# ADR 0011: Compliance and Data Governance Controls

- Status: Accepted
- Date: 2026-03-11
- Owners: Compliance Team, Security Team, Architecture Group
- Related:
  - `docs/adr/0006-security-and-key-management-baseline.md`
  - `docs/adr/0007-observability-and-audit-traceability-standard.md`
  - `docs/adr/0009-data-partitioning-and-retention-policy.md`
  - `docs/non-functional-slo.md`
  - `docs/phase-tracker.md`

## Context
The wallet platform must operate in regulated financial environments with auditable controls for identity verification, anti-money-laundering workflows, privacy obligations, and data access governance.

Without a formal compliance and governance baseline, controls can become inconsistent across domain apps and difficult to prove during audits.

## Decision
Adopt a control-driven compliance model with explicit ownership, evidence generation, and policy enforcement across all relevant OTP apps.

Core decisions:
1. Compliance controls are implemented as testable, auditable workflows.
2. Governance policies are mapped to technical controls and evidence artifacts.
3. Sensitive data access uses least privilege and approval workflows.
4. Compliance state transitions are explicit and traceable.
5. Control failures must trigger alerts and remediation workflows.

## Compliance Control Domains
1. Identity and onboarding controls:
- KYC/KYB document verification workflow.
- Risk-tiered onboarding decisions.
- Reverification triggers for stale/high-risk profiles.

2. AML and transaction monitoring controls:
- Rule-based monitoring for suspicious patterns.
- Case creation and review workflow.
- SAR workflow scaffolding and evidence capture.

3. Access and entitlement governance:
- RBAC with role lifecycle controls.
- Privileged access approval and review cycles.
- Segregation of duties for high-risk actions.

4. Data governance and privacy controls:
- Data classification and minimization enforcement.
- Retention and anonymization policy execution.
- Data subject request workflow where legally applicable.

## Policy-to-Control Mapping
Required artifacts:
- Control ID catalog with owner and implementation reference.
- Mapping table: policy requirement -> technical control -> evidence source.
- Review cadence and control effectiveness criteria.

Examples:
- `CTRL-KYC-001`: KYC decision event must include reviewer/system source and timestamp.
- `CTRL-AML-002`: Suspicious transfer score above threshold must create review case.
- `CTRL-AUD-003`: Privileged action requires immutable audit event.

## Evidence and Auditability Requirements
- Every control must produce machine-verifiable evidence.
- Evidence must be immutable or tamper-evident where required.
- Evidence queries must include period, actor, action, outcome, and control ID.
- Periodic evidence snapshots should be exportable for audits.

## Access Governance Baseline
- Least privilege by default for data and control actions.
- Time-bound elevated access with explicit reason and approval trail.
- Quarterly entitlement review for privileged roles.
- Break-glass access logged, reviewed, and time-limited.

## Exception and Waiver Management
- Policy exceptions require:
  - documented business rationale
  - expiry date
  - compensating controls
  - approval by control owner
- Exception lifecycle is auditable and periodically reviewed.

## Control Monitoring and Alerting
Mandatory monitoring:
- control execution success/failure rates
- overdue compliance case counts
- stale unresolved high-risk alerts
- missing evidence event counts

Alerting:
- Critical control failure -> immediate incident workflow.
- Repeated control degradation -> compliance review gate.

## Reporting and Review Cadence
- Weekly operational compliance health review.
- Monthly control effectiveness review.
- Quarterly governance and entitlement review.
- Pre-release compliance check for regulated-impacting changes.

## Test and Verification Requirements
1. Automated tests for core compliance workflows (KYC/KYB/AML case transitions).
2. Policy mapping validation tests (control IDs present and traceable).
3. Evidence integrity checks and export validation tests.
4. Access governance tests (role enforcement, break-glass logging).
5. Audit dry-run simulation with evidence retrieval walkthrough.

## Consequences
Positive:
- Improved readiness for internal/external audits.
- Better consistency of compliance control enforcement.
- Clear ownership and remediation pathways for control failures.

Trade-offs:
- Increased governance and reporting overhead.
- Additional coordination between engineering, security, and compliance.

## Acceptance Criteria
1. Control catalog and policy mapping approved.
2. Core compliance workflows emit required evidence artifacts.
3. Access governance controls are enforced and reviewable.
4. Compliance monitoring and alerting are active with runbooks.
5. Phase 7 gate includes control-evidence sign-off.