequired: true,
        },
        'data-classifier': {
            enabledCategories: ['FINANCIAL_CUSTOMER_INFO', 'BROKER_DEALER_COMMUNICATIONS', 'SUPERVISORY_RECORDS', 'COMPLAINT_RECORDS', 'PII', 'CREDENTIALS'],
            defaultAction: 'WARN',
            customerInfoAction: 'BLOCK',
        },
        'approval-queue': {
            principalReviewForCustomerCommunicationsRequired: true,
            researchReportApprovalRequired: true,
            retailCommunicationReviewRequired: true,
        },
        'attestation-manager': {
            annualPrincipalCertificationRequired: true,
            wspTestingVerificationRequired: true,
            designatedPrincipalOnFileRequired: true,
        },
        'event-bus': {
            rule4530EventDetectionActive: true,
            reportableEventDeadlineHours: 720, // 30 days
            seriousHarmImmediateNotificationRequired: true,
        },
        'supply-chain': {
            vendorAiSupervisoryResponsibilityAcknowledged: true,
            thirdPartyAiSystemInventoryRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['WORM-STORAGE', 'AUDIT-TRAIL', 'DATA-RESIDENCY-US'],
        blockReasons: {
            deepseek: 'PRC National Intelligence Law creates supervisory records custody risk incompatible with FINRA Rule 4511 US-jurisdiction records requirements.',
            baidu: 'PRC jurisdiction incompatible with Exchange Act records custody and FINRA supervisory control obligations.',
            alibaba: 'PRC jurisdiction incompatible with Exchange Act records custody and FINRA supervisory control obligations.',
        },
    },
    dataPolicy: {
        scanCategories: ['FINANCIAL_CUSTOMER_INFO', 'BROKER_DEALER_COMMUNICATIONS', 'SUPERVISORY_RECORDS', 'COMPLAINT_RECORDS', 'PII', 'CREDENTIALS'],
        categoryActions: {
            FINANCIAL_CUSTOMER_INFO: 'BLOCK',
            BROKER_DEALER_COMMUNICATIONS: 'WARN',
            SUPERVISORY_RECORDS: 'WARN',
            COMPLAINT_RECORDS: 'WARN',
            PII: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        // Rule 4511 / Exchange Act Rule 17a-4: general 3-year retention for most records
        // 6 years for blotters, ledgers, and certain communications
        // Lifetime-of-account for customer account records (Rule 4512)
        auditLogRetentionDays: 2190, // 6 years (most communications + supervisory records)
        sessionRetentionDays: 1095, // 3 years general records floor
        incidentRetentionDays: 2190,
        reference: 'FINRA Rule 4511 / Exchange Act Rule 17a-4: 3 years general; 6 years for blotters, ledgers, correspondence; Rule 4512 lifetime-of-account for customer records',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['us'],
    },
    incidentPolicy: {
        // Rule 4530: 30 calendar days for most reportable events
        // Immediate notification for specified serious customer harm events
        notificationDeadlineHours: 720, // 30 days
        reference: 'FINRA Rule 4530(a)-(b) -- reporting within 30 days of discovery for most specified events; immediate notification for specified serious events involving customer harm',
        requiredRecipients: ['finra-regulatory-affairs', 'chief-compliance-officer', 'designated-principal'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'finra-wsp-enforcement',
            description: 'Written Supervisory Procedures actively enforced for all AI-assisted broker-dealer workflows',
            reference: 'FINRA Rule 3110(a) -- supervisory system; Rule 3110(b) -- WSPs',
            check: 'finra_wsp_enforcement_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'finra-principal-review',
            description: 'Principal review gate required before AI-drafted customer communications are transmitted',
            reference: 'FINRA Rule 3110(b) -- principal review of correspondence and communications with the public',
            check: 'finra_principal_review_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'finra-worm-records',
            description: 'Books and records stored in WORM-compliant electronic format per Exchange Act Rule 17a-4(f)',
            reference: 'FINRA Rule 4511 -- books and records; Exchange Act Rule 17a-4(f) -- electronic storage requirements',
            check: 'finra_worm_records_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'finra-customer-account-info',
            description: 'Customer account essential information captured and maintained per Rule 4512 requirements',
            reference: 'FINRA Rule 4512 -- customer account information',
            check: 'data_classifier_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'finra-annual-certification',
            description: 'Senior principal annual certification of supervisory control system on file',
            reference: 'FINRA Rule 3120(a) -- annual certification',
            check: 'finra_annual_certification_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'finra-rule4530-reporting',
            description: 'Rule 4530 event detection active; 30-day reporting clock wired for regulatory events',
            reference: 'FINRA Rule 4530 -- reporting requirements; 30-day deadline for most specified events',
            check: 'finra_4530_reporting_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'finra-surveillance-active',
            description: 'AI-assisted surveillance for manipulative or abusive patterns in trading communications',
            reference: 'FINRA Rule 3110(d) -- internal inspections; FINRA RN 24-09 AI supervisory controls',
            check: 'post_market_monitoring',
            failSeverity: 'HIGH',
        },
        {
            id: 'finra-vendor-oversight',
            description: 'Third-party AI vendor supervisory responsibility acknowledged; vendor AI systems in inventory',
            reference: 'FINRA Rule 3110 -- supervisory responsibility not delegable to vendors; FINRA RN 24-09',
            check: 'subservice_registry_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'finra-audit-trail',
            description: 'Tamper-evident audit trail with 6-year retention for supervisory records and communications',
            reference: 'FINRA Rule 4511; Exchange Act Rule 17a-4 -- 6-year retention for specified records',
            check: 'audit_trail_exists',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'finra-access-control',
            description: 'Unique agent identity for broker-dealer records; access limited to authorised principals',
            reference: 'FINRA Rule 4511 -- records must identify creating/modifying persons; Reg S-P safeguards',
            check: 'rbac_active',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=finra-3110.js.map