Skip to content

Risk and compliance operations

Module id: risk

Records of scoring, provisioning, and reporting. The decision policy stays with the institution.

Bureau systems connect through adapters. This module stores the case, not the provider toolkit.

Risk, read top to bottom: no separate channel, then scoring and bureau access, then scoring, provisioning, and reporting records
Read top to bottom. There is no risk channel. Lending and onboarding call in. The domain handles scoring requests and bureau access. The core stores the records.

There is no exp-risk repository. domain-data-credit-bureaus is on disk and has no published OpenAPI.

Where AI participates in a scoring journey, it decides within approved limits, explained, recorded, and open to human review. Decisions with significant effects on people, or beyond delegated limits, go to people with delegated authority.

What it owns

  • Scoring cases, models, requests, and results
  • Records that a bureau was called, without embedding the provider toolkit
  • Provisioning cases, stage history, calculations, and journals
  • Reporting runs, submissions, and case records for reporting

What it does not own

  • The loan application. That is lending.
  • KYC and KYB evidence. That is onboarding.
  • Credit policy and the final decision authority. Those stay with the institution.
  • A regulatory outcome for an institution. This hub does not claim one.

Repositories

Repository Layer What it holds OpenAPI
domain-lending-credit-scoring Domain Scoring requests, cases, and models openapi.yml
domain-data-credit-bureaus Domain Bureau data access No published OpenAPI yet
core-lending-credit-scoring Core Scoring cases, models, results, bureau-call records openapi.yml
core-lending-provisioning-risk Core Provisioning cases, stage history, calculations openapi.yml
core-lending-regulatory-compliance Core Reporting runs, submissions, and related case records openapi.yml

How the pieces fit

domain-lending-credit-scoring exposes scoring requests, cases, and models. A request is the domain command. The result is stored, not implied.

core-lending-credit-scoring persists the case, the model reference, the result, and a record that a bureau was called. domain-data-credit-bureaus is the bureau-access repository. It has no checked-in OpenAPI, so this page does not describe its operations.

core-lending-provisioning-risk persists provisioning cases, stage history, calculations, and journals. core-lending-regulatory-compliance persists reporting runs, submissions, and reporting records. Those are operational records. They are not a statement that an institution meets a regulation.

Lending journeys call these services. They do not embed a bureau toolkit in exp-lending.