/**
 * CFPB Circular 2023-03 Compliance Pack
 *
 * CFPB Circular 2023-03 (19 Sept 2023) on adverse action notification
 * requirements when creditors use AI or complex algorithms. Interprets
 * ECOA §701 (15 USC §1691) + Regulation B (12 CFR Part 1002).
 * Supplemented by CFPB 2024 Advisory Opinion on automated credit
 * decisions.
 *
 * Key points:
 *   - Specific principal reasons are required; generic rationale
 *     ("algorithm decided") is non-compliant.
 *   - Creditors are responsible for the reasoning regardless of
 *     vendor-supplied scoring.
 *   - 30-day adverse action notification deadline.
 *   - Record retention: 25 months (consumer credit) / 12 months
 *     (business credit) per 12 CFR 1002.12.
 *
 * @connexum/ai-governance
 */
/**
 * CFPB Circular 2023-03 (Adverse Action Reason Codes) category classifiers.
 * Covers AI/ML adverse action under Regulation B (ECOA) -- credit decisions
 * must provide specific principal-factor reasons, not generic rationale.
 */
export const CFPB_2023_03_CATEGORY_CLASSIFIERS = {
    CREDIT_DECISION: {
        references: ['CFPB Circular 2023-03 -- adverse action notice; Reg B 12 CFR §1002.9'],
        classifier: (input) => {
            if (/\b(?:adverse\s+action|credit\s+(?:denial|approval|decision)|loan\s+(?:denied|approved|declined))\b/i.test(input))
                return true;
            if (/\b(?:credit\s+score|FICO|creditworthiness|underwriting\s+decision)\b/i.test(input))
                return true;
            return false;
        },
    },
    APPLICANT_PII: {
        references: ['Reg B 12 CFR §1002.12 -- record retention; applicant PII in credit records'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            if (/\b(?:applicant\s+name|applicant\s+(?:address|ID|date\s+of\s+birth))\b/i.test(input))
                return true;
            return false;
        },
    },
    MODEL_FEATURE: {
        references: ['CFPB Circular 2023-03 -- key factors from AI/ML model must be explainable'],
        classifier: (input) => {
            if (/\b(?:model\s+feature|SHAP\s+value|feature\s+importance|key\s+factor|principal\s+factor)\b/i.test(input))
                return true;
            return false;
        },
    },
    REASON_CODE: {
        references: ['CFPB Circular 2023-03 -- reason codes must be specific; generic codes blocked'],
        classifier: (input) => {
            if (/\b(?:reason\s+code|adverse\s+action\s+reason|denial\s+reason)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['CFPB -- information security for credit decision systems'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const CFPB_2023_03_PACK = {
    categoryClassifiers: CFPB_2023_03_CATEGORY_CLASSIFIERS,
    id: 'cfpb-2023-03',
    name: 'CFPB Circular 2023-03',
    version: '1.0.0',
    contentHash: '1973ad19646308d9e32af583941ee1035fff7b74ff2a903878f0212efb0cba73',
    description: 'CFPB Circular 2023-03 adverse action notification requirements for AI / complex algorithms in credit decisions. Interprets ECOA §701 and Regulation B; supplemented by CFPB 2024 Advisory Opinion.',
    authority: 'Consumer Financial Protection Bureau (CFPB)',
    industries: ['bank', 'credit-union', 'mortgage-lender', 'auto-finance', 'credit-card', 'bnpl', 'fintech-lender'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Credit-decision gate; reason-code validation before notice issuance',
            reference: 'ECOA §701; Circular 2023-03',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident record of adverse-action decisions and reason derivation',
            reference: '12 CFR 1002.12 (record retention)',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Detect CREDIT_DECISION, APPLICANT_PII, MODEL_FEATURE, REASON_CODE',
            reference: 'Circular 2023-03',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: '30-day adverse action clock survives restarts; per-application state',
            reference: 'ECOA §701; 12 CFR 1002.9',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Vendor-scoring attestation: creditor documents principal-factor methodology',
            reference: 'CFPB 2024 Advisory Opinion',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Block adverse action notice with generic rationale; route to human for specific reason mapping',
            reference: 'Circular 2023-03',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Reason-derivation methodology documentation per model; renewed on material change',
            reference: 'CFPB 2024 Advisory Opinion',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Detect conflicting reason codes for similar applicant profiles',
            reference: 'Circular 2023-03',
        },
        {
            name: 'bias-monitor',
            required: true,
            reason: 'ECOA anti-discrimination disparate impact monitoring',
            reference: 'ECOA §701',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Adverse action notification clock events; reason-code validation events',
            reference: '12 CFR 1002.9',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            adverseActionDeadlineDays: 30,
            principalFactorReasonRequired: true,
            genericRationaleBlocked: true,
        },
        'approval-queue': {
            genericReasonBlocked: true,
            vendorScoringCreditorDocumentationRequired: true,
            sampleFormCodeValidation: true,
        },
        'attestation-manager': {
            reasonDerivationMethodologyRequired: true,
            reasonDerivationMethodologyRenewalOnMaterialChange: true,
        },
        'anomaly-detector': {
            conflictingReasonCodeDetectionActive: true,
        },
        'bias-monitor': {
            ecoaDisparateImpactMonitoringRequired: true,
        },
        'data-classifier': {
            enabledCategories: ['CREDIT_DECISION', 'APPLICANT_PII', 'MODEL_FEATURE', 'REASON_CODE', 'CREDENTIALS'],
            reasonCodeRequiredOnAdverseAction: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: ['CREDIT-DECISION-EXPLAINABILITY'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: ['CREDIT_DECISION', 'APPLICANT_PII', 'MODEL_FEATURE', 'REASON_CODE', 'CREDENTIALS'],
        categoryActions: {
            CREDIT_DECISION: 'LOG',
            APPLICANT_PII: 'WARN',
            REASON_CODE: 'BLOCK',
            MODEL_FEATURE: 'LOG',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        sovereignty: ['US'],
        // 36 months default; Reg B minimum 25 months for consumer credit
        auditLogRetentionDays: 1095,
        sessionRetentionDays: 365,
        incidentRetentionDays: 1095,
        reference: '12 CFR 1002.12 -- consumer credit records retained 25 months. Pax1 default 36 months.',
    },
    incidentPolicy: {
        // Statutory 30-day adverse action notice (720 hours)
        notificationDeadlineHours: 720,
        reference: 'ECOA §701; 12 CFR 1002.9(a) -- adverse action notice within 30 days.',
        requiredRecipients: ['applicant', 'creditor-compliance-officer', 'cfpb-if-requested'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'cfpb-2023-03-deadline',
            description: '30-day adverse action notification clock tracked per application',
            reference: 'ECOA §701; 12 CFR 1002.9(a)',
            check: 'cfpb_adverse_deadline_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'cfpb-2023-03-principal-factor',
            description: 'Specific principal-factor reason required on every adverse action notice',
            reference: 'Circular 2023-03',
            check: 'cfpb_principal_factor_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'cfpb-2023-03-generic-blocked',
            description: 'Generic rationale ("algorithm decided") blocked',
            reference: 'Circular 2023-03',
            check: 'cfpb_generic_blocked_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'cfpb-2023-03-vendor-doc',
            description: 'Creditor-level documentation on vendor scoring methodology',
            reference: 'CFPB 2024 Advisory Opinion',
            check: 'cfpb_vendor_doc_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'cfpb-2023-03-sample-form',
            description: 'Regulation B sample-form codes validated against actual decision path',
            reference: '12 CFR 1002 App. C',
            check: 'cfpb_sample_form_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'cfpb-2023-03-methodology',
            description: 'Reason-derivation methodology documented per model',
            reference: 'CFPB 2024 Advisory Opinion',
            check: 'cfpb_methodology_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'cfpb-2023-03-bias',
            description: 'ECOA anti-discrimination disparate impact monitoring',
            reference: 'ECOA §701',
            check: 'cfpb_ecoa_bias_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'cfpb-2023-03-conflict',
            description: 'Conflicting reason codes for similar applicants flagged',
            reference: 'Circular 2023-03',
            check: 'cfpb_conflict_detection_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'cfpb-2023-03-retention',
            description: 'Records retained at least 25 months (consumer credit)',
            reference: '12 CFR 1002.12',
            check: 'cfpb_retention_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'cfpb-2023-03-audit-trail',
            description: 'Tamper-evident audit trail of adverse action decisions',
            reference: '12 CFR 1002.12',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=cfpb-2023-03.js.map