# Vertical Governance Policy: Financial Services — SOX / Dodd-Frank / SR 11-7 # Doctrine v6 | R3 Adversarial Receipts # Last revised: 2025-07 schema_version: "1.0.0" vertical: financial regime: SOX/Dodd-Frank/SR11-7 effective_date: "2025-07-01" jurisdiction: US-Federal meta: title: "Financial AI Governance Policy — SOX/Dodd-Frank/SR 11-7 Alignment" description: > Maps Sarbanes-Oxley Act, Dodd-Frank Wall Street Reform, and Federal Reserve SR 11-7 Model Risk Management guidance to Doctrine v6 Λ-axes for AI systems used in credit, trading, fraud detection, and financial reporting. authority: "Pub. L. 107-204 (SOX); Pub. L. 111-203 (Dodd-Frank); SR 11-7 (Fed, OCC, FDIC)" receipt_chain_required: true merkle_root_algorithm: SHA3-256 regulatory_clauses: - clause_id: SOX-302 title: "Corporate Responsibility for Financial Reports" citation: "Pub. L. 107-204 § 302; 17 CFR § 240.13a-15" full_ref: "SOX § 302 — CEO/CFO certification of financial statements; 17 C.F.R. § 240.13a-15 controls and procedures" lambda_axes: - axis: Λ2 label: Accountability weight: 1.0 enforcement: mandatory rationale: > AI systems generating financial figures or reports must produce signed receipts traceable to named human principals (CEO/CFO accountability chain). - axis: Λ7 label: Auditability weight: 0.95 enforcement: mandatory - clause_id: SOX-404 title: "Management Assessment of Internal Controls" citation: "Pub. L. 107-204 § 404; 17 CFR § 240.13a-15(f)" full_ref: "SOX § 404 — Annual assessment of internal controls over financial reporting (ICFR)" lambda_axes: - axis: Λ7 label: Auditability weight: 1.0 enforcement: mandatory rationale: > AI model controls must be documented in ICFR scope; Merkle DAG receipts serve as tamper-evident control evidence. - axis: Λ1 label: Transparency weight: 0.88 enforcement: mandatory - clause_id: SR11-7-MRM title: "Model Risk Management — Validation" citation: "Federal Reserve SR 11-7 (Apr 2011); OCC 2011-12" full_ref: "SR 11-7 Guidance on Model Risk Management §§ III.C (Validation), III.D (Ongoing Monitoring)" lambda_axes: - axis: Λ8 label: Robustness weight: 0.95 enforcement: mandatory rationale: > Independent model validation must test adversarial robustness; receipt chain must capture validation epoch, validator ID, and test-set hash. - axis: Λ9 label: Explainability weight: 0.90 enforcement: mandatory rationale: > Model outputs affecting credit decisions require explanations satisfying adverse action notice requirements (ECOA/FCRA). - clause_id: DODD-FRANK-1033 title: "Consumer Financial Data Rights" citation: "Pub. L. 111-203 § 1033; 12 CFR § 1033.201" full_ref: "Dodd-Frank § 1033 / CFPB Rule 1033 — Consumer right to access covered data" lambda_axes: - axis: Λ3 label: Privacy weight: 0.90 enforcement: mandatory - axis: Λ10 label: Sovereignty weight: 0.85 enforcement: mandatory rationale: > AI systems must honour data portability requests; receipt chain logs each export event with consumer-authorised scope token. - clause_id: DODD-FRANK-619 title: "Volcker Rule — Proprietary Trading Prohibition" citation: "Pub. L. 111-203 § 619; 12 CFR § 44 (OCC), § 248 (Fed)" full_ref: "Volcker Rule 12 C.F.R. § 248.3 — Prohibition on proprietary trading" lambda_axes: - axis: Λ4 label: Fairness weight: 0.75 enforcement: mandatory rationale: > AI trading algorithms must be receipt-tagged to distinguish permitted market-making from prohibited proprietary positions. - axis: Λ2 label: Accountability weight: 0.88 enforcement: mandatory - clause_id: FINRA-4370 title: "Business Continuity Plans and Emergency Contact Information" citation: "FINRA Rule 4370; SEC Rule 17a-4" full_ref: "FINRA Rule 4370 — Business Continuity and Contingency Plans; 17 C.F.R. § 240.17a-4 record retention" lambda_axes: - axis: Λ5 label: Safety weight: 0.85 enforcement: mandatory - axis: Λ6 label: Security weight: 0.80 enforcement: mandatory rationale: > AI trading and reporting systems must have verified fallback nodes; receipt chain must survive primary node failure with quorum 2-of-3. - clause_id: ECOA-FCRA-ADVERSE title: "Adverse Action Notices — Credit Decisions" citation: "15 USC § 1681m; 12 CFR § 202.9 (Reg B)" full_ref: "ECOA 15 U.S.C. § 1681m(a) — Adverse action notice requirements; Reg B 12 C.F.R. § 202.9" lambda_axes: - axis: Λ9 label: Explainability weight: 1.0 enforcement: mandatory rationale: > AI credit models must produce machine-readable reason codes per CFPB guidance; explanation receipt must accompany each denial. - axis: Λ4 label: Fairness weight: 0.92 enforcement: mandatory - clause_id: SOX-802 title: "Criminal Penalties for Altering Documents" citation: "Pub. L. 107-204 § 802; 18 USC § 1519" full_ref: "SOX § 802 — 18 U.S.C. § 1519 destruction/alteration of records; 20-year imprisonment" lambda_axes: - axis: Λ7 label: Auditability weight: 1.0 enforcement: mandatory rationale: > Receipt chain immutability is a legal requirement; SHA3-256 Merkle DAG nodes must be append-only with cryptographic proof of non-alteration. - axis: Λ6 label: Security weight: 0.95 enforcement: mandatory compliance_thresholds: minimum_lambda_coverage: 7 mandatory_axes: [Λ2, Λ7, Λ9] receipt_retention_days: 2555 # 7 years SOX record retention max_decision_latency_ms: 500 model_validation_cycle_days: 365 receipt_chain: algorithm: SHA3-256 chaining: merkle_dag quorum: 2-of-3 nodes: [primary, secondary, regulatory-archive]