Examination Framework
Five-Component AML Model Validation Framework
The Operational Control Behavior Assessment applies the five-component AML model validation framework established by OCC Bulletin 2011-12 and the ACAMS model risk management guidance — extended to the stablecoin operational context. Each component asks a distinct question about how the PPSI's operational control system actually works.
1
Conceptual Soundness
Is the risk engine's underlying logic correct? Do the classification rules accurately reflect the risk typologies the PPSI faces — exploit velocity, cross-chain movement, sanctions exposure?
OCC 2011-12 · ACAMS Model Risk Mgmt
2
Data Quality
Is the signal data feeding the risk engine complete, accurate, and timely? Does the monitoring platform cover both primary and secondary market activity as required by the FinCEN NPR?
FinCEN NPR § 3–5 · FFIEC BSA Manual
3
Implementation Accuracy
Does the implemented system match the designed model? Does the block/freeze/reject capability behave as documented in technical specifications and policies when tested under controlled conditions?
FinCEN NPR Technical Capabilities · GENIUS Act § 111
4
Outcomes Analysis
Are the outputs — alerts, restrictions, freezes — proportionate, accurate, and timely? What are the false positive and false negative rates? Are latency SLAs being met? What does the alert-to-action ratio show?
ACAMS Outcomes Analysis · FFIEC Independent Testing
5
Ongoing Governance
Is the operational control system governed and updated over time? Does smart contract change management trigger risk assessment updates? Is there an audit trail of model changes and recalibrations?
FinCEN NPR Dynamic Obligation · Phase 9 Ops Stream
Phase 8 DRIFT Analysis
DRIFT Signal-to-Action Trace — Phase 8 Perspective
Phase 7 identified that Circle's risk engine was in a Reactive posture. Phase 8 examines why — by tracing each signal event to the expected control action and measuring what actually happened. This is the signal-to-action trace that examines execution mechanics, not posture state.
DRIFT/Circle · Signal-to-Action Execution Trace · Phase 8 Analysis
Phase 8 Operations Stream Findings
T + 0 min
Signal: Exploit begins — rapid drain of $282M from Drift Protocol contracts. On-chain analytics platforms detect anomalous activity.
Expected: Classify as High/Critical → Initiate alert
⚠ Delayed
T + ~30 min
Signal: Attacker converts stolen assets to USDC. Circle's monitoring system receives signal. Classification outcome: "Suspicious — requires external validation."
Expected: Classify Critical → Trigger throttle
✗ Failed
T + 1–2 hrs
Signal: $100M+ USDC moving across 50+ wallet hops via CCTP cross-chain transfer. Velocity anomaly clearly detectable. No internal escalation trigger activated.
Expected: Restrict bridge access → Escalate to compliance officer
✗ Failed
T + 4–6 hrs
Signal: $230M+ USDC moved. Attacker begins converting USDC → ETH. Point of no return for asset recoverability. External blockchain analytics firms publicly flag addresses.
Expected: Freeze flagged wallets — both primary and secondary market
✗ Failed
T + 8+ hrs
Response: Circle ultimately froze some addresses after receiving external authorization (law enforcement coordination). Freeze capability confirmed functional. But assets had already been converted and dispersed.
Freeze capability: functional. Timing: too late.
✓ Capability OK
Phase 8 Finding — Implementation Accuracy Gap: The block/freeze/reject capability was technically implemented and eventually executed correctly. The failure was in the activation logic — the risk engine's conceptual soundness (Component 1) was miscalibrated: the "actionable containment" threshold was set too high, requiring external authorization rather than internal risk-based escalation. This is a Component 1 (Conceptual Soundness) + Component 3 (Implementation Accuracy) finding. The data quality (Component 2) was adequate — signals were present. The governance (Component 5) was inadequate — no internal escalation path existed without external trigger. Under the FinCEN NPR Apr 8 2026, a PPSI's technical capability must be able to respond to both lawful orders AND internal risk-based triggers without waiting for external authorization.
Latency Standards
Required Latency SLAs by Risk Level
Every Phase 8 examination item maps to a latency requirement. The FinCEN NPR does not define specific latency thresholds by number, but the regulatory expectation — derived from the "technical capabilities" mandate and the DRIFT case — implies the following operational standards. These thresholds are examined in Component 4 (Outcomes Analysis).
Risk Level · Critical
< 5 min
Detection to alert generation
OFAC sanctions match · Exploit velocity signal · Secondary market block execution · Lawful order compliance
Risk Level · High
< 1 hour
Alert to containment action
Bridge restriction for flagged wallets · Compliance officer notification · Throttle activation for velocity anomalies · Reserve ratio breach response
Risk Level · Medium
< 24 hours
Alert to investigation completion
SAR filing decision (primary market) · Smart contract change risk assessment trigger · DeFi concentration breach response · Peg monitoring circuit breaker review
Risk Level · Low / Governance
< 5 days
Governance action completion
Smart contract change risk assessment update · New blockchain deployment risk gate completion · AML model tuning recalibration · Board notification of significant events
Examination Items
Operational Control Behavior — Five-Component Examination
Forty-two examination items organized across the five AML model validation components. Each item specifies the test procedure and the specific FinCEN NPR or GENIUS Act provision being examined. Select Pass / Partial / Fail / N/A to track completion status for your PPSI.
Operations Stream Routing
From Behavior Assessment to Governance and Full Assurance
Phase 9 · Operations Stream
Operational Control Governance
AML model tuning · Change management · Ongoing calibration
Component 5 (Ongoing Governance) findings route directly to Phase 9 — the governance improvement workplan
Latency SLA failures (Component 4) become Phase 9 model tuning targets — threshold recalibration is an operational governance activity
Smart contract change management gaps feed Phase 9's governance framework design
New blockchain deployment gates must be in place before Phase 9 signs off on Dynamic posture
Phase 10 · Full Convergence
Full Integrated Assurance
SOC 2 Type II + Integrated Audit (both streams)
Phase 8 Operations Stream findings feed the Phase 10 integrated audit scope — specifically the execution effectiveness audit component that SOC 2 Type II alone does not cover
Component 3 (Implementation Accuracy) Pass items provide evidence that block/freeze/reject capabilities are functional — a core Phase 10 integrated audit assertion
Component 4 (Outcomes Analysis) data provides the operating effectiveness evidence for the Phase 10 SOC 2 Type II opinion period
All critical failures must be remediated before Phase 10 integrated audit can issue a clean opinion on operational execution