Event-Triggered Governance
Two Mandatory Event Triggers — FinCEN NPR
The FinCEN/OFAC NPR creates two specific mandatory triggers for operational risk assessment updates. These are not periodic review requirements — they are event-driven obligations that must fire automatically when the triggering condition occurs.
Trigger 1 — Mandatory · Smart Contract Change
Smart Contract Functionality Modified
Update risk assessment within 5 business days of change deployment
1
Trigger Detection Change management system records smart contract deployment event. Automated flag sent to compliance officer within 1 hour of deployment confirmation.
2
Scope Assessment Compliance officer reviews change. Does the modification affect: freeze/block logic, transfer restrictions, minting authorization, or sanctions screening integration? If yes → full Phase 7 ORA update required. If no → abbreviated impact assessment with documented rationale.
3
Risk Assessment Update Run applicable Phase 7 ORA scenario tests against updated contract. Update risk posture documentation. Note changes in operational posture vs. previous baseline.
4
Validation Phase 8 OCB Component 3 (Implementation Accuracy) test re-run for modified capability. Pass required before deployment proceeds to production for new chains. FinCEN NPR — Dynamic Risk Assessment Obligation
5
Documentation & Sign-Off Updated risk assessment signed by AML/CFT officer and retained for model life. Board notified if change materially affects block/freeze/reject capability. Audit trail updated.
Trigger 2 — Mandatory · New Blockchain Deployment
Stablecoin Deployed on New Blockchain
Risk assessment update must be completed BEFORE deployment goes live
1
Pre-Launch Gate Engineering team submits new blockchain deployment request. Compliance sign-off is a required gate in the deployment pipeline. No deployment proceeds without completed risk assessment update.
2
New Chain Risk Profile Assessment Document: native freeze/block capabilities of the new blockchain, CCTP or bridge infrastructure risk, on-chain monitoring coverage availability, OFAC screening applicability for the new chain.
3
Technical Capability Verification Confirm block/freeze/reject capability is operational on the new chain before deployment. Test Phase 7 ORA scenarios S1 and S2 (velocity exploit + OFAC match) on the new chain in a test environment.
4
Monitoring Coverage Confirmation Verify on-chain analytics platform covers the new blockchain. Confirm SIEM alert coverage extended to new chain events. If monitoring gap exists → deployment blocked until coverage confirmed. FinCEN NPR — New Blockchain Deployment Obligation
5
Governance Sign-Off AML/CFT officer signs updated risk assessment. Senior management notified. Record retained in model governance log. Phase 9 governance record updated with new blockchain entry.
Performance Metrics Dashboard
Operational Control Performance Tracking
These four metrics are the primary operational governance indicators. Track them at least quarterly. Trends in these metrics are the leading indicator of whether Phase 8 Component 4 (Outcomes Analysis) findings are improving — and whether the Phase 7 risk posture is moving toward Dynamic. Enter your current values to assess status.
Alert-to-Action Ratio
%
Target: > 70% of alerts actioned
Enter value
% of alerts that result in documented investigation, escalation, or control activation. Below 50% indicates false positive volume too high — threshold miscalibration.
Critical SLA Compliance
%
Target: > 99% within 5 min
Enter value
% of Critical-classified alerts (OFAC, exploit velocity) that generate system response within 5-minute SLA. Any breach below 95% is a Phase 8 Component 4 finding.
False Negative Rate
%
Target: 0% on known scenarios
Enter value
% of scenario tests (S1–S5 from Phase 7 ORA) that fail to generate an alert. Any false negative on a critical scenario (S1, S2) is a Critical Phase 8 finding requiring immediate recalibration.
Model Change Governance
%
Target: 100% documented
Enter value
% of model changes (threshold modifications, new rules, data feed changes) that were processed through formal change management with documented rationale and approval.
AML Model Tuning Cycle
Quarterly Calibration Governance
The AML model tuning cycle is the recurring governance process that maintains operational posture over time. A PPSI that passes Phase 8 today but has no tuning cycle will degrade over time as transaction patterns evolve. Phase 9 Operations Stream governs this cycle.
Quarterly AML Model Calibration Cycle
Driven by performance metrics · Produces updated Phase 7 operational risk posture · Evidence for Phase 10 integrated audit
Month 1
Performance Review
Pull 90-day metrics (alert-to-action, latency, false negatives). Identify threshold candidates for recalibration. Document current posture vs. last quarter. Present to compliance officer.
Monthly
Month 2
Threshold Analysis
Statistical analysis of alert population — above-the-line and below-the-line analysis. Propose threshold adjustments. Assess impact on false positive/negative rates. Document proposed changes with rationale.
Quarterly
Month 3 Week 1
Test & Validate
Run Phase 7 scenario tests (S1–S5) against proposed new thresholds in test environment. Confirm false negative rate stays at 0% for critical scenarios. Confirm false positive rate improves or stays flat.
Quarterly
Month 3 Week 2
Governance & Deploy
AML/CFT officer approves changes. Changes logged in model governance record. Deployed through formal change management. Phase 9 governance record updated. Board notified of material threshold changes.
Quarterly
Governance Checklist
Operational Control Governance Calendar
Governance activities organized by trigger type and frequency. Smart contract and blockchain deployment triggers are event-driven (no fixed schedule). All other activities are on a defined cycle. Mark each as Completed / Partial / Pending to track governance status.
Governance Activity Register
0 of 14 completed
| Governance Activity | Trigger / Frequency | What it Produces | FinCEN / NPR Basis | Status |
|---|
Routing to Phase 10
Operations Stream Convergence at Full Integrated Assurance
Phase 10 · Full Convergence
Full Integrated Assurance
Operations Stream component of Phase 10
Phase 9 Operations Stream governance records provide the Phase 10 integrated audit evidence for ongoing operational effectiveness — the dynamic counterpart to the SOC 2 Type II program stream evidence
Smart contract change log + associated risk assessment updates demonstrate the FinCEN NPR dynamic obligation is being met — a key Phase 10 integrated audit assertion
Quarterly tuning cycle records demonstrate that the risk engine is being maintained and improved — not left static after initial Phase 8 validation
New blockchain deployment governance records demonstrate pre-deployment compliance gates were enforced — directly addresses the secondary market scope expansion risk
Dynamic Posture Maintenance
Achieving & Sustaining Dynamic Posture
The highest operational maturity level
Dynamic posture (Phase 7 ORA level ↻) requires: automated trigger detection for smart contract changes AND new blockchain deployments, quarterly tuning cycle executed and documented, and FinCEN innovation mitigating factor demonstrated
PPSIs demonstrating Dynamic posture with Phase 9 governance records in place are positioned to receive favorable enforcement treatment per FinCEN NPR's innovation incentive framework
Dynamic posture is maintained through Phase 9, not achieved in a one-time assessment — the Operational Control Governance framework IS what makes posture Dynamic rather than Optimized
Phase 9 governance records feed back into Phase 7 ORA updates — creating the continuous loop that defines the Operations Stream's highest maturity level