/**
 * BSA / AML Compliance Pack
 *
 * Bank Secrecy Act (31 USC 5311-5336) + Anti-Money Laundering
 * regulations (31 CFR 1010-1030), enforced by FinCEN with banking-
 * agency supervisory authority.
 *
 * X1-DISAGGREGATION REVIEW (2026-04-24): ACCEPTABLE AS ONE PACK.
 *   "AML" is not a separate statute; it is the common-law name for the
 *   anti-money laundering program mandated by 31 USC 5318(h) within the
 *   Bank Secrecy Act itself. The five-pillar AML program (CIP/CDD/SAR/CTR/
 *   OFAC) is defined within BSA. The implementing regulations (31 CFR
 *   1010-1030) are all FinCEN rules under BSA. Single enforcer (FinCEN +
 *   banking agencies as supervisory co-regulators). Single integrated
 *   regulatory framework. No split required.
 *
 * Five pillars of an AML program (31 USC 5318(h)):
 *   1. Internal policies, procedures, and controls
 *   2. Designated BSA / AML compliance officer
 *   3. Ongoing training
 *   4. Independent testing
 *   5. Customer Due Diligence (CDD) Rule -- added 2016
 *
 * Key reports:
 *   - SAR (Suspicious Activity Report): 30 days from detection
 *     (31 CFR 1020.320, 1022.320, 1023.320)
 *   - CTR (Currency Transaction Report): transactions > $10K
 *     (31 CFR 1010.311)
 *   - 314(a) / 314(b) information sharing
 *   - OFAC sanctions screening (31 CFR 501-598)
 *   - Corporate Transparency Act (2021) BOI reporting to FinCEN
 *
 * 2023-2026 FinCEN guidance on AI/ML in AML:
 *   - AI transaction monitoring must be explainable for SAR narrative
 *   - Model governance aligned with SR 11-7
 *   - Bias evaluation across demographic groups
 *
 * @connexum/ai-governance
 */
/**
 * BSA/AML (Bank Secrecy Act / Anti-Money Laundering) category classifiers.
 * 31 CFR Chapter X. Covers CIP, CDD, SAR/CTR filing, OFAC screening,
 * BOI (Corporate Transparency Act), and sanctions-list identifiers.
 */
export const BSA_AML_CATEGORY_CLASSIFIERS = {
    NPI: {
        references: ['31 CFR §1020.220 -- CIP; customer nonpublic personal information'],
        classifier: (input) => {
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            if (/\b(?:account\s*(?:number|#|no\.?))[:\s]*\d{6,17}\b/i.test(input))
                return true;
            if (/\b(?:TIN|EIN|taxpayer\s*id)[:\s]*\d{2}-\d{7}\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['31 CFR §1020.220 -- CIP; customer identifying information'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b(?:date\s+of\s+birth|DOB)[:\s]*\d{1,2}[\/\-]\d{1,2}[\/\-]\d{2,4}\b/i.test(input))
                return true;
            return false;
        },
    },
    TRANSACTION_DATA: {
        references: ['31 CFR §1010.430 -- records; transaction reporting for CTR ($10,000 threshold)'],
        classifier: (input) => {
            // Dollar amounts that could trigger CTR
            if (/\$[\d,]{5,}(?:\.\d{2})?\b/.test(input))
                return true;
            if (/\b(?:transaction|wire\s*transfer|CTR|SAR|suspicious\s*activity)\b/i.test(input))
                return true;
            return false;
        },
    },
    BOI: {
        references: ['31 CFR §1010.380 -- Corporate Transparency Act; beneficial ownership information'],
        classifier: (input) => {
            if (/\b(?:beneficial\s*owner(?:ship)?|BO[I]?\s*report|CTA\s*filing|ownership\s*percentage)\b/i.test(input))
                return true;
            return false;
        },
    },
    SANCTIONS_IDENTIFIER: {
        references: ['31 CFR §501 -- OFAC sanctions; SDN list identifiers'],
        classifier: (input) => {
            // OFAC/SDN list markers
            if (/\b(?:OFAC|SDN|sanctions\s*list|specially\s*designated\s*national)\b/i.test(input))
                return true;
            // High-risk jurisdiction names (FATF list context)
            if (/\b(?:Iran|North Korea|DPRK|Syria|Cuba|Russia\s*sanctions|Belarus\s*sanctions)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['BSA/AML -- information security for SAR/CTR systems; credential exposure'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
    STRUCTURING: {
        references: ['31 CFR 1010.314 -- structuring; 31 USC 5324 -- evading currency transaction reporting'],
        classifier: (input) => {
            if (/\bstructur(?:ing|ed)\b/i.test(input) && /\b(threshold|currency|ctr|reporting|evade)\b/i.test(input))
                return true;
            if (/\bsmurfing\b/i.test(input))
                return true;
            if (/\bsub[\s-]?(?:ctr|10[\s,]?000|\$10k)\b/i.test(input))
                return true;
            // pattern: multiple cash deposits/wires of $9,000-$9,999 (just under $10K threshold)
            if (/\$9,?[0-9]{3}\b/i.test(input) && /\b(?:cash|wire|deposit|transfer|consecutive|multiple|series)\b/i.test(input))
                return true;
            if (/\bjust\s+below\s+the\s+\$?10[\s,]?000\s+(reporting\s+)?threshold\b/i.test(input))
                return true;
            if (/\bevade\s+(currency\s+)?(transaction\s+)?reporting\b/i.test(input))
                return true;
            return false;
        },
    },
    PEP: {
        references: ['FATF Recommendation 12 -- Politically Exposed Persons; FinCEN PEP guidance'],
        classifier: (input) => {
            // Bare PEP token in a meaningful AML context (avoid false positives on three-letter words)
            if (/\bpep\b/i.test(input) && /\b(politically|exposed|person|fatf|fincen|beneficiary|customer|sanction|advisory|screening|flag|match|guidance|domestic|foreign|advisor|advisory)\b/i.test(input))
                return true;
            if (/\bpolitically\s+exposed\s+person/i.test(input))
                return true;
            if (/\b(senior\s+)?foreign\s+political\s+(figure|official)\b/i.test(input))
                return true;
            if (/\b(domestic|foreign)\s+pep\b/i.test(input))
                return true;
            if (/\bhead[\s-]of[\s-]state\s+(family|relative|associate|immediate)/i.test(input))
                return true;
            if (/\bforeign\s+government\s+official\b/i.test(input))
                return true;
            return false;
        },
    },
    WIRE_RED_FLAG: {
        references: ['FinCEN wire transfer red flag advisories; 31 CFR 1010.410 -- wire transfer recordkeeping'],
        classifier: (input) => {
            if (/\bwire\s+transfer\b/i.test(input) && /\b(high[\s-]?risk\s+jurisdiction|shell\s+company|non[\s-]cooperative|funnel\s+account)\b/i.test(input))
                return true;
            // Beneficiary manipulation patterns: changed at last minute, added then removed, removed within day, etc.
            if (/\bbeneficiary\b/i.test(input) && /\b(changed\s+at\s+last\s+minute|added\s+then\s+removed|added\s+and\s+removed|removed\s+within\s+(?:same|24)\s+(?:day|hour))/i.test(input))
                return true;
            if (/\bthird[\s-]?party\s+wire\s+transfer\b/i.test(input) && /\b(no\s+apparent\s+business|unknown\s+purpose|suspicious)\b/i.test(input))
                return true;
            if (/\bfunnel\s+account\s+wire\s+pattern\b/i.test(input))
                return true;
            if (/\bpass[\s-]through\s+wire\b/i.test(input))
                return true;
            if (/\boutgoing\s+wire\s+to\s+shell\s+company\b/i.test(input))
                return true;
            return false;
        },
    },
};
export const BSA_AML_PACK = {
    categoryClassifiers: BSA_AML_CATEGORY_CLASSIFIERS,
    /** P3.5: NPI (non-public personal information) and BOI are inherently subject-keyed per BSA 31 USC §5318. */
    subjectKeyedCategories: ['NPI', 'BOI'],
    id: 'bsa-aml',
    name: 'BSA / AML',
    version: '1.0.0',
    description: 'Bank Secrecy Act / Anti-Money Laundering compliance including CIP, CDD Rule (2016), SAR / CTR reporting, OFAC sanctions, and Corporate Transparency Act BOI reporting. Reinforced by 2023-2026 FinCEN guidance on AI/ML in AML.',
    authority: 'FinCEN + banking regulators (FRB, OCC, FDIC, NCUA)',
    industries: [
        'banking',
        'credit-union',
        'money-services-business',
        'broker-dealer',
        'casino',
        'insurance-carrier',
        'mortgage-lender',
        'dealer-precious-metals',
        'fintech-money-transmitter',
    ],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'CIP + CDD gate; OFAC sanctions check before any transaction agent runs',
            reference: '31 CFR 1020.220, 1010.230, 501-598',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident record of transaction monitoring decisions + SAR / CTR filings',
            reference: '31 CFR 1020.320 record-keeping',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Stream suspicious-activity alerts, CTR thresholds, sanctions hits',
            reference: '31 CFR 1020.320',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'BSA officer approval for SAR filings; false-positive review; sanctions-hit override',
            reference: '31 USC 5318(h)(1)(B) -- designated officer',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Transaction-monitoring anomalies feed SAR pipeline',
            reference: 'FinCEN 2023-2026 AI/ML guidance',
        },
        {
            name: 'bias-monitor',
            required: true,
            reason: 'Avoid disparate impact in AI risk scoring',
            reference: 'FinCEN 2023-2026 AI/ML guidance',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Detect NPI, PII, TRANSACTION_DATA, BOI for handling rules',
            reference: '31 CFR 1010.410',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Third-party AML service provider oversight',
            reference: 'FinCEN third-party risk guidance',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'AML program attestations: officer designation, training completion, independent testing (5 pillars)',
            reference: '31 USC 5318(h)(1)',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Unique identity for SAR attribution and BSA officer actions',
            reference: '31 CFR 1020.210',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Customer relationship state across interactions (CDD continuity)',
            reference: '31 CFR 1010.230',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            cipRequired: true,
            cddRequired: true,
            ofacScreeningRequired: true,
            boiReportingRequired: true, // Corporate Transparency Act
        },
        'approval-queue': {
            sarRequiresBsaOfficerApproval: true,
            sanctionsHitOverrideRequiresApproval: true,
        },
        'attestation-manager': {
            bsaOfficerDesignationRequired: true,
            annualTrainingRequired: true,
            independentTestingCadenceDays: 365,
            fivePillarAttestation: true,
        },
        'data-classifier': {
            enabledCategories: ['NPI', 'PII', 'TRANSACTION_DATA', 'BOI', 'SANCTIONS_IDENTIFIER'],
            transactionThresholdCtrUsd: 10000,
        },
        'bias-monitor': {
            amlDemographicBiasMonitoringRequired: true,
        },
        'anomaly-detector': {
            transactionMonitoringActive: true,
            sarPipelineActive: true,
        },
    },
    providerPolicy: {
        // Block PRC providers for NPI + transaction data
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['AML-TRANSACTION-MONITORING', 'EXPLAINABILITY'],
        blockReasons: {
            deepseek: 'PRC jurisdiction. Cannot satisfy OFAC sanctions screening and BSA recordkeeping requirements.',
            baidu: 'PRC jurisdiction. Sanctions-screening integrity risk.',
            alibaba: 'PRC jurisdiction. Sanctions-screening integrity risk.',
        },
    },
    dataPolicy: {
        scanCategories: ['NPI', 'PII', 'TRANSACTION_DATA', 'BOI', 'SANCTIONS_IDENTIFIER', 'CREDENTIALS', 'STRUCTURING', 'PEP', 'WIRE_RED_FLAG'],
        categoryActions: {
            NPI: 'BLOCK',
            TRANSACTION_DATA: 'LOG',
            BOI: 'BLOCK',
            SANCTIONS_IDENTIFIER: 'BLOCK',
            PII: 'WARN',
            CREDENTIALS: 'BLOCK',
            STRUCTURING: 'BLOCK',
            PEP: 'WARN',
            WIRE_RED_FLAG: 'WARN',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        sovereignty: ['US'],
        // 5 years from date of record or date of transaction per 31 CFR 1010.430
        auditLogRetentionDays: 1825,
        sessionRetentionDays: 365,
        incidentRetentionDays: 1825,
        reference: '31 CFR 1010.430 -- records retained 5 years',
    },
    incidentPolicy: {
        // 30 days for SAR filing from detection (31 CFR 1020.320(b)(3))
        notificationDeadlineHours: 720,
        reference: '31 CFR 1020.320(b)(3) -- SAR filed within 30 days of detection (up to 60 days if no subject identified).',
        requiredRecipients: ['bsa-officer', 'fincen', 'senior-management', 'independent-testing-reviewer'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'bsa-aml-cip',
            description: 'Customer Identification Program active',
            reference: '31 CFR 1020.220',
            check: 'bsa_cip_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'bsa-aml-cdd',
            description: 'Customer Due Diligence + beneficial ownership collection active',
            reference: '31 CFR 1010.230',
            check: 'bsa_cdd_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'bsa-aml-ofac',
            description: 'OFAC sanctions screening on all parties to every transaction',
            reference: '31 CFR 501-598',
            check: 'bsa_ofac_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'bsa-aml-sar-30day',
            description: '30-day SAR filing deadline tracked',
            reference: '31 CFR 1020.320(b)(3)',
            check: 'bsa_sar_30day_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'bsa-aml-ctr-10k',
            description: 'CTR triggered on transactions over $10,000',
            reference: '31 CFR 1010.311',
            check: 'bsa_ctr_10k_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'bsa-aml-officer',
            description: 'BSA / AML compliance officer designated',
            reference: '31 USC 5318(h)(1)(B)',
            check: 'bsa_officer_designated',
            failSeverity: 'HIGH',
        },
        {
            id: 'bsa-aml-training',
            description: 'Annual BSA / AML training completed by all covered personnel',
            reference: '31 USC 5318(h)(1)(D)',
            check: 'bsa_annual_training_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'bsa-aml-independent-testing',
            description: 'Independent testing performed at least annually',
            reference: '31 USC 5318(h)(1)(C)',
            check: 'bsa_independent_testing_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'bsa-aml-boi',
            description: 'Beneficial Ownership Information reporting active (Corporate Transparency Act)',
            reference: 'CTA 2021; 31 CFR 1010.380',
            check: 'bsa_boi_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'bsa-aml-ai-explainability',
            description: 'AI transaction monitoring explainability available for SAR narrative',
            reference: 'FinCEN 2023-2026 AI/ML guidance',
            check: 'bsa_ai_explainability_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'bsa-aml-bias',
            description: 'AML AI risk scoring monitored for demographic disparate impact',
            reference: 'FinCEN 2023-2026 AI/ML guidance',
            check: 'bsa_aml_bias_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=bsa-aml.js.map