The Recognized Key Mandates, Frameworks & Standards

The Recognized Key Mandates, Frameworks & Standards

Six dedicated industry platforms. Catalogs never mix.

Consisting of Six (6) dedicated industry platforms: Financial, Healthcare, On-chain, Energy, Transport, and Telecom.

Each platform has been designed to cite and challenge an organization, their Risk Posture, and control effectiveness against recognized Regulatory Mandates, Frameworks, and Industry Standards that bind that pack. Catalogs never mix across industry planes.

Financial

OCC, FDIC, Federal Reserve, NCUA, SEC, FINRA, CFTC/NFA, FinCEN, OFAC, CFPB, NYDFS, BSA/AML. HIPAA, HITRUST, and FDA stay off this pack.

Healthcare

OCR, FDA, CMS, DEA, HIPAA / HITECH, 42 CFR Part 2. HITRUST is wizard-elected and does not replace HIPAA. GENIUS, BitLicense, and Wyoming SPDI stay off this examiner roster.

On-chain

SEC, CFTC, and FinCEN digital-asset overlay, Travel Rule, NYDFS virtual-currency oversight, MiCA, Wyoming SPDI, and GENIUS/CLARITY-class Watch instruments. Watch never handshake-passes.

Energy

NERC, FERC, TSA, PHMSA, EPA, and NRC. BES cyber systems, reliability registration, pipeline integrity, air/water permits, and occupied versus colo estate.

Transport

FMCSA, PHMSA, TSA, CBP, FMC, FRA, FAA, Coast Guard, and IATA. Pipelines stay on Energy.

Telecom

FCC, CISA, Ofcom, CRTC, and NIS2. NERC CIP stays on Energy.

Industry standards and frameworks

BSA/AML, NIST CSF 2.0, NIST SP 800-53, NIST AI RMF 1.0, HITRUST, ISO 27001, ISO 22301, CISA, FCPA, GDPR, CCPA/CPRA, PCI DSS, CIS Controls, and FTC map on the pack that binds them. They do not mix examiner catalogs.

International mandates

Scope includes G7 countries, the EU, the United Kingdom, Canada, Sweden, Switzerland, Denmark, Germany, Austria, France, Belgium, Spain, Portugal, Japan, China, Hong Kong, and South Africa, where organizations providing a service under that oversight are challenged.

Key Regulatory Mandates cited across multiple jurisdictions. Control ID remains the only enforcement identifier. Watch never handshake-passes.

SR 26-2 / SR 11-7 | Effective Challenge as Architecture

Supervisory governance, model risk, data integrity, third-party oversight, and capital adequacy: SR 26-2; SR 11-7; OCC Bulletin 2013-29; Basel III/IV; BCBS 239; FCA SYSC.

Independent challenges are embedded in the decision path. No material decision reaches production without validation, escalation, and evidence preservation.

BCBS 239 | Risk Data Traceability

Material risk determinations remain reconstructable through decision lineage, evidence provenance, and audit traceability.

DORA | Operational Resilience

Business continuity, operational survivability, systemic disruption, and third-party resilience: DORA; APRA CPS 230; MAS TRM; HKMA OREO; OCC third-party guidance.

The platform evaluates whether the institution can maintain safe operation through disruption, including critical-service and third-party degradation.

FATF / FinCEN / Global FIUs | Patterns, Not Attestations

AML, sanctions, suspicious-activity monitoring, fraud, and misconduct detection: FATF Recommendations; FinCEN; OFAC/SDN; SEC; CFTC; G7 FIUs; New Jersey Bureau of Securities.

Illicit finance is evaluated through continuous behavioral, counterparty, transaction, concentration, movement, and escalation signals.

SEC / CFTC | Market Integrity

Continuous surveillance evaluates manipulation indicators, conduct anomalies, and emerging market-abuse signals.

Anti-Corruption

EU Anti-Corruption Directive (proposed COM(2023) 234) · US Foreign Corrupt Practices Act (FCPA) · UK Bribery Act 2010.

OFAC / Sanctions | Pre-Execution Challenge

High-risk or prohibited activity is challenged before execution rather than identified only after settlement.

GENIUS Act | Stablecoin and Digital Asset Custody

Custody, reserve integrity, stablecoins, market surveillance, and blockchain governance: GENIUS Act; MiCA; NYDFS virtual-currency oversight; FCA and MAS Travel Rule; Wyoming SPDI; LlamaRisk ARFC.

Governance extends to reserve integrity, custody controls, operational controls, and transaction authorization pathways. GENIUS and CLARITY stay Watch. Watch never handshake-passes.

MiCA | Digital Asset Governance

Control effectiveness and governance evidence support ongoing supervisory review in European digital-asset markets.

Travel Rule: FATF / FCA / MAS | Cross-Border Transparency

Originator, beneficiary, and movement transparency are evaluated across transaction chains and jurisdictions.

Beyond LlamaRisk and ARFC, protocol-parameter tightening or freezing is not equivalent to a wallet, RWA, or cross-border transaction halt.

eyes-on-glass incorporates assessment inputs from the LlamaRisk ARFC, the LlamaRisk V3 methodology, protocol governance disclosures, on-chain activity, counterparty intelligence, and platform-generated evidence artifacts.

eyes-on-glass extends beyond protocol-centric assessment evidence through U.S. federal, state, and international regulatory frameworks, together with preemptive quarantine controls designed to stop a non-approved transaction from leaving an institutional or retail wallet.

NIST AI RMF / EU AI Act / ISO/IEC 42001 | Autonomous Decision Governance

Autonomous-system oversight, accountability, explainability, validation, and human challenge: NIST AI RMF; EU AI Act; ISO/IEC 42001; FSB AI Principles; SR 26-2.

The decision process itself is governed through accountability, validation, human oversight, explainability, and evidence.

Regulatory Intelligence and Supervisory Change Monitoring

The Regulatory Intelligence capability monitors emerging regulatory mandates, supervisory letters, enforcement actions, laws, standards, and industry guidance across U.S. federal, state, and international jurisdictions.

The institutional outcome is earlier visibility into developments before they become examination findings, audit observations, remediation plans, or enforcement events.

Each industry platform scans only the agencies, mandates, rules, frameworks, and standards that bind that pack. Watch never handshake-passes. The Canonical Control Map is not silently rewritten.

Scenario Simulation and Contagion Analysis

A dedicated Sandbox mirrors production governance dashboards while remaining isolated from the live Φ/Ω state of the operational 12-pillar ecosystem.

Institutions can modify assumptions, manipulate risk inputs, execute contagion simulations, run cascade-failure scenarios, stress-test governance controls, and evaluate recovery pathways.

Control ID Loss & Fine Calculator

Estimates financial loss exposure, regulatory-fine exposure, remediation costs, and residual-risk impact when an IT&O or business control fails to operate as intended.

Saved/prevented exposure is recorded as BIA Financial (F). Agency civil-penalty dollars are not invented.

Operational Downtime Modeling

Estimates crisis full-stop duration, recovery intervals, process interruption, and functional outage effects by Control ID, risk domain, and organizational function.

Institutional Testing Engine

The central repository for the seven categories of testing for which an institution is accountable or responsible: Systems & Technical Tests; Security & Cyber Stress Tests; Financial & Capital Stress Tests; Process & Operational Tests; Legal, Regulatory & Compliance Tests; Privacy & Data Protection Tests; and Administrative & Governance Tests.

Testing may be performed through internal resources, internal systems, independent validators, external managed-service providers, external assessors, or regulatory examiners.

The capability organizes and preserves evidence across Administrative, Operational, and Technical control environments and supports examination readiness against safety-and-soundness expectations.

Control ID remains the only enforcement identifier.

Detect. Predict. Prove.

Know what is changing. Understand the impact. Prove effectiveness. Reduce exposure.

• Anticipate Regulatory Change — Identify evolving obligations before they become findings, remediation plans, or enforcement events.
• Quantify Business Impact — Evaluate how control failures and disruptions propagate through financial, regulatory, operational, and organizational dependencies.
• Strengthen Examination Readiness — Maintain accessible evidence of testing, governance outcomes, and control effectiveness for regulators, auditors, and boards.
• Improve Decision Confidence — Provide executive, risk, compliance, legal, and audit functions with transparent, defensible, supervisory-aligned evidence.
• Reduce Regulatory Exposure — Identify weaknesses earlier, prioritize remediation, and reduce loss, penalty, and reputational exposure.
• Demonstrate Continuous Oversight — Move from point-in-time reviews toward ongoing monitoring, testing, validation, challenge, and evidence preservation.

Maintaining Sound Control

Continuous Regulatory Intelligence: Detect regulatory change. Predict institutional impact. Prove control effectiveness.

eyes-on-glass continuously monitors regulatory change, models the consequences of control failure, and preserves evidence of operational effectiveness. Together, these capabilities help institutions stay ahead of evolving supervisory expectations while maintaining continuous self-awareness across all risk domains.

Regulatory Intelligence

Detect emerging obligations. Know what regulators are changing.

Continuously tracks emerging laws, supervisory guidance, enforcement actions, and evolving regulatory expectations before they become findings, remediation plans, or enforcement events.

Scenario & Contagion Testing

Understand what happens when controls fail.

Stress-test controls, model contagion scenarios, estimate losses and fines, and evaluate operational disruption inside a dedicated Sandbox without affecting the live Φ/Ω state of the active 12-pillar ring.

The Control ID Loss & Fine Calculator estimates financial losses and regulatory fines when a control fails to operate as intended. Operational Downtime modeling estimates crisis full-stop minutes by Control ID, risk domain, and organizational function.

Saved/prevented exposure is recorded as BIA Financial (F). Agency civil-penalty dollars are not invented.

Institutional Testing Engine

Prove controls operate as intended. The seven categories of institutional testing and the resulting evidence are centralized across Administrative, Operational, and Technical control environments.

Testing may be conducted by internal resources, internal systems, external managed-service providers, independent assessors, or regulatory examiners evaluating safety-and-soundness expectations.

Preserve evidence before examination.

Most platforms track regulations. eyes-on-glass operationalizes them. By combining continuous regulatory intelligence, scenario and contagion testing, and institutional testing evidence, the platform helps institutions understand what regulators require, what happens when controls fail, how risk propagates, and whether governance mechanisms can withstand audit, board, and supervisory scrutiny.

Each pack names the asset class. Handshake, quarantine, Standing Gate, and Dual Vault halt execute on parent SOaaS. A successful halt is cyan — HTTP 423 is friction, not a Red loss. Watch instruments never handshake-pass.