"use strict";
/**
 * UK FCA Operational Resilience (PS21/3) Compliance Pack
 *
 * Regulation: FCA Policy Statement PS21/3 -- Building operational resilience:
 *               Impact tolerances for important business services
 *             PRA Supervisory Statement SS1/21 -- Operational Resilience
 *             Bank of England Statement of Policy -- Operational Resilience
 *             PRA Policy Statement PS6/21 (companion)
 *
 * Jurisdiction: GB (United Kingdom)
 * Regulator: FCA + PRA + Bank of England
 *
 * Effective dates:
 *   - 31 March 2022: policy effective; firms must identify IBS, set
 *     impact tolerances, and begin mapping/testing
 *   - 31 March 2025: firms must be able to remain within impact tolerances
 *     (transitional end date)
 *
 * Scope:
 *   Applies to FCA-regulated firms providing important business services.
 *   Dual-regulated firms (FCA + PRA) must comply with both policy statements.
 *
 * Key obligations:
 *   1. Identify important business services (IBS) -- services whose disruption
 *      would cause harm to consumers or market integrity.
 *   2. Set impact tolerances for each IBS -- maximum tolerable disruption
 *      in a severe but plausible scenario.
 *   3. Map people, processes, technology, facilities, and information
 *      (including third-party dependencies) for each IBS.
 *   4. Conduct scenario testing using severe-but-plausible scenarios; prove
 *      ability to remain within impact tolerances.
 *   5. Annual self-assessment against operational resilience requirements.
 *   6. Annual board attestation confirming self-assessment.
 *   7. Lessons-learned cycle from testing and real disruptions.
 *   8. Third-party criticality assessment for outsourced services.
 *
 * Retention:
 *   6 years general FCA standard (FCA SYSC 9.1.1R).
 *   Impact tolerance documentation: indefinite while service operates.
 *   Scenario test results: 6 years.
 *
 * Penalties:
 *   FCA and PRA enforcement powers; unlimited fines; requirement for remediation.
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.FCA_OP_RESILIENCE_PACK = exports.FCA_OP_RESILIENCE_CATEGORY_CLASSIFIERS = void 0;
exports.FCA_OP_RESILIENCE_CATEGORY_CLASSIFIERS = {
    IMPORTANT_BUSINESS_SERVICE: {
        references: ['FCA PS21/3 -- identifying important business services (IBS); PRA SS1/21 -- IBS identification'],
        classifier: (input) => {
            if (/\b(?:important\s+business\s+service|ibs\s+fca|ibs\s+pra|ps21\/3\s+service|operational\s+resilience\s+service)\b/i.test(input))
                return true;
            if (/\b(?:fca\s+resilience\s+service|pra\s+resilience\s+service|bank\s+of\s+england\s+resilience|critical\s+business\s+service\s+fca)\b/i.test(input))
                return true;
            return false;
        },
    },
    IMPACT_TOLERANCE_RECORD: {
        references: ['FCA PS21/3 -- setting impact tolerances; PRA SS1/21 -- impact tolerances (maximum tolerable disruption)'],
        classifier: (input) => {
            if (/\b(?:impact\s+tolerance|maximum\s+tolerable\s+disruption|ps21\/3\s+tolerance|operational\s+resilience\s+tolerance)\b/i.test(input))
                return true;
            if (/\b(?:fca\s+impact\s+tolerance|pra\s+impact\s+tolerance|disruption\s+tolerance\s+fca|rto\s+fca\s+resilience)\b/i.test(input))
                return true;
            return false;
        },
    },
    MAPPING_RECORD: {
        references: ['FCA PS21/3 -- mapping people, processes, technology, facilities, information; PRA SS1/21 -- mapping'],
        classifier: (input) => {
            if (/\b(?:resilience\s+mapping|ibs\s+mapping|ps21\/3\s+mapping|fca\s+op\s+resilience\s+map|process\s+technology\s+mapping\s+fca)\b/i.test(input))
                return true;
            if (/\b(?:third.party\s+dependency\s+map|operational\s+dependency\s+map\s+fca|supplier\s+mapping\s+resilience\s+fca)\b/i.test(input))
                return true;
            return false;
        },
    },
    SCENARIO_TEST_RECORD: {
        references: ['FCA PS21/3 -- scenario testing (severe but plausible); PRA SS1/21 -- testing; BoE SoP -- testing requirements'],
        classifier: (input) => {
            if (/\b(?:scenario\s+testing\s+fca|severe\s+but\s+plausible\s+scenario|resilience\s+scenario\s+test|ps21\/3\s+scenario)\b/i.test(input))
                return true;
            if (/\b(?:business\s+continuity\s+scenario\s+fca|stress\s+scenario\s+resilience\s+fca|operational\s+resilience\s+test\s+result)\b/i.test(input))
                return true;
            return false;
        },
    },
    THIRD_PARTY_DEPENDENCY_RECORD: {
        references: ['FCA PS21/3 -- third-party dependency mapping; PRA SS1/21 -- outsourcing dependencies; FCA outsourcing rules SYSC 8'],
        classifier: (input) => {
            if (/\b(?:third.party\s+resilience|critical\s+third\s+party\s+fca|ctp\s+fca|outsourcing\s+resilience\s+fca|supplier\s+criticality\s+fca)\b/i.test(input))
                return true;
            if (/\b(?:ps21\/3\s+third\s+party|third.party\s+dependency\s+fca|fca\s+operational\s+resilience\s+vendor)\b/i.test(input))
                return true;
            return false;
        },
    },
    LESSONS_LEARNED_RECORD: {
        references: ['FCA PS21/3 -- lessons-learned cycle; PRA SS1/21 -- continuous improvement; BoE SoP -- post-incident review'],
        classifier: (input) => {
            if (/\b(?:lessons\s+learned\s+resilience|post.incident\s+review\s+fca|operational\s+resilience\s+improvement|resilience\s+lessons)\b/i.test(input))
                return true;
            if (/\b(?:ps21\/3\s+lessons|fca\s+resilience\s+post\s+incident|pra\s+resilience\s+lesson\s+learned)\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['UK GDPR Art. 4(1) -- personal data; FCA SYSC 13 -- operational risk systems and controls'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b[A-CEGHJ-PR-TW-Z]{2}\s?\d{2}\s?\d{2}\s?\d{2}\s?[A-D]\b/i.test(input))
                return true;
            if (/\b(?:sort\s+code|account\s+number|client\s+name|customer\s+account\s+number)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['UK GDPR Art. 32 -- security; FCA SYSC 13 -- operational risk; FCA PS21/3 -- security of IBS systems'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
exports.FCA_OP_RESILIENCE_PACK = {
    categoryClassifiers: exports.FCA_OP_RESILIENCE_CATEGORY_CLASSIFIERS,
    id: 'fca-op-resilience',
    aliases: [],
    name: 'FCA Operational Resilience (PS21/3)',
    version: '1.0.0',
    contentHash: '3909d06855028bd5e3d8ff4a9ced83ca2832d546a66ba4b60b595f52c7a097bc',
    description: 'FCA Policy Statement PS21/3 (Building operational resilience) + PRA SS1/21 + Bank of England Statement of Policy. Requires FCA/PRA-regulated firms to: identify important business services (IBS); set maximum impact tolerances; map people/processes/technology/data/third-parties for each IBS; conduct scenario testing using severe-but-plausible scenarios; produce annual self-assessments; and obtain annual board attestation. Transitional period: firms must operate within impact tolerances by 31 March 2025. Enforcement by FCA, PRA, and Bank of England.',
    authority: 'FCA (Financial Conduct Authority) + PRA (Prudential Regulation Authority) + Bank of England',
    industries: ['financial-services', 'banking', 'insurance', 'investments', 'payments', 'market-infrastructure'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Impact tolerance enforcement gate: AI systems must remain within IBS impact tolerances during disruption; governance-runtime enforces the disruption detection and tolerance breach workflow.',
            reference: 'FCA PS21/3 -- impact tolerances; PRA SS1/21 -- remaining within impact tolerances by 31 March 2025; BoE SoP -- operational resilience governance',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit trail for IBS mapping records, scenario test results, self-assessment documentation, and board attestation records; required for FCA/PRA supervisory review.',
            reference: 'FCA PS21/3 -- documentation and reporting obligations; FCA SYSC 9.1.1R -- 6-year record retention; PRA SS1/21 -- operational resilience documentation',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Annual self-assessment lifecycle management; board attestation workflow; IBS impact tolerance documentation; scenario test result records (6-year retention); third-party criticality assessment records.',
            reference: 'FCA PS21/3 -- self-assessment; PRA SS1/21 -- annual self-assessment and board attestation; BoE SoP -- self-assessment requirements',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Operational disruption detection: trigger IBS disruption alerts; impact tolerance breach escalation to CEO/Board; FCA/PRA notification event workflow for important business service failures.',
            reference: 'FCA PS21/3 -- disruption notifications; PRA SS1/21 -- notifying regulators; BoE SoP -- severity escalation; FCA PS21/3 impact tolerance breach escalation',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Third-party criticality assessment: identify and record critical third-party dependencies for each IBS; AI vendor operational resilience due diligence; FCA SYSC 8 outsourcing compliance.',
            reference: 'FCA PS21/3 -- third-party dependency mapping; PRA SS1/21 -- outsourcing dependencies; FCA SYSC 8 -- outsourcing; CTP (Critical Third Parties) framework designation',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'IBS mapping continuity across session boundaries; scenario test records continuity; 6-year retention enforcement for FCA operational resilience records.',
            reference: 'FCA SYSC 9.1.1R -- 6-year retention; FCA PS21/3 -- continuity of mapping and impact tolerance records; PRA SS1/21 -- documentation retention',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Board attestation sign-off workflow; self-assessment human review gate; scenario test results approval before regulatory submission; CEO/Board escalation for impact tolerance breaches.',
            reference: 'FCA PS21/3 -- board attestation requirement; PRA SS1/21 -- board ownership of operational resilience; BoE SoP -- board responsibility',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'Protection of IBS mapping records, scenario test results, and operational resilience self-assessments containing commercially sensitive and personal data.',
            reference: 'UK GDPR Art. 32(1)(a) -- encryption; FCA SYSC 13 -- operational risk information security; FCA PS21/3 -- security of operational resilience data',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Classify important business service data, impact tolerance records, third-party dependency records, and lessons-learned records for appropriate handling and retention.',
            reference: 'FCA PS21/3 -- IBS data classification; UK GDPR Art. 4 -- personal data within IBS context; FCA SYSC 9 -- record classification',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Continuous operational resilience monitoring: detect degradation signals that could indicate an approaching IBS disruption before impact tolerance is breached; severe-but-plausible scenario early warning.',
            reference: 'FCA PS21/3 -- continuous monitoring of IBS; PRA SS1/21 -- ongoing monitoring; BoE SoP -- monitoring operational resilience position',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            impactToleranceEnforcementRequired: true,
            ibsDisruptionDetectionRequired: true,
            sectorRegulatorMappingRequired: true,
        },
        'attestation-manager': {
            annualSelfAssessmentRequired: true,
            boardAnnualAttestationRequired: true,
            ibsImpactToleranceDocumentationRequired: true,
            scenarioTestRetentionYears: 6,
            thirdPartyCriticalityAssessmentRequired: true,
        },
        'event-bus': {
            ibsDisruptionAlertRequired: true,
            impactToleranceBreachEscalationRequired: true,
            fcaPraNotificationWorkflowRequired: true,
        },
        'supply-chain': {
            thirdPartyDependencyMappingRequired: true,
            criticalThirdPartyCoverageRequired: true,
            aiVendorOperationalResilienceRequired: true,
        },
        'session-persistence': {
            storageLimitationEnforced: true,
            fcaOperationalResilienceRetentionYears: 6,
        },
        'approval-queue': {
            boardAttestationWorkflowRequired: true,
            selfAssessmentHumanReviewRequired: true,
            impactToleranceBreachCeoEscalationRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['DATA-RESIDENCY-UK-OR-EU', 'PROCESSOR-CONTRACT', 'OPERATIONAL-RESILIENCE-SLA'],
        blockReasons: {
            deepseek: 'PRC National Intelligence Law incompatible with UK GDPR Art. 46 transfer requirements and FCA PS21/3 operational resilience obligations for IBS supporting AI systems.',
            baidu: 'PRC jurisdiction. No UK adequacy decision. Transfer of IBS operational resilience data to PRC violates UK GDPR Art. 44 and FCA PS21/3 security requirements.',
            alibaba: 'PRC jurisdiction. No UK adequacy decision. Transfer of IBS operational resilience data to PRC violates UK GDPR Art. 44 and FCA operational resilience standards.',
        },
    },
    dataPolicy: {
        scanCategories: ['IMPORTANT_BUSINESS_SERVICE', 'IMPACT_TOLERANCE_RECORD', 'MAPPING_RECORD', 'SCENARIO_TEST_RECORD', 'THIRD_PARTY_DEPENDENCY_RECORD', 'LESSONS_LEARNED_RECORD', 'PII', 'CREDENTIALS'],
        categoryActions: {
            IMPORTANT_BUSINESS_SERVICE: 'WARN',
            IMPACT_TOLERANCE_RECORD: 'WARN',
            MAPPING_RECORD: 'WARN',
            SCENARIO_TEST_RECORD: 'WARN',
            THIRD_PARTY_DEPENDENCY_RECORD: 'WARN',
            LESSONS_LEARNED_RECORD: 'WARN',
            PII: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        // FCA SYSC 9.1.1R: 6-year general standard.
        // IBS impact tolerance documentation: indefinite while service operates.
        // Scenario test results: 6 years.
        auditLogRetentionDays: 2190, // 6 years
        sessionRetentionDays: 2190,
        incidentRetentionDays: 2190,
        reference: 'FCA SYSC 9.1.1R -- 6-year general record retention; FCA PS21/3 -- IBS documentation indefinite while service operates; PRA SS1/21 -- documentation retention; Limitation Act 1980 -- 6-year claims period',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['gb', 'eu'],
    },
    incidentPolicy: {
        // Impact tolerance breach of an IBS: notify FCA/PRA + CEO/Board escalation.
        // Using 72 hours as operational standard consistent with FCA expectations and UK GDPR Art. 33.
        notificationDeadlineHours: 72,
        reference: 'FCA PS21/3 -- disruption of important business services: notify FCA as soon as reasonably practicable; PRA SS1/21 -- regulator notification for IBS disruptions; UK GDPR Art. 33 -- parallel data breach 72-hour ICO notification',
        requiredRecipients: ['fca-supervisory-contact', 'pra-supervisory-contact', 'chief-executive-officer', 'board-chair', 'chief-risk-officer'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'fca-or-ibs-identification',
            description: 'Important business service (IBS) identification active: AI systems mapped to applicable IBS; governance-runtime enforces IBS scope classification before deployment',
            reference: 'FCA PS21/3 -- identifying important business services; PRA SS1/21 -- IBS identification requirements; BoE SoP -- scope of operational resilience',
            check: 'governance_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fca-or-impact-tolerance-attestation',
            description: 'Impact tolerance documentation active: maximum tolerable disruption set for each IBS; board attestation workflow configured; annual self-assessment cycle active',
            reference: 'FCA PS21/3 -- impact tolerances and self-assessment; PRA SS1/21 -- impact tolerance setting; BoE SoP -- annual board attestation requirement',
            check: 'attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fca-or-scenario-testing',
            description: 'Scenario testing program active: severe-but-plausible scenarios configured; test results retained for 6 years; lessons-learned cycle documented',
            reference: 'FCA PS21/3 -- scenario testing obligations (severe but plausible); PRA SS1/21 -- testing scenarios; transitional deadline 31 March 2025',
            check: 'audit_trail_exists',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fca-or-board-attestation',
            description: 'Annual board attestation workflow active: board confirms operational resilience self-assessment; board ownership of IBS impact tolerances evidenced',
            reference: 'FCA PS21/3 -- board attestation requirement; PRA SS1/21 -- senior management and board accountability; BoE SoP -- governance',
            check: 'approval_queue_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fca-or-third-party-assessment',
            description: 'Third-party criticality assessment active: critical third-party dependencies identified and mapped for each IBS; AI vendor operational resilience due diligence completed',
            reference: 'FCA PS21/3 -- third-party dependency mapping; PRA SS1/21 -- outsourcing dependencies; CTP designation framework; FCA SYSC 8 -- outsourcing requirements',
            check: 'subservice_registry_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fca-or-disruption-monitoring',
            description: 'Operational disruption monitoring active: IBS degradation detection; impact tolerance breach alerts; FCA/PRA notification event workflow configured',
            reference: 'FCA PS21/3 -- continuous monitoring and notification; PRA SS1/21 -- ongoing monitoring; BoE SoP -- monitoring requirements',
            check: 'monitoring_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fca-or-encryption',
            description: 'IBS mapping records, scenario test results, and self-assessments encrypted at rest and in transit; commercially sensitive operational resilience data protected',
            reference: 'UK GDPR Art. 32(1)(a) -- encryption; FCA SYSC 13 -- operational risk information security; FCA PS21/3 -- security of operational resilience infrastructure',
            check: 'encryption_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'fca-or-data-classifier',
            description: 'IBS operational resilience data classified appropriately; impact tolerance records and third-party dependency data handled with appropriate access controls',
            reference: 'FCA PS21/3 -- IBS data handling; UK GDPR Art. 4 -- personal data classification; FCA SYSC 9 -- record classification requirements',
            check: 'data_classifier_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'fca-or-anomaly-detection',
            description: 'Operational resilience anomaly detection active: early warning for approaching IBS disruption; severe-but-plausible scenario simulation monitoring',
            reference: 'FCA PS21/3 -- continuous monitoring; PRA SS1/21 -- proactive resilience management; BoE SoP -- monitoring operational resilience position',
            check: 'post_market_monitoring',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=fca-op-resilience.js.map