"use strict";
/**
 * FCA Consumer Duty Compliance Pack
 *
 * Regulation: FCA Policy Statement PS22/9 -- A New Consumer Duty
 *             (including Principle 12 and the Cross-Cutting Rules)
 *             FCA Handbook: PRIN 12; PRIN 2A (Cross-Cutting Rules);
 *             PRIN 2B (Outcomes: Products and Services, Price and Value,
 *             Consumer Understanding, Consumer Support)
 *
 * Jurisdiction: GB (United Kingdom)
 * Regulator: FCA (Financial Conduct Authority)
 *
 * Alias: FS-09
 *
 * Effective dates:
 *   - 31 July 2023: open products and services
 *   - 31 July 2024: closed products and services (legacy book)
 *
 * Scope:
 *   Applies to UK-regulated firms that manufacture or distribute retail
 *   financial products or services to retail customers. The Duty requires
 *   firms to act to deliver good outcomes for retail customers across four
 *   outcome areas (Products and Services; Price and Value; Consumer
 *   Understanding; Consumer Support) and to comply with the overarching
 *   Cross-Cutting Rules (act in good faith; avoid foreseeable harm; enable
 *   pursuit of financial objectives).
 *
 * Principle 12 overarching obligation:
 *   "A firm must act to deliver good outcomes for retail customers."
 *   Customer-facing actions must be assessed against this outcome standard,
 *   not merely as technical rule compliance.
 *
 * Key obligations:
 *   1. Target market assessment: identify who the product/service is
 *      designed for and evidence that it meets their needs.
 *   2. Fair value assessment: price must be proportionate to the benefit
 *      received by retail customers.
 *   3. Consumer understanding testing: communications tested to confirm
 *      they are likely to be understood by the target market.
 *   4. Consumer support quality: support must be as easy to access and
 *      use as the sale journey.
 *   5. Vulnerable customer identification and appropriate treatment.
 *   6. Distribution strategy review: annual review per PRIN 2A.2.4R.
 *   7. Board annual attestation: board must attest that the Duty is
 *      being met and review MI packages.
 *
 * Retention:
 *   SYSC 9.1.1R: firms must retain records for at least 5 years
 *   (financial instruments); FCA guidance on Consumer Duty aligns with
 *   6-year general financial services record retention. Fair value
 *   assessments are retained for the life of the product + 6 years.
 *
 * Penalties:
 *   FCA can impose unlimited fines; consumer redress schemes; cancellation
 *   of regulatory permissions. No fixed statutory fine cap.
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.FCA_CONSUMER_DUTY_PACK = exports.FCA_CONSUMER_DUTY_CATEGORY_CLASSIFIERS = void 0;
exports.FCA_CONSUMER_DUTY_CATEGORY_CLASSIFIERS = {
    RETAIL_CUSTOMER_DATA: {
        references: ['PRIN 12 -- acting to deliver good outcomes for retail customers; PRIN 2A.2 Cross-Cutting Rules'],
        classifier: (input) => {
            if (/\b(?:retail\s+customer|retail\s+client|consumer\s+data|customer\s+outcome|consumer\s+outcome)\b/i.test(input))
                return true;
            if (/\b(?:consumer\s+duty|fca\s+duty|principle\s+12|customer\s+segmentation\s+data)\b/i.test(input))
                return true;
            if (/\b(?:target\s+market\s+data|distribution\s+channel\s+customer|retail\s+financial\s+product)\b/i.test(input))
                return true;
            return false;
        },
    },
    FINANCIAL_PRODUCT_DISTRIBUTION: {
        references: ['PRIN 2B.3 -- Products and Services outcome; PRIN 2B.4 -- Price and Value outcome'],
        classifier: (input) => {
            if (/\b(?:product\s+distribution|fair\s+value\s+assessment|target\s+market\s+assessment|tma|fva)\b/i.test(input))
                return true;
            if (/\b(?:distribution\s+strategy|price\s+and\s+value|manufacturer\s+distributor|value\s+assessment)\b/i.test(input))
                return true;
            if (/\b(?:financial\s+product\s+design|product\s+governance|suitability\s+assessment)\b/i.test(input))
                return true;
            return false;
        },
    },
    VULNERABLE_CUSTOMER_DATA: {
        references: ['FCA Guidance FG21/1 -- Guidance for firms on the fair treatment of vulnerable customers; PRIN 2A -- Cross-Cutting Rules'],
        classifier: (input) => {
            if (/\b(?:vulnerable\s+customer|vulnerable\s+consumer|vulnerability\s+data|customer\s+vulnerability)\b/i.test(input))
                return true;
            if (/\b(?:bereavement|severe\s+illness|mental\s+health\s+financial|cognitive\s+impairment\s+customer|low\s+financial\s+resilience)\b/i.test(input))
                return true;
            if (/\b(?:fg21\/1|vulnerable\s+flag|accessibility\s+needs\s+customer)\b/i.test(input))
                return true;
            return false;
        },
    },
    COMPLAINT_HANDLING_RECORD: {
        references: ['DISP 1 -- Treating complainants fairly; PRIN 2B.5 -- Consumer Support outcome'],
        classifier: (input) => {
            if (/\b(?:complaint\s+record|fca\s+complaint|disp\s+complaint|financial\s+ombudsman\s+referral|fos\s+referral)\b/i.test(input))
                return true;
            if (/\b(?:consumer\s+complaint|retail\s+customer\s+complaint|complaint\s+handling\s+data|complaint\s+outcome)\b/i.test(input))
                return true;
            return false;
        },
    },
    CUSTOMER_OUTCOME_RECORD: {
        references: ['PRIN 2A.2.4R -- monitoring and review; PRIN 12 -- good outcome evidence; Board MI'],
        classifier: (input) => {
            if (/\b(?:customer\s+outcome\s+report|outcome\s+monitoring|board\s+mi|management\s+information\s+consumer\s+duty)\b/i.test(input))
                return true;
            if (/\b(?:outcome\s+data|consumer\s+outcome\s+metric|good\s+outcome\s+evidence|duty\s+attestation)\b/i.test(input))
                return true;
            if (/\b(?:consumer\s+understanding\s+test\s+result|communications\s+testing\s+outcome)\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['UK GDPR Art. 4(1) -- personal data; FCA Consumer Duty customer data obligations'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            if (/\b[A-CEGHJ-PR-TW-Z]{2}\s?\d{2}\s?\d{2}\s?\d{2}\s?[A-D]\b/i.test(input))
                return true;
            if (/\b(?:customer\s+name|client\s+name|account\s+holder\s+name|sort\s+code|account\s+number)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['UK GDPR Art. 32 -- security; FCA SYSC 13 -- operational risk systems security'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
exports.FCA_CONSUMER_DUTY_PACK = {
    categoryClassifiers: exports.FCA_CONSUMER_DUTY_CATEGORY_CLASSIFIERS,
    id: 'fca-consumer-duty',
    aliases: ['FS-09'],
    name: 'FCA Consumer Duty (PS22/9)',
    version: '1.0.0',
    contentHash: 'd1c5d9821df4e70e08d35d669d3050fd212eddbbc4c8f7e8381acc0e58d640c3',
    description: 'FCA Consumer Duty (Policy Statement PS22/9) -- the overarching obligation that UK-regulated firms must act to deliver good outcomes for retail customers (Principle 12). Encompasses: Cross-Cutting Rules (act in good faith, avoid foreseeable harm, enable financial objectives); four outcome areas (Products and Services, Price and Value, Consumer Understanding, Consumer Support); target market assessments; fair value assessments; consumer understanding testing; vulnerable customer identification and treatment; annual board attestation. Effective 31 July 2023 (open products); 31 July 2024 (closed products). Enforced by FCA with unlimited fine power, remediation and cancellation of permissions.',
    authority: 'FCA (Financial Conduct Authority)',
    industries: ['financial-services', 'banking', 'insurance', 'investments', 'retail-lending', 'wealth-management', 'payments', 'mortgage-lending'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Enforce Principle 12 outcome assessment gate for customer-facing AI actions; Cross-Cutting Rules compliance (good faith, avoid foreseeable harm, enable financial objectives); target market scope control for product distribution AI',
            reference: 'PRIN 12 -- overarching Consumer Duty obligation; PRIN 2A.1 -- Cross-Cutting Rules; PRIN 2A.2.4R -- monitoring and review requirements',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Classify retail customer data, vulnerable customer data, complaint records, and customer outcome records; enable differential handling for vulnerable customer flags',
            reference: 'PRIN 2B.5 -- Consumer Support outcome; FCA FG21/1 -- vulnerable customers; DISP 1 -- complaints data classification',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit trail for customer outcome evidence, fair value assessments, target market assessments, and board MI packages; required for FCA supervisory review and enforcement defence',
            reference: 'PRIN 2A.2.4R -- outcome monitoring and record-keeping; FCA SYSC 9.1.1R -- general record-keeping; Consumer Duty MI requirements',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Access control for retail customer data and vulnerable customer records; ensures only authorised personnel can view or modify customer outcome data',
            reference: 'FCA SYSC 13.7.6R -- operational risk access controls; UK GDPR Art. 32 -- appropriate security measures for personal data',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'Retail customer personal data encrypted at rest and in transit; vulnerable customer flags encrypted separately to minimise unnecessary access',
            reference: 'UK GDPR Art. 32(1)(a) -- encryption; FCA SYSC 13 -- operational risk; FCA Cyber and Technology Resilience guidance',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Human review gate for AI-generated customer communications to verify consumer understanding compliance; fair value assessment sign-off workflow; board attestation workflow',
            reference: 'PRIN 2B.4 -- Consumer Understanding outcome (communications tested before distribution); PRIN 2B.6 -- board attestation; FCA "Dear CEO" letter guidance on AI communications',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Target market assessment documentation; fair value assessment lifecycle records (product life + 6 years); annual board attestation records; distribution strategy review documentation',
            reference: 'PRIN 2B.3 -- Products and Services TMA; PRIN 2B.4 -- Price and Value FVA; PRIN 2A.2.4R -- annual review; FCA SYSC 9 retention requirements',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Customer harm event detection and root cause analysis workflow; "Dear CEO" letter trigger classification; vulnerable customer detriment escalation; FCA supervisory notification events',
            reference: 'PRIN 12 -- customer harm remediation; FCA supervisory tool: "Dear CEO" letters; FCA Consumer Duty implementation guidance on incident response',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Manufacturer-distributor contractual obligations under Consumer Duty; AI system vendors must confirm Consumer Duty compliance; distribution chain accountability documentation',
            reference: 'PRIN 2A.2.10R -- manufacturer responsibilities to distributors; PRIN 2A.2.14R -- distributor feedback obligations; FCA PS22/9 Chapter 5 (distribution chain)',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Retention of customer outcome records across session boundaries; fair value assessment continuity; retention enforcement for 6-year FCA record-keeping requirement',
            reference: 'FCA SYSC 9.1.1R -- 6-year record retention; PRIN 2A.2.4R -- ongoing monitoring continuity; Consumer Duty MI package continuity',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Consumer understanding disclosures in AI-generated communications; vulnerable customer adapted communication delivery; product information transparency per Consumer Duty outcome',
            reference: 'PRIN 2B.4 -- Consumer Understanding outcome; FCA Guidance on AI and Consumer Duty -- communications must be clear, fair, not misleading; FCA Consumer Duty communications testing obligations',
        },
        {
            name: 'bias-monitor',
            required: true,
            reason: 'Monitoring for disparate outcomes across retail customer segments; vulnerable customer detriment detection; fair value disparities across demographic groups',
            reference: 'PRIN 2A.1.3G -- treating customers fairly across the board; FCA FG21/1 -- vulnerable customer outcome monitoring; Consumer Duty board MI on customer segment outcomes',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            principle12OutcomeAssessmentRequired: true,
            crossCuttingRulesEnforced: true,
            targetMarketScopeRequired: true,
            vulnerableCustomerTriageRequired: true,
            foreseableHarmCheckRequired: true,
        },
        'data-classifier': {
            enabledCategories: ['RETAIL_CUSTOMER_DATA', 'FINANCIAL_PRODUCT_DISTRIBUTION', 'VULNERABLE_CUSTOMER_DATA', 'COMPLAINT_HANDLING_RECORD', 'CUSTOMER_OUTCOME_RECORD', 'PII', 'CREDENTIALS'],
            vulnerableCustomerDataAction: 'WARN',
            complaintHandlingRecordAction: 'WARN',
            customerOutcomeRecordAction: 'WARN',
            credentialsAction: 'BLOCK',
        },
        'approval-queue': {
            article22HumanReviewRequired: true,
            consumerCommunicationTestingRequired: true,
            fairValueAssessmentSignOffRequired: true,
            boardAttestationWorkflowRequired: true,
        },
        'attestation-manager': {
            targetMarketAssessmentRequired: true,
            fairValueAssessmentRequired: true,
            fairValueAssessmentRetentionYears: 6,
            distributionStrategyReviewAnnualRequired: true,
            boardAnnualAttestationRequired: true,
        },
        'event-bus': {
            customerHarmEventRootCauseAnalysisRequired: true,
            dearCeoLetterTriggerClassificationRequired: true,
            vulnerableCustomerDetrimentEscalationRequired: true,
        },
        'supply-chain': {
            manufacturerDistributorContractRequired: true,
            distributionChainAccountabilityRequired: true,
        },
        'session-persistence': {
            storageLimitationEnforced: true,
            fcaRecordRetentionYears: 6,
        },
        'bias-monitor': {
            customerSegmentOutcomeMonitoringRequired: true,
            vulnerableCustomerDetrimentDetectionRequired: true,
            fairValueDisparityDetectionRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['DATA-RESIDENCY-UK-OR-EU', 'PROCESSOR-CONTRACT', 'CONSUMER-DUTY-COMPLIANT-COMMUNICATIONS'],
        blockReasons: {
            deepseek: 'PRC National Intelligence Law incompatible with UK GDPR Art. 46 transfer requirements and FCA Consumer Duty data security obligations for retail customer data.',
            baidu: 'PRC jurisdiction. No UK adequacy decision. Transfer of UK retail customer data to PRC violates UK GDPR Art. 44 and FCA operational resilience requirements.',
            alibaba: 'PRC jurisdiction. No UK adequacy decision. Transfer of UK retail customer personal data and vulnerable customer flags to PRC violates UK GDPR Art. 44 and FCA Consumer Duty.',
        },
    },
    dataPolicy: {
        scanCategories: ['RETAIL_CUSTOMER_DATA', 'FINANCIAL_PRODUCT_DISTRIBUTION', 'VULNERABLE_CUSTOMER_DATA', 'COMPLAINT_HANDLING_RECORD', 'CUSTOMER_OUTCOME_RECORD', 'PII', 'CREDENTIALS'],
        categoryActions: {
            RETAIL_CUSTOMER_DATA: 'WARN',
            FINANCIAL_PRODUCT_DISTRIBUTION: 'WARN',
            VULNERABLE_CUSTOMER_DATA: 'WARN',
            COMPLAINT_HANDLING_RECORD: 'WARN',
            CUSTOMER_OUTCOME_RECORD: 'WARN',
            PII: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        // FCA SYSC 9.1.1R: general 5-year minimum; 6-year common standard aligning with Limitation Act 1980.
        // Fair value assessments: product life + 6 years (FCA PS22/9 para 8.43).
        // Complaint records: DISP 1.9 -- 3 years for most; 5 years for pension and MiFID complaints.
        auditLogRetentionDays: 2190, // 6 years (aligns with Limitation Act 1980 claims period)
        sessionRetentionDays: 2190, // 6 years for customer outcome records
        incidentRetentionDays: 2190, // 6 years for customer harm incidents and FCA supervisory responses
        reference: 'FCA SYSC 9.1.1R -- 5-year general minimum; FCA PS22/9 para 8.43 -- fair value assessment retention; DISP 1.9 -- complaint records retention; Limitation Act 1980 -- 6-year claims period',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['gb', 'eu'], // UK data sovereignty; EU adequate for UK GDPR transfers
    },
    incidentPolicy: {
        // No fixed statutory breach notification deadline under Consumer Duty.
        // FCA supervisory expectation: "as soon as reasonably practicable" for significant customer harm events.
        // Using 72 hours as operational standard consistent with UK GDPR Art. 33 and FCA operational resilience.
        notificationDeadlineHours: 72,
        reference: 'FCA Consumer Duty PS22/9 -- customer harm event reporting expectations; UK GDPR Art. 33 -- 72-hour ICO notification (parallel data breach); FCA Operational Resilience Policy Statement -- PS21/3',
        requiredRecipients: ['fca-supervisory-contact', 'chief-compliance-officer', 'consumer-duty-board-champion', 'data-protection-officer'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'fca-cd-principle12-outcome-gate',
            description: 'Principle 12 outcome assessment gate active: customer-facing AI actions evaluated against good outcome standard before delivery',
            reference: 'PRIN 12 -- A firm must act to deliver good outcomes for retail customers; FCA PS22/9 Chapter 2 -- overarching obligation',
            check: 'governance_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fca-cd-consumer-understanding-test',
            description: 'Consumer understanding testing gate active for AI-generated communications; human review required before distribution to retail customers',
            reference: 'PRIN 2B.4 -- Consumer Understanding outcome; FCA PS22/9 Chapter 6 -- consumer understanding; FCA "Dear CEO" letter on AI communications',
            check: 'approval_queue_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fca-cd-vulnerable-customer-classifier',
            description: 'Vulnerable customer data classifier active; VULNERABLE_CUSTOMER_DATA category triggers differential treatment workflow',
            reference: 'FCA FG21/1 -- fair treatment of vulnerable customers; PRIN 2A -- Cross-Cutting Rules; PRIN 2B.5 -- Consumer Support outcome',
            check: 'data_classifier_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fca-cd-fair-value-assessment',
            description: 'Fair value assessment documentation maintained; retained for product life + 6 years',
            reference: 'PRIN 2B.4 -- Price and Value outcome (FVA); FCA PS22/9 para 8.43 -- fair value assessment retention; PRIN 2A.2.4R -- annual review',
            check: 'attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fca-cd-board-attestation',
            description: 'Annual board attestation workflow active; board confirms Consumer Duty obligations are being met; MI package reviewed',
            reference: 'PRIN 2B.6R -- board attestation requirement; FCA PS22/9 Chapter 9 -- governance; FCA "Dear CEO" letter expectations on board ownership',
            check: 'gdpr_ropa_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fca-cd-customer-harm-event-response',
            description: 'Customer harm event detection active; root cause analysis and remediation workflow triggered on harm identification; "Dear CEO" letter trigger classification active',
            reference: 'PRIN 12 -- deliver good outcomes; FCA PS22/9 -- customer harm remediation; FCA supervisory tool: "Dear CEO" letters on Consumer Duty failures',
            check: 'monitoring_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fca-cd-encryption',
            description: 'Retail customer data and vulnerable customer records encrypted at rest and in transit',
            reference: 'UK GDPR Art. 32(1)(a) -- encryption; FCA SYSC 13 -- operational risk; FCA Cyber and Technology Resilience',
            check: 'encryption_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'fca-cd-audit-trail',
            description: 'Tamper-evident audit trail active for customer outcome evidence, fair value assessments, and board MI packages',
            reference: 'PRIN 2A.2.4R -- outcome monitoring records; FCA SYSC 9.1.1R -- record-keeping obligation; Consumer Duty supervisory evidence requirements',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
        {
            id: 'fca-cd-distribution-chain',
            description: 'Manufacturer-distributor contractual accountability active; AI vendor Consumer Duty compliance confirmed in supply chain',
            reference: 'PRIN 2A.2.10R -- manufacturer responsibility to distributors; PRIN 2A.2.14R -- distributor feedback obligations; FCA PS22/9 Chapter 5',
            check: 'subservice_registry_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'fca-cd-communications-transparency',
            description: 'AI-generated retail customer communications subject to transparency injector; fair, clear, not misleading standard enforced',
            reference: 'PRIN 2B.4 -- Consumer Understanding outcome; FCA Conduct of Business Rules on communications; PRIN 7 -- communications with clients',
            check: 'transparency_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'fca-cd-access-control',
            description: 'Access to retail customer data and vulnerable customer flags limited to authorised personnel; agent authentication enforced',
            reference: 'FCA SYSC 13.7.6R -- operational risk access controls; UK GDPR Art. 32(1)(b) -- access control; Consumer Duty data handling obligations',
            check: 'rbac_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'fca-cd-outcome-monitoring',
            description: 'Ongoing monitoring of customer outcomes active; disparate outcome detection across retail customer segments and vulnerable groups',
            reference: 'PRIN 2A.2.4R -- ongoing monitoring and review; FCA PS22/9 -- board MI requirements; FCA FG21/1 -- vulnerable customer outcome monitoring',
            check: 'bias_monitor_active',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=fca-consumer-duty.js.map