/**
 * Regulation E / Electronic Fund Transfer Act Compliance Pack
 *
 * Regulation: Electronic Fund Transfer Act (EFTA), 15 U.S.C. §1693 et seq.,
 *             implemented by Regulation E, 12 C.F.R. Part 1005.
 *
 * Regulator: Consumer Financial Protection Bureau (CFPB) -- primary since
 *            Dodd-Frank (2011). Prior authority vested in the Federal Reserve
 *            Board. Examination and enforcement shared with prudential
 *            regulators (OCC, FDIC, NCUA) for their supervised institutions.
 *
 * Scope:
 *   - Electronic fund transfers (EFTs) initiated through electronic terminals,
 *     telephone, computer, or magnetic tape for consumer accounts.
 *   - Prepaid account rules (Subpart E, effective April 1, 2019): prepaid
 *     cards, payroll cards, mobile wallets, peer-to-peer payment products.
 *   - Gift card / gift certificate rules (12 C.F.R. §1005.20): dormancy
 *     fees, expiration dates, disclosure requirements.
 *   - Remittance transfer rules (Subpart B, 12 C.F.R. §§1005.30-1005.36):
 *     international remittances sent by consumers.
 *
 * Companion regulation:
 *   Regulation Z (12 C.F.R. Part 1026 / TILA) covers credit-related
 *   disclosures. Reg E and Reg Z are companion consumer financial
 *   regulations: Reg E covers debit/EFT, Reg Z covers credit. This pack
 *   covers Reg E only. See us-tila.ts for Reg Z.
 *
 * Pack alias note:
 *   FS-05 on site/packs.html is NOT assigned to this pack. FS-05 is currently
 *   attached to us-tila.ts (Reg Z). Reg E is a separate pack without a current
 *   FS-0x alias; one should be assigned when the HTML surface is next updated.
 *
 * Key obligations for AI systems:
 *   - Error resolution: 10 business days to investigate, extendable to 45
 *     business days if provisional credit is given. Consumer has 60 days from
 *     statement to report unauthorized transfer.
 *   - Change-in-terms notice: 21 days before effective date.
 *   - Periodic statement: required for accounts; prepaid account rules vary.
 *   - Prepaid account disclosures: short-form + long-form disclosure before
 *     account acquisition (§1005.18(b)).
 *
 * Retention: Most records -- 2 years per 12 C.F.R. §1005.13.
 *
 * @connexum/ai-governance
 */
import { sharedPiiClassifier } from './_base-classifiers.js';
/**
 * Regulation E category classifiers.
 */
export const REG_E_CATEGORY_CLASSIFIERS = {
    ELECTRONIC_FUND_TRANSFER: {
        references: ['12 C.F.R. §1005.3 -- coverage; EFTA §903 -- electronic fund transfer definition'],
        classifier: (input) => {
            if (/\b(?:electronic\s+fund\s+transfer|EFT|ACH\s+transfer|direct\s+debit|wire\s+transfer|debit\s+card\s+transaction)\b/i.test(input))
                return true;
            if (/\b(?:ATM\s+(?:withdrawal|transaction)|point.of.sale|POS\s+transaction|online\s+banking\s+transfer)\b/i.test(input))
                return true;
            if (/\b(?:preauthorized\s+(?:transfer|payment)|recurring\s+debit|scheduled\s+transfer)\b/i.test(input))
                return true;
            return false;
        },
    },
    PREPAID_ACCOUNT_DATA: {
        references: ['12 C.F.R. §1005.2(b)(3) -- prepaid account definition; Subpart E -- Prepaid Accounts'],
        classifier: (input) => {
            if (/\b(?:prepaid\s+(?:card|account|debit|product)|payroll\s+card|general.purpose\s+reloadable|GPR\s+card)\b/i.test(input))
                return true;
            if (/\b(?:mobile\s+wallet|peer.to.peer\s+payment|P2P\s+payment|digital\s+wallet)\b/i.test(input))
                return true;
            if (/\b(?:prepaid\s+disclosure|short.form\s+disclosure|long.form\s+disclosure)\b/i.test(input))
                return true;
            return false;
        },
    },
    GIFT_CARD_RECORD: {
        references: ['12 C.F.R. §1005.20 -- requirements for gift cards and gift certificates'],
        classifier: (input) => {
            if (/\b(?:gift\s+card|gift\s+certificate|store\s+credit|merchant\s+gift)\b/i.test(input))
                return true;
            if (/\b(?:dormancy\s+fee|inactivity\s+fee|expiration\s+date\s+disclosure)\b/i.test(input))
                return true;
            return false;
        },
    },
    ERROR_RESOLUTION_RECORD: {
        references: ['12 C.F.R. §1005.11 -- procedures for resolving errors'],
        classifier: (input) => {
            if (/\b(?:error\s+resolution|unauthorized\s+transfer|disputed\s+transaction|EFT\s+dispute|Reg\s+E\s+claim)\b/i.test(input))
                return true;
            if (/\b(?:provisional\s+credit|10\s+business\s+days|45\s+business\s+days|60.day\s+reporting)\b/i.test(input))
                return true;
            if (/\b(?:error\s+notice|written\s+complaint\s+EFT|investigation\s+letter)\b/i.test(input))
                return true;
            return false;
        },
    },
    UNAUTHORIZED_TRANSFER_RECORD: {
        references: ['12 C.F.R. §1005.6 -- liability of consumer for unauthorized transfers'],
        classifier: (input) => {
            if (/\b(?:unauthorized\s+(?:EFT|transfer|access|use)|lost\s+(?:card|PIN|access\s+device)|stolen\s+(?:card|PIN))\b/i.test(input))
                return true;
            if (/\b(?:consumer\s+liability|zero\s+liability|liability\s+limit|timely\s+notice)\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['12 C.F.R. §1005.4 -- initial disclosures; §1005.18 -- prepaid account disclosures'],
        classifier: (input) => {
            if (sharedPiiClassifier(input))
                return true;
            // Bank account / routing numbers (Reg E specific)
            if (/\b(?:account\s*(?:number|#|no\.?))[:\s]*\d{4,17}\b/i.test(input))
                return true;
            if (/\b(?:routing\s*(?:number|#|no\.?))[:\s]*\d{9}\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['12 C.F.R. §1005.18(b)(2)(ix) -- prepaid account access credentials'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const REG_E_PACK = {
    categoryClassifiers: REG_E_CATEGORY_CLASSIFIERS,
    id: 'reg-e',
    name: 'Regulation E / Electronic Fund Transfer Act (EFTA)',
    version: '1.0.0',
    contentHash: '0c91fda4dcfe7d84a8175a818c18ffbfd9117aaa87d8d8d462d17898ee498be2',
    description: 'Regulation E (12 C.F.R. Part 1005) and the Electronic Fund Transfer Act (15 U.S.C. §1693 et seq.) compliance for AI systems involved in consumer EFT workflows. Covers EFT disclosures, error resolution procedures (10- and 45-business-day investigation clocks), unauthorized transfer investigations, prepaid account disclosures (Subpart E), gift card rules (§1005.20), change-in-terms notices, and periodic statement generation. Regulated by the CFPB. Companion to Regulation Z (us-tila.ts): Reg E covers debit/EFT, Reg Z covers credit. 2-year record retention per 12 C.F.R. §1005.13.',
    authority: 'CFPB (Consumer Financial Protection Bureau) -- primary; prior Federal Reserve authority under EFTA',
    industries: ['banking', 'fintech', 'payments', 'prepaid-cards', 'consumer-financial-services', 'credit-unions', 'remittance'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'EFT disclosure enforcement; change-in-terms notice workflow (21-day pre-effective notice); periodic statement generation trigger',
            reference: 'EFTA §905 -- content of disclosures; 12 C.F.R. §1005.4 -- initial disclosures; §1005.8 -- change-in-terms notice (21 days); §1005.9 -- receipts and periodic statements',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident records of EFT authorisations, error resolution actions, and investigation outcomes; 2-year record retention per §1005.13',
            reference: '12 C.F.R. §1005.13 -- recordkeeping requirements (2 years from disclosure or action date); §1005.11 -- error resolution documentation',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Classify EFT transactions, error resolution records, prepaid account data, gift card records, and unauthorized transfer reports for appropriate handling',
            reference: '12 C.F.R. §1005.11 -- error resolution; §1005.6 -- consumer liability; §1005.18 -- prepaid account disclosures; §1005.20 -- gift card rules',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Human-in-the-loop gate for error resolution decisions; provisional credit approval workflow; unauthorized transfer investigation escalation',
            reference: '12 C.F.R. §1005.11(c) -- time limits for investigation (10 business days, extendable to 45); §1005.11(c)(2) -- provisional credit requirement',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Error notification clock management (60-day consumer reporting window, 10-business-day investigation, 45-business-day with provisional credit); change-in-terms 21-day notice trigger',
            reference: '12 C.F.R. §1005.11(b)(1)(i) -- consumer 60-day notice window; §1005.11(c) -- institution investigation deadlines; §1005.8 -- 21-day change-in-terms notice',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Third-party processor oversight for EFT networks; prepaid program manager and card network contractual controls; sub-processor liability management',
            reference: '12 C.F.R. §1005.14 -- electronic fund transfer services provided by financial institutions not holding the consumer account; CFPB supervision of service providers',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: '2-year records retention per §1005.13; error resolution case continuity across sessions; prepaid account disclosure tracking',
            reference: '12 C.F.R. §1005.13 -- recordkeeping: 2 years from date of occurrence; §1005.11 -- investigation state continuity',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Prepaid disclosure documentation (short-form + long-form per §1005.18(b)); periodic statement records; change-in-terms notice attestation',
            reference: '12 C.F.R. §1005.18(b) -- prepaid account disclosure requirements; §1005.9 -- periodic statement; §1005.8 -- change in terms notice',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Access control for consumer financial records; unique agent identity for audit trail; no unauthorised access to EFT account data',
            reference: '12 C.F.R. §1005.13 -- recordkeeping; GLBA Safeguards Rule access controls applicable to EFT records',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'EFT initial disclosures; prepaid account short-form disclosures at point of sale; error resolution rights notice; periodic statement transparency',
            reference: '12 C.F.R. §1005.4 -- initial disclosure; §1005.18(b) -- prepaid short/long-form disclosure; §1005.11(b) -- error notice to consumer',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            eftDisclosureEnforced: true,
            changeInTerms21DayNoticeRequired: true,
            periodicStatementGenerationRequired: true,
            prepaidDisclosureRequired: true,
        },
        'audit-integrity': {
            twoYearRetentionRequired: true,
            errorResolutionDocumentationRequired: true,
        },
        'data-classifier': {
            enabledCategories: ['ELECTRONIC_FUND_TRANSFER', 'PREPAID_ACCOUNT_DATA', 'GIFT_CARD_RECORD', 'ERROR_RESOLUTION_RECORD', 'UNAUTHORIZED_TRANSFER_RECORD', 'PII', 'CREDENTIALS'],
            defaultAction: 'WARN',
            credentialsAction: 'BLOCK',
            piiAction: 'WARN',
        },
        'approval-queue': {
            errorResolutionApprovalRequired: true,
            provisionalCreditAuthorizationRequired: true,
            unauthorizedTransferEscalationRequired: true,
        },
        'event-bus': {
            consumer60DayReportingWindowTracked: true,
            investigation10BusinessDayClockActive: true,
            investigation45BusinessDayExtensionActive: true,
            changeInTerms21DayNoticeClockActive: true,
        },
        'session-persistence': {
            recordRetentionDays: 730, // 2 years per §1005.13
        },
        'attestation-manager': {
            prepaidShortFormDisclosureRequired: true,
            prepaidLongFormDisclosureRequired: true,
            periodicStatementRecordRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['DATA-RESIDENCY-US', 'AUDIT-TRAIL', 'CONSUMER-FINANCIAL-DATA-HANDLING'],
        blockReasons: {
            deepseek: 'PRC National Intelligence Law creates consumer financial data custody risk incompatible with EFTA §1005.13 US-jurisdiction recordkeeping and CFPB examination requirements.',
            baidu: 'PRC jurisdiction incompatible with CFPB supervisory expectations for consumer EFT records and GLBA Safeguards Rule data residency.',
            alibaba: 'PRC jurisdiction incompatible with CFPB supervisory expectations for consumer EFT records and GLBA Safeguards Rule data residency.',
        },
    },
    dataPolicy: {
        scanCategories: ['ELECTRONIC_FUND_TRANSFER', 'PREPAID_ACCOUNT_DATA', 'GIFT_CARD_RECORD', 'ERROR_RESOLUTION_RECORD', 'UNAUTHORIZED_TRANSFER_RECORD', 'PII', 'CREDENTIALS'],
        categoryActions: {
            ELECTRONIC_FUND_TRANSFER: 'WARN',
            PREPAID_ACCOUNT_DATA: 'WARN',
            GIFT_CARD_RECORD: 'WARN',
            ERROR_RESOLUTION_RECORD: 'WARN',
            UNAUTHORIZED_TRANSFER_RECORD: 'WARN',
            PII: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        // 12 C.F.R. §1005.13: 2 years from date of disclosure or action
        auditLogRetentionDays: 730, // 2 years
        sessionRetentionDays: 730,
        incidentRetentionDays: 730,
        reference: '12 C.F.R. §1005.13 -- recordkeeping requirements: 2 years from date of disclosure, notice, or occurrence of action; EFTA §918 -- recordkeeping authority',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['us'],
    },
    incidentPolicy: {
        // Error resolution: consumer has 60 days from statement to report.
        // Institution has 10 business days to investigate (extendable to 45 with provisional credit).
        // Regulatory notification to CFPB follows CFPB supervisory exam timeline, not a fixed breach deadline.
        // Using 240 hours (10 business days) as the primary investigation deadline clock.
        notificationDeadlineHours: 240, // 10 business days for error investigation (§1005.11(c))
        reference: '12 C.F.R. §1005.11(b)(1)(i) -- consumer 60-day reporting window from statement; §1005.11(c) -- institution 10 business days to investigate (45 days with provisional credit per §1005.11(c)(2)); CFPB supervisory notification per exam procedures',
        requiredRecipients: ['chief-compliance-officer', 'consumer-reporting-unit', 'cfpb-regulatory-affairs'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'reg-e-eft-disclosure',
            description: 'Initial EFT disclosures delivered to consumer before first EFT per §1005.4; change-in-terms 21-day notice wired',
            reference: '12 C.F.R. §1005.4 -- initial disclosures; §1005.8 -- change in terms notice (21 days before effective date)',
            check: 'transparency_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'reg-e-error-resolution-clock',
            description: 'Error resolution investigation clock active: 10 business days standard, 45 business days with provisional credit; consumer 60-day reporting window tracked',
            reference: '12 C.F.R. §1005.11(b)(1)(i) -- 60-day consumer window; §1005.11(c) -- 10/45 business day investigation clocks',
            check: 'event_clock_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'reg-e-unauthorized-transfer-investigation',
            description: 'Unauthorized transfer investigation procedure wired; consumer liability limits applied per §1005.6',
            reference: '12 C.F.R. §1005.6 -- consumer liability limits; §1005.11 -- error resolution; §1005.6(b) -- tiered liability based on reporting timeliness',
            check: 'approval_queue_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'reg-e-record-retention-2yr',
            description: '2-year record retention enforced per §1005.13 for all EFT disclosures and error resolution records',
            reference: '12 C.F.R. §1005.13 -- recordkeeping: 2 years from date of occurrence; EFTA §918',
            check: 'audit_trail_exists',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'reg-e-prepaid-disclosure',
            description: 'Prepaid account short-form + long-form disclosures generated per §1005.18(b) before or at account acquisition',
            reference: '12 C.F.R. §1005.18(b) -- prepaid account disclosure requirements; Subpart E effective April 2019',
            check: 'reg_e_prepaid_disclosure_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'reg-e-data-classifier',
            description: 'EFT transaction data, error resolution records, prepaid account data, and gift card records classified and handled appropriately',
            reference: '12 C.F.R. §1005.11 -- error resolution records; §1005.18 -- prepaid; §1005.20 -- gift cards',
            check: 'data_classifier_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'reg-e-periodic-statement',
            description: 'Periodic statement generation active; statement includes required EFT transaction disclosures',
            reference: '12 C.F.R. §1005.9 -- receipts and periodic statements; §1005.18(c) -- prepaid account periodic statement alternatives',
            check: 'governance_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'reg-e-provisional-credit',
            description: 'Provisional credit workflow available when investigation extends beyond 10 business days; credit applied within timeline',
            reference: '12 C.F.R. §1005.11(c)(2) -- provisional credit allows investigation extension to 45 business days',
            check: 'reg_e_provisional_credit_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'reg-e-access-control',
            description: 'Consumer EFT and prepaid account data access limited to authorised personnel; audit trail maintained',
            reference: '12 C.F.R. §1005.13 -- recordkeeping; GLBA Safeguards Rule -- access controls for consumer financial data',
            check: 'rbac_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'reg-e-third-party-processor',
            description: 'Third-party EFT processor and prepaid program manager oversight; contractual controls for service providers',
            reference: '12 C.F.R. §1005.14 -- EFT services by non-holding institutions; CFPB guidance on service provider supervision',
            check: 'subservice_registry_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=reg-e.js.map