Banking-era compliance
Re-walk every credit decision in front of an examiner.HMAC-signed per workspace. Tamper-evident audit PDFs. SOX §404 evidence rows already wired.
The examiner’s questions almost never match the dashboard your model-risk team built — so Plumbline writes every credit, MRM, and fair-lending decision the model rendered onto a SHA-256 chain that’s already the answer. Per-workspace HMAC signatures, retention windows agreed in week one, tombstoned proof of deletion, and a tamper-evident audit PDF the examiner can re-derive without a call back to engineering.
§01 · Examiner posture
What SR 26-2, ECOA, and SOX ask for — and where Plumbline lives in the answer.
The examiner’s questions are almost always the same. Every row below is a real banking/fintech regulator expectation and the Plumbline artifact the ledger already produces on the way through — no after-the-fact paste-up.
- SR 26-2 · Model Risk Management
Every model is subject to independent validation and ongoing monitoring, with the validation evidence on the same record the production traffic runs through.
Plumbline artifact · MRM · CARDEDPer-model signed card pinned to evaluation history. Independent validation set, ongoing monitoring, and the evaluator breakdown all run on the same row — auditor and MRM lead read the same bundle.
- ECOA / Reg B · fair lending
Each adverse-action notice cites the specific reason codes that drove the decision and the feature snapshot that produced them.
Plumbline artifact · EQUAL CREDIT · CO-LINKEDInput-feature snapshot + adverse-action reason codes captured at write time, on the same row as the credit decision. The notice and the model version travel together — no after-the-fact reconstruction.
- Fair Housing Act · HMDA
Protected-class disclosures are handled by scope, not by post-hoc filtering; sensitive fields never appear in cleartext audit logs.
Plumbline artifact · FAIR-LENDING · SCOPEDScope is set at write time. Sensitive-class fields are hashed; reason codes log the basis without exposing the input. The BAA boundary and the equal-credit scope are one query, not a delegation chart.
- CFPB UDAAP · Reg Z
Consumer-disclosure linkage: the rationale the model produced travels with the disclosure the customer received.
Plumbline artifact · DISCLOSURE · LINKEDRationale evaluator score rides on the same record chain as the disclosure, so the consumer-facing Reg Z text and the model version can’t drift apart after launch.
- SOX §404 · ITGC
Model change-management produces signed artifacts a SOX owner and a SOC 2 auditor both read — the same bundle, once.
Plumbline artifact · SOX · ITGCSigned model cards, change tickets, and audit-export PDFs are co-signed onto the same chain. SOX owner and SOC 2 auditor hand the same bundle to counsel without a separate reconciliation step.
- NAIC SR 02-23 · insurance UW
Insurance underwriting models respect the retention window agreed up front, with tombstoned proof that closed records are gone on purpose.
Plumbline artifact · UW · WINDOWEDRetention window agreed before the first record is written. Records past the window are tombstoned with a signed deletion record — the chain tells the regulator the record is gone on purpose.
- SR 12-9 · SR 22-8 (broker-dealer / crypto)
Technology governance posture is provable from public material — sub-processors, signature chain, and audit PDF re-derivable without a call back.
Plumbline artifact · TECH-GOV · RE-DERIVABLETamper-evident audit PDF is co-signed with the sub-processor matrix and re-derivable from /verify. Examiner or counsel pulls the bundle from a public link, with no side-channel request.
§02 · The examiner walk-back
A credit decision, opened two quarters later.What the record carries — and what the examiner walks back.
- 1.What decision did the model surface?The credit outcome (decline-with-offer) and the underlying reason-code bundle sit on the same row as the model version and the rationale evaluator's score.
- 2.Was the basis for the adverse-action on the notice? ECOA Reg B expects specific principal reason codes; the evaluator set logs them inline with the input-feature snapshot, on the same record chain as the disclosure.
- 3.Did the calibration drift before or after? Score distribution walks back through the same ledger 30, 60, or 90 days at a time — no separate monitoring lake to reconcile against the production record.
- 4.Did protected-class fields ever appear in cleartext? Scope is set at write time. Sensitive attributes are hashed; the audit-export PDF reads reason codes without exposing the input.
- 5.Has the record been edited since capture? The HMAC SHA-256 chain breaks visibly at the next record; tampering is detected at fetch, not at audit time.
- 6.What does the examiner hand back to the SOX owner? A tamper-evident audit PDF (model card + record hash + signature chain), re-derivable from the public /verify page — the SOX owner reads the same bundle, once.
§03 · Cross-links
Read next, by buyer intent.
Reserve a banking pilot, or send the procurement team our evidence packet.
Buying for a credit, MRM, or fair-lending program and want the walk-through? Drop your email and the scoping checklist lands in your inbox before any contract is drawn up. Buying at the enterprise level with a SOX packet already on the desk? Send the procurement team the intake form and we'll reply with the security packet and a short validation offer tailored to the SEC exam window.
We'll never share your email. No marketing blast — only the next-step note when a slot opens. If your examiner window is already on the calendar, mention the date on the call.
§06 · Pricing
Ready to see this on your models?
Start with the $1,000 Evidence Pilot: one workflow, one model, and 30 days ending in a replayable evidence package. Plumbline captures forward from the moment you connect, and the full pilot fee is credited toward Regulated Team.