arckit-cli 6.1.1__py3-none-any.whl

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/uk-fs-safeguarding-template.md

@@ -0,0 +1,348 @@
+# UK EMI / PI Safeguarding Assessment
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:uk-fs-safeguarding`
+
+## Document Control
+
+<!-- Default: OFFICIAL. Upgrade to OFFICIAL-SENSITIVE if this document reveals the specific
+     safeguarding bank account numbers, policy reference numbers, or shortfall thresholds that
+     could be exploited if disclosed. Driven by user_config.default_classification. -->
+
+| Field | Value |
+|-------|-------|
+| **Document ID** | {{DOCUMENT_ID}} |
+| **Document Type** | UK EMI / PI Safeguarding Assessment |
+| **Project** | {{PROJECT_NAME}} |
+| **Classification** | {{CLASSIFICATION}} |
+| **Status** | DRAFT |
+| **Version** | 1.0 |
+| **Created Date** | {{CREATED_DATE}} |
+| **Last Modified** | {{LAST_MODIFIED}} |
+| **Review Cycle** | Annual (minimum); review immediately on change of safeguarding bank, insurer, or product scope |
+| **Next Review Date** | {{NEXT_REVIEW_DATE}} |
+| **Owner** | {{DOCUMENT_OWNER_ROLE}} — {{DOCUMENT_OWNER_NAME}} |
+| **Reviewed By** | PENDING |
+| **Approved By** | PENDING |
+| **Distribution** | {{DISTRIBUTION}} |
+| **Firm Authorisation / Registration Type** | {{FIRM_AUTHORISATION_TYPE}} (EMI — authorised / API — authorised / SPI — registered) |
+| **FCA Firm Reference Number** | {{FCA_FRN}} |
+| **SMF Holder (Safeguarding)** | {{SMF_HOLDER_NAME}} — {{SMF_HOLDER_FUNCTION}} |
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| 1.0 | {{CREATED_DATE}} | ArcKit AI | Initial creation from `/arckit:uk-fs-safeguarding` command | PENDING | PENDING |
+
+<!-- Add additional rows as needed -->
+
+---
+
+## Executive Summary
+
+{{EXECUTIVE_SUMMARY_PARAGRAPH_1}}
+
+{{EXECUTIVE_SUMMARY_PARAGRAPH_2}}
+
+{{EXECUTIVE_SUMMARY_PARAGRAPH_3}}
+
+> ⚠️ This document is a **working assessment** — not a regulatory submission. All safeguarding
+> arrangements must be reviewed and signed off by qualified UK FS regulatory counsel, the firm's
+> SMF holder for safeguarding (primary accountability — typically SMF1/SMF24 in larger firms), the
+> firm's MLRO (for AML-angle review of the client-money position, not primary safeguarding
+> accountability), and the firm's Compliance Officer before implementation. Regulatory citations
+> reflect the position as at the document creation date; verify against current FCA publications —
+> including the FCA Approach Document (May 2026 edition) and PS24/9 — before reliance.
+
+---
+
+## 1. Firm Authorisation / Registration Context
+
+### 1.1 Authorisation or Registration Details
+
+| Field | Value |
+|-------|-------|
+| **Legal entity name** | {{FIRM_NAME}} |
+| **FCA Firm Reference Number** | {{FCA_FRN}} |
+| **Authorisation / registration type** | {{FIRM_AUTHORISATION_TYPE}} (EMIs and APIs are *authorised*; SPIs are *registered*) |
+| **Authorisation / registration date** | {{AUTHORISATION_DATE}} |
+| **Applicable regulation** | {{APPLICABLE_REGULATION}} |
+| **Passporting arrangements** | {{PASSPORTING_ARRANGEMENTS}} |
+| **SMF holder(s) for safeguarding** | {{SMF_HOLDER_LIST}} |
+
+### 1.2 In-Scope Payment Services and E-Money Products
+
+{{IN_SCOPE_SERVICES_NARRATIVE}}
+
+| Service / Product | Regulatory category | Relevant funds arise? | Notes |
+|-------------------|---------------------|-----------------------|-------|
+| {{SERVICE_1_NAME}} | {{SERVICE_1_CATEGORY}} | {{SERVICE_1_RELEVANT_FUNDS}} | {{SERVICE_1_NOTES}} |
+| {{SERVICE_2_NAME}} | {{SERVICE_2_CATEGORY}} | {{SERVICE_2_RELEVANT_FUNDS}} | {{SERVICE_2_NOTES}} |
+| {{SERVICE_3_NAME}} | {{SERVICE_3_CATEGORY}} | {{SERVICE_3_RELEVANT_FUNDS}} | {{SERVICE_3_NOTES}} |
+
+<!-- Add additional rows as needed -->
+
+### 1.3 Out-of-Scope Services
+
+{{OUT_OF_SCOPE_SERVICES_NARRATIVE}}
+
+---
+
+## 2. Safeguarding Obligation Scope
+
+### 2.1 Definition of Relevant Funds
+
+"Relevant funds" for this firm are defined as: {{RELEVANT_FUNDS_DEFINITION}}
+
+The safeguarding obligation arises at the moment of receipt of funds, not at the point of payment
+initiation (EMR 2011 Reg 20; PSRs 2017 Reg 23).
+
+### 2.2 Client Populations in Scope
+
+| Client segment | Approximate funds volume (monthly) | Safeguarding obligation | Notes |
+|----------------|-------------------------------------|-------------------------|-------|
+| {{SEGMENT_1_NAME}} | {{SEGMENT_1_VOLUME}} | {{SEGMENT_1_OBLIGATION}} | {{SEGMENT_1_NOTES}} |
+| {{SEGMENT_2_NAME}} | {{SEGMENT_2_VOLUME}} | {{SEGMENT_2_OBLIGATION}} | {{SEGMENT_2_NOTES}} |
+| {{SEGMENT_3_NAME}} | {{SEGMENT_3_VOLUME}} | {{SEGMENT_3_OBLIGATION}} | {{SEGMENT_3_NOTES}} |
+
+<!-- Add additional rows as needed -->
+
+### 2.3 Exclusions
+
+The following funds are **not** relevant funds and are therefore excluded from safeguarding scope:
+
+{{EXCLUSIONS_NARRATIVE}}
+
+---
+
+## 3. Safeguarding Method Statement
+
+### 3.1 Selected Method
+
+**Safeguarding method**: {{SAFEGUARDING_METHOD}}
+
+| Method | Applicable to this firm? | Regulatory basis | Notes |
+|--------|--------------------------|------------------|-------|
+| Segregation in designated safeguarding account | {{SEGREGATION_APPLICABLE}} | EMR 2011 Reg 20, Reg 21; PSRs 2017 Reg 23(2)–(11) | Primary method |
+| Comparable guarantee | {{GUARANTEE_APPLICABLE}} | EMR 2011 Reg 22; PSRs 2017 Reg 23(12)–(13) | Alternative method |
+| Insurance policy | {{INSURANCE_APPLICABLE}} | EMR 2011 Reg 22; PSRs 2017 Reg 23(12)–(13) | Alternative method |
+
+### 3.2 Method Justification
+
+{{METHOD_JUSTIFICATION_NARRATIVE}}
+
+The firm has selected **{{SAFEGUARDING_METHOD}}** because: {{METHOD_SELECTION_RATIONALE}}
+
+### 3.3 Commingling Controls
+
+The following controls prevent commingling of relevant funds with the firm's own operational funds.
+The commingling prohibition is set out in **EMR 2011 Reg 21(3)(b)** (the designated account "must
+be used only for holding those funds or assets") and **PSRs 2017 Reg 23(6)**.
+
+1. {{COMMINGLING_CONTROL_1}}
+2. {{COMMINGLING_CONTROL_2}}
+3. {{COMMINGLING_CONTROL_3}}
+
+<!-- Add additional controls as needed -->
+
+### 3.4 Segregation Trigger and Timing
+
+| Event | Segregation deadline | Regulatory basis |
+|-------|----------------------|------------------|
+| Receipt of funds from customer (payment institution) | End of business day of receipt | PSRs 2017 Reg 23(2) |
+| Receipt of funds for e-money issuance (EMI) | "by the end of five business days after the date on which the electronic money has been issued" (verbatim) | EMR 2011 Reg 20(4) |
+| {{FIRM_SPECIFIC_TRIGGER}} | {{FIRM_SPECIFIC_DEADLINE}} | {{FIRM_SPECIFIC_BASIS}} |
+
+<!-- Add additional rows as needed -->
+
+> **FCA practice note**: The May 2026 Approach Document expects firms to minimise the float
+> period between receipt and segregation in practice, even where the statutory deadline allows
+> up to five business days. Firms should document the operational target alongside the statutory
+> deadline.
+
+---
+
+## 4. Designated Safeguarding Arrangements
+
+### 4.1 Designated Safeguarding Account(s)
+
+> ⚠️ **Classification note**: If this section is completed with live account details (sort code,
+> account number, IBAN), the document should be upgraded to OFFICIAL-SENSITIVE.
+
+| Field | Value |
+|-------|-------|
+| **Safeguarding bank name** | {{SAFEGUARDING_BANK_NAME}} |
+| **Safeguarding bank FCA FRN** | {{SAFEGUARDING_BANK_FRN}} |
+| **Safeguarding bank FRN verified date** | {{SAFEGUARDING_BANK_FRN_VERIFIED_DATE}} |
+| **Account type** | {{SAFEGUARDING_ACCOUNT_TYPE}} |
+| **Account designation** | {{SAFEGUARDING_ACCOUNT_DESIGNATION}} |
+| **Date designated** | {{SAFEGUARDING_ACCOUNT_DESIGNATION_DATE}} |
+| **Currency(ies)** | {{SAFEGUARDING_ACCOUNT_CURRENCIES}} |
+| **Backup safeguarding bank** | {{BACKUP_SAFEGUARDING_BANK_NAME}} |
+| **Backup bank FCA FRN** | {{BACKUP_SAFEGUARDING_BANK_FRN}} |
+
+> **CTP dependency note**: The safeguarding bank is a critical third-party dependency. It must be
+> assessed in the firm's CTP dependency register. Use `/arckit:uk-fs-ctp-dependency` to produce
+> that assessment.
+
+### 4.2 Insurance Policy or Guarantee Arrangements (if applicable)
+
+*Complete this section only if the firm uses the insurance or guarantee safeguarding method.
+Mark as N/A if segregation is the sole method.*
+
+| Field | Value |
+|-------|-------|
+| **Insurer / guarantor name** | {{INSURER_GUARANTOR_NAME}} |
+| **Insurer / guarantor FCA FRN** | {{INSURER_GUARANTOR_FRN}} |
+| **Policy / guarantee reference** | {{POLICY_GUARANTEE_REFERENCE}} |
+| **Coverage amount** | {{COVERAGE_AMOUNT}} |
+| **Policy / guarantee start date** | {{POLICY_START_DATE}} |
+| **Policy / guarantee expiry date** | {{POLICY_EXPIRY_DATE}} |
+| **Renewal review date** | {{POLICY_RENEWAL_REVIEW_DATE}} |
+| **Trigger for payout into designated account** | {{INSOLVENCY_TRIGGER}} |
+
+---
+
+## 5. End-to-End Client Funds Flow
+
+### 5.1 Funds Flow Diagram
+
+```text
+{{INSERT_FUNDS_FLOW_DIAGRAM_HERE}}
+```
+
+*Suggested Mermaid format:*
+
+```mermaid
+flowchart LR
+    A[Customer payment] --> B[Receipt into\noperational account]
+    B --> C{Segregation\ntrigger}
+    C -->|Same-day / EoB| D[Designated\nsafeguarding account]
+    D --> E[Daily\nreconciliation]
+    E -->|Match| F[Payout to payee]
+    E -->|Shortfall| G[Escalation +\nFCA notification]
+```
+
+### 5.2 Funds Flow Narrative
+
+| Stage | System / component | Data record created | Responsible team |
+|-------|--------------------|---------------------|------------------|
+| {{STAGE_1_NAME}} | {{STAGE_1_SYSTEM}} | {{STAGE_1_DATA_RECORD}} | {{STAGE_1_TEAM}} |
+| {{STAGE_2_NAME}} | {{STAGE_2_SYSTEM}} | {{STAGE_2_DATA_RECORD}} | {{STAGE_2_TEAM}} |
+| {{STAGE_3_NAME}} | {{STAGE_3_SYSTEM}} | {{STAGE_3_DATA_RECORD}} | {{STAGE_3_TEAM}} |
+| {{STAGE_4_NAME}} | {{STAGE_4_SYSTEM}} | {{STAGE_4_DATA_RECORD}} | {{STAGE_4_TEAM}} |
+| {{STAGE_5_NAME}} | {{STAGE_5_SYSTEM}} | {{STAGE_5_DATA_RECORD}} | {{STAGE_5_TEAM}} |
+
+<!-- Add additional rows as needed -->
+
+### 5.3 Intra-Day Float Management
+
+{{INTRADAY_FLOAT_NARRATIVE}}
+
+---
+
+## 6. Reconciliation Cadence and Sign-Off Chain
+
+{{INSERT_RECONCILIATION_BLOCK_HERE}}
+
+---
+
+## 7. Audit Plan
+
+### 7.1 Internal Audit
+
+| Audit element | Detail |
+|---------------|--------|
+| **Internal audit frequency** | {{INTERNAL_AUDIT_FREQUENCY}} |
+| **Audit scope** | {{INTERNAL_AUDIT_SCOPE}} |
+| **Lead auditor (internal)** | {{INTERNAL_AUDIT_LEAD}} |
+| **Audit report recipient** | {{INTERNAL_AUDIT_REPORT_RECIPIENT}} |
+| **Next scheduled audit date** | {{NEXT_INTERNAL_AUDIT_DATE}} |
+
+### 7.2 External Audit
+
+| Audit element | Detail |
+|---------------|--------|
+| **External auditor engaged?** | {{EXTERNAL_AUDITOR_ENGAGED}} |
+| **External auditor name** | {{EXTERNAL_AUDITOR_NAME}} |
+| **Engagement scope** | {{EXTERNAL_AUDIT_SCOPE}} |
+| **Last external audit date** | {{LAST_EXTERNAL_AUDIT_DATE}} |
+| **Next external audit date** | {{NEXT_EXTERNAL_AUDIT_DATE}} |
+
+### 7.3 Regulator-Readable Evidence Pack
+
+The following data and reports must be producible on FCA request, and are submitted via the monthly
+safeguarding return (SUP 16 Annex 34A for payment institutions; SUP 16 Annex 34B for EMIs):
+
+| Evidence item | Format | Retention period | Responsible system |
+|---------------|--------|------------------|--------------------|
+| Daily reconciliation records | {{RECON_FORMAT}} | 6 years (FCA SUP 16) | {{RECON_SYSTEM}} |
+| Designated account bank statements | {{STATEMENT_FORMAT}} | 6 years | {{STATEMENT_SYSTEM}} |
+| Shortfall notification log | {{SHORTFALL_LOG_FORMAT}} | 6 years | {{SHORTFALL_LOG_SYSTEM}} |
+| SMF sign-off register | {{SIGNOFF_FORMAT}} | 6 years | {{SIGNOFF_SYSTEM}} |
+| Insurance / guarantee policy documents | {{POLICY_DOC_FORMAT}} | 6 years | {{POLICY_DOC_SYSTEM}} |
+| Monthly safeguarding return (REP-CRIM) | SUP 16 Annex 34A/34B format | 6 years | {{MONTHLY_RETURN_SYSTEM}} |
+
+<!-- Add additional rows as needed -->
+
+---
+
+## 8. Failure Scenarios and Recovery
+
+### 8.1 Safeguarding Bank Failure
+
+| Element | Detail |
+|---------|--------|
+| **FSCS protection applicable?** | {{FSCS_APPLICABLE}} |
+| **FSCS coverage limit** | {{FSCS_COVERAGE}} |
+| **Second safeguarding bank available?** | {{SECOND_BANK_AVAILABLE}} |
+| **Fund portability procedure** | {{FUND_PORTABILITY_PROCEDURE}} |
+| **Insolvency priority claim basis** | PSRs 2017 Reg 23(5): payment service users' claims rank in priority to all other creditors |
+| **Recovery time objective (RTO)** | {{SAFEGUARDING_BANK_FAILURE_RTO}} |
+| **Recovery point objective (RPO)** | {{SAFEGUARDING_BANK_FAILURE_RPO}} |
+| **FCA notification required?** | Yes — notify FCA immediately if safeguarding bank fails or terminates the relationship |
+
+### 8.2 Reconciliation Shortfall
+
+| Element | Detail |
+|---------|--------|
+| **Shortfall detection mechanism** | {{SHORTFALL_DETECTION}} |
+| **Immediate containment action** | {{SHORTFALL_CONTAINMENT}} |
+| **SMF notification trigger** | {{SMF_NOTIFICATION_TRIGGER}} |
+| **FCA notification trigger** | {{FCA_NOTIFICATION_TRIGGER}} |
+| **Remediation timeline** | {{SHORTFALL_REMEDIATION_TIMELINE}} |
+| **Root cause analysis process** | {{RCA_PROCESS}} |
+
+### 8.3 Payout Blockage
+
+| Scenario | Cause | Response | Owner |
+|----------|-------|----------|-------|
+| Sanctions screening freeze | OFAC/OFSI match on safeguarding account | Escalate to MLRO; engage compliance counsel; notify FCA | MLRO |
+| Bank technical outage | Safeguarding bank system failure | Activate backup safeguarding bank; notify clients within {{CLIENT_NOTIFICATION_SLA}} | CFO / Treasurer |
+| Regulatory restriction order | FCA or court order restricting account | Engage legal counsel immediately; notify board | CEO / SMF holder |
+
+<!-- Add additional rows as needed -->
+
+---
+
+## 9. References
+
+| Reference | Citation | URL |
+|-----------|----------|-----|
+| EMR 2011 Reg 20 | Electronic Money Regulations 2011 — Regulation 20: Safeguarding | <https://www.legislation.gov.uk/uksi/2011/99/regulation/20> |
+| EMR 2011 | Electronic Money Regulations 2011 (SI 2011/99) — full instrument | <https://www.legislation.gov.uk/uksi/2011/99> |
+| PSRs 2017 Reg 23 | Payment Services Regulations 2017 — Regulation 23: Safeguarding | <https://www.legislation.gov.uk/uksi/2017/752/regulation/23> |
+| PSRs 2017 | Payment Services Regulations 2017 (SI 2017/752) — full instrument | <https://www.legislation.gov.uk/uksi/2017/752> |
+| FCA Approach Document | Payment Services and Electronic Money — Our Approach (FCA, May 2026) | <https://www.fca.org.uk/publication/finalised-guidance/payment-services-electronic-money-approach.pdf> |
+| FCA PS24/9 | PS24/9 — Safeguarding reforms for payment and e-money firms (2024) | <https://www.fca.org.uk/publication/policy/ps24-9.pdf> |
+| FCA CP22/25 | CP22/25 — Improving outcomes for consumers of payment and e-money firms | <https://www.fca.org.uk/publication/consultation/cp22-25.pdf> |
+| FCA SUP 16 | SUP 16 — Reporting requirements (entry point for Annex 34A/34B monthly safeguarding return) | <https://www.handbook.fca.org.uk/handbook/SUP/16/> |
+| FCA key publications | FCA EMI and Payment Institutions — key publications | <https://www.fca.org.uk/firms/emi-payment-institutions-key-publications> |
+
+---
+
+**Generated by**: ArcKit `/arckit:uk-fs-safeguarding` command
+**Generated on**: [DATE]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/uk-fs-sca-rts-exemption-matrix-template.md

@@ -0,0 +1,47 @@
+# SCA-RTS Per-Exemption Matrix Block
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION]
+> **Usage**: This template defines the shape of one per-exemption entry in §3 of the master
+> `uk-fs-sca-rts-template.md`. The `/arckit:uk-fs-sca-rts` command generates one block per
+> in-scope SCA-RTS Article (10, 10A, 11, 13, 14, 15, 16, 17, 18). Article 12 is excluded from
+> scope. Copy and fill this block for each exemption — do not include this header comment in the
+> generated artefact.
+
+---
+
+## Per-Exemption Block
+
+### Exemption: {{EXEMPTION_NAME}} (SCA-RTS Article {{ARTICLE_NUMBER}})
+
+**Reference**: [SCA-RTS Article {{ARTICLE_NUMBER}}]({{CITATION_URL}})
+(UK Technical Standards on SCA, FCA 2020/70 as amended — implemented under PSRs 2017 Reg 106A)
+
+**Decision**: {{APPLY | DO_NOT_APPLY | CONDITIONAL}}
+
+**Applicability rationale**:
+
+<!-- One to two paragraphs: why this exemption is or is not applied to this firm's payment flows -->
+{{APPLICABILITY_RATIONALE}}
+
+**Conditions / thresholds**:
+
+- {{CONDITION_1}}
+- {{CONDITION_2}}
+- {{CONDITION_3}}
+
+**Audit-trail fields logged**:
+
+- `exemption_code`: {{ARTICLE_CODE}} (e.g., `ART10`, `ART10A`, `ART11`, `ART13`, etc.)
+- {{FIELD_2}}
+- {{FIELD_3}}
+
+**Fraud rate target / band**: {{N_BPS_REFERENCE_FRAUD_RATE}}
+(Reference: UK SCA-RTS Article 18 table — applicable only where TRA is the basis for this exemption)
+
+**Owning team**: {{TEAM}}
+
+**Last review date**: {{LAST_REVIEW_DATE}}
+
+**Next review date**: {{NEXT_REVIEW_DATE}}
+
+---

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/uk-fs-sca-rts-template.md

@@ -0,0 +1,273 @@
+# UK PSD2 SCA-RTS Exemption Design
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:uk-fs-sca-rts`
+
+## Document Control
+
+<!-- Default: OFFICIAL. Use OFFICIAL-SENSITIVE if the document reveals proprietary fraud model parameters or detection thresholds. Driven by user_config.default_classification. -->
+
+| Field | Value |
+|-------|-------|
+| **Document ID** | {{DOCUMENT_ID}} |
+| **Document Type** | UK PSD2 SCA-RTS Exemption Design |
+| **Project** | {{PROJECT_NAME}} |
+| **Classification** | {{CLASSIFICATION}} |
+| **Status** | DRAFT |
+| **Version** | 1.0 |
+| **Created Date** | {{CREATED_DATE}} |
+| **Last Modified** | {{LAST_MODIFIED}} |
+| **Review Cycle** | Quarterly |
+| **Next Review Date** | {{NEXT_REVIEW_DATE}} |
+| **Owner** | {{OWNER_ROLE}} — {{OWNER_NAME}} |
+| **Reviewed By** | PENDING |
+| **Approved By** | PENDING |
+| **Distribution** | {{DISTRIBUTION}} |
+| **Firm Authorisation Type** | {{FIRM_AUTHORISATION_TYPE}} (PSP / EMI / PI / ASPSP / TPP) |
+| **FCA Firm Reference Number** | {{FCA_FRN}} |
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| 1.0 | {{CREATED_DATE}} | ArcKit AI | Initial creation from `/arckit:uk-fs-sca-rts` command | PENDING | PENDING |
+
+---
+
+## Executive Summary
+
+{{EXECUTIVE_SUMMARY_PARAGRAPH_1}}
+
+{{EXECUTIVE_SUMMARY_PARAGRAPH_2}}
+
+{{EXECUTIVE_SUMMARY_PARAGRAPH_3}}
+
+> ⚠️ This document is a **working design pack** — not a regulatory submission. All exemption decisions
+> must be reviewed and signed off by qualified UK FS regulatory counsel, the firm's MLRO, and the
+> firm's Compliance Officer before production implementation. Regulatory citations reflect the
+> position as at the document creation date; verify against current FCA publications before reliance.
+
+---
+
+## 1. Regulatory Context
+
+### 1.1 Applicable Framework
+
+Strong Customer Authentication (SCA) requirements for UK payment service providers derive from:
+
+- **Payment Services Regulations 2017 (SI 2017/752), Regulation 100** — the primary legal obligation
+  to apply SCA when a payer accesses a payment account online, initiates an electronic payment
+  transaction, or carries out any action through a remote channel that may imply a risk of payment
+  fraud or other abuses.
+- **PSRs 2017, Regulation 106A** — grants the FCA power to make technical standards specifying SCA
+  requirements, exemptions, and secure communication obligations.
+- **UK Technical Standards on Strong Customer Authentication and Common and Secure Methods of
+  Communication (FCA 2020/70, as amended by PS21/19)** — sets out the detailed exemption conditions
+  (Articles 10–18) and dynamic-linking requirements that apply in Great Britain post-EU-withdrawal.
+- **FCA Payment Services and Electronic Money — Our Approach Document (current edition)** — the
+  FCA's non-binding but authoritative interpretive guidance on how it applies the PSRs 2017.
+
+### 1.2 Regulatory Perimeter
+
+| Entity type | SCA obligation? | Notes |
+|-------------|-----------------|-------|
+| Authorised Payment Institution (PI) | Yes | Full PSRs 2017 scope |
+| E-Money Institution (EMI) | Yes | Via PSRs 2017 applied to e-money payment transactions |
+| Account Servicing PSP (ASPSP) | Yes | Must offer dedicated interface; Article 10A applies |
+| Third-Party Provider — PISP | Yes | Relies on ASPSP SCA; must not impede |
+| Third-Party Provider — AISP | Yes (Art 10A post-PS21/19) | 90-day re-consent; exemption available |
+| Small Payment Institution | Partial | Exempt from Reg 100 if below thresholds |
+
+**This firm's regulatory perimeter**: {{FIRM_AUTHORISATION_TYPE}} — {{REGULATORY_PERIMETER_NARRATIVE}}
+
+### 1.3 In-Scope Payment Channels
+
+{{IN_SCOPE_CHANNELS_LIST}}
+
+### 1.4 Out-of-Scope Channels
+
+{{OUT_OF_SCOPE_CHANNELS_LIST}}
+
+---
+
+## 2. Authentication Architecture
+
+### 2.1 SCA Factor Inventory
+
+SCA requires at least two independent elements from the following three categories (PSRs 2017
+Reg 100(2)). Dynamic linking (Reg 100(3)) must bind the authentication code to a specific amount
+and payee for remote payment transactions.
+
+| Factor category | Elements available | Dynamic linking capable? |
+|-----------------|--------------------|--------------------------|
+| **Knowledge** — something only the user knows | {{KNOWLEDGE_FACTORS}} | {{KNOWLEDGE_DL}} |
+| **Possession** — something only the user possesses | {{POSSESSION_FACTORS}} | {{POSSESSION_DL}} |
+| **Inherence** — something the user is | {{INHERENCE_FACTORS}} | {{INHERENCE_DL}} |
+
+### 2.2 Dynamic Linking Implementation
+
+For remote payment transactions, the authentication code must be:
+
+- Specific to the transaction amount and the payee at the time of authentication
+- Invalidated if either the amount or payee changes after authentication
+
+| Implementation element | Detail |
+|------------------------|--------|
+| **Transaction binding mechanism** | {{BINDING_MECHANISM}} |
+| **Authentication code lifetime** | {{CODE_LIFETIME}} |
+| **Fallback if amount/payee changes** | {{FALLBACK_MECHANISM}} |
+| **Linkage verified by** | {{LINKAGE_VERIFICATION}} |
+
+### 2.3 Exemption-Decision Engine Architecture
+
+The exemption-decision engine determines at transaction time whether a full SCA challenge is
+required or an exemption can be applied.
+
+| Component | Description |
+|-----------|-------------|
+| **Decision layer** | {{DECISION_LAYER}} (issuer / acquirer / PSP middleware) |
+| **Data inputs** | {{DECISION_INPUTS}} |
+| **Exemption precedence order** | {{EXEMPTION_PRECEDENCE}} |
+| **Fallback to full SCA** | {{FULL_SCA_FALLBACK}} |
+| **Soft-decline handling** | {{SOFT_DECLINE_HANDLING}} |
+
+---
+
+## 3. Exemption Applicability Matrix
+
+The sections below record the firm's design decision for each SCA-RTS exemption. Each entry uses
+the format defined in `uk-fs-sca-rts-exemption-matrix-template.md`.
+
+**Article 12 is explicitly excluded from scope** — it applies only to payment account access by
+Account Information Service Providers (AISPs) and has been superseded for AISP reauthentication
+by Article 10A (PS21/19, effective 26 March 2022).
+
+{{INSERT_EXEMPTION_MATRIX_ENTRIES_HERE}}
+
+---
+
+## 4. Transaction Risk Analysis (TRA) Thresholds
+
+This section applies only if the firm is applying the Article 18 (TRA) exemption. If Article 18
+is not applied (DO_NOT_APPLY decision in §3), mark this section N/A.
+
+### 4.1 Reference Fraud Rates (UK SCA-RTS Article 18)
+
+The following reference fraud rates must be continuously met for the TRA exemption to remain valid.
+Fraud rates are expressed as basis points (bps) of transaction value — i.e., fraud losses divided
+by total transaction value for the same transaction category and channel.
+
+| Transaction value band | Reference fraud rate (remote card transactions) | Reference fraud rate (credit transfers) |
+|------------------------|------------------------------------------------|----------------------------------------|
+| Up to £30 | 0.13% | 0.01% |
+| Up to £100 | 0.06% | 0.01% |
+| Up to £250 | 0.01% | 0.005% |
+
+Source: UK SCA-RTS (FCA 2020/70, amended per PS21/19), cross-referenced against FCA Approach
+Document §§ on TRA.
+
+### 4.2 Firm Fraud Rate Monitoring
+
+| Metric | Current value | Threshold | Status |
+|--------|--------------|-----------|--------|
+| Remote card transaction fraud rate (rolling 90 days) | {{CURRENT_CARD_FRAUD_RATE}} | {{TARGET_THRESHOLD}} | {{CARD_FRAUD_RATE_STATUS}} |
+| Credit transfer fraud rate (rolling 90 days) | {{CURRENT_CT_FRAUD_RATE}} | {{TARGET_CT_THRESHOLD}} | {{CT_FRAUD_RATE_STATUS}} |
+| **150% threshold trigger (mandatory SCA reintroduction)** | — | {{TRIGGER_THRESHOLD}} | {{TRIGGER_STATUS}} |
+
+### 4.3 FCA Reporting
+
+| Requirement | Detail |
+|-------------|--------|
+| Reporting frequency | {{REPORTING_FREQUENCY}} |
+| Report format | {{REPORT_FORMAT}} |
+| Submission route | {{SUBMISSION_ROUTE}} |
+| Escalation if threshold breached | {{ESCALATION_PATH}} |
+
+---
+
+## 5. Fraud Monitoring Framework
+
+### 5.1 Real-Time Monitoring Controls
+
+| Control | Description | Owner |
+|---------|-------------|-------|
+| {{CONTROL_1_NAME}} | {{CONTROL_1_DESCRIPTION}} | {{CONTROL_1_OWNER}} |
+| {{CONTROL_2_NAME}} | {{CONTROL_2_DESCRIPTION}} | {{CONTROL_2_OWNER}} |
+| {{CONTROL_3_NAME}} | {{CONTROL_3_DESCRIPTION}} | {{CONTROL_3_OWNER}} |
+
+<!-- Add additional control rows as needed -->
+
+### 5.2 Model Governance
+
+| Element | Detail |
+|---------|--------|
+| **Model type** | {{MODEL_TYPE}} |
+| **Training data cadence** | {{TRAINING_CADENCE}} |
+| **Retraining trigger** | {{RETRAINING_TRIGGER}} |
+| **Validation gate** | {{VALIDATION_GATE}} |
+| **Champion/challenger regime** | {{CHAMPION_CHALLENGER}} |
+
+### 5.3 Escalation Paths
+
+| Trigger | Escalation action | Owner | SLA |
+|---------|-------------------|-------|-----|
+| Fraud rate exceeds 100% of reference rate | Internal alert to Fraud Operations | {{INTERNAL_ALERT_OWNER}} | {{INTERNAL_ALERT_SLA}} |
+| Fraud rate exceeds 150% of reference rate | Mandatory SCA reintroduction; MLRO + Compliance notified | MLRO | {{SCA_REINTRODUCTION_SLA}} |
+| Regulatory request for data | Provide audit trail within {{REGULATOR_SLA}} | Compliance Officer | {{REGULATORY_REQUEST_SLA}} |
+
+---
+
+## 6. Audit Trail Requirements
+
+All exemption decisions must be logged to a tamper-evident audit trail. The trail must be available
+to the FCA on request (PSRs 2017 Reg 100 + FCA Handbook SYSC 9.1).
+
+### 6.1 Fields Logged Per Exemption Decision
+
+| Field | Description | Format |
+|-------|-------------|--------|
+| `exemption_code` | Article reference applied (e.g., `ART10`, `ART18`) | String |
+| `transaction_reference` | Unique transaction ID | UUID |
+| `transaction_amount` | Transaction value in minor currency units | Integer |
+| `currency` | ISO 4217 currency code | String (3) |
+| `payee_identifier` | Hashed payee account reference | SHA-256 hex |
+| `channel` | Payment channel (e.g., `CNP_WEB`, `CNP_APP`, `POS_CONTACTLESS`) | Enum |
+| `fraud_score` | Real-time fraud model score at decision time | Float 0.0–1.0 |
+| `device_fingerprint_hash` | SHA-256 of device fingerprint inputs | Hex |
+| `timestamp_utc` | Decision timestamp | ISO 8601 UTC |
+| `sca_applied` | Whether full SCA was applied (true/false) | Boolean |
+| `exemption_rationale` | Free-text reason if exemption overridden | String (256) |
+
+### 6.2 Retention and Access
+
+| Requirement | Detail |
+|-------------|--------|
+| **Retention period** | Minimum 5 years (PSRs 2017 Reg 100; FCA SYSC 9.1) |
+| **Storage location** | {{AUDIT_STORAGE_LOCATION}} |
+| **Access controls** | {{AUDIT_ACCESS_CONTROLS}} |
+| **Regulator-readable format** | Machine-readable (JSON / CSV export within 24 hours of request) |
+| **Integrity mechanism** | {{INTEGRITY_MECHANISM}} (e.g., WORM storage, cryptographic hash chain) |
+
+---
+
+## 7. References
+
+| Reference | Citation | URL |
+|-----------|----------|-----|
+| PSRs 2017 | Payment Services Regulations 2017 (SI 2017/752) | <https://www.legislation.gov.uk/uksi/2017/752> |
+| PSRs 2017 Reg 100 | Authentication requirements | <https://www.legislation.gov.uk/uksi/2017/752/regulation/100> |
+| PSRs 2017 Reg 106A | FCA power to make SCA technical standards | <https://www.legislation.gov.uk/uksi/2017/752/regulation/106A> |
+| FCA Approach Document | Payment Services and Electronic Money — Our Approach (current edition) | <https://www.fca.org.uk/publication/finalised-guidance/payment-services-electronic-money-approach.pdf> |
+| FCA Firms SCA Guidance | Strong Customer Authentication — FCA firms guidance page | <https://www.fca.org.uk/firms/strong-customer-authentication> |
+| FCA PS19/26 | Brexit — UK SCA-RTS (post-EU-withdrawal framework) | <https://www.fca.org.uk/publications/policy-statements/ps19-26-brexit-regulatory-technical-standards-strong-customer-authentication> |
+| FCA PS21/19 | Changes to SCA-RTS — Article 10A AISP exemption | <https://www.fca.org.uk/publications/policy-statements/ps21-19-changes-sca-rts-and-guidance-approach-document-and-perimeter-guidance-manual> |
+| FCA SCA coronavirus statement | FCA SCA extension — COVID-19 (30 April 2020) | <https://www.fca.org.uk/news/statements/strong-customer-authentication-and-coronavirus> |
+| UK Finance SCA Guidance | UK Finance Industry Guidance on Strong Customer Authentication (2025) | <https://www.ukfinance.org.uk/system/files/2025-07/UK-Finance-Industry-Guidance-Strong-Customer-Authentication.pdf> |
+| FCA key publications | FCA EMI and Payment Institutions — key publications | <https://www.fca.org.uk/firms/emi-payment-institutions-key-publications> |
+
+---
+
+**Generated by**: ArcKit `/arckit:uk-fs-sca-rts` command
+**Generated on**: [DATE]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]