Governance

Operational actions that touch funds, limits, or account status require a maker to propose the change and a separate checker to approve it before it takes effect. No single operator can unilaterally execute a sensitive change.

Every approval, configuration change, and administrative action is recorded with actor, timestamp, and before/after state, giving a complete internal record for review and reconciliation.

• Recovery point objective: minimal transactional data loss window on failover.
• Recovery time objective: defined internal target for restoring core services after disruption.
• Independent rollback protection for the frozen banking core baseline.

Core account, payment, and settlement services are held to internal availability and latency targets, monitored continuously with alerting routed to on-call operations.

Identity verification, transaction monitoring, and sanctions screening are embedded in onboarding and transaction flows, with escalation paths for review by the compliance function.

1. Proposed

   A change is drafted with scope and rollback plan.

2. Reviewed

   A second approver evaluates risk and readiness.

3. Scheduled

   Change window is agreed and stakeholders notified.

4. Released

   Change ships with monitoring and rollback on standby.